{ "Event": { "published": true, "date": "2022-10-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-10-21", "timestamp": 1666396982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "84566f1e-85dc-436e-9f3d-476114ebeca9", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58605b98-511c-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1666341770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341770, "uuid": "238461f2-8109-4bd0-955b-c5e6f0b1be15", "comment": "Malware payload (Loki)", "value": "6a75c2e2eb8707f0ee424490aaebd831", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341770, "uuid": "87432ef7-1afb-47e9-8ac1-2af096a8b0b8", "comment": "Malware payload (Loki)", "value": "0011b1236acf0a114e7e25f58a70476e5f5b319930439d84422b3e9b05eb1cf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341770, "uuid": "94664b51-e526-4ab1-a001-3ec46653deda", "comment": "Malware payload (Loki)", "value": "0656256068b1eeb38ecc3f05347b3d49384362db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341770, "uuid": "e0b62793-8273-41f5-b27b-4877a08be91f", "comment": "Malware payload (Loki)", "value": "1ff34eef41512ea9447bd389cd68c13e28397892010a547e78afceca2192385c9c68655a2d7a7f08feb7e8f8733727da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341770, "uuid": "041dd993-2057-4ebe-9939-0cab5bdf4aa6", "value": "T16B15D3BA2280255FD556B571CC83D8B367F7AD696232D1C370D31F6FBC480BB8A12296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341770, "uuid": "08f44b94-ed77-43aa-94b5-3d6e7f378fe8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341770, "uuid": "97acf7f5-02ce-49ef-b898-4dfd657cf687", "value": "12288:zlzMfEu3orI99ujpvBiXWWEZrGPmxc28dqxHfX2sesBeC8mj41:Vk99KpviCD/7e9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666341770, "uuid": "69e35116-6218-4385-87bc-88aaa8f6c7ee", "value": 921088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666341770, "uuid": "490f4f0f-3bfc-48d1-b0ab-8a7cd94fa3f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341770, "uuid": "00996f59-5111-4252-9a18-aec92d0dffec", "value": "6a75c2e2eb8707f0ee424490aaebd831.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134d8603-516d-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666376443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376443, "uuid": "5d28513e-5c5b-4ccb-9454-20d72ab10b6e", "comment": "Malware payload (Mirai)", "value": "6f81e01ea6995eef2ade7b7f0f9e57af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376443, "uuid": "9a24f649-6f74-469d-bed6-2d166c82ceaf", "comment": "Malware payload (Mirai)", "value": "0156ebe6f91a0430dc2d875e5a9549680f7977c8905e44f0e3b5d82cbcf2a010", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376443, "uuid": "07c4125d-136b-40f9-8428-de69c168d97c", "comment": "Malware payload (Mirai)", "value": "7e53735c6c318fbe7baa79288df86a5c0cc9e707", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376443, "uuid": "1492c63d-148b-4ba7-ab11-269a30af720f", "comment": "Malware payload (Mirai)", "value": "a69f203583eca08a696ff458c28085feba6e6d5d0f5726aea2cf3cf58cfb6a7ca39612cdc19efbd9a28de9419d5faf45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376443, "uuid": "ff88fac2-c030-42ce-bb4a-a6c8953f2272", "value": "T1ED436B256A7A2E17C0E4B4BE22F74754B2E1665E25E8C61E7D330E4FFF21A50A0436F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376443, "uuid": "64bba0aa-f1c1-48e4-9fda-3b86280a16d4", "value": "768:Cuopf8bQPAZqRU+fECeU6tq9bXV85PnXIsf0lkgUI7O+qoSJ/a:CuOoQAqRU6ECeU6tSbXm5PX5If5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666376443, "uuid": "0f0de340-e9fa-4a54-9f1b-4804b5aee9e5", "value": 59664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666376443, "uuid": "a8e0ce38-6246-4ce5-bb4b-e7c4d80a654b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376443, "uuid": "45d66b74-ad0e-4508-bb8b-17b76cf50626", "value": "6f81e01ea6995eef2ade7b7f0f9e57af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71d7464-5187-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666387912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666387912, "uuid": "3ecb0ce7-af51-4815-976f-6eac80ca2c43", "comment": "Malware payload", "value": "0d7c4aced977c775331445be63e4c18e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666387912, "uuid": "885b57a1-c704-4ddd-9ca4-857b5babb386", "comment": "Malware payload", "value": "01b395ef1e98098a35ab3d84e6189a863a3408ba87ebff065e30e9cd81e6fe72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666387912, "uuid": "f9481450-7117-499b-9b3c-0a8a890e946f", "comment": "Malware payload", "value": "1b31dbf1f220667630e12e9783434d419a8a0b60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666387912, "uuid": "ecb511ce-d3a6-4820-9763-fb4b22ed6f84", "comment": "Malware payload", "value": "cfa31a04d5a2b20958d0814a50b1939e05622c7c2bd14ddc81d1e9f833978a372d16cf4dc332108914eb5af4bb8f39d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666387912, "uuid": "9f18f128-14fb-41f6-a5e0-316fb7f79ea0", "value": "T1E3740121F592C472C88A45790061EBA0067FF4B115722E9B7B953BEE7E303C22E77766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666387912, "uuid": "6178b2a3-6a5a-4a8f-aee8-3df239891d90", "value": "bc5a05e947eb61731a4e3024a4f4b617", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666387912, "uuid": "8b993108-6b36-4925-bdc8-53806bbc8cb0", "value": "6144:A++LgmmAth3utZCFAU1IR8MMqwU0EmVM/dxwMFi+2gWIc8SS:A++0mrthjAKIB0Emy/d6MFinP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666387912, "uuid": "7a2b0c66-a794-4308-b785-f92ae0eef25d", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666387912, "uuid": "7debf538-9cdd-4fcc-aa57-21e669b5c4ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666387912, "uuid": "ec150b50-d46c-427f-8331-f415b0c5fdf1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d954ad3f-513c-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666355730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666355730, "uuid": "122960c5-f1f0-4703-a2fc-3a1419b4042c", "comment": "Malware payload (ArkeiStealer)", "value": "bb4557ad1dd69e1ec4b52129df9eceb8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666355730, "uuid": "5d4d67f0-7619-44ef-826c-333061c34f14", "comment": "Malware payload (ArkeiStealer)", "value": "0217f3ad172709ea917cc7851ff34764f42c209ce17253f7fa4003810dd65b96", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666355730, "uuid": "1475ad2b-d613-44cf-aab2-824e5c31f803", "comment": "Malware payload (ArkeiStealer)", "value": "3e678acdf6cfbb7f639dc085ffeca6ac0f732069", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666355730, "uuid": "c786fcaf-da1c-4ee8-98fb-e42ba9f7d2bb", "comment": "Malware payload (ArkeiStealer)", "value": "457103a2736454b031d1ece024996706710e96336178481a351ba1d916115f08ccb3a2e8f870f7e7dab0ddb6d8b72810", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666355730, "uuid": "8a44b94b-51bf-4edd-bcc3-84a753d48244", "value": "T1A024D0D5BAD2CC73C55604304860CAB12B7FA83726744AD73764276E6F702E25AB738A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666355730, "uuid": "a9142696-5a1b-4ba1-a217-c5e4c3575513", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666355730, "uuid": "a5a2dd01-78b2-490c-bf1e-3ca01d079eab", "value": "3072:AXePM/L+7DKQkz5JatrPpT64IJUtp/rq1S0KgFoWeqaIz:0QM/LIKQkiDpouzqE0FoxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666355730, "uuid": "ee67f3b5-fed3-4a88-abaf-6843da2aae0e", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666355730, "uuid": "9695c15b-da78-40e0-96a2-6ddcf0ee495b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666355730, "uuid": "c0af7779-fa10-45d8-a222-f399600f82a6", "value": "bb4557ad1dd69e1ec4b52129df9eceb8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40eb48b1-5121-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343878, "uuid": "c9d78f33-3608-447f-828f-5b2d2bc3e29a", "comment": "Malware payload", "value": "05eaa04bc27db3af51215d68a1d32d05", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343878, "uuid": "c9d7585f-5a62-49be-9cfb-8a17f0775995", "comment": "Malware payload", "value": "02d6ca25b2057f181af96d2837486b26231eaa496defdf39785b5222014ef209", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343878, "uuid": "58127689-df1d-415a-9b09-b76372fa63d7", "comment": "Malware payload", "value": "222bb71aecb45d4430cefa1bfa0a53c3fa4a67f0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343878, "uuid": "5fe5ee79-afce-4898-9ddc-3e219f62edee", "comment": "Malware payload", "value": "cb73070be7852cf1fa187a96bdb7f87f9621ae217dc664703a9865fd5506727929576c1720969ba67c0c74c1f60d9779", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343878, "uuid": "0344fc12-21bd-4a3d-afec-e77c73b870d0", "value": "T139360182F399B967C8B7D73652B49737E24A8C158747A34A1404B3BC6DFBED04A44BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343878, "uuid": "ecb0d189-de70-4dd5-be43-950bfda9e6ed", "value": "98304:XM5qOMDIlsxIfmIoKw9+qpTSQPGs5A+7hyzGl/85Q9Gk:c5mDIeIeEtZE7hyzGV8Vk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343878, "uuid": "6b3469c2-0c57-4fef-b461-5d19eb8c6bf4", "value": 5013702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343878, "uuid": "2b38f575-797c-4523-a37f-0001a5d0f928", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343878, "uuid": "78d62430-457a-48e6-bc0e-4803015621c6", "value": "02d6ca25b2057f181af96d2837486b26231eaa496defdf39785b5222014ef209", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35773837-5121-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343859, "uuid": "36eaa072-d3d1-411c-a608-903b6cb585b4", "comment": "Malware payload", "value": "34be434996b9bc19112f875f0a3711d2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343859, "uuid": "4181393e-1067-4979-8732-57ec483f79fc", "comment": "Malware payload", "value": "039fc34ace1012eff687f864369540b9085b167f0d66023f3b94f280a7fdf8b7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343859, "uuid": "8d49e241-a0f2-4f5b-83f2-e7b8c0c63cbf", "comment": "Malware payload", "value": "ad451e4fc750c83a58fe8f7234f1766ad315a565", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343859, "uuid": "dc3dde96-e761-45ba-b34e-04f3f4789907", "comment": "Malware payload", "value": "df7c86969667cf6eeba3b680aa7776df38316cb577913b0c8d0946d1a600bf27496df0b762bed3055f68e89bf9790a12", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343859, "uuid": "48b9ec88-f2ec-4bea-904e-515618d67785", "value": "T1A355D0E2E359FC75D47BDA3E83B18693A55A4C44D60EEB320B05F0384EFAD45885CB89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343859, "uuid": "15788351-aa7d-4ab0-8b09-78ded1e09ddb", "value": "24576:RknbtoZcY5eJDj+6DiASSjctlRSEuw/pzIx27hCzGLQLfFK1RnHrmVXyQZ:RknbtoZcY5eFJibtrSEucp97hCzGLQbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343859, "uuid": "6d179685-cf20-4b9c-adb0-b4f29a616864", "value": 1326538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343859, "uuid": "c1133c73-fc68-4b6d-b5df-ce3545192e42", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343859, "uuid": "f7866c67-540d-4a37-b099-73918b1dd657", "value": "039fc34ace1012eff687f864369540b9085b167f0d66023f3b94f280a7fdf8b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a34f451-5152-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666365073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365073, "uuid": "f0110b3c-afd4-4249-a42a-a779b7d5a5b4", "comment": "Malware payload (GCleaner)", "value": "4107fda0a164148417a597b8613cf827", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365073, "uuid": "c66d9bd0-e3da-4850-b91a-1920482f3d2c", "comment": "Malware payload (GCleaner)", "value": "03ac3cbd7050f92b2a2eb5da7ce5341b1fe994d542a1732f083428e0c1bb4458", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365073, "uuid": "c05c8518-1319-432f-b799-0e2717b03fa8", "comment": "Malware payload (GCleaner)", "value": "cc90097ac67420a92498611be91b10e5a4a9ee72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365073, "uuid": "07c1d59f-c924-4d38-8f30-e3809e3cc693", "comment": "Malware payload (GCleaner)", "value": "f76d41c1f021e8d926680ac379d5f1e2435840c14c53e06e985625fd669747969a6c9f792bd611019cc2915c395808c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365073, "uuid": "9867ce78-33b9-4da7-a822-21fe2ddef037", "value": "T1D7B533C2EBF1C8B3C0F038B594666DB968132411A93D7C1AA74C253E0775B65CE4BBB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365073, "uuid": "f7b0e875-47d6-4558-a7bc-a1d67646c93c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365073, "uuid": "fb5af57b-5965-4bc9-8c4d-a7282a514cf3", "value": "49152:Z2eBL262Tswm7dBW6St7yqxKmde9mfzUz6U8CEPlxHPp3lA5hq:Meb2uRg6A1xpcIrJiEPlxHoDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666365073, "uuid": "2d3aedbc-82bd-4d8c-8410-c4dfdf98b659", "value": 2359736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666365073, "uuid": "6d5bc3f8-469b-4d7f-8fd0-d46b7bd49f8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365073, "uuid": "ec14ab01-aea1-4160-b338-3a2e171bebf8", "value": "4107fda0a164148417a597b8613cf827", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e12ccc-511b-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666341437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341437, "uuid": "cb9ff929-b14d-4570-9451-8c1dafc04217", "comment": "Malware payload (Mirai)", "value": "114b8b27d13281108107393dd6aecb9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341437, "uuid": "ee3ce8e5-8305-4ba9-a132-1c473956647e", "comment": "Malware payload (Mirai)", "value": "0465264909ef667a201623c1f0a301401eb65881e38dc668dc7f7d820d1409d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341437, "uuid": "f2397aa1-24cc-4159-b5f7-35759f444fc9", "comment": "Malware payload (Mirai)", "value": "c0f377d8526b513cc769c6e6a44eb6b1f8a83208", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341437, "uuid": "2be36bd9-ec14-47c3-9e6f-20bbcb936b9b", "comment": "Malware payload (Mirai)", "value": "4674c4b46aa78b37150209d0c57c641c355290a90437c5b2834a434010369408b48c3d3af8d707c54544ff2c1ade5c51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341437, "uuid": "35041410-f47b-4fc7-bbe2-a7db9deebed5", "value": "T159C2D170AD8E2CB0C2B00571C3B696D27B830F7DF0FE6DB522544A696A838D921FC546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341437, "uuid": "7e6c26aa-87be-452f-8f23-6f56c193c99d", "value": "384:ARt/koxisa34beDtZw6c7wutWf4e55s4zAPO3obE+H4ex24+GP4xlhymdGUop5hi:A7soTAZawJzcJm445sils3UozA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666341437, "uuid": "a3a69502-7353-4704-a346-507ae151873d", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666341437, "uuid": "67edd184-13b5-42b5-bd1e-218efa805546", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341437, "uuid": "65be5bed-e71f-43a1-a9d0-df85ab21cd77", "value": "114b8b27d13281108107393dd6aecb9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0d85b2-5149-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666361103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666361103, "uuid": "a34fdcee-c7a6-4366-98aa-f2a425b8af06", "comment": "Malware payload", "value": "92316bfbca39867e9e8739e89e807c61", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666361103, "uuid": "244d7ff3-bfab-4cac-bdb0-2baa7bdced45", "comment": "Malware payload", "value": "04981edbf264c1e9301356d5f63dce4544e0a6159db53f2012ef8c110deaade8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666361103, "uuid": "f48d03d7-8c19-42a9-8af1-a4792723c319", "comment": "Malware payload", "value": "7cfdc09e6e48e6c63d61eb5c8bc948346aeeb9c1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666361103, "uuid": "4aa2fc1d-4a9d-424a-8718-d92808e4b245", "comment": "Malware payload", "value": "f903ada71175eff2e37ab3e0daed587ba2eb42c1fa8492e3e21b2a6457c105e82afe85f8bb0a5b3382bf040084b683d0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666361103, "uuid": "c6ebed4b-b158-48e9-b3c3-299d0497aa5a", "value": "T1B0D533B6FD92CC12C86EF471DA170FD8836D1A12D9457EC6E21A522DBEF6C4C413A0E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666361103, "uuid": "1705041f-5ef6-4e3c-94d2-52f423d07bf8", "value": "49152:xvirYN3CRa25ppxFpSAXN2zsY3bQOH2SzYQqHqpU7j:A5w2Xdp392zbb12SzYdHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666361103, "uuid": "c4a126b2-cc1d-43f1-986b-879a92480b93", "value": 2829804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666361103, "uuid": "b0cd79e0-2381-4d3b-ae5a-67aecdcedd5b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666361103, "uuid": "db889f35-0659-41be-8401-a2f4d5e79893", "value": "ID-Archivo_Fact64401IHBZULHECH59021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1175c2-5115-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666338929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338929, "uuid": "df919d18-da19-456b-ad68-f301e310d7a2", "comment": "Malware payload (AgentTesla)", "value": "9230195422f54a91a96ce38ca331282b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338929, "uuid": "a88c88f2-598b-401c-b35f-6810dca2da06", "comment": "Malware payload (AgentTesla)", "value": "051321c57584c1455a4682883436eda1f3dc21f5402cdad1912f4adeb07fb8aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338929, "uuid": "b98b14f8-854d-4495-98f8-f1b53d400a24", "comment": "Malware payload (AgentTesla)", "value": "616ce6be5671fe7476ae049c890806c292420d7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338929, "uuid": "c9fba644-a7b5-420c-bab8-b571a4fb0644", "comment": "Malware payload (AgentTesla)", "value": "06102047760fac4902ca5a69e300a9f03a710e1798b8389fffef5b4e7fed54ca3fc765b0623fd6e5cf9a4b5ca6e7c070", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338929, "uuid": "6547043d-46d2-47d0-b3f0-71351881e106", "value": "T1BA72A501B3884736C9B646766C33D27103B6BF518A57CBAEB8D07D0BBD266441AE2771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338929, "uuid": "04760310-99ca-4b69-bba3-9713915f36bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338929, "uuid": "e6bb149b-3802-44e0-b9b9-4baaf0552089", "value": "96:rJdN4Ut3KtL8/AmJ+DNGrU/1sxhYUmkJpW1ss8jn5VyoFELLGYzNt:rJw5L8/AmJa8rUtehYUhJzjfyoWu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666338929, "uuid": "2835a51d-4d34-4eb4-9bb3-203e4082da0f", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666338929, "uuid": "eb47e8d1-1388-4739-96d8-4f9d238e8ab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338929, "uuid": "2544dfa0-7314-4afd-94d2-d5a8cefec3c4", "value": "Dokument_ZD_0071_10_22_pdf .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f591046-5152-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666365055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365055, "uuid": "da84a4d0-8c2f-4b1a-88f7-806ab2c39b45", "comment": "Malware payload", "value": "bc58c4d7ccbc8648b230d14f1faba9a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365055, "uuid": "c2eaf295-93a1-4103-a85d-dad737d670ef", "comment": "Malware payload", "value": "0596dd9f0350b7526c910a9a26e45b1886fc5e9130d96ea2543935a4bc410295", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365055, "uuid": "548ba90f-b3ba-46a6-a4fb-d934661c8dca", "comment": "Malware payload", "value": "f200c48690b86270aa81690970f071acba82541c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365055, "uuid": "36e766f9-f932-4c69-af42-9417360b324e", "comment": "Malware payload", "value": "812cdfe02a5ec4af527bc9168f4f0be0898923353a1a1300797a7463204adf598f38f8d0742f73b1e49d338414a113b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365055, "uuid": "693e6c1d-1cf1-4043-af92-bd278dab2e65", "value": "T1445623B715B921CEC4E4C93E8633FCA571F10B67CA82BC7C69EA1DC935160A4E617A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365055, "uuid": "52ad7a94-a975-493c-a726-ffa81871d756", "value": "2ee8171ce21fe66bda1a25b6597b89cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365055, "uuid": "98638fa3-e2ea-4b22-82f6-41378765f1a4", "value": "98304:kLhSbHKhquqi9g5tSnkRFrc7eCt/bavgz0iy0ErxBoFqu0BFAiCDHfSdea:6UFqoTCpsZikzoFPwFAqdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666365055, "uuid": "2c470342-88af-4183-b0f4-233c23cac0e4", "value": 6121984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666365055, "uuid": "4e1c527d-4245-4a33-9e97-56604e467840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365055, "uuid": "96ee1795-57cb-4345-8caa-4e78ba45c164", "value": "bc58c4d7ccbc8648b230d14f1faba9a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2aab60-5120-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666343709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343709, "uuid": "69357603-49cc-495f-8601-cbad171c6b60", "comment": "Malware payload (Mirai)", "value": "b625887e4bd88af026d24f50e2451684", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343709, "uuid": "ce41861b-73d0-4b15-a84a-1b038aa1624f", "comment": "Malware payload (Mirai)", "value": "09b465d60b313b0665f6a4fe484fccc6293b5c1ad513c81c8592f02756e33bdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343709, "uuid": "f01c4582-6b11-48e1-8c4d-0376d6c51e36", "comment": "Malware payload (Mirai)", "value": "8433099ef63fb1196adbd64b051aea34a3dbe426", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343709, "uuid": "c13bccdd-ea85-4206-96e3-2fad0b9680b2", "comment": "Malware payload (Mirai)", "value": "1c1fb3946ea465b511d4180255ce9246c2ad577b8f6a46bc986c0dedb7dc5ad39e866b31363bbb4e3497efea9befaace", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343709, "uuid": "d0ee750b-a555-41b7-a158-7c57bd02f1b6", "value": "T1F5E2F14B2A929C75CAB139F17E334ACB7B443AFCA0F5F1630409D2647DA4A977A3C141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343709, "uuid": "d6b977f7-2775-4dc8-8fc7-e1dfdf0a9cb1", "value": "768:uoiWiO031v+MMtpvSjJ0TGncgNfWV9q3UEL5I8:uorm1v+FvSuXgJWoLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343709, "uuid": "c5e28149-e10b-47d1-a31a-ee69dff15801", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343709, "uuid": "d0f555a5-77df-46b1-972e-32f90bb1b9d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343709, "uuid": "8d687fb0-fc3d-4d19-b229-fb21cb2261a5", "value": "b625887e4bd88af026d24f50e2451684", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd5e427-50e9-11ed-9266-42010a9c0072", "comment": "Malware payload (ChinaZ)", "timestamp": 1666319791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666319791, "uuid": "f0549be5-a4c0-4c0f-923a-42fe5ffbf999", "comment": "Malware payload (ChinaZ)", "value": "b6a59da20064367d4a954123c69345dc", "object_relation": "md5", "Tag": [ { "name": "ChinaZ", "colour": "#11709A", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666319791, "uuid": "cd3ea8a9-5bea-41df-b927-bdcff2e80bb7", "comment": "Malware payload (ChinaZ)", "value": "09bc639a0192cb829d74d3e64c0333be46aa72f780a7a17ef2adc072d7ed80b3", "object_relation": "sha256", "Tag": [ { "name": "ChinaZ", "colour": "#11709A", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666319791, "uuid": "1fe0ca1f-cd1e-4ec3-8d57-1ca0c7bd7bab", "comment": "Malware payload (ChinaZ)", "value": "2c8b614069440f2476415dd54e4b985c72be3eef", "object_relation": "sha1", "Tag": [ { "name": "ChinaZ", "colour": "#11709A", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666319791, "uuid": "9ce343d7-a72d-40a6-bce0-d7ce4719ba35", "comment": "Malware payload (ChinaZ)", "value": "87192293fa20ec1e85a9a115100e4f6a8f2e4a3133d6bf096c75cf89af6dce1c94bcc634ee23818d44ab6b0da89a59de", "object_relation": "sha3-384", "Tag": [ { "name": "ChinaZ", "colour": "#11709A", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666319791, "uuid": "c6eaa614-43ff-4bc8-ade4-e3b87180c5a4", "value": "T18F556D1DF64344B5C837D17002CFEB7F8D24AA398017CA97AD8DDD39BCAB9A1690D612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666319791, "uuid": "6cc83f0c-b24c-4c99-8ea9-1ec082f0c1e4", "value": "24576:8kUpotcUSzgtPLdOEG0V0JRzFB3ywyUZ1N2AhNdhBjh+hnPlVVW0Mk7t69Kx/ti8:MoKXwZOK0TFBCwy8P2AhNdhBjh+hnPlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666319791, "uuid": "9a1e73ef-18b9-4df2-b2fd-c112a39dba8e", "value": 1315556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666319791, "uuid": "807ab3db-0aeb-440b-90f7-5ef983695530", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666319791, "uuid": "d1e3aaac-d6a4-452a-b2da-fc2270410449", "value": "Linux4.7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47902e4a-5186-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1666387268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666387268, "uuid": "fe4b6a88-5538-43a6-aace-05fc36a1e4af", "comment": "Malware payload (DCRat)", "value": "11194286e4d52f44ada168f98f948cbb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666387268, "uuid": "bbecc614-5ae1-4eae-a368-84b0fc6d2d03", "comment": "Malware payload (DCRat)", "value": "0a6b6e2c663fbae55aa647c5299f8361637c8f1e143798c57820e99cae64516e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666387268, "uuid": "065c37ed-e09f-4b64-ba19-fd8148109e8f", "comment": "Malware payload (DCRat)", "value": "2bd52aec3f2f2d312b216dcd4a2990a941ce0a2b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666387268, "uuid": "0ac3d4ed-1d26-4de0-9f6b-01ae40d5a4fd", "comment": "Malware payload (DCRat)", "value": "44cde69631df8f6c3ee6c0551ff85193076eb6caf0db3306e8967b83b56570cf80e192f91ce0b951d1025f732c870cb9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666387268, "uuid": "c4a4b44d-2577-431c-960f-695468371a59", "value": "T104B53331F08C91F0C3D30E3603EF6691D645A1B7787A3BD99BFEAA45928D208E35694C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666387268, "uuid": "b250ae29-a8db-4c0a-8c27-4066784c805e", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666387268, "uuid": "fb28e493-24ac-4d29-ae58-a280aee291ea", "value": "49152:T9GGMmvc6PETUkDIuAaSakM8lmcNmihhi/vbpj2+kY4j7hqO7AQRP:TwGMaET30VMGmcNmih+v1vklhqO7A0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666387268, "uuid": "91253dc3-6cc2-448d-ac84-e815d3520836", "value": 2444800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666387268, "uuid": "40fd333a-e72d-4a96-af55-2f8631b23d6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666387268, "uuid": "0cfab90f-a644-4a4a-99a8-ce4dd40954fb", "value": "gamingservicesnet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b190262c-5144-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666359099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666359099, "uuid": "6c2b63fd-42af-42f6-8900-35cb8c3aedf3", "comment": "Malware payload", "value": "d3fcda3d1f7887f36067524d406441d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "extracted", "colour": "#045F7D", "exportable": true, "hide_tag": false }, { "name": "fake powerdvd", "colour": "#1D4D84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666359099, "uuid": "6d930652-d824-4b1a-86c0-3fb00451ca3f", "comment": "Malware payload", "value": "0c363f9ab54c9ee1087837a2deb4c1b7e4e9b69f8750b9a46bb198f45cefaf0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "extracted", "colour": "#045F7D", "exportable": true, "hide_tag": false }, { "name": "fake powerdvd", "colour": "#1D4D84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666359099, "uuid": "d5622722-b84e-4079-ab60-7e8361f08493", "comment": "Malware payload", "value": "a93a8af7ea119cb900f7afab146ed0533ea511d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "extracted", "colour": "#045F7D", "exportable": true, "hide_tag": false }, { "name": "fake powerdvd", "colour": "#1D4D84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666359099, "uuid": "2247d93f-0171-4f01-acef-c9e627a8962f", "comment": "Malware payload", "value": "b53560a016ab98bfd99def49ce372b53240b4a6906cee3fa2c8152e63662f188ebd7193502dbc0dee7c95f398209478e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "extracted", "colour": "#045F7D", "exportable": true, "hide_tag": false }, { "name": "fake powerdvd", "colour": "#1D4D84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666359099, "uuid": "7e0b10d8-a77f-423a-8a33-716609268216", "value": "T16C6623B3D3454496E4A28539D437FDB132BB566D8A61D83E225FB8C11A737D2B023E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666359099, "uuid": "219eb380-2b1b-4428-9058-1e29692ea742", "value": "895e5e6e037e9108574fb94ed614d804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666359099, "uuid": "55bd4bd7-7733-47ed-a054-1e8e5b3e7ece", "value": "196608:lg0Q4FgHrFIqZx5I6Yin0Fkiudgww8TIoUeSa:lY4FgWqN7ruGgwwKWeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666359099, "uuid": "77bd011a-999b-46dc-8fe3-5ce4b386aa43", "value": 7081984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666359099, "uuid": "e54276e4-2c71-4c91-b3d8-f30592db6d27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666359099, "uuid": "b22839e0-0952-4d2b-b849-a56f9e2abb3a", "value": "loader.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e278604-511c-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666341833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341833, "uuid": "0eb5f29c-8738-41f7-89d7-55a84c5c074b", "comment": "Malware payload (AgentTesla)", "value": "d881b25107c15e6a403533b2fded497f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341833, "uuid": "190cdb81-92f2-439f-963d-bc7313bc2ac8", "comment": "Malware payload (AgentTesla)", "value": "0c38b5488a2c72a89b8bbcf9114d94578acb14b442ffa2d5715e5da9ba2a4be6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341833, "uuid": "f9e7e096-5e9e-4f0d-9c41-4d1e82de454a", "comment": "Malware payload (AgentTesla)", "value": "157a39b6cc0bf291ae562de3375ef1b6ecfde68f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341833, "uuid": "eb6aa96c-ca8d-4f8d-a335-68b76ad890ff", "comment": "Malware payload (AgentTesla)", "value": "ae826c5d67a182b96f9cc8d8173350ebc83333198256fcd4d858f294d023da644844f8da57209e48a4a16d63ab88029f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341833, "uuid": "b5da0c8e-da39-47d8-ad30-4fb4a6eb6a8e", "value": "T196451202B7CD84B2C47219315936671D6D3F7E201EF4CA5FE3E0596FAAF11906221BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341833, "uuid": "75564334-8758-4128-9384-2586f136aac1", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341833, "uuid": "922baf06-acbb-4059-aba4-f6478c2ca21b", "value": "24576:gAOcZXQOsoYKjqsM3RwfksQU8OIgibj5HHeg/cbGOSMIKB4p:+boisM3afkXU8H335HdYGOSMji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666341833, "uuid": "5b66995e-764f-4b5b-ab14-2e87b016ec9f", "value": 1267760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666341833, "uuid": "5cdbfcbb-9c57-4511-944c-1645a8c739ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341833, "uuid": "89a50192-4ca6-4c6e-a2f0-a65f7c2a6be5", "value": "d881b25107c15e6a403533b2fded497f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28824b5-519a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666396011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666396011, "uuid": "abc08a42-f851-4dd1-8418-fa08578a63ae", "comment": "Malware payload", "value": "1919c59a80b448402c93cfc195b33861", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666396011, "uuid": "51b5e463-c15e-44fe-b2f2-e764d7375fbc", "comment": "Malware payload", "value": "0cdcbf3024e7d0128c30fad5a89fa9d7c5e952c52f50b111550b42b3ee15d2df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666396011, "uuid": "bf220125-f68e-4b9b-b772-427d27b0883e", "comment": "Malware payload", "value": "66ca0b1aa255a9465befd5123ba5843645f72214", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666396011, "uuid": "f5fbe57a-e8ab-4f6a-9a9f-09df055c5759", "comment": "Malware payload", "value": "20a57d4f37e50838aa6bda5e5beccb7c040dbb0a77240fc43f0166046eb641e7693bd77dee0843d2b12939d9f946e534", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666396011, "uuid": "9aeda68f-e585-49ca-b9f2-54359b946575", "value": "T1F8C53366A189DB35F1A1E835AF2392599F713D0A53ACE00ADCCCE95D2F32CC4443BB65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666396011, "uuid": "10cbdb17-1514-49d2-a6b5-3ca7dcc87393", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666396011, "uuid": "23f3c3cc-5f78-4134-8587-351cb64b95d8", "value": "49152:Z2xB+s6pSUc2a9KtkrgShOvnLBFJU10ykugyAA5hq:Mxws6pSQ0OkrgGOvLRUnkuX/Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666396011, "uuid": "b61a9704-961a-49ca-8023-e83f2aabaedd", "value": 2529315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666396011, "uuid": "85b1e6bd-db0b-4cd9-bad0-1fe5d14cc73d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666396011, "uuid": "df111d48-e418-418b-b3ad-26c9cd8ee052", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df23671-516a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666375226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666375226, "uuid": "729ef243-9ca0-437a-a2e7-afa34a428058", "comment": "Malware payload", "value": "2d497f4c12f1f0167fc10ecf35f723d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666375226, "uuid": "1755b834-0b2e-4b78-a7ff-2a407c28891b", "comment": "Malware payload", "value": "0d09a4ab3e8ceb83ed61d72f369dafe02bcfee6e57551b3a9077aee0a718aee8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666375226, "uuid": "37d603cd-bbc3-48a8-b549-5f4172bf7ddd", "comment": "Malware payload", "value": "96a8d7fead7f50bcc39ff986b289e9cc240a8f20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666375226, "uuid": "0cc4b4cb-bc2a-42aa-86ae-f79c19c91203", "comment": "Malware payload", "value": "8a6ec30269e77599b9093e62e2eef4fe940de83ae79a8831f814d93396fea09b55e52e32aaab13e9391159c835d6c35d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666375226, "uuid": "1e5f4138-a4eb-47d3-8f18-ace6e60b8fd8", "value": "T1A374AED2B9A0C87FD0325D7209E8967F4E3CA92007724ADB7BCC1A5D8E206F1567CE56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666375226, "uuid": "5b699cd5-d67c-4a73-99ef-36d3bc04b87d", "value": "787d271a2df462be9e8efbef70e9c88f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666375226, "uuid": "a3a55a29-1e15-4e16-9a27-6096b428aaa5", "value": "6144:K3e/3W0KIVKIV41+YlMQxQHyeNnCm0AO0MRll/UGk2YLJK2iRdh:KW3W0KIVKL+YlJFZtnpk2YLJmdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666375226, "uuid": "01d1f909-39cf-43fc-9c21-e6cf0600c1b3", "value": 364032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666375226, "uuid": "39fc169e-cf31-405b-a5d0-7b94a125dc4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666375226, "uuid": "8b796ba7-de28-4900-8439-7fceb971724c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7551c4b-5119-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666340641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340641, "uuid": "bd099fdc-80de-4358-967b-197f6df4a897", "comment": "Malware payload", "value": "6151b1e2e5035a8eb596ce1c37565e87", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340641, "uuid": "58546be0-90bb-4f36-8640-1c09a7060fc3", "comment": "Malware payload", "value": "0d09d5e46e779d796a8d295043e5bbd90ac43705fa7ff7953faa5d8370840f93", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340641, "uuid": "b84aed18-3775-41ef-8c5e-86f61569a98b", "comment": "Malware payload", "value": "bf482e86d512da46126f0e61733bca4352620176", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340641, "uuid": "5cf148e2-e5b0-4f81-b6c5-66c933779f06", "comment": "Malware payload", "value": "87bc368aa7ebe69d210d822b4d66c491c2b29d733ba012bb963ee0d5df8e8597644b15e6f2af376bcdecad40c87ac449", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340641, "uuid": "fe1a6545-fae3-4e85-9db0-79b4cb348766", "value": "T11926E046F748A97AC4F3833266361226547BCC268B83D687195C723C1CB79DC9F99BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340641, "uuid": "d0c7b19b-8d1a-4797-b501-d284b4f8371e", "value": "98304:AGtCFIYkriTxD7j9bapQAnLUDaZKSRVrYO/eh1cLsdFrufrcjEj3:FWpD37dSRVWh1cLsdML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666340641, "uuid": "c6ca87ee-73b5-4323-aa58-24d959493bf1", "value": 4553813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666340641, "uuid": "847277ec-426c-4405-bae4-30939018844e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340641, "uuid": "49ad9534-5e48-41f9-8ddc-695dd19119d3", "value": "sarayemaghale.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9726f298-5119-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666340587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340587, "uuid": "78924c3a-7e7f-4757-82c5-cfa72d93b361", "comment": "Malware payload (AgentTesla)", "value": "c0f990265b6ce24e8a7b3dd8c0c17557", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340587, "uuid": "352ce265-6474-4718-bf9e-a7d01497cfef", "comment": "Malware payload (AgentTesla)", "value": "0d0db21c9200f0949ea2887f37e23866c3d8c44493994310307c81ad98a75fcd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340587, "uuid": "f5872209-e796-46a5-a672-786125c0c257", "comment": "Malware payload (AgentTesla)", "value": "4b3659b732165725d5e4e0fba6e71cc9ade024e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340587, "uuid": "7b9c0a00-0245-47ef-95cf-2aed1b4619bc", "comment": "Malware payload (AgentTesla)", "value": "6902bf0a06e8bedac45bb16eee9c0e1fd46250160bb6b1e528270d0986c693bb98f002364e5ecd5a201bc27dfd4f1a72", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340587, "uuid": "e0a4a402-8daf-4ce9-b450-b15949c1759d", "value": "T1CD054AB626D51217E42972B59083E6F326FBAE506041E1C3A5D34F6FBC841BBD62334B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340587, "uuid": "3e03582d-e366-4cd2-a21a-5ab9b58c0f3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340587, "uuid": "a55ac376-cdf1-4fd4-8767-ecbf69d21bf4", "value": "12288:oMsLAaMH+wO8f+y139fXxtjIxF8UFIer+HZkqeVZo7b4tRfEu5:WJ6O8Wy139fBtjToIeqHZTeVcb4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666340587, "uuid": "4793a620-b84d-4e7b-8c30-a321a212cc94", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666340587, "uuid": "7f2638c2-b585-4c23-958f-a5ff8ca61e9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340587, "uuid": "c1b6999a-61ce-4b4a-b6e3-f8db243b60e6", "value": "Bank slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d3d411e-511d-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666342234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666342234, "uuid": "de3b7ea5-4970-44d8-98c8-f4ca7fe260a3", "comment": "Malware payload (AgentTesla)", "value": "9d6468098347d901ad1bbbdc06f516a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666342234, "uuid": "2ae7f814-3414-442f-867e-7b957e8c3389", "comment": "Malware payload (AgentTesla)", "value": "0d390c4dc6ec192b02e46d117c0a42425b9b49cc6d3a806515700e1315e4845e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666342234, "uuid": "f7d4c85e-9415-463a-a735-14180566635d", "comment": "Malware payload (AgentTesla)", "value": "4a90c8cf11863870be5ab27fccdbc74076654c18", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666342234, "uuid": "fe487073-7d28-4334-833a-0278e694cc5c", "comment": "Malware payload (AgentTesla)", "value": "3dc35a062c7c40670731d434fedbde80eb87f18554528e7eeae7ce5abf5a01b378a48a5a4cded394379b0528898e1659", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666342234, "uuid": "7465cf10-32ad-4f97-93c7-059042be8af7", "value": "T14C3549BA26D50143E8293A759093D2B366FBAE416446E1CB60D31F2FBC841FF9653387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666342234, "uuid": "1658b878-c34a-4267-880a-33977fea8f2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666342234, "uuid": "3578d7ec-609c-4bfb-b174-76cbe31b625a", "value": "12288:1drbrCIznGYeXI4hvqVlfEuE+KriN1ebdUbVIVGBKrMl6P6QCVZfI2Bw4sO1ywyQ:iCAbYZB0Ms6o75wye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666342234, "uuid": "c050a868-51d9-4b37-942b-9c645371948a", "value": 1062400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666342234, "uuid": "643d8cca-718a-440e-bdca-ad0b62820fcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666342234, "uuid": "d99c5d87-d758-408d-8802-a67f2db1556c", "value": "FB-108N & FB-108NK \u8a62\u50f9 - \u7530\u52e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5262b780-515a-11ed-9266-42010a9c0072", "comment": "Malware payload (DanaBot)", "timestamp": 1666368388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368388, "uuid": "36243504-db2a-4320-9319-899858be22de", "comment": "Malware payload (DanaBot)", "value": "7737730d3a03d2510dca4bd7663a91ae", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368388, "uuid": "4a63b3b1-23fd-4193-88bf-aba5596446e6", "comment": "Malware payload (DanaBot)", "value": "0d75ee72b5ee8528fddab43bf8aa7d1e23bfba8678c7ad9f0fef924f3104cc54", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368388, "uuid": "2c75912a-d834-40b3-8f34-6d5992b602a6", "comment": "Malware payload (DanaBot)", "value": "17c7a4609f065ed4235298ec963d7683a9533d51", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368388, "uuid": "d2e1d77d-9eba-4585-842b-69189e14012b", "comment": "Malware payload (DanaBot)", "value": "6a01e2d9fd4cec86da684a5bbd2bb097774a397e27eb80f1c8be9c9d9c0fcb87a18ef3b8881a2b7931cb94781a072734", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368388, "uuid": "c1403032-d4ac-485d-ad73-6a0b26ac314f", "value": "T1C4552313B1D2DCB1C065C030906BDF9376BD6C7B03E2A9ABB7B05B792D402926FA7155", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368388, "uuid": "82d37dc5-bfaa-4565-967f-717426ff6479", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368388, "uuid": "4c272e28-375e-4ebc-b707-03ee274b7ad2", "value": "24576:HMIfgvXYV+9URhsb7Px4RHE5RCx9lZcWjZy7OEqzOKOM:HMIIvXY8ORhsHCteSKKOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666368388, "uuid": "6618fc77-39a9-4209-8628-d5268382fe7b", "value": 1331200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666368388, "uuid": "48e9e85d-0c23-4769-b17f-b9870a0645f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368388, "uuid": "e2517800-a0c8-4a1b-a626-3c3077003ec9", "value": "SecuriteInfo.com.Variant.Babar.111863.21978.7247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a92a19c7-511a-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1666341046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341046, "uuid": "47efa0ab-0229-4eaf-bb4d-4face42e1b5c", "comment": "Malware payload (Loki)", "value": "64e6900610a8bb7ce26f2a2d143c48a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341046, "uuid": "78bf74e2-690d-49f1-bace-76f3efc9ea08", "comment": "Malware payload (Loki)", "value": "0e41690be1d1ba651f4c8b28cccc4d154efc852cd3fa32ab99c6b587162fcfc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341046, "uuid": "77e236db-a780-4178-9169-909b0dcf4e22", "comment": "Malware payload (Loki)", "value": "51600b652b637c764699cff610bf122a8b9fbe6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341046, "uuid": "a915390d-76d2-4952-926e-4d6bcef35a0a", "comment": "Malware payload (Loki)", "value": "39a2b52fb37a7a38ad7ba44a6a9ccae8ce081c1e053c44b302f94396a91c644ef384d479270290b881685129414d3311", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341046, "uuid": "2f56a968-07e0-4c51-80cf-992e92c02194", "value": "T1F3F302B0A774C567D8B1413129379BBA9EFAD5201A649E0743803E6E3DB35E08F5F790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341046, "uuid": "89af8233-4e8e-414b-afdd-88d795cefc9f", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341046, "uuid": "f78a27fa-d001-4d15-9cfd-b53091d6f442", "value": "3072:mbG7N2kDTHUpou/bfiqj7DaKhNKC3D5C8AGlOZJIR4vy8qyrihNHp4LqUL0D4+fh:mbE/HUbfhaisCT0OSXih136+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666341046, "uuid": "a6c41711-515b-412b-a8ec-21db116c81a7", "value": 172069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666341046, "uuid": "77e10e36-d0b2-471e-9337-f64874845f99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341046, "uuid": "affa7e40-d6eb-4def-97fd-3b837a6aaff1", "value": "64e6900610a8bb7ce26f2a2d143c48a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf6a753-5140-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666357508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666357508, "uuid": "461ab44f-fbea-49b6-8510-cb9ef84e3067", "comment": "Malware payload (Formbook)", "value": "da78f641e327211524e65a9f1a5a7984", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666357508, "uuid": "ba9ef2a9-fd78-4c40-aafa-d1d13e850b3e", "comment": "Malware payload (Formbook)", "value": "0ed50d0d40d3262f868efbb888964d9ebe6a1ef1f5ec58f6b979d24559f3ae38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666357508, "uuid": "e1688ee1-1c4a-453a-ac28-1bf85bbb94bf", "comment": "Malware payload (Formbook)", "value": "e19dfd89a9b07edfe9f5cc8a4ae0add125def694", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666357508, "uuid": "6bbb311a-287b-4fc7-8fbe-aa8fdc279a8f", "comment": "Malware payload (Formbook)", "value": "a6392b55f91b1c3b327c9abdce9e2f5cf9701a7e3b97072c328aa573543db14b8c1a8e673488e803dc885a02169cf91a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666357508, "uuid": "9c718cb5-3672-41f2-b997-9880d6ced356", "value": "T1654412496A40D623D45346330577D7A7CFF6B8163A306E1B23583F0A69B3A526E3F392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666357508, "uuid": "e1c3f07c-8bef-4f8d-a7d8-092e2c3dd2b8", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666357508, "uuid": "c9ba419d-2003-491c-9fe2-776b5f6ad25f", "value": "6144:mbE/HUb8TwJJZZUiI7ZAEnOBZBjC2s748HU3cX:mb/XCxONQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666357508, "uuid": "a8670f51-4385-42e1-b3ae-4fca8d990a02", "value": 265643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666357508, "uuid": "41f9b178-eeb1-4bf6-b6a6-c70a2b9eb663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666357508, "uuid": "321688d9-718e-4e12-b0ed-8b4ec787931a", "value": "Account info_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60915d9c-517e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666383874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383874, "uuid": "203033bd-ed6c-42c9-b383-9a392e5b2fd0", "comment": "Malware payload", "value": "e0b69f64911305dd73bc72efa5c8a93d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383874, "uuid": "f84d17a7-1c03-436b-8eb5-4489cb8c1ad5", "comment": "Malware payload", "value": "0ffb00e7cdeb83905113fe155872a01f5715b6cc30915d3d27ad7c7d795c1fdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383874, "uuid": "3265b3ba-4cbe-46c9-b9e5-7c8400d4e26f", "comment": "Malware payload", "value": "3b20e82690abf10b01c32895e28ece5942c61219", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383874, "uuid": "b9df3a7b-f246-47f8-b961-ed7eed4b0869", "comment": "Malware payload", "value": "9d11fa0d1d32a774df23bf22cd56a1249c200a415c01b9de8d0a78f480a337a9dd08f7d26d7988302137423a1480da6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383874, "uuid": "c2b0ab60-9f89-4a88-aad9-e7bd7b46f626", "value": "T1020502D7EB604493CEA86234D5A746101776ECADED618F8F638C30615BB31C776EA08B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383874, "uuid": "7d29ebfe-9df4-4c17-9be1-4f2c793ed735", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383874, "uuid": "6066706a-f21b-47a6-9bbf-1651761f643b", "value": "12288:RzAxWWqvXzPjDYzG3Eqo1AKn/l55jLcS+YuvoTNNF/WF3R3f7g4IVC:dfvTKRqMn55jLcSMoJTg3TgbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666383874, "uuid": "03fbe7f2-1f95-4551-b019-454120d4cb01", "value": 817192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666383874, "uuid": "74f9c8f0-376d-4537-8d8b-4cfdc2e078d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383874, "uuid": "b3bdb774-e913-4445-be93-ba515f155d48", "value": "RFQ101722-Wolf Machine Inc .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40831d14-5109-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666333569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333569, "uuid": "f05e2bab-cb44-4909-a6f8-5f610d34c9a8", "comment": "Malware payload (Formbook)", "value": "1aef96a7e959cd1417a0a7bf09832404", "object_relation": "md5", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333569, "uuid": "1db46bb1-0518-4193-8f99-555ad26d6e3f", "comment": "Malware payload (Formbook)", "value": "1091eaee4a21598cf40239726bd3b09addae8ecc2d3181173b4d7cf72fe1fd8c", "object_relation": "sha256", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333569, "uuid": "41c83163-6b83-447a-853b-a404ba3fef23", "comment": "Malware payload (Formbook)", "value": "a66a37aa4ae73b6e279c7622d1ab4cfde738bf9b", "object_relation": "sha1", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333569, "uuid": "33e46dd6-c8d9-41b8-8815-8f9caaa80ce2", "comment": "Malware payload (Formbook)", "value": "5190c92349f80d7ea048e6911d91f77b71844f90f302c0f0a81331bfa04a8c8f6e47aaa27aeefe9fdcd0e7f14c819285", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333569, "uuid": "1d10726c-1564-4c89-af52-06955f43eefb", "value": "T111751298B3E94E04F3BF6FB8ECF110549671F8179812D64E1885205D0F36B8AAD61B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333569, "uuid": "eb229700-3f37-4a27-b38d-c3ff74fff967", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333569, "uuid": "bac940c9-145a-4f6e-b277-41f1b45fe0ca", "value": "24576:klAi2Q9NXw2/wPOjdGxYqfw+Jwz/S/6RZs8nVW6k5JHkARt7DBAqnW:c/Tq24GjdGSgw+W7SCRnVQTEQ/BA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666333569, "uuid": "aeac3281-4ddb-4f43-94a7-efbf1649babf", "value": 1570304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666333569, "uuid": "5f47b71c-32f5-47a1-9d48-9afad0c8c7b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333569, "uuid": "6d54ea39-444e-429d-8309-a4595dda04f9", "value": "build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05123702-5139-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666354085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666354085, "uuid": "6f33c12c-c57a-49ac-abe3-d924eeb4d7fa", "comment": "Malware payload (AgentTesla)", "value": "6d5f75dd236e48e168726c043106d244", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666354085, "uuid": "4ddb614a-b501-4f11-aa83-7257935b0d58", "comment": "Malware payload (AgentTesla)", "value": "13bee76dae73be7d12dd2190c7348ecafc9ae959c1edf8d416b22781df0dedf8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666354085, "uuid": "f6afcaad-7ef8-4f83-adf0-8dd81c30a466", "comment": "Malware payload (AgentTesla)", "value": "7ed622dc8b9ecd803eec55fa814098fb17ab3e05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666354085, "uuid": "26159aaa-df83-4bb0-8103-5016feddfe39", "comment": "Malware payload (AgentTesla)", "value": "730580a995ab463a2f85d0d54243afb382a55ef9035f0f90c041cca6b5fa532eba8269c7c1feca9436b47f3901070df0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666354085, "uuid": "1689474c-3d66-4f88-b0f4-a8712c171050", "value": "T1D5C1C601B3D4033BCEB746BABC6347401279A3515D17CBEE68D4625BAD27B120E62AF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666354085, "uuid": "5dd59f04-b3be-401a-85be-59644f8c7642", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666354085, "uuid": "c4a68a3e-e44b-4e2a-bb98-723b2155d73c", "value": "96:IutEQJZv4N3L/927L5H/umCx+4kEmTcLcNzNt:L9Dw7927L5H/umCxIEmTcgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666354085, "uuid": "50b16a76-130d-47f2-b0a4-085c9849856a", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666354085, "uuid": "4c399b7c-0d9e-4563-93d1-bee2f2ef402f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666354085, "uuid": "178ae418-5ead-4c0d-a214-56f2005472e9", "value": "20146287.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246e69b1-5168-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1666374324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666374324, "uuid": "91740cf5-bd6e-44ed-a9cb-b1b595912736", "comment": "Malware payload (DCRat)", "value": "2590b1017ea0cf9d56165badf7d6fc60", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666374324, "uuid": "bb2a7a30-c618-40a8-a562-6c81a525742b", "comment": "Malware payload (DCRat)", "value": "1424887a14e1bbf4c1c1ea1aaea4e71661c51ed417678972ac4ed5f6a3c66ae5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666374324, "uuid": "0f409fc5-df33-48ab-a2d7-7ee6b597efef", "comment": "Malware payload (DCRat)", "value": "271031955c8c734e14f8f7df8c386123ab56f731", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666374324, "uuid": "7b697395-cdbe-461e-98d7-7369e702e5bd", "comment": "Malware payload (DCRat)", "value": "69bbb26542c612f753a8b1acc0ac12e24c8758898dddee8d8e88788ed7fa5d36873fea4d79c52817339d12f5f89c9dc3", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666374324, "uuid": "a58079f5-61c7-4b8e-8bf8-467c0ecd58d5", "value": "T15714E009BA8EC8B2C487457C4428CBF56A7F6D31D635C94737242B1FAE70FE016B616A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666374324, "uuid": "824877a1-5f69-45e9-8458-adb70808f6db", "value": "f310dcb1ccbd1dfa6fff52a7ca4ff31b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666374324, "uuid": "d6447130-e709-4ddc-9b45-8db2ee3bc67a", "value": "3072:bXOrdKLhzhiEpPXs5u7UGKEV5Bc13vb+LwZ9EE0KWFyUmKUuS:zadKLh9dFUaVkN+Uz0jyuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666374324, "uuid": "f27b275b-22e4-43ae-9ff8-c6fe43dc488c", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666374324, "uuid": "5f26e390-51d9-44fe-be95-c4db0aa40b90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666374324, "uuid": "153ce6f9-34a4-4a3f-9e83-c5d71f59c5f5", "value": "2590b1017ea0cf9d56165badf7d6fc60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6d1953-5127-11ed-9266-42010a9c0072", "comment": "Malware payload (DanaBot)", "timestamp": 1666346608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666346608, "uuid": "d20dd71d-e5e5-4f51-a9c0-1d5ba665bc0c", "comment": "Malware payload (DanaBot)", "value": "94dc8f3af0017f0e5d3492beb111a5e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666346608, "uuid": "8f6b3673-275a-4e06-929c-fd98ab5c8961", "comment": "Malware payload (DanaBot)", "value": "1445cc1e3676b05b4a1d5bdb3da5c9d38ccd9dedc99537e05d61c594d65d5955", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666346608, "uuid": "e60e5eb0-b84e-4832-b59e-15d88f14b428", "comment": "Malware payload (DanaBot)", "value": "8567e9ae5880d149799595fde4ec1922f3506285", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666346608, "uuid": "c88a0b22-b174-4ce2-be2b-033b979d42f3", "comment": "Malware payload (DanaBot)", "value": "89ba68e93a875748574ff0780b0d00970b4ff58243fffcdccf646a40d6bb510c71d9601790baf80fcf2a32062bd3a691", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666346608, "uuid": "8ca94e4d-b729-4f37-993d-d51d09ca0fd3", "value": "T1F7552397B3C2C8B1C0C855B07135DA7169FB61308EA9AD4327A453AF6E723C16E763C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666346608, "uuid": "81438eff-539a-4e12-86de-0e26506572bc", "value": "965326d499ea63bde30a73f94c3886cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666346608, "uuid": "b72100e5-f5a7-4a4a-a418-44201e355530", "value": "24576:sHbbQxvojIWTLteF8DU/kzGb3ZGEpHjSOM4PE24RegFR7j6FRCMVj6e:sAxvCLRDYkzGb3ZZXMlaW6rX6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666346608, "uuid": "c9a257f5-3faa-40c9-85a9-49c4bfd0b20a", "value": 1308672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666346608, "uuid": "b1aa210c-9ea4-40b1-9eb7-a6adc6435706", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666346608, "uuid": "5b3bc40d-3dd7-49ee-9594-2274ee1df153", "value": "94dc8f3af0017f0e5d3492beb111a5e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aaeac1d-512d-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666348994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348994, "uuid": "a913ee3a-45c0-4191-95a9-eca21271cf07", "comment": "Malware payload (AgentTesla)", "value": "44748c8b0f450833f5d627d16aa04c46", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348994, "uuid": "3539ab1a-7492-4ed8-ac5f-fae91f0736da", "comment": "Malware payload (AgentTesla)", "value": "149b03a8c58c43a782afdc77a95f8f64bf7f7ecceb7c7693a09e56bd6030b670", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348994, "uuid": "22913273-8314-41ef-a0a9-1cabd69ab43b", "comment": "Malware payload (AgentTesla)", "value": "d10cf2b24f371f7e03888df3c24edea6f02d4c6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348994, "uuid": "d4d3a512-5af5-420a-9091-8257a0126cf7", "comment": "Malware payload (AgentTesla)", "value": "8e8997d2b189bad60edae7bd198f6115264eaf0cb6f31c38d3012f9491c24b2be161c8db6af5d798c99a6751abbbc0f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348994, "uuid": "1cd9e7d3-b5d2-45f9-84af-17d39b4f1c90", "value": "T1CD056BB616D69607E425317588C3D2F32AFBAE607061D1C79AD72F2FBC450BB9213386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348994, "uuid": "89ea1787-92bd-4bd5-9abd-b64c060942db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348994, "uuid": "1a15877a-9786-413f-bcdf-b41256543bb8", "value": "12288:F0s/n1jcJB/A/44blk2kcwYzTmDZwjwgRW0zKbtIM+vTP:+/nIqc/zTWOkgRHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666348994, "uuid": "cdd8fb62-1b82-4c2b-86ae-a9a7504aea9a", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666348994, "uuid": "d16fc486-66fb-46e3-86b1-7280aa9c9b9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348994, "uuid": "843a5a02-32be-40c3-9439-8ad29d2c9f01", "value": "Curriculum Vitae - Pauleti Estefania.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5bd0b67-5194-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666393439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666393439, "uuid": "747e4266-122d-41b6-b06e-07a63ff41822", "comment": "Malware payload", "value": "80e881c917953bbf9da21266c9b40036", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666393439, "uuid": "ca023ba5-24f1-4870-9b5c-f3fb3a69f475", "comment": "Malware payload", "value": "1646efa1e5e5e2664f94e5436b666393f353fe62ef1b2035594b2602672731b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666393439, "uuid": "7cad5afd-29d6-4757-91e3-f6a64a5cf148", "comment": "Malware payload", "value": "6c6534eb35d432273d053cd85ed2351a711b6493", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666393439, "uuid": "aa71e267-1477-4541-b243-0fcfee5819e2", "comment": "Malware payload", "value": "db03daf633f70dfeb3097de54acff8305a62c9b87c7b32145c6292a0f3c4f794c5e77fb586a38f045ba310a1e77f987b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666393439, "uuid": "0951745b-734f-4a37-b167-7b5c85749007", "value": "T1457633A3F4F745F9D3233031CA583A95E0A9EA9D4E6012F6E38A44ED147C1AEC72754B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666393439, "uuid": "8adda36e-3825-4d7e-9d51-2f9501250e8d", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666393439, "uuid": "7984ab5d-0004-4ad5-af44-dac8ceb598ea", "value": "196608:91O1rvedp4ZTEsKQfr4iCp08uFQpviZtjElOnir4A5:3O1TePAy0fTxFiviZtwl/8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666393439, "uuid": "b3d55f6b-6931-47c4-ae04-af54ad019439", "value": 7602059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666393439, "uuid": "88b63161-caea-45e2-931f-5740d6ffc944", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666393439, "uuid": "905d129a-e278-4cf8-9b74-fa4bd208b8c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e40c523-5116-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666339149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339149, "uuid": "3bfcac50-6202-4c95-b9d5-376611006b1f", "comment": "Malware payload (SnakeKeylogger)", "value": "728b3de4492c0baddea6770e24fbe5d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339149, "uuid": "88cd1747-8142-4778-aa16-983177c6b9b4", "comment": "Malware payload (SnakeKeylogger)", "value": "16c6e27daa1a1e14e32a2a49ee97054d64a9ae4b4549db8d4d7c3bfca889c15d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339149, "uuid": "113f1805-228d-4ec7-82e3-cc94116ed2d8", "comment": "Malware payload (SnakeKeylogger)", "value": "5736c68e0ff928b897013e9ae2fb366e2798d871", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339149, "uuid": "c1c82944-7784-47f1-90a3-77e77903e087", "comment": "Malware payload (SnakeKeylogger)", "value": "9d739a3e69dc126ca476656959afa2740bded2f955773dd6b2695ba2f124c94dbaed3ca953e23a7f6b2e601328e65604", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339149, "uuid": "3aaf24df-bf75-45a4-9cf2-3c1437a98dbd", "value": "T176D412289BBE5A1BC7ED077AE12756290731C515F003F79F0ACAA8FD2D93B848105EE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339149, "uuid": "812d14f2-0d4c-4436-8e5a-975e1a55631a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339149, "uuid": "3bd4aed0-122c-4f52-99e5-101161c59aab", "value": "12288:Irjg0NoZ8dGJuqF/TvJuIbdt4cd9cYEerEBHUmcngtLAxaOgPQ:Iv5ZdVqF/TvJL5t4cIYlQBkgK5gPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666339149, "uuid": "17d4578d-f6ee-418c-8142-3f6b56624077", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666339149, "uuid": "5fd237c4-d52d-4146-9c70-585e821473d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339149, "uuid": "1d1f15e3-d21e-44e7-9ffd-0bdb829d5e69", "value": "File W652S4GBtWihECa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77fa837-5142-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666358304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666358304, "uuid": "657188a8-9904-4bf4-af8d-71735a078093", "comment": "Malware payload (GCleaner)", "value": "ebb733bc20f560cd8da60f694516351f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666358304, "uuid": "ea3e1052-785b-4b6b-9abb-f195c085e70f", "comment": "Malware payload (GCleaner)", "value": "16e6a0dbd3770c32e801be26a34810bd1e154e3950bd593f93b5f7c0e3632798", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666358304, "uuid": "6bc85498-c86d-458e-8acf-8b2eea3d8e90", "comment": "Malware payload (GCleaner)", "value": "bbf2d39643659a2babda789434dc78eb5bbd3742", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666358304, "uuid": "1f1c612e-3579-48b9-92b7-b0ad7d06ab45", "comment": "Malware payload (GCleaner)", "value": "e57eef2e70f00926a36fe457f2c743e2703808388578dc301d9eb2a8e1a9d31f4ce860cd9c055158c8774ee3182e7549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666358304, "uuid": "7a59156e-4a55-402e-96c1-81cc844b852f", "value": "T1D4C53333AB21D771E095E6B04F4C2E6DA0633EA25678A4F56A5D83CF293B450F43835E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666358304, "uuid": "8f8477b7-896d-4510-bdcd-4085cfb24ccf", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666358304, "uuid": "7f2fa90b-b818-4b5b-a643-73f61b679a36", "value": "49152:Z2WzifLCtQvK302DBgPtoSuPavF77sGqGShbJGdzPa13KJStA5hq:MljCtWYHBgPWlIVjNS1Jmzy13SDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666358304, "uuid": "eeade4c6-b51f-4cae-b555-c449ab2ed0ad", "value": 2548294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666358304, "uuid": "2702116a-bc01-4505-b225-f5defa0aebbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666358304, "uuid": "29e28b2b-8824-4a3e-97a8-614b1d157bb8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce1b97f-5116-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666339200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339200, "uuid": "52d97e46-3091-4897-abdc-0699d35ef7b4", "comment": "Malware payload", "value": "33618b657256eb9b7b2b6e4413731ba9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339200, "uuid": "4c844d28-0b8d-40f6-980a-c468305c8d78", "comment": "Malware payload", "value": "171a4b3e8dfa2e9617afd67df54b441f704fa8cf06da227a785734e3abd98772", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339200, "uuid": "8fad5cc8-8fe0-4887-a419-b542d9bd7648", "comment": "Malware payload", "value": "afee5e58e5df7b1d39b9427526a82ee53d78b21c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339200, "uuid": "f0ed6c73-d93f-498d-beb0-195ab328f755", "comment": "Malware payload", "value": "ba2e34766f44ec101357a519c68c787d3e466616e79a0082cd0d232a19a9f75e325af36f4baa27b93f050a396c360180", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339200, "uuid": "276a14a9-d1db-472a-a65a-5a42c02d717b", "value": "T16E74E621F7E79615E3B32A3444BDAA614F627CD6EDB4924A308E7D1A2B31F504C13B36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339200, "uuid": "0236853b-9fc0-4743-a0be-a13d03dc4d54", "value": "6144:BHOa6Uee8qS15iRxVKpD0H6P2FrKJPSm40hbQdv:BHOauJ5/aH6+F+JPy0hM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666339200, "uuid": "58f0cf6d-f297-440b-a3e2-18165bff08d8", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666339200, "uuid": "1c2a9d49-1972-43fd-b96c-c7c2b38abd35", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339200, "uuid": "3ae2a715-da9d-4c3b-b59a-4bdf724fa23e", "value": "22595-00-0000-MR-6110.13-001_E00 \u8f74\u6d41\u6b62\u56de\u9600\u8bf7\u8d2d\u6587\u4ef6.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8fedda-514b-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666361965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666361965, "uuid": "189df9be-7f95-4d90-bf3d-0b6677d8ff7a", "comment": "Malware payload (GCleaner)", "value": "1dcee3ad77b986bc60b979789e9d0ac4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666361965, "uuid": "f1629d2e-33fe-4b66-b99d-00612b71811c", "comment": "Malware payload (GCleaner)", "value": "1743f5b48702b5ee8e41dd309b940e8c3d38a51246e348e13feeaf86e4ca63c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666361965, "uuid": "d5a95897-6b7a-4c6a-9624-e5cd06be6b60", "comment": "Malware payload (GCleaner)", "value": "101ebb71f5fb1f2e4356877d9c623b2f1406ed4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666361965, "uuid": "ac526fc8-b4e2-4d9d-a302-84208b1eae90", "comment": "Malware payload (GCleaner)", "value": "96fa8ca93eece490987b7d32ad2605330c2afef80a1095288e9836fa7c23d5a33774cf0587d6e6a25e64a5dde65d1311", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666361965, "uuid": "72287aba-ba1d-4ef9-be9c-3a35340eca1e", "value": "T1FEB53394C3D8CDB3E161ADB4BD71DB7647763B5201AFA8277C8D40892F36E1AA804736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666361965, "uuid": "c694bf01-bef6-454d-8531-c03f01720ea0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666361965, "uuid": "fd638cd3-77a7-4215-b483-9f9bd06a0e73", "value": "49152:Z208NWfo1aopaEn8b6fokKO34te+9D+JP/XqnKkA5hq:M08QQ1ak8b6fokKQfJXXqnKLDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666361965, "uuid": "0f029516-1e6d-40f7-b8c8-38ea825c6c95", "value": 2381685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666361965, "uuid": "19232fd4-085a-447e-88ed-15132e303b60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666361965, "uuid": "3878bd56-f900-41ed-bb5a-146dfac3554b", "value": "1dcee3ad77b986bc60b979789e9d0ac4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75cc852-50dc-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666314495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666314495, "uuid": "f2f2acae-6f93-4524-97c7-f70f8f5abc50", "comment": "Malware payload (Smoke Loader)", "value": "8d546893647186f0aefbfd258a017a36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666314495, "uuid": "9665aa4b-ae69-47ad-ab6b-6bf8e8201a29", "comment": "Malware payload (Smoke Loader)", "value": "183f0d82e6f9807c4d5db686c87cf78048bb9e5ec9bb03a801bf6fbfc11fdba6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666314495, "uuid": "80d8267e-8e97-4ba6-b57b-ecc7fc11fbe2", "comment": "Malware payload (Smoke Loader)", "value": "1c8dca838cc88a5faee14750af35e42c1d18802e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666314495, "uuid": "912031ae-d2d8-46ad-b06f-ead7629c99d5", "comment": "Malware payload (Smoke Loader)", "value": "45df286fd24e70564ecb4400de98a75de227bb2f998137afc35f9eb5dea7bf32c113dbe895f09460eabba8313405fa43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666314495, "uuid": "400c3726-7e1b-4b56-b05c-fcb894377d79", "value": "T13614E105B953C831C44591349828DFB02B3BA83166798FD73FA92F7E6F712D157BA282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666314495, "uuid": "e9987357-b5ae-4a97-adf5-53095e0095df", "value": "ee783376aeb5a6ccd1e2676f1a5f0e82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666314495, "uuid": "828ea7ac-9e65-4a6a-8dff-f8b1f230847c", "value": "3072:XXSkiL/+aMN+5swsNo1weBoKTo6wBvA0rnhJweM0KaEfC:HhiLzu1wooq2oaIBv9IeM0HZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666314495, "uuid": "f25e48cc-55f4-4bb5-abf7-e209caafc266", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666314495, "uuid": "cb1860e6-bd64-4a11-aaf2-797d072fc965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666314495, "uuid": "50216b00-0434-4f69-8c41-ab1a773e6038", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e874d56-5113-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666338022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338022, "uuid": "aed6172e-c32a-4a2e-9130-c5b70fbfd1b9", "comment": "Malware payload (AgentTesla)", "value": "cb9f24dd11cefc28aa4bd97736191ef9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338022, "uuid": "f86653b4-c018-45ac-9cb5-96cda95e8b2f", "comment": "Malware payload (AgentTesla)", "value": "18795ac4c12ef439ea3be9a8833f9e20b5540fcbd561eb421c61e68b5b81e55b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338022, "uuid": "d9f72159-374a-45cc-93f4-937191ce413a", "comment": "Malware payload (AgentTesla)", "value": "bb6ff483d53ce19b87e4738d879cdec5e08d5ea6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338022, "uuid": "a9d66590-d3b4-4b6e-9d04-2600e16ef84a", "comment": "Malware payload (AgentTesla)", "value": "65a719337c0a334bc419f465aa118697767c78d0dea77942a37594d0e55709068ca623be291189aab0550f8531211612", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338022, "uuid": "25ac325d-c9c6-48fd-882b-f906e9ef7057", "value": "T19DE4132D5BD64D2BC66C1B7A90250D281332C20EB85BF78F4DC1B6DD99D27C4C8896EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338022, "uuid": "b386b669-ec04-42ca-9942-1b30ecde7245", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338022, "uuid": "81a9e21d-699c-44e0-a3a8-064867fb1204", "value": "12288:hXG8Mm4vQjTgHKZ580tn8UENS9enipKXCgspw2NuE6Q:dG8MQjTgqZtzEeevXCjpw8uE6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666338022, "uuid": "5621aa06-61be-4bb6-b2dd-916cfbf0b3c1", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666338022, "uuid": "a10e926f-e51a-40fb-b8f4-9bade437cb7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338022, "uuid": "7cf717ff-141f-4085-91ca-417948d010d3", "value": "TT COPY.r00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce63ddd-511b-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666341214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341214, "uuid": "f5595662-08b8-438b-8531-ef60fc81e9f3", "comment": "Malware payload (AgentTesla)", "value": "9942e14c6616468e1c6884be1bf5f6e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341214, "uuid": "aa3d54c9-992f-4727-bf1f-001ad57873a4", "comment": "Malware payload (AgentTesla)", "value": "189e6c35afdf0ec44a5a7bc4f7666d468b9e967ed9c44013d3feae14c385d8ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341214, "uuid": "cfd91664-3397-4594-88e7-404d51cd3ff4", "comment": "Malware payload (AgentTesla)", "value": "75996d8dde2fa0416f15d36aeb97c34d64a5cf93", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341214, "uuid": "d10e6867-64aa-4814-9d84-675cbe5174cd", "comment": "Malware payload (AgentTesla)", "value": "b281d6f931e4cbf410816d80349c33d554ffd4d3f697b79a4c62ec7e9e881919179a0cdae234f1ee9b63cae81f4181bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341214, "uuid": "0cc05200-ba22-4f9b-9c9f-2c6cb946fe89", "value": "T1D4E4125A83AD0753CABD2FBE94451B500B39D117B083E3AF9CC2B8ED1D633D498466DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341214, "uuid": "b0355cec-91db-48d0-8b18-593b1e07f87a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341214, "uuid": "6772d6f6-2c33-405a-8ab8-e57d7284dd0f", "value": "12288:bUPH+QrCwSBBHUThwS9EwDPKMZ8MW4CFWmLEE4AHuZRyRL6pQ:bIrCHLUfEwTKMNoFoPAiyRL6pQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666341214, "uuid": "bfce6b3a-3a8e-4a42-a15f-fc2b1ff4f4ef", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666341214, "uuid": "c45a819d-f3f6-4167-8240-55f22d9fee2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341214, "uuid": "f2ace23c-ca46-40c0-b685-9de72ba4e92b", "value": "PI #20221021#0210224010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14dd2610-5133-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1666351535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666351535, "uuid": "8a81a8a4-4bc1-46f5-98f6-65546013d4fd", "comment": "Malware payload (Stop)", "value": "f52b4e894b2d577073ef81610150e2a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666351535, "uuid": "0d8b7ce0-7140-4e6c-b17d-3118a42d7f0c", "comment": "Malware payload (Stop)", "value": "1a08cc395ac01cf060018296b61a187c981c956cbd1d6d8f1f3bfaf98bdd565d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666351535, "uuid": "1db5ead4-98af-4c15-9d48-b53f84170604", "comment": "Malware payload (Stop)", "value": "b3aa05260ad6b0cb6c3cd8705968e8e5d8ebb46b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666351535, "uuid": "2e9a003b-03b6-4ddd-9fe0-b1da79bc87bc", "comment": "Malware payload (Stop)", "value": "9ba5c22e11fb524b4460a372e00f04fd12da8263f83ab3fa68a8352b103ce528b62b3b8e2586b3112e3a9474b1bc3e82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666351535, "uuid": "620510de-5faa-41a2-8c33-2dbd3f4b7e4a", "value": "T105F41201B2D264B1C8B954F09469DFE0267FADFA6A315E4F33516E1E2A336C10A767C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666351535, "uuid": "46780f47-1370-42c8-a877-fcc47b75be9b", "value": "965326d499ea63bde30a73f94c3886cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666351535, "uuid": "8c880c7a-065c-43a2-b406-60ab4c001be2", "value": "12288:if5h4N9gOgQRBaNsEaICj6cIFqHdmiiLDDdW+w4bGIM/d8Nw16foqcop:icN9nxRcKEajj6x99DK4bJM/d8ND1cop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666351535, "uuid": "da90bdd1-edc2-420c-bfcd-4088d28725a2", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666351535, "uuid": "8ac69d67-0d3d-4dff-9f98-93d52ec241db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666351535, "uuid": "78b715a6-367e-4b19-83ec-87955433f523", "value": "f52b4e894b2d577073ef81610150e2a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7159e58e-511a-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666340953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340953, "uuid": "ebd738eb-6ff7-4f61-b20a-e354479e6834", "comment": "Malware payload (AgentTesla)", "value": "6a482d94834a06b712b0c1e5ebe62a3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340953, "uuid": "fb410da3-0dd8-48d0-981f-a66560d91f09", "comment": "Malware payload (AgentTesla)", "value": "1acea777279c733a8b266cca571b4277e3c54f0c6f7ba5d341215cf77d6e68ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340953, "uuid": "021232bb-cc25-4af1-af17-8bcf9e9702e4", "comment": "Malware payload (AgentTesla)", "value": "70b2bd8cf084987edb9cf98f27439086843fef7b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340953, "uuid": "218b0bac-c074-40dc-88f1-86321cf18071", "comment": "Malware payload (AgentTesla)", "value": "2dacb55aa0bdcfdc80bfb302860bef01fcd100e437aa8c0c54a1bb91e1f19bcfffdf3b1634ce7645e9a74b66ba6ab1ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340953, "uuid": "3d13469c-0b1e-44fe-9a6c-2772376c8f21", "value": "T154E3348DD78B81A18F84637703674E8845BCB63EF74155B531AC83B533EAC3A49A58BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340953, "uuid": "4a87f6cf-a63d-4a1a-b333-505e20ae4262", "value": "384:ree9/OnyZqxaU0LRAdMZsF3+y0744wcGwUbzrln9/hnAhfCE6r7TJBGfDJ26LAv:ree1OyZqT0LRDW9mHG7bzraSurJuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666340953, "uuid": "dc052a18-6244-458e-b5ac-5fecea91ae2e", "value": 150645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666340953, "uuid": "5790932d-34ac-48be-bd5a-f5833740f994", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340953, "uuid": "193adde3-1829-4fd8-ab97-0bdadb83bf2a", "value": "enquiry202210.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12e2c32-5125-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666345892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345892, "uuid": "3f5470db-6caf-4d75-9bd5-20c8c1502b6a", "comment": "Malware payload (Smoke Loader)", "value": "afb8e9edaeee41043b5297811e366a35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345892, "uuid": "f119854b-19a5-40b9-8e2f-eb6f9b14693b", "comment": "Malware payload (Smoke Loader)", "value": "1af53450a3facfce63dd570a8f0ab4ec224e0fcf70aa00f55c77b6c34b4f1f96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345892, "uuid": "23099056-f4de-41cf-ab26-ca8b4616f799", "comment": "Malware payload (Smoke Loader)", "value": "b272ee272f8e0792ab1025ec53e96eab1c943586", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345892, "uuid": "1545fceb-6f3d-4f5a-8477-0b5c522ab4c3", "comment": "Malware payload (Smoke Loader)", "value": "8f4f0852da06e7a3409c39723d9f166687c521c4168062087d812f3b8b06c25295b3681446bbd752f16cd5d3218bdbaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345892, "uuid": "454a2158-5a5d-4e0a-b5ea-a555030d5a38", "value": "T1C024F011B993D871C84668344864EFA4267FBC702671978B3B682F6F1F703D2A6B6347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345892, "uuid": "bd47c1de-5de5-4d93-86a5-bc086d9a8d4e", "value": "965326d499ea63bde30a73f94c3886cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345892, "uuid": "6abd95df-f862-4e20-98ff-66b42bde67bf", "value": "3072:MXtPbLDbwgRdWP5C51Ta//3UagVofSPaZRV1NglogXEBka8nl0KxvSFk6:I5bLXwgRog4OWfSi/V1NglzB0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666345892, "uuid": "5d54633b-8009-4fe7-a9a2-7ddd2390f67e", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666345892, "uuid": "e38171a2-3dab-43e0-ae7e-13e049311d0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345892, "uuid": "901f7e08-93f3-4359-8e7d-40dcd198aa41", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d8a56f-5109-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666333553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333553, "uuid": "f6fafcc1-9aaf-4871-98ee-7f74bfcbe49d", "comment": "Malware payload", "value": "85e85028b0d5399456477b6ad7678d34", "object_relation": "md5", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333553, "uuid": "29ab8fe5-00ab-4522-b268-7e8a865cf8e8", "comment": "Malware payload", "value": "1b68c03d02c8a6e80dc63df0f09021bc612a4588ee65a12ee2c9d26cb18c01d6", "object_relation": "sha256", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333553, "uuid": "c4b37672-60e0-4504-962d-212837f2656c", "comment": "Malware payload", "value": "33791a5eecd3be9f7e518ded7159554d95c79b95", "object_relation": "sha1", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333553, "uuid": "2219aa66-364a-406c-97bf-28202ea7f87a", "comment": "Malware payload", "value": "9328506ef247decdfabe4e74e1fd7ad7b045c20fbcf652ff32b3e23cff43e1a032701c58b5d6bb82c04eb4b859e71cf6", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333553, "uuid": "b23d2742-6901-4bf7-9c19-aa9d26d46510", "value": "T1BCC5BF313045C053EAA25DF2549E81B0A0F47AAC955EA6CD21C1BF2B79F236C41AF7ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333553, "uuid": "aa7b3d94-11f5-4b9d-b782-de2904a009ec", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333553, "uuid": "86da9e01-ca8e-4624-8ae5-2c4afc54f529", "value": "49152:3Bn00Ux71c4/sWXSTZ9PLlOIbxn3OrDXFUJeOYFBRT+PzpOVI7F:xLOZxSNFLrbp3MXFpOURCPzpOuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666333553, "uuid": "660d5e83-63f5-41b3-9a03-e1f6754ef480", "value": 2664668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666333553, "uuid": "a8c76032-d261-49c3-872d-6f749137def7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333553, "uuid": "2974d9c1-b9cd-4ecf-a71e-8309fb294b0b", "value": "Request for Quotation.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c777137-5194-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666393424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666393424, "uuid": "fbc48fda-2803-40bb-bf9f-6ee3e31838bf", "comment": "Malware payload", "value": "7ae8136c83153051753ddd4fac688b47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666393424, "uuid": "1086447c-e5d4-47d4-b3b9-cdbdb3dcebad", "comment": "Malware payload", "value": "1bfd758aade113116c5e0288c994cfb118bcfe628b0aa51f5c13460b5a1ebe33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666393424, "uuid": "a5a4e1cf-be7c-4ed8-8e1f-ecf7319936a1", "comment": "Malware payload", "value": "c15b22361fde2d8a16dc9881eb098d8d32bdecf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666393424, "uuid": "17f90909-7fe9-49b4-a52f-1c19de8509f4", "comment": "Malware payload", "value": "f3dc738980ab8b038fd96b8c5a41a0afe6144ef193f071a2542d7c9228a8cd65f44cc72fc3203618ed628f2ff0410d63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666393424, "uuid": "7171983c-f1f0-4675-a7d7-6f57961fa800", "value": "T1E234F110BAC3D832C78655348864DBA05AFEEC322574498B7BA83BEE5F702D16777346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666393424, "uuid": "4f2dc3b6-4c33-4b3a-80ff-b31e4ebc6cf4", "value": "b7130d64e41e1f3aeb19371c8fcd9d1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666393424, "uuid": "85f056a0-38e0-428c-8fb3-7dce378f6d9b", "value": "3072:KXDxaLQE9AYAr5hYrBoO6dyzmSxxztMuB3+I25RvEPvY0SwS:qtaLQ8AYAvSotcz/dMuR/2L+vjvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666393424, "uuid": "7b6a70b8-6119-4a99-914e-db7a1491b465", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666393424, "uuid": "bfb3a5c8-539c-4d9a-9930-dcf7e3ef473f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666393424, "uuid": "194f80e5-1cfb-44ca-9484-6e31c5a671f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f81cb0-5123-11ed-9266-42010a9c0072", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1666344717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666344717, "uuid": "e664aabf-6d77-4dc9-b5ec-c0a7aa665a2f", "comment": "Malware payload (RaccoonStealer)", "value": "ee6cb7d44b65b0817f1bbb9e958d1873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666344717, "uuid": "4cc10619-2461-4c92-9967-90561f422391", "comment": "Malware payload (RaccoonStealer)", "value": "1d18b0282035bf5d338d9d3b292d8e224dd9a11209e9f1ec5aadc39f1d842302", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666344717, "uuid": "f3830559-06dd-428e-b0c3-1be9ec1148e4", "comment": "Malware payload (RaccoonStealer)", "value": "60d492526190e731344e2de56045b728fa601954", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666344717, "uuid": "43c2d109-883f-4960-a549-7eba69a62782", "comment": "Malware payload (RaccoonStealer)", "value": "d1a9de6f3e459e91882e795dcbe091e975af714e4f334b47a29d309d550a48aee09036cba2845af200a6e8f4f677f160", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666344717, "uuid": "3caa165a-6f43-4beb-90cc-6d7d52d9fd4f", "value": "T1B846869D726075DFC867D0729EB82DB8EB5178BB831F8203902715AD9A4D887EF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666344717, "uuid": "4483bb89-b978-4a55-b87e-f9167b021533", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666344717, "uuid": "19c79fc9-83fc-48cd-9354-5f10163758ba", "value": "49152:Ccp0EB9au/0qat+eS2c9GOrGGGGGRC7lUcfwzcsnI7:Bp0yaNqNN2cGOrGGGGGRGlUcfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666344717, "uuid": "9deeffbf-359f-40e3-93e0-36ea7cb9b46e", "value": 5842944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666344717, "uuid": "63174947-ec3d-4525-8f04-d1abd7075e4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666344717, "uuid": "fca6231c-f707-40db-a700-ffc5aec1ad7f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b410eacc-511f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343212, "uuid": "947031bb-2ff5-4c4b-bd67-9cb21cdd165d", "comment": "Malware payload", "value": "80483a90cf3e46ca6eb0ffe03a10c759", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343212, "uuid": "c77a3abf-8ec4-4540-adfc-09b861b4240a", "comment": "Malware payload", "value": "1dc12c6a44852023f1687f9f31a9e58dc7ce96d492a58a3e87dec5aa8f45ba92", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343212, "uuid": "a588fdf5-e577-4f05-98c9-4f604f6db0c9", "comment": "Malware payload", "value": "5428c02bda841adec9c5e42b50b9ee52f7fc3f85", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343212, "uuid": "3f5f67c3-08d0-4255-99d7-42c5f390f519", "comment": "Malware payload", "value": "1da62da2b58c4c67edcb7efc78234ce2ac361733be4b0df6f12a44ff6391aca6f3a6f16523ee2bd95012f9ef8a842de3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343212, "uuid": "151b6032-655e-4281-8ac9-269bf852ca90", "value": "T12EE52393F31AFCA5D122C536937619C379255DA0CA54E32E321DF1A85FF7940CE8CAA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343212, "uuid": "33d81c1c-757d-4984-8adf-efd747a37958", "value": "49152:S/T44QImNVv3DIN03mS47uTStWWyQ0kA/v1Z5aK6+5NvCCYEkdw7lChDk:4R1u+IfQdA3z5ahwC2kayI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343212, "uuid": "c5aac9c0-c975-4b35-905f-458e50853d48", "value": 3310537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343212, "uuid": "c7258ff4-04bc-46a9-94fa-0cb856725c71", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343212, "uuid": "8351de0a-e0fc-407e-b904-cee9496e57e0", "value": "1dc12c6a44852023f1687f9f31a9e58dc7ce96d492a58a3e87dec5aa8f45ba92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36bd2199-5182-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666385522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666385522, "uuid": "de49762a-6faf-4c93-9996-9f05533ab9bb", "comment": "Malware payload", "value": "c35825f99fa58c9108e79050768aa385", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666385522, "uuid": "61b62034-8cb7-49fa-beb6-70038a5acec7", "comment": "Malware payload", "value": "1e120fcdb2d771ee3a1b169b5aab47a4321f8bd42688819e9e030cbbc8b9a88d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666385522, "uuid": "39435fc2-52ae-4ca3-9e72-438c6d88a27d", "comment": "Malware payload", "value": "8afdce7bfc83e0510c0770f295f54393e9318f2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666385522, "uuid": "5da40694-16ec-466c-a4dc-91934bf26d08", "comment": "Malware payload", "value": "c9699ddf0d6dbc68edcfb53d6d2914f31754d2de8c4c2b34e70af143de6045fea7dd434912e0a52ca92b35f2313fa1b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666385522, "uuid": "5de2f8f4-3dec-458b-b5f5-351c3d375d54", "value": "T146740221B592C873C8869434487AE75465FBF8F1347589477F183BEEAE306C35A7234A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666385522, "uuid": "450d8b8f-9dcb-4203-b69e-b598f9180319", "value": "bc5a05e947eb61731a4e3024a4f4b617", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666385522, "uuid": "ec6c7cd1-e274-41c5-b489-f27bae2e78c3", "value": "6144:Dl+LgmmAtX2Xd1816cbRzlcwwCrnp7oqgzIRhHE0Ew7rpPC4/8VZ3rIbwS:Dl+0mrtGXT816cZywwC4UR60blg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666385522, "uuid": "0e7d8bcd-90cb-48a2-a6ef-ba1536aa70c8", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666385522, "uuid": "9d14536e-c7d0-48e6-997e-57be3c86338c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666385522, "uuid": "362c685d-ac02-495c-90e3-a8b8b66481b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae1bbf20-5119-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1666340625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340625, "uuid": "0d8afe9e-a658-4678-9c61-27969e8873d8", "comment": "Malware payload (RemcosRAT)", "value": "60032e284ee011f4f46fce76c60e138f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340625, "uuid": "5482c137-b405-423b-b54b-091d5057978c", "comment": "Malware payload (RemcosRAT)", "value": "1e4c43645fb4a1b4ca08c7b22b4e63d38f7fe76191abda38e84fcada08339bfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340625, "uuid": "e1d78138-0097-4fce-a90f-10bbe50c3138", "comment": "Malware payload (RemcosRAT)", "value": "f667ad3b3c50bd88c1c25ddd453f33acbfdb4dd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340625, "uuid": "b9ab8efe-dab6-4243-b34b-196933a1007a", "comment": "Malware payload (RemcosRAT)", "value": "c0d46293106dfc1043e0564f8b5f1205693de148141f654a70dba4cc8f31adef0c92b00c65a27df9fe7823095d20cada", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340625, "uuid": "572274f4-2499-47dc-aa99-e3b5de34eab2", "value": "T1E4C1B30093D887B7DE3707B6B8A3638002B0F7955DA3CBDE2AC8245B6D037910D226B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340625, "uuid": "a35ec8e4-6e29-462e-a2d5-666d3eac7a8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340625, "uuid": "b5c2285b-dbaa-4db3-af0f-e4fbd48e5eab", "value": "48:62jgrsiEetneWESty89PYTaV6iIxdixNMr+2+zmbq5cSk9MXsAOsitiOlzM+J6M7:gieteWPtjA2VAdik+2+yJO+xi2BszNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666340625, "uuid": "c1ef9daf-ed17-48e7-8bf0-786320183c50", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666340625, "uuid": "15a5c1b1-a438-4eb9-80b9-795d725692a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340625, "uuid": "703a4284-ed8d-48e1-963f-fa69d390b425", "value": "Signed_PO_801221651.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115e0a0c-50ed-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1666321464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666321464, "uuid": "203cda9c-53e1-401c-9b1b-02fb86d511dd", "comment": "Malware payload (IcedID)", "value": "c629d6f58117d412173063ef636e6b65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666321464, "uuid": "08371fa8-5dde-4989-aadb-3b52eb50b651", "comment": "Malware payload (IcedID)", "value": "1f505f27867178bbc42c42c7b550c2a24e0a42bbf5341667d1270dd8013a271a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666321464, "uuid": "08d28351-6a30-46b0-83bd-1fc6f23d1ba9", "comment": "Malware payload (IcedID)", "value": "46c77ccde087080cb5ade178f10e813d48dac71b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666321464, "uuid": "90a70d18-148a-4ea7-9e56-bd2b691e9dab", "comment": "Malware payload (IcedID)", "value": "8559aef06d3f4b6f766cd6148689e2e2990d74765f44deb0f3a98c92e761b6db7608fc9f7b9afa489c3ab18ebf417fdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666321464, "uuid": "ec41a096-c7ba-48cb-8502-fd4da07fd521", "value": "T12614DF027A93C4B2C44510380875EBB0767FA4352B65CA573BB97B7E6E702E253BB2C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666321464, "uuid": "bcfc8e3d-1241-4c7d-8fd2-93de1e547ff4", "value": "ee783376aeb5a6ccd1e2676f1a5f0e82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666321464, "uuid": "ee5028b0-fc67-4ed1-9df1-d251bedc433d", "value": "3072:+XJ22LA23ve5jcK3fEUMjP/E3mUqkU0Kwt69DC:GA2L1/cLvAT/6PqkU0jEVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666321464, "uuid": "d446f9d6-64fc-4d3c-ab86-796b1fee26c6", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666321464, "uuid": "0f9cc8f4-a730-496e-8156-e466d86832fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666321464, "uuid": "49767d53-7755-40b4-bcbf-4560bc2e592c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e53df5-5181-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666385312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666385312, "uuid": "2814e3ff-8963-4af7-9e6c-2950981b9776", "comment": "Malware payload", "value": "5561d1a5fde86c1ae8c463a18fa3200b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666385312, "uuid": "efe5788b-90c7-4dfc-81a6-54d3d54b145e", "comment": "Malware payload", "value": "20c21da6f8666daf8d4fbf5d8a16df5a6ed360dec343013a6127f6022b8989e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666385312, "uuid": "7c0045d8-dea7-419e-a965-4e044f07ab4e", "comment": "Malware payload", "value": "40557f13ab943c203fd8af00b7b2ecacb12465b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666385312, "uuid": "f281f041-44a2-47bf-a690-7f4165c1982a", "comment": "Malware payload", "value": "e03c287cd0445a724ca1c13e6066fbd61589e1adc4ba59b549286df9edb56b806982e901664459d3440d6fcf264836e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666385312, "uuid": "6c03da50-2f1a-47a5-b370-ee84411cf3de", "value": "T1F734D010FAC2C432C08255345474D7A5D5BFBC3156718ABB376C3BBE6E712C2AAB2356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666385312, "uuid": "7105fe2c-799c-413d-87f9-7e47271f52eb", "value": "bc5a05e947eb61731a4e3024a4f4b617", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666385312, "uuid": "c343dee7-2ac7-47db-a392-27940b25301f", "value": "3072:lXNny5LZ7ysABE5mIuXw3cJXjcdNvLZXjvc2BBgKmqfCgEXpNCHo31IlkazvS:htcLZusABV8OcdNzVjhjTKHMIlZ0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666385312, "uuid": "092fc1ca-fc9b-49f0-a11e-f0057fabc08a", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666385312, "uuid": "3c2fc2ff-c89b-4210-9a3a-2a10679ba87b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666385312, "uuid": "29b04ceb-c7a9-4097-a0b1-cab86aa58187", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf66c6b8-50f7-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666326078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666326078, "uuid": "78b4ee0e-578f-4b5d-948b-5b5629bb9cd5", "comment": "Malware payload", "value": "0d4411bd7cf711912012b7e3c75ea50e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666326078, "uuid": "741b30c2-fc81-489f-8dac-8d1bbcd9f751", "comment": "Malware payload", "value": "2299090b9cd36e59462655cfbb2e1d13c77d8abc6c1e9ad09cd2eb07b47191f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666326078, "uuid": "ec4e9d43-4762-449f-a17b-ed29b2d590e7", "comment": "Malware payload", "value": "a13858bd7a0287bfa8b036cc68159b78804834f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666326078, "uuid": "2ba40a41-9a7d-4eb2-9170-66e30fad111b", "comment": "Malware payload", "value": "e1c82fddc69a07b7b1922f009c07c7163866b4d1fd0136c8781c6324254fa04ce93fa83c2cb59030d5d3d5eb47d7d0c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666326078, "uuid": "df222b56-1e88-4b36-ad28-f25caea06115", "value": "T113763323BDD280F6C3020D725E6D1B4AB478AEB40959C35FE787885C6FB854563B272E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666326078, "uuid": "db735154-2968-41bd-86e9-567171744613", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666326078, "uuid": "0fdac112-4759-4c12-81c8-2dccf027782e", "value": "196608:91OpL6NhHl2Q4hiIu/dA21dBLWIHz8ZbM20SlOg2d+iS:3OsN5lIEH1dBLWaIR3CnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666326078, "uuid": "459a8a97-6857-42cf-abad-dcab51274909", "value": 7617800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666326078, "uuid": "e31f225c-d0b2-46dc-8484-79303c9791c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666326078, "uuid": "5544ded4-4459-4e79-a581-7dcc4acc2c88", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed3ed9c-5186-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666387468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666387468, "uuid": "7a393980-a341-4851-bae1-3b0c5bcbada1", "comment": "Malware payload", "value": "2c63006459624fced4052ba204dea9ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666387468, "uuid": "d5378c88-8bd8-45b4-8d72-7d6bd2d66220", "comment": "Malware payload", "value": "25a9bff1e6e2a433363ba1d677b7b4fa6c77ebc8274b32d8e871fea39c70a49e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666387468, "uuid": "98a8f3b4-9284-4df7-bc36-7accb415a6c7", "comment": "Malware payload", "value": "57126d7bf02d3b9a1da98def102969d986fbab25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666387468, "uuid": "3abc06da-5764-4ba0-b29e-b400ab3162a3", "comment": "Malware payload", "value": "dedb4a65cd1018d41d3896a296911bc91f0340d7ffe20dcc7289cfc83ba9af91078e762048c5bf537b4f5f3e9bd4efca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666387468, "uuid": "45440397-c4ce-45af-a947-d93992447c81", "value": "T15534E011B5D3C8B1C48304754871EBB46A7BBC3216B5499B37A03B7EAF702D25BB634A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666387468, "uuid": "0d27b92c-21c6-43c0-a1d4-5fc85a6e610a", "value": "bc5a05e947eb61731a4e3024a4f4b617", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666387468, "uuid": "fe596c2a-1dac-4f3a-ad72-f5ac661b0410", "value": "3072:PXSHGLGk4xeAPE5ljza06GBbGbSpTEREzxK6NMz4lbNlcqtVS:/wGLGkUeAPikbUE09Cz4lbNiWVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666387468, "uuid": "6c9d4cea-e7ff-416d-8162-20718502c11e", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666387468, "uuid": "7f5bfec4-2a71-4176-96b1-d8242ff135f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666387468, "uuid": "b4b64d9e-7f7a-4d6b-9ad1-cc6a20734fe5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2c7137-5184-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666386365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666386365, "uuid": "409bda38-0aa7-471f-9cbd-c58842b3d657", "comment": "Malware payload", "value": "656ed11fc5f4da29581dfbab4af12a4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666386365, "uuid": "ad86dfd5-8a2c-4b72-ae82-f23cf56e804f", "comment": "Malware payload", "value": "25e1622155caafa29e86a4533afd44ba1062b91eb58afa8b98835cd5be8f626a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666386365, "uuid": "137e926e-1515-4e4f-a013-9da6b3d44d91", "comment": "Malware payload", "value": "0df5032b66a60d3c16d561df2bfe262dc7ed9223", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666386365, "uuid": "b713dbae-5c92-4541-b829-4b1571a89d4b", "comment": "Malware payload", "value": "d4f009d1f0f475be664847779f85c7f3a230f66b4641b138805dcc5ea99daabb4c3d2ceca9b35843f04d4b51a2f52984", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666386365, "uuid": "d810529f-a35d-4230-badd-982b0244799b", "value": "T19F34D011BAC3F872C88347704460DAB076BBB83215F5494BB7943BAEAF702D12B76365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666386365, "uuid": "d57d6f57-bc58-4db7-a76e-b0d41a02ecea", "value": "bc5a05e947eb61731a4e3024a4f4b617", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666386365, "uuid": "edcd7e07-bbc6-4871-9f2c-f14300687da7", "value": "3072:bXeulLdCmJAyE5In/d4sVpJB8DGtpLW3UcLZPManO95rmpWR7YVtu+S:z5lLdVJAyddP9OGTi3flEanOT1RuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666386365, "uuid": "c50ec09f-7ee5-444c-a367-cb55499e4f44", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666386365, "uuid": "30ead892-5fff-4935-8f10-efaf77413b05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666386365, "uuid": "e9a7f3f7-909b-44e2-a21a-915b9854b8f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d825a730-5117-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1666339837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339837, "uuid": "de36b122-5f6b-4836-858c-c16b743993e4", "comment": "Malware payload (DCRat)", "value": "1b0a96844050e7891fad3c8e08a82457", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339837, "uuid": "dafb997a-9487-421b-b59a-401d70c88104", "comment": "Malware payload (DCRat)", "value": "265b49bf29634b82819ace4a83486e8fc2550df3370ad017d02ae5561dd63540", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339837, "uuid": "1f814700-3bdc-411f-a4a7-f61c03134aaf", "comment": "Malware payload (DCRat)", "value": "61ee9fe0af8f80d574b72eb2022626bf3dd62c5e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339837, "uuid": "6b3fb2fb-a5bd-4447-aacb-a1d96f8916e6", "comment": "Malware payload (DCRat)", "value": "38afa3d457f19b4cbe25a1d90c8b79f6980f4153b579c8a47b20c21ba44e2656ea57729655e0a25eff4f7c687c659196", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339837, "uuid": "bde39242-70d6-4d89-9da0-3f43da8ca61a", "value": "T141B5CE027E44CA12F00856B3C2FF454847B4E9516BA6E32B7DBA73AD55123A77C0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339837, "uuid": "eb9d00f2-23b7-4207-9e07-ad9075f99913", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339837, "uuid": "7c1b0583-a435-416a-8c12-7920e51a6c91", "value": "49152:TG+SAKF66S229mMMSvAPZmTLlj+VS9E5Sj4vDrfzCQ1O:C+Osm1Zq5+AqSIrfOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666339837, "uuid": "1c69dc05-8c73-4667-8f50-4938be882cbe", "value": 2472960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666339837, "uuid": "c30074fb-74eb-4e38-be5a-6273fd80fa10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339837, "uuid": "6a2b1340-2245-43ad-a2e0-c618f448b181", "value": "265B49BF29634B82819ACE4A83486E8FC2550DF3370AD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ad985a-5121-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343866, "uuid": "01f1b4cd-7f49-45e1-8e1b-5c58b9304071", "comment": "Malware payload", "value": "c4951ce5e946596e0356979341e6f240", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343866, "uuid": "d7444564-4ca8-4532-a99c-6d5755f29637", "comment": "Malware payload", "value": "290d70472f4b00a1cf01f5c1311aacffaa39057bb1c826c99419999ccef7ae53", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343866, "uuid": "2f503d8e-59fa-4fe4-89a2-f71b8ec84e75", "comment": "Malware payload", "value": "530e602b959009f80b5161aeb0eaec7c75dfd826", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343866, "uuid": "70148fd0-9232-4df8-bd06-c06a9920ec34", "comment": "Malware payload", "value": "2a339a254df8ca66b935f4e36d67376dbd29845da031956e068e43b9b275e6b40c4bc48614acb184b388528efb32b6c9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343866, "uuid": "5ac0ec50-eca3-4d01-ac2f-b6e40f694f59", "value": "T13A85E1D3E799F86AE4B7CA37C7318752A5A58C584716DBA30A0BF13C4AB7DC08349D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343866, "uuid": "321e9f57-4563-4bf6-81f0-25c7a3c83215", "value": "24576:Y/sKffJ6jKuJjE62OdFTeLNFVMV40UfVkaVBRm1LMX9xfZvYQaFe:FKffJmKojE6DwNFC4PdkKmGXdae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343866, "uuid": "19474ea3-ed54-4bd0-a491-72991423d484", "value": 1817813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343866, "uuid": "2b3eb2ff-b36c-4856-b048-f2ee0832feee", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343866, "uuid": "ee43c164-2fb4-4d94-bb75-0e9606bf4136", "value": "290d70472f4b00a1cf01f5c1311aacffaa39057bb1c826c99419999ccef7ae53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddefcfc0-519b-11ed-9266-42010a9c0072", "comment": "Malware payload (njrat)", "timestamp": 1666396540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666396540, "uuid": "aa391181-daaa-41a3-803f-df1f347cb0b0", "comment": "Malware payload (njrat)", "value": "19e666141753e2fbfe02e1dd9a240978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666396540, "uuid": "68f98771-1a18-4ff9-93dc-46da2914a912", "comment": "Malware payload (njrat)", "value": "2a2bc38f6672085aaf92b341052c7b9452d5f645bc0b25e3a5caf941753dc3ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666396540, "uuid": "b1eee7a9-557a-444c-b07a-cc17e77713d9", "comment": "Malware payload (njrat)", "value": "836b4f01186e158a6274e240b589f3b7f7d62700", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666396540, "uuid": "96628d4e-587f-4483-a1a8-162f9a572dd5", "comment": "Malware payload (njrat)", "value": "18cd0d79fa1239a018b352f852b9180e3c7ee0c7b98e1e631d1bf5d54c8d91fad4ac1b9f168f91d55c3994d41de1ec83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666396540, "uuid": "7d9bb02f-2b27-4137-94d3-67a1f11d1631", "value": "T1EBE31C6352459B49C418D7FCA09B0260B3F74312DFBDCDACAD9D29C09EF6E029199AC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666396540, "uuid": "52afeef6-f3f1-4fe9-b6ff-a9a13607b86b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666396540, "uuid": "f08ea25b-fc47-4fab-8399-d6782f9edde3", "value": "3072:uIC5xprvp8baRYX2NCancRu7AlSfREPCNIj2BMshq3QiBDfgFUo7BKJ4vwY9Am:grV2BDfgFUkBKqb9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666396540, "uuid": "05d7b245-7ebc-403b-8952-046ca2802dc4", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666396540, "uuid": "2d5295f8-9424-4684-babc-9918cc0b6e4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666396540, "uuid": "674cad3e-36b9-4ea5-8872-11661fa9ca9d", "value": "19e666141753e2fbfe02e1dd9a240978.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b544da4-5109-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1666333534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333534, "uuid": "56a76ddb-ef11-421e-bd8b-7f218d30e00f", "comment": "Malware payload (AsyncRAT)", "value": "8b87d2daee425e6dea0290289fe1314b", "object_relation": "md5", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333534, "uuid": "13164045-8803-4b9c-bbf2-f6004258eb7c", "comment": "Malware payload (AsyncRAT)", "value": "2b095c5dba429ff30bca95b983ce7ebbadbae5f8d47b5c2ae99f8887c4e2539a", "object_relation": "sha256", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333534, "uuid": "be7ed89d-3b6d-4e55-bc93-9f911e0b0a0d", "comment": "Malware payload (AsyncRAT)", "value": "01483a331bc621311116166c7795f81a82669d56", "object_relation": "sha1", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333534, "uuid": "dddcf527-c2cb-4401-b883-ad962b4f5af7", "comment": "Malware payload (AsyncRAT)", "value": "1aa317d3b9652f3ea24a224467fab6f296baf6abe9d3af8ee6fe96922ae2ba8da07e7652bf83f9eda7610a29de30e66f", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333534, "uuid": "e858aa25-ded5-4e22-b6a6-74a23abf574b", "value": "T14986330272C86CB5D41329B35C3ED6106579BA5D0628CA0F77A2AE1E94F23C1753BF9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333534, "uuid": "8579e976-1b06-44ec-83ab-e6381df69175", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333534, "uuid": "7215a706-3d70-47aa-b1e9-e385f5f6f818", "value": "196608:fzp7R3mTU5gSCQcOGrDWsIFP/2bEOPpSwjtw2OT+:fz3mUCQcXIZGSwjS2u+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666333534, "uuid": "15139f15-61b6-4853-bc95-a92b8a8b6ff9", "value": 8415437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666333534, "uuid": "5b74cefb-b566-4fd2-bab5-8b66d3a88464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333534, "uuid": "921a33bb-3136-4535-9fb1-f8b9fa38c7e4", "value": "Video Sample.mp4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2404a9-5157-11ed-9266-42010a9c0072", "comment": "Malware payload (NanoCore)", "timestamp": 1666367141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666367141, "uuid": "86eb71a5-c13f-4ea5-944e-8bfef6549215", "comment": "Malware payload (NanoCore)", "value": "4efc94d8768163a6e25a53e7d002e962", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666367141, "uuid": "c794edae-5e19-4a05-acce-978c2500d68a", "comment": "Malware payload (NanoCore)", "value": "2bad850d4fc1355d5cbdef48a773968dfd53bae047865fe20b131bcf854eb833", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666367141, "uuid": "764f9397-e5ce-4640-bb40-33cf4d060e5b", "comment": "Malware payload (NanoCore)", "value": "35bbd174ee8a9dc8b269b3bcb2ef42f468af6e43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666367141, "uuid": "6fa6521a-a7fe-4ad3-8c16-f82aef524fce", "comment": "Malware payload (NanoCore)", "value": "7879ce85ad88cfb53e0615d22be59c0ed535b8bdf6003dc3580dde565106888f1b6597abdabb196f831a9ff35915fa85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666367141, "uuid": "cd37f241-2aad-4a49-ad85-4b38383c4369", "value": "T14B361242F3D28176E4BE167415B717368EB9AA115331DACB8BD02C499E727F09E3A343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666367141, "uuid": "001e8e73-0b0a-4c17-be01-fd5eb23b2bdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666367141, "uuid": "e866c134-6ce4-4d68-9472-e5e59f47cb86", "value": "98304:JAB7bQf3s64R9ybzUcwti78OqJ7TPBF3ZlHHgkWJ0P39qXSaDv:u7CzUcwti7TQlF3ZxxWJSUnDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666367141, "uuid": "b92ec4f8-81ac-4e37-a904-abf97173620b", "value": 4907520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666367141, "uuid": "742fb4a8-a490-4f3d-ba08-690c0bf3ab7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666367141, "uuid": "0ce602ca-b0d5-4b29-9630-7f2c8dd11bf0", "value": "2BAD850D4FC1355D5CBDEF48A773968DFD53BAE047865.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea93b8c0-5118-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666340297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340297, "uuid": "b20a8857-fc6f-4f6c-b454-96c775dc73d7", "comment": "Malware payload (AgentTesla)", "value": "e46743f44dba07e645f4fd968b451f01", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340297, "uuid": "6e068651-9c99-40ea-8be0-4c64f5aca51e", "comment": "Malware payload (AgentTesla)", "value": "2c41399013c260a744177bb98db08b2232b0969a7c759bda8036f3d8ab7cbaeb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340297, "uuid": "f6509ae3-0500-425a-9dce-2fd0683c7761", "comment": "Malware payload (AgentTesla)", "value": "bd359285307286ac2c5bcc29f7b36944aef90a47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340297, "uuid": "82864aaa-489a-4af8-9f13-c291697471a6", "comment": "Malware payload (AgentTesla)", "value": "c22cd4a9d456dc235b7d89f0d96a491d5d8ce7352c065537e68407a66f43c8d1cc1ec59a4059ac88a1899947ce538155", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340297, "uuid": "ce0a24d8-950c-466d-89b9-a49ecc4a6a34", "value": "T1A5A4CF14D2049ED6D212B238A5FCFF5D56008F69B26EAB48D571BD01B8727CF283AD8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340297, "uuid": "df95bc33-34f4-402a-8c37-c29d2d4ae3cf", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340297, "uuid": "bc746f7a-74d5-4691-9a02-1f78daa30a68", "value": "12288:wbwv6cxdTKD3PpFagWFTRYnpaAn3CfJYxHpnQ:wbwvlTClWFTRIpumxH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666340297, "uuid": "cb5be78b-14da-4e38-8e84-fc927628465a", "value": 488233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666340297, "uuid": "82e8abf1-1fd9-450c-95ee-e215fcf25e55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340297, "uuid": "9c6d5401-f42d-4c3d-a0a5-c3de31984686", "value": "shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038d2d46-5135-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666352365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352365, "uuid": "b3121604-6e9d-46e2-ae73-038050728bf8", "comment": "Malware payload (GCleaner)", "value": "b68e0e6e61eeaccca64b1c25cf9a177e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352365, "uuid": "56a8bfe9-f8ce-455c-8056-4b10ea7f2541", "comment": "Malware payload (GCleaner)", "value": "2d880883676a36d1fdd1ae7e1598c6f620707b4d48a05246fd6f22db1cc1d0c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352365, "uuid": "3e337716-3032-4853-8e0c-bd5b6786e827", "comment": "Malware payload (GCleaner)", "value": "50eb00957693640a16438e6896f95d74216780fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352365, "uuid": "6371cc44-0641-463c-8fc5-1eea9c8dc1b7", "comment": "Malware payload (GCleaner)", "value": "961ec55b478046fb9e43783cd6f34885bbdc614e64ec7bf4fda940ab80eb3ebb15358f5faf8e53f4230630f9ee4fb51e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352365, "uuid": "73a631cf-a7df-4ef0-8455-293cee9bdf3d", "value": "T15CB533336DEC8470D0B0DD365E1FC66A9FB17E91143DA86871EC246DAEB299DC0887C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352365, "uuid": "2e6abb32-e076-49fd-964b-c35792d52424", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352365, "uuid": "f23d64e5-bbc5-4614-8c78-a659f4b0757a", "value": "49152:Z2VHMuWYdu5qhfMcf4iGmX4dQweF5/mEIyN+Mh4MYtB44O2wYNvb5A5hq:MJM9Ydu5qhfff4ip4mwebqMh4PFwUvOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666352365, "uuid": "937804f5-2aa4-4005-b0a6-b28a43661912", "value": 2357721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666352365, "uuid": "34ba2bb4-164f-4c37-bda5-cb6c2cdfa4ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352365, "uuid": "d81eb756-0b64-40d0-94bd-8db2efdf807e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf10179-5194-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666393475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666393475, "uuid": "53468a17-de74-4ca1-81d5-48535fab453b", "comment": "Malware payload", "value": "39d05dff7ec36a9749477a0b4084266e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666393475, "uuid": "69b16098-f135-4e09-a265-dbc6e8677338", "comment": "Malware payload", "value": "2e0ce1e7dfc046666a60761cbb6aeaff9357134e1dbb3c7db64807594eca6d44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666393475, "uuid": "df1b41bc-dc02-4754-bb11-69949312323a", "comment": "Malware payload", "value": "6bc0a0f906aeb369c242e28f285f823bc6b77175", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666393475, "uuid": "3814507c-bc13-4658-a15c-0f52d6b1f60c", "comment": "Malware payload", "value": "1c020db148ae3a008c20d21265f8d8822b74e8a316722d95e8294c95a05f000a7d9d4d1c16cf99a26f3dc5c57f6e0383", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666393475, "uuid": "53db583e-57ef-421e-9383-86d68d02c4cd", "value": "T1AE34E111BA92C433C88314344830DFE069BFBC7255799A973B543BAE6FB02D25AB6347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666393475, "uuid": "593d3f14-c86d-42a1-af7e-9b2606866efd", "value": "b7130d64e41e1f3aeb19371c8fcd9d1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666393475, "uuid": "24fd48d5-099a-4507-b808-2fc069c8a9af", "value": "3072:/XmBn9LBaLvYOr5lWVJi1yjX7PzkGxk/jchwFaKM3Uh2KBgsUer0US:vm9LBUvYOrWVX/kR/C2jwi2Kisbr0US", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666393475, "uuid": "8699d5c1-4b79-473b-90af-152b377484de", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666393475, "uuid": "d239a05e-5982-477c-a168-de95b351390f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666393475, "uuid": "14c0c262-5edc-4aaa-a8d1-42d5ed19ce25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850b3c76-5134-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666352153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352153, "uuid": "df32a576-7d37-4865-af77-21e802402b80", "comment": "Malware payload (RedLineStealer)", "value": "6944eb5e4a29c34a5a873f6f6bac6681", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352153, "uuid": "0c04a7be-eefe-4aa8-ac35-ad8490abc232", "comment": "Malware payload (RedLineStealer)", "value": "2ebebd5699e266f7cca90f9df22d2eaa8314ec1279cae05c5c79c47e97d67206", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352153, "uuid": "92a01bf0-cd09-4c8b-91d4-3932d53493b2", "comment": "Malware payload (RedLineStealer)", "value": "4004ccfd256ceeedaadfd24feec607882e66e9eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352153, "uuid": "91c5c2ce-9403-4997-a5f1-43d73bd3aec5", "comment": "Malware payload (RedLineStealer)", "value": "2ac634b8ede388d391903d82d42ccf84d0a1b183ff56b7f5566709256ea80ce14b43581f2658157eab1dc0227b489918", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352153, "uuid": "7d0687bb-320d-42df-93ce-27692a43ecf1", "value": "T188640221B6E3E871C04685358811CB60BABF75322675896727931B7FAF703D19B3A34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352153, "uuid": "ade76428-738d-4bf9-bdfc-74316d0148ac", "value": "965326d499ea63bde30a73f94c3886cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352153, "uuid": "168a2c92-863a-48e9-986c-f127d3f0e31e", "value": "6144:wwWLzUXRnuOB2xF+TQ02Svx2HNBI11IpONKI/JSw0ziqL/BD:w9nUxcxCpvQHNe13siG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666352153, "uuid": "9f480a1b-0f42-4d1d-8bf8-2240aa45230b", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666352153, "uuid": "3130f6fb-969b-49b8-bf90-76545124ae0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352153, "uuid": "3472017d-a5a4-4995-87a9-606586012a55", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c20dc0-5193-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666392741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666392741, "uuid": "84ddef78-124b-4227-b638-48d3e0f80fb3", "comment": "Malware payload", "value": "9637c7c2db3e7871cf9632768cbb909c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666392741, "uuid": "adb06c18-da9d-4716-90f1-9a34a018e481", "comment": "Malware payload", "value": "2fd4e12ca05b5c792920ebfc3d54526ff279f70a64408c536ec0299fe1025613", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666392741, "uuid": "aaf5f3ba-d80a-40d5-9959-d9c8cde95abe", "comment": "Malware payload", "value": "9fe6ca71c964e35fc238d198f34fc31714d78ef6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666392741, "uuid": "738712ab-4ad0-4931-b137-a00bed3bdc91", "comment": "Malware payload", "value": "7fe81bdf81caa2b9837d0c5636e1102939ca0b75a58454ee029756d3512036df421865ff78eaa038a2b574e4e68299d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666392741, "uuid": "e8d127da-2e1c-4fa9-80a0-3e376daf3075", "value": "T1E9740151F592C4B2C68294304460EBA519BBF87224754A877F683FEE6F702C35AB770B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666392741, "uuid": "3383e8c3-562a-40f3-b87f-1685587a43d3", "value": "b7130d64e41e1f3aeb19371c8fcd9d1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666392741, "uuid": "5ed22820-354d-486b-ab4b-cae6c5698eba", "value": "6144:k0XLgCe0YB9JjK3AJVMy1qy3vPzaKkIUDysGVnvQkXcCmBWAcleS:k0X8CkBa6T1vaKdiysGVnvlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666392741, "uuid": "8b6c1371-5a46-4ee3-a66b-732003cae23c", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666392741, "uuid": "4ef058e4-8b60-43ad-a14e-612e85327325", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666392741, "uuid": "9d7503bf-6aa5-4fe2-b493-35c9645f5564", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e8ea4c-5150-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666364207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666364207, "uuid": "37cede2b-04bc-47ac-9286-5e94af21ac7c", "comment": "Malware payload (CoinMiner)", "value": "6f1fca7b2fcf1c532da2ecbfa8f9b9de", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666364207, "uuid": "6f5e5972-c48e-41eb-84d8-3693d3e998c1", "comment": "Malware payload (CoinMiner)", "value": "32a7a824ab47b46b9127b1ad2528761e4550cbdbcd288f73c115fb14b3b63736", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666364207, "uuid": "ea178bbe-fc37-421b-be34-492b69784ad4", "comment": "Malware payload (CoinMiner)", "value": "871b7ddc07751a0295692f9298ab9b56c4ef1bca", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666364207, "uuid": "8e041ad8-bc8b-4f09-b293-1a5d68b20e7b", "comment": "Malware payload (CoinMiner)", "value": "eb13e8b7d9af63750341c75193051d16e904424f696fb5567460bd4a904237a1a5d849b8d324d0f890afbbff55ba1913", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666364207, "uuid": "5154a0d5-296a-4642-9b68-30ff0d945e67", "value": "T1CE34E011B9D3C832C89249354834F7E026BBBC325576499B37543B6E6E703D2ABB6327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666364207, "uuid": "84ea4790-8e76-4e14-9b4d-7d34a90dc0c3", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666364207, "uuid": "de270412-ea77-4538-a44e-fefb049fa61f", "value": "3072:kXSvdLEPcoHQNO56dPA0q0hTTd8oNro2tEJz2rMw+h99kOKTz5DcP:gUdLY9HQN308N8UjEggphvktTzJcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666364207, "uuid": "f8f13de2-b404-4421-af55-0a032f7f6e23", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666364207, "uuid": "d15bfc93-abe1-4188-8195-32ae89dce247", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666364207, "uuid": "249941ed-63c3-4778-996c-82a0cda82e56", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c65f2d4-5115-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1666338636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338636, "uuid": "31486bd5-a206-4608-bbbd-672abe76f131", "comment": "Malware payload (Loki)", "value": "595c723f27f6f8ca4e45b20d193d8eb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338636, "uuid": "7282a7ab-8c2f-4d9f-a080-4c5e57ca60ec", "comment": "Malware payload (Loki)", "value": "33afc6737c360e6f5cb75e8bc630f14367730b0769231abc42aec3b174f7df24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338636, "uuid": "ef3d5695-fa5f-42f0-bbdd-c0c853b808f0", "comment": "Malware payload (Loki)", "value": "cf25389207211034b6dda5ccae150d0fd1045a7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338636, "uuid": "52f73b13-593d-4b9b-a8a6-28ba522c8761", "comment": "Malware payload (Loki)", "value": "83696d1056bb30b61c9fdc855b4af4001abe8d28124bdc8b82b41c1041dbd187d38cb6bec1e90f98039a3c32dfa6300b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338636, "uuid": "55c42900-6d4a-4904-8d13-9a1cdfc55a5b", "value": "T190F30260BAA0D167D5B203338D3ADBBE53AA992620754E0717803E9E3DF36D09A5F741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338636, "uuid": "4c6d7b35-a5de-4875-afb7-fb76fb646138", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338636, "uuid": "cbc8eebf-cdb8-4567-9738-90cab0c4fb05", "value": "3072:mbG7N2kDTHUpou/bmtkypafcg+kIw6P1icWHvIMK4OFAQbC108K5aYAh82iWno5f:mbE/HUbG8cg+H1oJPIMKxFLMNYAe29/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666338636, "uuid": "187b782d-1db3-43f1-ad3b-73ca601dd8e8", "value": 172557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666338636, "uuid": "a203522b-fca1-43d2-8206-6b2f95115e20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338636, "uuid": "40e4ecdb-1d8e-4caf-9639-17a1ad0f98e1", "value": "595c723f27f6f8ca4e45b20d193d8eb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c3848f-510e-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666335776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335776, "uuid": "080f370f-af0b-4509-b766-d3292ffad0a6", "comment": "Malware payload (AgentTesla)", "value": "0f968e081646d6795c3729962add511f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335776, "uuid": "4c8e19dc-2de5-4d97-9cb2-549710e01af9", "comment": "Malware payload (AgentTesla)", "value": "3484bbcd44fe881449a2db3c689a1c1e09ed199b0ca02db2792e943339c74883", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335776, "uuid": "13bcd554-8c17-4a80-a189-64ca438c1b33", "comment": "Malware payload (AgentTesla)", "value": "d3ecf0f5ff43a16c0e9b7e79d540575a4fbeb5b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335776, "uuid": "af6faba1-6892-4306-ad87-666508540920", "comment": "Malware payload (AgentTesla)", "value": "90ffda481341066e2499dbb74341f9383acaecb20533f0a8d57a5b8ed995fc2f53fdb2f0e8aa56fe406c5ff9e688e2a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335776, "uuid": "1b5c9d71-f469-49fe-b230-29ee55833f7f", "value": "T18FE41219879EAF6BCB6D0F7C80116A1D0771C61FE443E38D59D3BDDD0E92B818D02A9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335776, "uuid": "0a4bcffd-4d9c-4740-9921-908d0e0b14e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335776, "uuid": "1187b004-19b1-46a3-b8a0-22c0f969c458", "value": "12288:3JriLj3/kMgsppo6rX/pHo5Ft/+7vlmSBO3XbjLi3/pDB6:3JriPkQppXrX/QulZO3X+3/pDB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666335776, "uuid": "719444b7-66eb-4a19-bf6a-43453f0d09ab", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666335776, "uuid": "608796e4-a5a3-4bc2-94a9-4fccf7100e13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335776, "uuid": "de569012-76df-47fd-98e4-e542d125007e", "value": "Payment Remittance_MT103_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ea2fea-5140-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666357196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666357196, "uuid": "df761207-eae5-45b2-a3c5-04fe56666409", "comment": "Malware payload (RedLineStealer)", "value": "7f7856e4a3e90595db55663ace7d8c44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666357196, "uuid": "bc8ec753-0564-4ac9-8edf-df57a9159c67", "comment": "Malware payload (RedLineStealer)", "value": "35aa7869c19e4d0399fe01363b4e1785c2d94966170a8c6870621b2d656af1d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666357196, "uuid": "927eb879-2714-45c1-bbff-2ecdb99eb807", "comment": "Malware payload (RedLineStealer)", "value": "ff21381ecf4c680facfcc5b8f392a535efe01457", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666357196, "uuid": "fa770645-866f-468a-a55f-07e142bee966", "comment": "Malware payload (RedLineStealer)", "value": "8ccaaa926e5a4a60e4a00628ebcf43c85d4e134b66d3cfdb78ac6b0f2ba2c6f56224d4c328cd4510e6e82fca1ae12deb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666357196, "uuid": "8e47d462-75df-438a-8e10-51e06928fb75", "value": "T184C52B139A8B0D75DDD237B4A1CB633EA734ED30CA2A8B7FB608C53959532C56C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666357196, "uuid": "c835f482-bd52-45ac-93b3-125589892482", "value": "29677885c0fdc7680e2620d4335d1995", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666357196, "uuid": "35d1c113-9b1b-4415-b0bc-4dd8e412e067", "value": "24576:XEe2UBChqI6U3YZ2m7sSYCY1jmHoxMPpgSedqdzHx9EPAGLY/r6TYpxkzJDWLemm:XVChqI6MYZ2mWMEPqrAYpxkzJDWqnl3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666357196, "uuid": "80660096-109b-4bfd-a0e7-60637d18d01b", "value": 2732956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666357196, "uuid": "2a5f86db-2266-4de3-89ba-74826f1483ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666357196, "uuid": "d7a71b2f-dde2-4e62-81be-cebfbe06c820", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813e60e0-5160-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666371044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666371044, "uuid": "a31c354a-d7ae-41b9-ad52-feda884b8cb5", "comment": "Malware payload (CoinMiner)", "value": "83f2392a9f78ec5f3ee0ca9b948f415b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666371044, "uuid": "2e1e4490-5541-4b39-a8f0-4c5da0292feb", "comment": "Malware payload (CoinMiner)", "value": "36fcd70ecc70524dcc35192b0482973befe933dfd53fe1afbf8da24e42eb6288", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666371044, "uuid": "b82ffa88-2d69-49e9-b51a-758c1295df69", "comment": "Malware payload (CoinMiner)", "value": "56a90630d9872d9b53d829edaa3819563dc35699", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666371044, "uuid": "957c5c0b-f8ea-4ef6-a14f-ca34dfc8af24", "comment": "Malware payload (CoinMiner)", "value": "6c09f0c0544c91427f73790fbdc31914124ba934bb87436aa0c38ef29bebe13cd3e7615cfec657f7236c3eae565466f0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666371044, "uuid": "fed39a56-1d31-49ae-882b-25ef77186540", "value": "T19634D0117692C872CC9A45364870CBE01E7EAC3255744D8B77683FAEEE702E17A76347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666371044, "uuid": "14e5b508-f235-4add-9cc5-83c5cea483b3", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666371044, "uuid": "680030df-7637-4a72-90f7-1a319cc9c9fe", "value": "3072:MXOYALYjdSQ8JO5n6ph893aGOif/qd9KiueapNDC904Y:IPALY5SQ8J961qd9x0nsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666371044, "uuid": "e260b0d2-927c-42bb-8d0f-840f7a4e8de5", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666371044, "uuid": "516035e1-6680-46ca-9205-b98c6a5f7627", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666371044, "uuid": "a056927b-eff3-4a6b-9ef5-aab208bd3598", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42682cd-5142-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666358298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666358298, "uuid": "463cbff5-dcf4-450f-98ce-d48a29aa193c", "comment": "Malware payload (Smoke Loader)", "value": "bf42d175883b135e19856f1511bd7d57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666358298, "uuid": "d603e153-7bad-43d7-b3ca-611a9d7101f9", "comment": "Malware payload (Smoke Loader)", "value": "3797edf753b5105c88e3c9b65d1a74e8b66512ebe1bdf28bfeca43c4c772ae9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666358298, "uuid": "08169dfb-80d3-4bb8-8a45-90e8a62e398c", "comment": "Malware payload (Smoke Loader)", "value": "a75ac30f033752c0b4fcb3b386f9f2d3c195c3ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666358298, "uuid": "44e7221a-4f77-4fb0-a234-807e3c4141a7", "comment": "Malware payload (Smoke Loader)", "value": "f4836200a1897a8e58d9b8a08104dee2e8f589a85bae5dc20465057abb6b500590bdbae2735d41a38c96c0d7dfc7aedc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666358298, "uuid": "3155c9d0-2e39-4558-9e1a-78dc565b3875", "value": "T11214E11279CACB72C4C60430587CFB655A7EB83215718A5B3B643B6E9E702C25BB630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666358298, "uuid": "2b15280a-de63-4bcb-98fa-d5e107531206", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666358298, "uuid": "387dc118-1d7e-4994-8207-24cf9c8b5da7", "value": "3072:ZXmQbQohLMsbOQdaz5dt516cHpprMvPkDJ0uB:9DbQkLHbOQdajnTrM/uB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666358298, "uuid": "e2e4aae6-d5e4-4820-8ba8-5c89d2a4bf84", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666358298, "uuid": "afd96663-6ce3-4855-bc1d-dd8f070321aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666358298, "uuid": "f7cea0f5-8725-4228-8df1-b01c465a9175", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825efc50-5152-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666365033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365033, "uuid": "274b7dcf-d638-4e5a-9f06-22cbfb9bf186", "comment": "Malware payload", "value": "aa506968af783ad6fa4a2bd355ae6e1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365033, "uuid": "2dd56258-2536-43fe-be1f-d8a64072d2e6", "comment": "Malware payload", "value": "37eb53d5603f42cfcf2c47aa45fb7e6353e9a7f9480169a0966648859d492536", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365033, "uuid": "268e0e27-2602-470c-bedb-ef3aa953030c", "comment": "Malware payload", "value": "dd9e628c2f8a0c90f598390a61337e9e2c410556", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365033, "uuid": "1d5e6185-eb1d-4cce-bf48-139c4a67fed7", "comment": "Malware payload", "value": "ace6f677ac21943cf4f4104cdda623aada9eb003266100ed03f5d68c24771fd8d0d2f6d0ec80f0a21fe0b75cbc5623f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365033, "uuid": "bf243c6c-a6ef-4cfa-95b2-ed5e76b35630", "value": "T1498423DCEA5B561F27167E7C8E380A78A40916C54CEA1EE26FDE5A6034CD88F317058B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365033, "uuid": "ada10c31-c28c-4c12-b827-481143f2c672", "value": "6144:TGSkV5gPOA1cqhnKrEqa8QNxAIF2F0e9uOrbEzxyW55avKpjNePxg+Yps:hkV5qF1KrEqaIcXmuzwvKpAPxg+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666365033, "uuid": "b9c25671-54eb-4eb1-b016-c748848c4df7", "value": 393764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666365033, "uuid": "6bf817a9-38a3-4d89-b49b-554ebff2a384", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365033, "uuid": "01c9ddeb-2791-4d90-aed0-a4613fadc1e6", "value": "aa506968af783ad6fa4a2bd355ae6e1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbbfd1bd-5164-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666372887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666372887, "uuid": "10c0a3fe-8d49-4385-8bac-90185f606c6e", "comment": "Malware payload", "value": "f3427e5f016cafc0fb3e719937c2ed1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666372887, "uuid": "1a602ad3-2ef0-4783-b12e-a43ae4b9648b", "comment": "Malware payload", "value": "39df945a201a8891a98e8da9eca61390aea99e913a05451a1c98a5a934fa3346", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666372887, "uuid": "0219326e-5e08-4e57-8941-5586e1d129a7", "comment": "Malware payload", "value": "7dcdb5b1668ca62a98f28295b90525091bdd3707", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666372887, "uuid": "6cb06a42-20be-4b6a-8fa2-04397446ad89", "comment": "Malware payload", "value": "7010e72dc45fa713aa4eaac12fad196cb2afdde5aaa1344098fdcd69e9fac52514820f5625b9e0214e966044a24eea89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666372887, "uuid": "9bc92420-6fec-4634-99fb-4a35bad93e7e", "value": "T1AE740221F492C473D892863008B5EB9455BBFC7225A58A9F7B5837FE6E302C31936763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666372887, "uuid": "e203e1d9-aa5d-42b1-b99d-334f3c6490cb", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666372887, "uuid": "2c1aeb93-6aa1-439f-9e8f-5aed5e99bf9d", "value": "6144:6UiLqKbQ/SFPPtbTX0+o1xqSNA19GCEnDAkAIop/Qu:6UimK0/YP5T/SNA1SD9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666372887, "uuid": "bfd5975d-d682-4c6c-b7c2-03e98b77acea", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666372887, "uuid": "9b849c99-5ec4-4422-81e5-723a46029ffb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666372887, "uuid": "dd6bc09f-84a6-444c-a8d2-da6596fdd297", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47e01ad-5165-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666373278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373278, "uuid": "094fd0fc-5298-4385-9715-ff9059055478", "comment": "Malware payload (GCleaner)", "value": "b6addc530c2698543fd78298c21d6bb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373278, "uuid": "1ea1f848-15ae-4400-b902-79486ce52e0f", "comment": "Malware payload (GCleaner)", "value": "3beebd83ca607c2aef9487abe0b54c18dc7382307134d4e7924bbab15487de33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373278, "uuid": "14d0ad70-08e6-474f-bdad-1f84b2a9920b", "comment": "Malware payload (GCleaner)", "value": "69557410805f1015d53c477c235a73acbaf979e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373278, "uuid": "f8f65410-c20a-4ebf-834f-0c37c14848f5", "comment": "Malware payload (GCleaner)", "value": "b0ca155428c749476bee55143de89a6f113acc3421f5ca02828e2b476db5bb66370555f5b105397e8a4e239eb0e68a15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373278, "uuid": "ee723ab2-34e5-4a03-b178-134e2d5f8f12", "value": "T1F0B53364C776F172F470B4B29DB5910D82773F36192EE89CB50CD8E84D31B928A293A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373278, "uuid": "aaba83f2-5ce4-4d63-9a17-53a6860993b6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373278, "uuid": "a5de1ee8-a63a-43ba-b3d3-1b840bef545f", "value": "49152:Z2Wyj8TY8/YrO7S6pnytRuajZJ9M2uQe/wA5hq:Mhpq73n0RuUuNtDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666373278, "uuid": "625d3f9e-1e6e-448b-9031-4b4d83865796", "value": 2474624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666373278, "uuid": "bf6176fb-a743-4eb1-b03c-baf4e24abfe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373278, "uuid": "db3f9466-278f-4448-951d-af814b208725", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c57306-510e-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666335773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335773, "uuid": "79020638-3312-4c8c-b2d4-186837c32a6c", "comment": "Malware payload (AgentTesla)", "value": "cf08f8a4dd01949a56522a5671fd2af4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335773, "uuid": "3cd542d9-8a03-4ab0-ae39-356de8ffd7e5", "comment": "Malware payload (AgentTesla)", "value": "3c6e68b6ac37e83297be2aa9555684046a464cfaceb90ed6a575c7d31ec0cffa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335773, "uuid": "0b313dc5-e921-424a-92ff-7ef664676cf7", "comment": "Malware payload (AgentTesla)", "value": "351b0cfc54a548ee5d9b09ebc9c8b81d2fc95345", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335773, "uuid": "7899cbfe-a131-48a3-ac85-f823baddfb2c", "comment": "Malware payload (AgentTesla)", "value": "5dd173750b24fb12dd2ffa3899a01f1884f0ef84183887e83eb0a7d5288753d06232f4d0ea5b900f80401fcdb2104ba2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335773, "uuid": "397a6ce6-b9e4-40a1-9942-4982311329e0", "value": "T12FE4125D6D89540BCBDF867A92D921078B76C3B6B647EFC64644D4FC3B823F909022B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335773, "uuid": "60dd35a8-09db-4167-9336-50c22e73f317", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335773, "uuid": "54811e50-8844-41af-b1c1-92e0beb9fd5e", "value": "12288:WvCtpRhYfbIJsV7KgmcHD0E9Zo/pExD06nsF6fVJdbE4AVGIF3S:3RhwbIJOux/ugp8VJdj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666335773, "uuid": "d8d77d1a-47fd-49e9-9938-b96bc2403a35", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666335773, "uuid": "7c8bb829-85d0-47df-b1f2-c998c4080770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335773, "uuid": "3677f648-fa79-44ef-94b3-8549849802bc", "value": "Offer_CTJV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e700eb-50db-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666314086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666314086, "uuid": "db3cf2c6-601e-4973-9cc9-487587cfc952", "comment": "Malware payload (Smoke Loader)", "value": "378aa9513d43ab0502ff20063fbf4adf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666314086, "uuid": "5c929177-4b77-49fb-bc96-e0062a37dc1c", "comment": "Malware payload (Smoke Loader)", "value": "3cbcc012cbbef46174c926b269a38e157bcbb02da83ef2fb4478d4d6e821c673", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666314086, "uuid": "9ecafaed-3691-48d1-9b47-919859a3d64a", "comment": "Malware payload (Smoke Loader)", "value": "d3b06d16b1c1bccdc0489f8014893cf33e028729", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666314086, "uuid": "5241c53a-d49e-4a7d-a8fa-72ad1c83aba3", "comment": "Malware payload (Smoke Loader)", "value": "ac9c8c691d42d893dbeefed54131049d4fb9e093235f8a206c51889ae67922254a25ad31a049fb1f4fcc634618ff0135", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666314086, "uuid": "377b0a30-5635-44fe-b72b-22fd983eae7f", "value": "T19414D010BA93C7B2C48B54304429CFA1667FB6312AA50A4737673BBE1F313D1677A386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666314086, "uuid": "3a26b7ed-f031-47d3-bf81-353ef890737b", "value": "ee783376aeb5a6ccd1e2676f1a5f0e82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666314086, "uuid": "236a080c-0ba1-4951-9095-38f99cb52329", "value": "3072:4XONILLxZOC5WZDEk5Ml/rx0yGhS0KtW7xN0K4LOl:MoIL9g5pyl107hS0MW7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666314086, "uuid": "99b03cd7-dbbd-452c-93f0-a247459f93de", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666314086, "uuid": "303c633d-6c45-41ed-bfaa-68babd06a552", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666314086, "uuid": "0c90f8d7-b4f2-4750-acaa-2a2d01672f98", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7bce1e-5120-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343607, "uuid": "43d4947a-9261-480a-b535-7d2295a8dffd", "comment": "Malware payload", "value": "25a65cbfc9d34f5367acb5ea2a32e3ef", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343607, "uuid": "3535fbeb-bed7-475a-9779-83971149e45e", "comment": "Malware payload", "value": "3d41830f943c31f69eb6ed7804cc18b289ba2172d258bd118a8503d120318d63", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343607, "uuid": "1b25d438-f51b-4aa8-8f6f-94736ba369df", "comment": "Malware payload", "value": "4bbea845641b884f5e07005881caa3a157f3ce55", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343607, "uuid": "bef2d22e-bd4a-4224-bc5f-692de6e51d86", "comment": "Malware payload", "value": "3fbf95c36017393ceca7cadaec150d0b3f82671321c7bf6cdb3a03da7dc251883c9654a80b6940afbb063d85f8fa48db", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343607, "uuid": "84c93751-ac5f-4a9a-971d-e3e9b5018793", "value": "T177A522F27FACE990C0275C3592065862FA2243055506E23ED9B1A1AC3D37E345BCBDFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343607, "uuid": "23ebcd72-525e-43de-a669-159b5a472718", "value": "49152:zlw/wLY5/z22cSTiduk0i3dhQBtELjmNh1Lko:zlwIckGTUuk0i3dhQfELypLko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343607, "uuid": "89cd224a-6afa-4583-a65a-52ad585087a7", "value": 2152830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343607, "uuid": "1cda5369-887d-4391-ab0e-a12203b6405e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343607, "uuid": "1249326a-ad57-4801-8734-1586553f84ee", "value": "3d41830f943c31f69eb6ed7804cc18b289ba2172d258bd118a8503d120318d63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb437ea-5167-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666374073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666374073, "uuid": "4d5bc177-03f8-4e3e-8c4c-c216d1e2f6d9", "comment": "Malware payload (Mirai)", "value": "9c937557f1dc69edb1dbd931911b5743", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666374073, "uuid": "7d90966a-71b6-42d0-9bbf-7e04c9270e81", "comment": "Malware payload (Mirai)", "value": "3e07e0a8a6224e587c7cbe7361a1aea9e2d3d09c3022428af1f2d7ccbfed891e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666374073, "uuid": "f59293ce-9453-402c-945f-58d3dd61349d", "comment": "Malware payload (Mirai)", "value": "41f97491cdcc9ef0ba1bb54e28ef808214355b85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666374073, "uuid": "842aec7a-a87c-4f1e-b28d-b2c062e18cca", "comment": "Malware payload (Mirai)", "value": "5041cc05d6a6fc08d37faa304c7f08e15d988971d800a868ed55e3954f33e22ac5aa7e781ba0fd50e0ecaa5786d16d3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666374073, "uuid": "54fcefb7-249b-4ef1-ac61-fa9ea5fef364", "value": "T11464F1CBEA01BC7AF9DA47757A6B0B09B3F0DAC5D3C3B140A264C5443CBD685AB645C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666374073, "uuid": "e9a36aea-5a93-448b-bb9a-808a20c2fe8e", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6copPa5POdOQ33Q:7O/QJHZweEL/NOjCHm7FZZncpPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666374073, "uuid": "fcf203f3-ec86-43b2-b520-6506687a5e89", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666374073, "uuid": "2d1ce597-980d-432a-9b0c-c9f646b6d3f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666374073, "uuid": "a641c43f-27c1-43ed-9d90-9971430a0c2f", "value": "9c937557f1dc69edb1dbd931911b5743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b2efb1-5127-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666346563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666346563, "uuid": "52cb4fc1-dc00-44aa-adb8-72143d544a23", "comment": "Malware payload", "value": "00a5ab98294114091820a92d3bd45229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666346563, "uuid": "bc72a354-ad1b-4782-887c-a6d3263edd34", "comment": "Malware payload", "value": "3efd4f4f200eca54b5682fad22abfb2af9301f4f051cf36a4df51810209d88a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666346563, "uuid": "cf848ca9-206f-4208-80e4-36fe3aeb1499", "comment": "Malware payload", "value": "c777f363fc8936bec0233f5ece0277343b075851", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666346563, "uuid": "5b7a7e7f-a9a8-46eb-b84a-9f12a91beb76", "comment": "Malware payload", "value": "9ff7bc248f2b909d5ae8fa095c01cdcb65902d7fdc79b03f2c29ee0c36cd16405e406d1e2e1450e73202a786c418cc4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666346563, "uuid": "6ebfaf8e-032a-4601-b5a9-db5b57278cf5", "value": "T1FA76331F39C34974C3A268B98E772BE4F3EDE1A40B25CD074749069E5EBE054E3606E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666346563, "uuid": "32f8a8dd-b97e-4a52-8205-ca3e8efb9993", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666346563, "uuid": "adb6f1ef-794e-45f2-8a8d-041ad405a02d", "value": "196608:91OYXRIUE5sh8kZpQOJoe8XFiJ71iN7QYud2ZUycbZ:3OYXRIUz8vOJobM7MCntbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666346563, "uuid": "d33e6833-dc7f-4738-bcf1-f9e3a34cb1b0", "value": 7594094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666346563, "uuid": "79cb481c-28af-4200-966b-e119556af3c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666346563, "uuid": "08f99f90-e629-4942-9a90-a4331740f353", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462692b5-514f-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666363643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666363643, "uuid": "2af8eab2-49bc-4fe8-9964-57330a7f92fd", "comment": "Malware payload (Smoke Loader)", "value": "36a1313ce44c85b297d9aa08d89f098c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666363643, "uuid": "f331eec4-579b-4923-bc8a-667b1800e931", "comment": "Malware payload (Smoke Loader)", "value": "3f5c63a179583b6e02a53182ec0dae3913f3d265f65cc261c54330a8567a3770", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666363643, "uuid": "b0092b4e-acc3-4a8f-84e8-c1607c0e648e", "comment": "Malware payload (Smoke Loader)", "value": "034defcaca8d85c34e801610b5a5bb07c627b654", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666363643, "uuid": "b5632c96-c2ed-49e0-895a-1a96904740bb", "comment": "Malware payload (Smoke Loader)", "value": "917175e29cda6fe43c2826d19bcf38ab323c886d770332292412893cc66d61e2d09ebf655dd3a2ec15e4a39b6ebfb25b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666363643, "uuid": "58701d8d-a31c-4d5e-940e-4734403f37a4", "value": "T15824E001BA92D872C84228740834DBA016BFF83255759E977BB43B6F6F702D266B6346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666363643, "uuid": "9f3481b7-0a66-4bd6-a8c8-f690f1433a57", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666363643, "uuid": "f3a1714e-4150-40c0-936d-0ec9f95b0889", "value": "3072:NXSAhLd4sVQBO57z1w/figZRjWYkr2ZkfNuyJkyigkln:JfhLdJVQBi1uigZRjWwcU/yhen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666363643, "uuid": "6ff9d45e-5f41-4ab5-870b-fc65d971f0c6", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666363643, "uuid": "0cca8499-66ae-4a29-857f-1fe205fef467", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666363643, "uuid": "9524574d-d1a8-4711-bfd8-7c6f91e4b970", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad12cb72-5146-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1666359951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666359951, "uuid": "3ded5571-eea5-4b61-abe6-bcef7528c588", "comment": "Malware payload (Stop)", "value": "96aab3305d909772783a15430cb92a4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666359951, "uuid": "803a662a-d9d1-4b92-8c9b-70977d9825f5", "comment": "Malware payload (Stop)", "value": "410fa5a0e70666b338ed43ed60663cdf06f2942e67ce12c108f6a4de78d1ede7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666359951, "uuid": "d3f26ffb-8c73-4a62-9356-dc4de427fcc0", "comment": "Malware payload (Stop)", "value": "282bd8a54fe2a803eaea6ac18470f3b6ca099d91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666359951, "uuid": "28bec9c3-9c3e-424a-a76e-b7e3483e89b0", "comment": "Malware payload (Stop)", "value": "c1d8ac25f3df039f4e93c1da05150e26165fd965a1b820cfcafe78736b7a4f47e39f4781470f29c05d188785b6311244", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666359951, "uuid": "e850cd5d-cdd9-4b82-bb73-40ba83cc9050", "value": "T152E422123AD2C871C98200363879CAE5FB7BB8B1057157137B647BAD6FB02D15FBA249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666359951, "uuid": "07b3b3f0-c8f0-458b-a760-27c6a723383a", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666359951, "uuid": "71df1364-e96c-42f4-ba36-97900c6ef23d", "value": "12288:v+g5eRPR+65txs9WupHZJeZS45DtoqopkC/Y0uGpfW5VLqaWSL6aWqdkz/GY:v+fRFLcWAHSZS45IKLMY5oSWaWqIeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666359951, "uuid": "6e439591-42e3-41e5-82ab-9d03818ab69b", "value": 715264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666359951, "uuid": "fb04695e-0d3f-4d00-bcec-640972f2422f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666359951, "uuid": "12bca665-b18d-42a4-be68-396410ddf8e4", "value": "96aab3305d909772783a15430cb92a4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdd1c05-5135-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666352385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352385, "uuid": "c9a66879-dfb3-4281-aa9a-34568dfb8734", "comment": "Malware payload", "value": "7a191a3d5704b046591c2d4147e66631", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352385, "uuid": "650fbaee-6a3a-4b99-9ea9-9ed4d1384516", "comment": "Malware payload", "value": "427fd4eb496b6ab1eab875898ac842864625e24f8502ee1162ef7887640aa159", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352385, "uuid": "d9164a3b-e40a-4804-bd1e-a362e8f34fa1", "comment": "Malware payload", "value": "454c794cbf1bebf5802a78809148f4b8095ef964", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352385, "uuid": "22da13aa-6ab4-4985-83b6-fdcf41ff5980", "comment": "Malware payload", "value": "dbe9b5338ebea93d921af0f5bf948aa9a54c1b7cb8ca99d0c91e5d0013779280a2ac507a740327af1a4a462fd2e25eab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352385, "uuid": "e9434c9a-981b-460a-8938-a685e94db0bc", "value": "T1F97633A13DA081FEE9858635AF188BD8913CF9F00F746497ABC485CE8D398C9E97553C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352385, "uuid": "2870a184-ab69-4488-bf31-0141c0179418", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352385, "uuid": "3aafae9c-0259-4536-ad65-151e8f2bf267", "value": "196608:91OBQ5kHCyqpgfuGvM0oYvtnhJkDt8nXVUYD0ceKk:3OBwkHCsk0Nv3JkDKnDD0/Kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666352385, "uuid": "ced6eb13-b1f0-4813-87c5-1379f4a38dfe", "value": 7634345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666352385, "uuid": "a502e67e-ff24-4a64-b0cf-fd7b11e3ea48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352385, "uuid": "2d153a1b-8051-4665-bffb-c85d3c3b0c4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0aa2ba4-5165-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666373271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373271, "uuid": "ef7e2d74-7e37-494e-8ac3-f7b5f10da47e", "comment": "Malware payload (Smoke Loader)", "value": "f835d1c1a14ca294fa224f1050410b6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373271, "uuid": "d8adbe3e-d482-42f2-9bc0-2a74ee8bcc28", "comment": "Malware payload (Smoke Loader)", "value": "42da013c9e55b9ec095a215c3ca3c296a66d1551697099d2d7182a40abc3b41a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373271, "uuid": "44ff13d4-39b8-4e38-a316-39567ff04a43", "comment": "Malware payload (Smoke Loader)", "value": "275bfa1bc8e69fc2d16b1b70f9b4d234efa5f1cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373271, "uuid": "6416c5c6-f8ba-4691-9fe6-6c948a92b53b", "comment": "Malware payload (Smoke Loader)", "value": "808b66712c2c8953b85fc049f9a83fc74d729c810b432a4fca533582db8dc83c7caa4a5972ef34665fc882fea6289fa0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373271, "uuid": "8e4473dd-021e-484a-90b4-4563698dea7f", "value": "T1B034E011B6C2D872C44245754834CBA1657AAC3219788C9B3FA43BAE6FF31D35AB6F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373271, "uuid": "b97624e3-f096-4943-a47c-700c3cc1efdb", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373271, "uuid": "a3216a6b-a613-4bb5-bbe3-ec8ccaf05449", "value": "3072:MXZRH6LgSmVQ3O5Th5xqfDppB2lNtDcVgJKjXEBxXEPUz+nt6h8+:ILaLgpVQ344DPBgNtDUhbAxJ6Mhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666373271, "uuid": "31d76323-81ad-4065-b571-bd46b7df3fa6", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666373271, "uuid": "bb6b5be3-726a-4ed4-ac75-76cf82a45929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373271, "uuid": "63e317f3-965c-4828-b82a-3a2ee901056c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d325038b-512c-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666348848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348848, "uuid": "2f0c9ec9-b1ae-43ba-9c9c-55b590a3c1f5", "comment": "Malware payload (RedLineStealer)", "value": "9a042c64499c2a87e900d62706747d79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348848, "uuid": "292a8a1a-41f9-4fbf-b76b-e545e6bf6988", "comment": "Malware payload (RedLineStealer)", "value": "431259109385ec63af8de3962a7439e71c9361c30051ac30febcda57114e201a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348848, "uuid": "12958c75-3a06-4b4e-b5c1-26db2612169a", "comment": "Malware payload (RedLineStealer)", "value": "31adf0d2db0347fa75dff3c449834581be3053d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348848, "uuid": "7c09840b-8260-4cfa-ba02-1d87317e12e9", "comment": "Malware payload (RedLineStealer)", "value": "6c913b4a90c1b439056acaefac68e39d0fc5257cf8a15a676ff9f672abdd7236e6300342e4c59487bc8a18f1c49d56ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348848, "uuid": "cda9956c-f7f5-4134-876f-40172ea45014", "value": "T1479405C573948017EC675A304EA383CA9729FCD1AE34719B2365F76E073B9E26E64B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348848, "uuid": "bdffcbf5-4c5a-4ab5-8da8-706c7256d33b", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348848, "uuid": "a410de98-cb90-42ef-9eaf-31652552ac70", "value": "1536:Wrae78zjORCDGwfdCSog01313rs5gl9cOh1CXt/cN45Hth/YVj60UJg/3Lx2R7LL:uahKyd2n31A5yz1CXqN29W2pLahMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666348848, "uuid": "9c21e8bc-9c44-4483-9c69-947644fe7154", "value": 432128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666348848, "uuid": "35f4330f-3573-48b7-80b6-ffab4cfc3848", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348848, "uuid": "1d00f46a-3bf5-4aa2-96a2-43792d01bf82", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9efb3363-5192-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666392569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666392569, "uuid": "1a15c836-e293-4cb2-8f15-c7856972e892", "comment": "Malware payload", "value": "5cff57938dd4f393924ce9ae57ac62e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666392569, "uuid": "90823959-068e-48e7-a1db-4f90688c6d00", "comment": "Malware payload", "value": "43e1fa4b3aad207f7fb5ff928d102aaf2e0636d03c9ba15831494d34fb9940fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666392569, "uuid": "f8789473-03d4-4f69-9503-5c2b62d62deb", "comment": "Malware payload", "value": "07fee9b195dab95a0201e9ebb64a0cf92135b52f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666392569, "uuid": "b28494da-a3d1-4bcc-a051-c2c8e10d363d", "comment": "Malware payload", "value": "73385d3b66c4efb71f8d3754b8a73f091ab6e329dfb2152c0518b843ba155436bac7cce1e6070855f52b59319035d1b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666392569, "uuid": "701f2fdb-f181-4515-98af-86b61c56bc2d", "value": "T1D034E122BAD2C471C88204744875CBF015BFACF21576498B7B643B6E6E732D15BFA34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666392569, "uuid": "f5de94b9-f039-4fc5-be8f-22377c2bbd24", "value": "b7130d64e41e1f3aeb19371c8fcd9d1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666392569, "uuid": "64febe71-39ab-4c72-8164-0b53a69eafab", "value": "3072:UXm2dt3LeabJYOr5FBOC5elPbHkitVkZNDr2NS6/NGHKS:QzdZLeQJYOFOHlPbHkitVkZdfKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666392569, "uuid": "bf647d5a-6dc8-458e-8d2e-ecf0af9fa80f", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666392569, "uuid": "ff8d86d2-aa89-4cce-ad7e-121dd5304fdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666392569, "uuid": "d408b0e7-15b6-49ca-a714-1f2514cdad76", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883911ee-5128-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666347004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347004, "uuid": "fdbafab6-aaf0-4689-8f9a-1a5c8203d31d", "comment": "Malware payload", "value": "b3fd3d932fa7af749f4a0eb52a8dd811", "object_relation": "md5", "Tag": [ { "name": "drivetools-xyz", "colour": "#C903D6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347004, "uuid": "ee3136b1-8263-49f0-ab81-b4459c0b75e6", "comment": "Malware payload", "value": "442c2b7b8e7ec13306bfb6c1332bd87e4d9cac242fd86555df355a606b895c46", "object_relation": "sha256", "Tag": [ { "name": "drivetools-xyz", "colour": "#C903D6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347004, "uuid": "065dd1a8-cb49-4dc6-ba40-a9d35a1b36d9", "comment": "Malware payload", "value": "bee6460d9a9b678b15f719dab2fd5bd5d1ee8c48", "object_relation": "sha1", "Tag": [ { "name": "drivetools-xyz", "colour": "#C903D6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347004, "uuid": "651fcbec-e7e4-4b62-b056-029d319d3bb7", "comment": "Malware payload", "value": "7270d1fa81af550794cf3666e426f8ee89caead6136820bca6df197104d43f7080b89aace4c1cd5b1a8d82bec5f27939", "object_relation": "sha3-384", "Tag": [ { "name": "drivetools-xyz", "colour": "#C903D6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347004, "uuid": "4b04c2ca-0b88-40ff-8052-9942fa635095", "value": "T154865B91F9DB44F5EB03087048ABA2BF63307D059B25CAC7EA507F6AF8776D20932159", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347004, "uuid": "626017a6-3ef7-4b93-9b5a-78e9a25e468c", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347004, "uuid": "87fa0686-4a9f-420a-ac9c-7f7a2257bb0c", "value": "98304:g0QP8ZLxCaQ1T6jzvJyRQjnUh2B8Hx67t9yMBq:g/PKL0AN2xUt9yMBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666347004, "uuid": "7ca56e7a-cbf8-4f8b-97d8-4635cef0e400", "value": 7936000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666347004, "uuid": "a4c2a9dc-5da5-4fe5-84ad-6244b452c596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347004, "uuid": "a063b1b3-992e-4740-ab4d-19c9f9080f93", "value": "442c2b7b8e7ec13306bfb6c1332bd87e4d9cac242fd86555df355a606b895c46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f219b1-514c-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666362625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666362625, "uuid": "a2003087-ca81-432f-8eb4-88e29e0d0525", "comment": "Malware payload (AgentTesla)", "value": "c8e55e4f73df2b003a9d93896be50edc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666362625, "uuid": "798ef307-31b2-4c36-91d3-eb4f71d0c1a5", "comment": "Malware payload (AgentTesla)", "value": "4617c1f129c70221b728325f9428433362851edf3237f4ddcd96eb5edcbc0f42", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666362625, "uuid": "cdf22c29-c350-4329-9267-39334fe02eae", "comment": "Malware payload (AgentTesla)", "value": "8801a140becd32ae91e2b5b43c1e127ed67c1f81", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666362625, "uuid": "ebbaaec8-4fbe-4171-883e-931e050343b3", "comment": "Malware payload (AgentTesla)", "value": "a3b839c371c71fcce81568b593e9685a495c880fbcce6e19b57bd983c1e8752b8de2b5281f496efe7c0a0b9a8c28674e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666362625, "uuid": "ba877482-76cb-4de9-8498-477b36835497", "value": "T12BD4EFBC63484E53FD2E807EC0B9805543F4D8BE1516F69E3FD3309A6AE979E1361886", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666362625, "uuid": "830dca93-47bb-4b21-aa37-4113467c8b4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666362625, "uuid": "e4f1bef8-9b10-48a8-991d-f17253386d91", "value": "12288:VmDF9zJvCCQo4EBM2vn9TUj7R7Oqm3pvP8C8qy7/ZiPgSIkQt+o:SFn9TS8l0Cfy7/Zi2kQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666362625, "uuid": "c21a9921-b53a-44a8-a743-03522c1444e9", "value": 635392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666362625, "uuid": "505751c0-fe9b-4820-9aaf-0b592c890a2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666362625, "uuid": "7e27af7f-f27f-4400-9e76-dd8fcaac8704", "value": "MT_103 swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ad487b-515a-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666368334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368334, "uuid": "b2a74414-7cab-413e-91f0-c90999a8c303", "comment": "Malware payload (RedLineStealer)", "value": "2bdd362bde047942eea50258d7dcdc12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368334, "uuid": "e9d62e24-22ef-4023-83d9-a5837f5117d3", "comment": "Malware payload (RedLineStealer)", "value": "47ac3d18dc7010640808ab90a5a83881593a6ab8a5bc178ff72f983e26c3476f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368334, "uuid": "64a7fde3-2816-4b39-8b8c-4844333afe36", "comment": "Malware payload (RedLineStealer)", "value": "387a0b559b2f8b5449cef770337a1c55d5bb3c3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368334, "uuid": "a886e0e0-85b3-4d2c-b4c6-9420e442b252", "comment": "Malware payload (RedLineStealer)", "value": "81e5092ebb7b5bf1cc822483e3158a60f180924c7d9334d21c972c444c59c39794f75776a96e0383a72b9e9bec28337f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368334, "uuid": "c02d94c0-dac0-48eb-a9d7-5b3f31f07bcd", "value": "T1BD34D012B292DB72C8B644764424DBF1167EF8332935898B77643B6E2F703D266B3217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368334, "uuid": "c868d4bd-545a-440f-a085-bc3cd17a74f1", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368334, "uuid": "547e220f-5624-4262-9839-1fccf177311b", "value": "3072:CXDE4LeFgaQOO5G9uPW8HdZIp45y5XlW91IUZRN9g8w2/:Cw4LeSaQOUPFHIpT5E1IIn9gc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666368334, "uuid": "6a415b80-86b0-4689-b6bd-d011eb311d6d", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666368334, "uuid": "5cffc45e-bd4c-4c2d-8925-9571ca3c8d9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368334, "uuid": "0202a9f9-7bb7-40f2-abfd-c0adaca3e082", "value": "2bdd362bde047942eea50258d7dcdc12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25149c20-5192-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666392364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666392364, "uuid": "b1a92ec8-07e7-4a44-bce0-e672d9afad7f", "comment": "Malware payload", "value": "856755cc1dd56b3b31176ca5b9e0f196", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666392364, "uuid": "ff04731d-69e3-4c96-a1d4-5a9d3563b310", "comment": "Malware payload", "value": "47b8efa5dc8cb24e977160e856e02670c3ce6e5077a3aa6de5a6c2d053e3f039", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666392364, "uuid": "7f0e276d-fdb0-4d13-9c9b-1c4ad6ca027a", "comment": "Malware payload", "value": "e61b06e849380e30c15809a1521743d90cdf8799", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666392364, "uuid": "a5c4762b-f9a5-4fb3-a576-f3ff17dc8f57", "comment": "Malware payload", "value": "8fdfc6816966e8c18c237b46216cc4097ff6ce74247007c132f895c9abfa82a0d3c51ebbe83f894b0f54c2c7e00c096b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666392364, "uuid": "caa4d725-a9a9-44ec-bbde-809f2e107eb0", "value": "T16DC53396DB9CCCB0C810AEB45C3FC960A7273EA23839E949F15C946F9D37541488EBD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666392364, "uuid": "f0df93d2-0b05-4971-bff8-beb85f81be7d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666392364, "uuid": "dd9cc7d5-eca0-406f-893b-a7df58e6390d", "value": "49152:Z2Ot1D05xdrBCa9ATpt0B7N/sr7RlxC83N6tR3yMLtcz1hAgP6VMcRyA5hq:MO3A5xdwaGINkr7rxCEN6iM5ihAgPSbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666392364, "uuid": "db5eab89-3e85-42f0-94b7-45566c151441", "value": 2544919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666392364, "uuid": "18243f69-d2e4-4251-b81c-03ad5e353ac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666392364, "uuid": "d6360eed-60e5-434d-b833-de23c367d3ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7245a241-516d-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666376602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376602, "uuid": "877f3d4c-662e-4831-8859-5dfc59cbe66d", "comment": "Malware payload (Mirai)", "value": "b11dc82e3c722d50db9beb00b54d4bd7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376602, "uuid": "dfc224f9-8ddf-4e9f-8daa-701734e53067", "comment": "Malware payload (Mirai)", "value": "481f8a6450c37b4de8076fbef757592419d48eac921284ffa42760f0c81669b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376602, "uuid": "92504fe9-3f71-4466-9ca3-c8530fb044ff", "comment": "Malware payload (Mirai)", "value": "1f4deca8edf441ce06c7c2493a2f06f8fb73fd24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376602, "uuid": "1d175220-8227-441f-acf9-91336ad8351e", "comment": "Malware payload (Mirai)", "value": "b70c075ae68da62276eab2e397f610780d68b25f6d33110c23ef5480aee997aabffed5ad4f1336d9a029a9542dba43e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376602, "uuid": "67381f2a-98f9-46a1-85cc-17e0bdce33a4", "value": "T169338E76C42EADD8C6458734B82A4A740FA3E10891E76EFA5B8586A54043FFCF61C3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376602, "uuid": "971c0b02-ee1b-4d5c-9cda-9f1bc411b93c", "value": "768:Er9Q6eGyC75erUUeOiwwtNp40Zdi/FyGoMuJLk3XCmlolN9aXCxe:EcdC753UlwtNEFyGoMD3X3qlGXCxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666376602, "uuid": "af9c887c-1ead-43de-abd6-a955316e62b3", "value": 51924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666376602, "uuid": "e8e36060-aacc-4a39-9b2f-ad50cd228dd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376602, "uuid": "99a0d3ac-3fc0-47ff-bfd2-592245a5b1b1", "value": "b11dc82e3c722d50db9beb00b54d4bd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa03da3-511f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343223, "uuid": "3f6f161c-6647-4fed-902a-3a31e6dc67f3", "comment": "Malware payload", "value": "f05d8588cf2e8be9fa6ccac39a0f7311", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343223, "uuid": "1567ef24-e93f-422a-a1a1-23ac83ba88bc", "comment": "Malware payload", "value": "48d642c2c77eeabff36249c59ce397a9ee5f3d825d735f839c5c05939499406e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343223, "uuid": "3f327a8f-9a82-4b34-adb7-3ab3c3ba33cf", "comment": "Malware payload", "value": "eddfb1947ce609cf33c1409f5977ea78ecaf0f32", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343223, "uuid": "bb0f1997-b5aa-44f9-a7bc-5c6714bfecaf", "comment": "Malware payload", "value": "ce2b5af074f5d5d913866d23123ff759647909d119676862b491066cc7c92f4a7c8acda623be5de022cbf7a5a8c3483c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343223, "uuid": "8870915c-101e-4642-ad52-2ab80be94413", "value": "T146D62354F6D0EE95E86ACD3A8227C64B45A0EE041502E2777B5CB26C3B7FCC45A0EED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343223, "uuid": "61fac092-d595-4b36-8d8e-98e52983cb58", "value": "393216:XBKZWCHmM+PCIgBBDGKPlO+mm3V3ffPn6npmai6eu+Tl9SwzWR2JCu1xrHbj:XBKZWCHmM+PCIgBlGKdO+mmxffPn6npi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343223, "uuid": "55045161-a278-479c-b35e-7455f80d8a2c", "value": 12664109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343223, "uuid": "bf38e6aa-4e87-4ebc-8d4c-6a5d8d9a7b0e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343223, "uuid": "7e8da8cd-fc55-4df0-b546-1351bd8a07a2", "value": "48d642c2c77eeabff36249c59ce397a9ee5f3d825d735f839c5c05939499406e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812ad03b-5183-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666386076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666386076, "uuid": "c71d232d-3dfb-43d2-a390-27b989ceabbb", "comment": "Malware payload", "value": "6ae2eb12e7cde4f4a68772e02006271c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666386076, "uuid": "4fb84e91-74e0-43d2-8d56-860f04672752", "comment": "Malware payload", "value": "4b891db57a899d19ffd793b3d50cc61b0e9eeb66da60842778ae0063acaac960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666386076, "uuid": "63c18908-80c9-40a2-92e6-4ed6ff34bdd7", "comment": "Malware payload", "value": "d8e62b764c612479f77d573e6b53c0e993a379dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666386076, "uuid": "88596f99-8fe6-4688-89fe-e029b871d2e4", "comment": "Malware payload", "value": "592b4300ad9d788889254f45330c8308209b40452016d9f331051f8664549b8d7abb9209646a5fc064380a4f08350ebb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666386076, "uuid": "66be51cf-1c07-45c0-8900-b16ad1e19fb9", "value": "T131C53351CB936C72F63189F55C6EEB6CE9A33F9928366E0476FD214B1F2A181710E350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666386076, "uuid": "ab48194d-35d8-482c-8013-f357ac162b37", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666386076, "uuid": "f032e369-0f6b-494e-ad78-979a86e152ec", "value": "49152:Z2TMUmvi5cxt/TMhfBJE29agoXD1Ix4o5ePsL6I1WmewaMdqUmdguA5hq:MgUmCcxrXT6C6ePsLF1OHUmdgNDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666386076, "uuid": "1812eaf1-6435-438b-bbbf-fbb2dc0f700d", "value": 2498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666386076, "uuid": "12f35950-8d2f-4bd8-b334-f2ef55f3240e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666386076, "uuid": "723137e7-5f7e-44e1-bb66-c5ace2a53501", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf0a1cf-516d-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666376484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376484, "uuid": "7b13d224-66a6-4af7-94ec-64d8205079af", "comment": "Malware payload (Mirai)", "value": "7b6baf5c9d08f87b70f4eede11c88434", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376484, "uuid": "7da81195-cb47-4c21-8117-30f1f6b5cfe3", "comment": "Malware payload (Mirai)", "value": "4bc7c4ad9abedac8bf14ad0461d350d9a7c482bd696745536923657de3c3db8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376484, "uuid": "d54aef31-1573-4492-85c2-4fb95a9687ec", "comment": "Malware payload (Mirai)", "value": "19d9b834d8d09acd50a10facf9cb5beb75a6c842", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376484, "uuid": "3a62a9e0-60a8-4efd-8888-63bfc42d041f", "comment": "Malware payload (Mirai)", "value": "bf0661287da3ae7407796e88e48d8d1cef92e402e0f359b23ec79937f419d1591d0b864e839b3ae242ff12d2406aa0dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376484, "uuid": "b2a6f8b1-71e5-4cf3-bc38-906ea7605faa", "value": "T116435D43321C0E47D1A25EB0253F17E093BFE95124F4B689265F9B5A8B36E3B1486F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376484, "uuid": "9b1edaf0-6dad-4a76-95de-014eb166d067", "value": "768:lgbf8RQzh1r3FgzRaN7+faVt7Ymuiygu1HoGczEpGVuz2GipH6TnSgGABh:ybUg1Jgzz4Cqu1Hisi6nSgG8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666376484, "uuid": "021936ab-be21-48ac-b365-734e19bd76e8", "value": 55472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666376484, "uuid": "91fefc7e-4ecd-4c67-b992-f0cd0f4e3a5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376484, "uuid": "124dadc5-1e7f-4cbb-baf3-929da2f43aa5", "value": "7b6baf5c9d08f87b70f4eede11c88434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b41cb5fb-50e4-11ed-9266-42010a9c0072", "comment": "Malware payload (TeamBot)", "timestamp": 1666317872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666317872, "uuid": "27e243a4-379a-448c-be48-319dcddd15c3", "comment": "Malware payload (TeamBot)", "value": "476635a30e84fa5142f3b0258807cdc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666317872, "uuid": "8fc05434-499d-49a1-ae77-d5fc319ee905", "comment": "Malware payload (TeamBot)", "value": "4e7e69b5d2eac0b3769fc98da8f94fa4943a5dee7eac4a080cde7812ca5714ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666317872, "uuid": "08468923-17f0-4e9d-b15c-e8ef93edb32f", "comment": "Malware payload (TeamBot)", "value": "48e256b43da8ae4a2dc4f788d1e8e60ba6a5efc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666317872, "uuid": "8e942ac7-080e-4b7a-8fbb-140616c6144e", "comment": "Malware payload (TeamBot)", "value": "d13913e146ab19618a9861ac007ea6d0c61514085213776de108ab45e00128059fcf6e6a8a5b6b98a3f52b545a40bf47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666317872, "uuid": "0b273d46-065b-48a6-a136-04d159358141", "value": "T1E714E1267682C8B1C40610748728DBBD6A7FA4F22A758B5737581B7E9F303D27776382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666317872, "uuid": "3d6ff7e1-8291-4892-8244-571bf0dcfbed", "value": "ee783376aeb5a6ccd1e2676f1a5f0e82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666317872, "uuid": "403be4c1-2cfb-48d6-837a-30b0f5f7ba89", "value": "3072:FXmqTLeWtkC5W8E3oiSX8LyVXlch1RJejk0KS1tPjF4:BbTL7Od3EX6yVVigk0t1tPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666317872, "uuid": "4464c29d-0bb3-4aaf-b5b8-7c6c0fd120ed", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666317872, "uuid": "8cd0b02d-b8eb-48f2-80fb-8afe74a3ddc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666317872, "uuid": "03cf20ce-0caf-4c22-9024-9bad120f6e44", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebdd9ae-5148-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1666360544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666360544, "uuid": "366940d5-4c58-4dfe-b7e9-beabfc891c66", "comment": "Malware payload (Stop)", "value": "37e50799ed1d80df649a4fc3ead18cd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666360544, "uuid": "501da949-4ec4-426e-b92b-484cf0e74eef", "comment": "Malware payload (Stop)", "value": "4e96392ca0e20290cc18877d6f0fdda7b62b8f85269d97f6a527813596491779", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666360544, "uuid": "0918c3fc-a946-4eee-a5a4-756db399de09", "comment": "Malware payload (Stop)", "value": "8ea20844fa6918a10ce900a0f1f8eb0927ab4e1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666360544, "uuid": "cf2c16c3-07e0-4dcc-a466-3400b0638d24", "comment": "Malware payload (Stop)", "value": "67b45bdf807c3eff568be7365d9e125c0a213a765a1878f615ce28d65a9f75d476f9e15fd1eba031b4ccf9a8a342ac22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666360544, "uuid": "544b02db-36e5-49ab-9b20-54deb3815176", "value": "T1D4E423107092CC72C48B08315871CAA926BF7D7A24BA5D9B73547B6F5F303D2AAB7709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666360544, "uuid": "55b7b066-ec62-454c-b9c9-007b3f6873ed", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666360544, "uuid": "4d363363-aca1-469c-bd98-9c3080cb1822", "value": "12288:rpR+QbdFpRjoXldz2ltA4WW+NmP9RdAZhp+KSmojUPOc5/Q79niOGeS:rptbdVDlCiUmP9RyZKK3CUHQRniOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666360544, "uuid": "64c870da-81f1-4454-a636-469dd4eff8ef", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666360544, "uuid": "20623d34-224e-4efe-8db7-828303fb91c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666360544, "uuid": "3037610b-691c-4484-bb14-74278d958d17", "value": "37e50799ed1d80df649a4fc3ead18cd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384c171e-5153-11ed-9266-42010a9c0072", "comment": "Malware payload (Arechclient2)", "timestamp": 1666365338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365338, "uuid": "bc9341b0-b29f-423a-9ca8-faaac13e0c4e", "comment": "Malware payload (Arechclient2)", "value": "0643c9b48a2fc4fd5ddbca7ee1fede60", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365338, "uuid": "c971bf7e-1cee-4fbb-b9f1-0dcd704c0ece", "comment": "Malware payload (Arechclient2)", "value": "4f7f83557bbf4e9eb1edac445033bc77543c1d3dbb4eb72b331bcf4ebbf11b79", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365338, "uuid": "0de92fde-626b-4b64-b7c5-1789581c48ed", "comment": "Malware payload (Arechclient2)", "value": "cecf04cb618c436114deb799899446aadeb296c4", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365338, "uuid": "0068123e-18ed-425e-805a-f249eb826c5f", "comment": "Malware payload (Arechclient2)", "value": "66ce3a700fcbd45c135ba2467f8d47297e56d1e1c908622f7c48111a77ab7369f95bc3818f0aa9ba636eea333047079d", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365338, "uuid": "bed99d56-e49e-45aa-884c-750cb58aaae2", "value": "T15B058D6C330F5932DED9733440FF5EBD52A662675289225A284CE8C01FE235DCB89ADD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365338, "uuid": "d70a4897-776d-482b-9186-1799b37628f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365338, "uuid": "2d47379b-3bf3-4316-8dc8-739e8fa3b981", "value": "12288:2XG1P4+m1RB7/ZvM9F7aZrBcNqBDevQcsmAAAA+0a:2H+mbB69OrWNkFGAAAA+0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666365338, "uuid": "c21fc72f-e118-476a-90de-36da091c2645", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666365338, "uuid": "517ee536-6b9b-4757-a769-5924c5cead80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365338, "uuid": "9bb65581-530d-456b-8c85-da110d08d048", "value": "4F7F83557BBF4E9EB1EDAC445033BC77543C1D3DBB4EB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b93769-5128-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666347000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347000, "uuid": "a2d443ab-8655-43c2-9ef1-104b997b3bc7", "comment": "Malware payload", "value": "dfc7ee57c86d0eac5b31ce30a763b745", "object_relation": "md5", "Tag": [ { "name": "drivetools-xyz", "colour": "#C903D6", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347000, "uuid": "19e901b1-a046-4a5c-85ff-583868ce743a", "comment": "Malware payload", "value": "500ae0f1ab40a254f81c73331c9848bada4c26adad613d53d339d14ca3599a32", "object_relation": "sha256", "Tag": [ { "name": "drivetools-xyz", "colour": "#C903D6", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347000, "uuid": "9a4e0493-af26-4e47-90b5-3d084f583638", "comment": "Malware payload", "value": "63a8b68ceab1bee92db181fd5a8c9c8f7797fa0d", "object_relation": "sha1", "Tag": [ { "name": "drivetools-xyz", "colour": "#C903D6", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347000, "uuid": "0328d084-2f8f-4402-8006-c113daaf3120", "comment": "Malware payload", "value": "fb149ac760c935eb8c7839448bdd0fde243c1e38c6a1d82d44bd2b68baab1dd2d31731b8501d0d079ba56379258ae309", "object_relation": "sha3-384", "Tag": [ { "name": "drivetools-xyz", "colour": "#C903D6", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347000, "uuid": "1fcef44f-59e4-489f-b6b3-585ca2659053", "value": "T10821ED182FD49B25C3730E3B002BD3018675B909CD01CF9E01A541D96829910FC74D6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347000, "uuid": "b3e1fd5b-744a-4f49-839f-427fa81d8464", "value": "24:8Zq0xjrtddcL8Al0Z2+/eJ+PLFwOPMNB8w/x8/nmc:85j7+iYchPExUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666347000, "uuid": "b4b1b35d-6330-4b64-8147-cec5e617cf3e", "value": 1115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666347000, "uuid": "3a4d3c5f-abcf-4494-a63e-ae5c68192071", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347000, "uuid": "b8d2f0f5-ea09-49c3-a57c-6aea34c7a279", "value": "500ae0f1ab40a254f81c73331c9848bada4c26adad613d53d339d14ca3599a32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b05132-5114-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666338197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338197, "uuid": "60bec6e3-1285-4cde-b297-066787407bb0", "comment": "Malware payload (Formbook)", "value": "4f62e76a76917d307ad36d8911d083a3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338197, "uuid": "b2991565-4968-443c-8b10-1f25b05d5d22", "comment": "Malware payload (Formbook)", "value": "50af107e222511f18c5abf1a2c5e3327b282148e5d76b086559fda85e3b01d04", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338197, "uuid": "57964155-43fb-4de6-a8ff-46907251b154", "comment": "Malware payload (Formbook)", "value": "3b09c1435f4779e2f80f632730c18fa3102bbd2f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338197, "uuid": "e63d28d5-bfdf-42b4-ac88-da782ef7ba08", "comment": "Malware payload (Formbook)", "value": "6f4176167a80b280d91b8908626019a6e7f92ffd5e4924e1b29e9a52bc0bdb7ec138952c1e9b8f622cc244a37a6ab7a2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338197, "uuid": "ec0d94e1-d25c-4683-9e52-de58fa7521b9", "value": "T1EA75332EB54EF0B64879596C7E68A952760F74EDB6E000189F12FC97B17348BA3C01DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338197, "uuid": "b6c58b29-3140-40dd-8639-b89264d7dacd", "value": "24576:NdxkY1XT5E3wrHn5eK6n9w26q+WbYpBUHeKPHddzq10YtUsqs481NS6SRRgjKX:NZRbzngHcxW0pBUH1Pd5UpVJ6RmeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666338197, "uuid": "12319020-3a43-44eb-bced-dccb683af812", "value": 1701007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666338197, "uuid": "2c73c0be-16d6-4476-a4ae-2827e378d9bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338197, "uuid": "79297b35-b96a-494e-86da-f3dc67e01cbd", "value": "RTK-0983456709.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524d4c44-5117-11ed-9266-42010a9c0072", "comment": "Malware payload (Vjw0rm)", "timestamp": 1666339612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339612, "uuid": "52f3089c-5041-4806-8487-8c6b06d77432", "comment": "Malware payload (Vjw0rm)", "value": "a663841150e75f704b3fbef187076901", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339612, "uuid": "3b992d37-3912-463f-afb4-1cf6e2e1b4a0", "comment": "Malware payload (Vjw0rm)", "value": "50b81e945d5bac6579e334b2530f84cef1882cdcf145a49bd2bc1e0a31bc982e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339612, "uuid": "25252050-6732-4351-b06c-2c63d165002a", "comment": "Malware payload (Vjw0rm)", "value": "4ace3c5df679e46fd4725ce50bb56188210cb619", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339612, "uuid": "34319bc1-2bd8-47d0-b49a-b7712a69395e", "comment": "Malware payload (Vjw0rm)", "value": "aec72255ffbad8717136cebe2f588965daba59f232c9b7cca1bfdfd3e57fc40aaafb3a7f1e8a2f87a4dbeac49a6f205f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339612, "uuid": "43add921-0135-49b1-966b-0d359c3815dd", "value": "T126037EA9C9B70772EE0C1F038AB8FE1D7F78785E54B02DAF3B05954C41A652DE0691AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339612, "uuid": "204cd8f4-9961-4177-bc53-a75afc1d7823", "value": "768:4Dh5+XTqoLpO6DYgMAFKsukdMXfam1i18qq4xrvfh9PuMx:kAXOyKsukdMfam13qq4xrnfPuMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666339612, "uuid": "02ed02a7-1002-4001-a077-8045a0bc5756", "value": 39123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666339612, "uuid": "71674f79-da52-4af2-a811-580711d60714", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339612, "uuid": "a7e13f17-a935-479f-8c53-9d43fd57f606", "value": "GwpdKgFDRG_wynmove.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d23853-5131-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666350735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666350735, "uuid": "0941b211-2195-43b1-a746-7903814c10be", "comment": "Malware payload (RedLineStealer)", "value": "33c7dd33a7eae167c45dd9d1e4ca667b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666350735, "uuid": "9728b1ca-3401-4d44-a0c4-4ba4371936a3", "comment": "Malware payload (RedLineStealer)", "value": "51b2df898ee11b79dd93410fca7c71eca0a6c868fd11db5de02f87145fa8e827", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666350735, "uuid": "83782c12-9844-44f1-b31f-91b31facd152", "comment": "Malware payload (RedLineStealer)", "value": "90739b08545bae7f2efe0cb957ca852037332fbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666350735, "uuid": "0b259374-7575-43ac-bdd7-d36a371f52ed", "comment": "Malware payload (RedLineStealer)", "value": "0031993294581e53184400c5fe85891ce89b7d5c23985da5b7359e236e1c06c55fc404733577355175a9f5109d8e7513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666350735, "uuid": "1d5d6ba8-61eb-4c07-837f-0953c4cb324d", "value": "T17CC52B139A8B0D75DDD237B4A1CB633BA734ED30CA2A8B7FB608C53959532C56C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666350735, "uuid": "c3e83ffe-b61c-41af-a489-31cfd66516d8", "value": "29677885c0fdc7680e2620d4335d1995", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666350735, "uuid": "0846dbf8-ff34-45ef-b402-9063b9ba0a91", "value": "24576:hI+rO0XWGlUHzo/OhjHG7sjYyY5jWXIOMPpwSedqpMHx+aPAGLY/r6TWehzkj3LZ:GS1UHzo/OlHGKYaPqrAWehzkj3Dl3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666350735, "uuid": "385af895-12de-49aa-9ae1-45cfe15d2a8c", "value": 2732956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666350735, "uuid": "b6dc1829-ad0c-4fd0-91f2-1c4cffeb8942", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666350735, "uuid": "ffe31395-ea7e-47cd-8e78-3a62f7d0739f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d426d02a-511f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343266, "uuid": "e35c3070-977f-4159-85c9-a8a5c27da8a0", "comment": "Malware payload", "value": "12bea094932da9fa51853740fcaa68a1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343266, "uuid": "7ec92fb5-f69f-41eb-8c0a-0178b67e487a", "comment": "Malware payload", "value": "53e00f1e8d2d6aa2d8a0eda2bf2d924fbc6f67db12ac3238d7c4b4520de7fadc", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343266, "uuid": "9d7e137c-6def-40be-a20f-91064173f752", "comment": "Malware payload", "value": "3a799c0fc8fe06659b8d22d2332f24f18effe17d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343266, "uuid": "3540e313-7995-4d6b-8249-0388491e527a", "comment": "Malware payload", "value": "b1ac19b444629740299a0565a913de0fe65321383f95c2b27a9a098a6907ffc88743dc17b9e49549dc9ed5a17157a4d5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343266, "uuid": "e86c61be-3b2c-4c56-8d69-5b92cea1173d", "value": "T17A5623C7E389D876D5B7C83A83B1435BAF524C558E56E3622989F02C4FFB9C04649F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343266, "uuid": "30cfe0ae-a40a-4a52-9085-7fbda823b67f", "value": "98304:s2qWPyxc712gHG4H3psL0668zxh40JyFY6ZLbuN8dkTPQVLjnHlGGF:qW8Y1LH3O6p0Jyec+8+TPQV/gGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343266, "uuid": "bed6ea74-7e3e-424a-8e69-2b9d999ebf3e", "value": 5942885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343266, "uuid": "a7bdfc3f-e230-4efa-9360-8c6631f2079a", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343266, "uuid": "3a61d8e3-a8e5-43a0-80ee-86e10a0ace82", "value": "53e00f1e8d2d6aa2d8a0eda2bf2d924fbc6f67db12ac3238d7c4b4520de7fadc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b23666a-511f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343117, "uuid": "9ee3cc96-2c3b-401c-b38a-3fcf2a18ad90", "comment": "Malware payload", "value": "d3f3ca4ca277ac92ebbf03f538a349a0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343117, "uuid": "0bcba4b7-1bda-46c3-8290-960636ad10e8", "comment": "Malware payload", "value": "53ed971b48ae0b2ff6bcdd7bf4e8970d6eac3e7cdcd3ae6fa05860b9e5ac58ee", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343117, "uuid": "35330c78-252a-48b5-a140-f9b2cea3da0b", "comment": "Malware payload", "value": "801d2fb5d710c5d79b05d937e3a3ef73f69fe747", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343117, "uuid": "02cb1237-1dbb-4c87-ba1a-521a7c84f319", "comment": "Malware payload", "value": "3d6fc2e4a16a63d3593cf620500d31a8aa00a152359ae24ece66fd8134362b9e463a745d34e09bb04efd216fc9bc5552", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343117, "uuid": "960ac46f-7be5-4cdc-bc1a-27a3112fdeaa", "value": "T1EB4523D3BFC19184D72BFD36C712A813AB211D890A51CAE36A16BC5C52BBEB0074E75D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343117, "uuid": "eaf049d1-2e42-4626-9b4c-8e048356f744", "value": "24576:MkOFCH9Z9uEAXxnh8KFeKX3ZRkEtW3QC8yvs7CODHlmuFshu:/H9ZfAXxhOKnfoCes1xdFsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343117, "uuid": "905eb292-151c-4a58-b93a-876cf7c5318e", "value": 1262717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343117, "uuid": "3cdb4f5c-aad1-4fe9-8566-634f2b7bfedf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343117, "uuid": "b0fc6b90-d07d-41c2-8dc7-f0b0cec406c1", "value": "53ed971b48ae0b2ff6bcdd7bf4e8970d6eac3e7cdcd3ae6fa05860b9e5ac58ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b41d1b9-5121-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343841, "uuid": "bef6e2b4-213b-484c-8357-11af1a8763cd", "comment": "Malware payload", "value": "d199c202beb4380e2f675e93c36cf0f4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343841, "uuid": "6e0db40c-2920-4f83-be27-30f68619b5dd", "comment": "Malware payload", "value": "54479fbb2f3c8c16714e526925537e738b1b586310c8d15ce10f33327392e879", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343841, "uuid": "c20fc02c-0b3c-49e7-bcb3-350887166b6b", "comment": "Malware payload", "value": "94037ffde778e4f0c49bc357d8e84a991f3baf6f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343841, "uuid": "f423cf00-4014-489b-ab47-a4fbefc53a7a", "comment": "Malware payload", "value": "02a8116caec265956a2c26b4f9540eb4a225485ff7c243015de1152a4a8bc7227b50653b8bd05a4282acafb2c56d017a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343841, "uuid": "e4d78978-dcac-4746-9cf5-7f3b5ff580ae", "value": "T17A562387E349E466D6B3C43B43B1426B5E924C548E4AE7532999F06C8FFBDC08649FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343841, "uuid": "d9793b00-5957-48a8-ac2b-a97be01e2e41", "value": "98304:XXL7VHdxc7UADwD4H3ZoL0z68zxh40JytY6ZLXck38Vg5WQEOjnHlGGR:fVDYUuH3L6p0JymwL38VgGugGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343841, "uuid": "2118e11a-7522-49a2-afe6-e5eb370697be", "value": 5943508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343841, "uuid": "af040fb5-f3df-4476-9526-a2c4a1c3c1d2", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343841, "uuid": "193e9cf9-17b5-4186-8750-df23a5a663e8", "value": "54479fbb2f3c8c16714e526925537e738b1b586310c8d15ce10f33327392e879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f3dfe5-517c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666383207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383207, "uuid": "fcfa1903-2362-44f5-9c24-cda25046ce22", "comment": "Malware payload", "value": "723c5b7723ec8c2559191d28502ed91d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383207, "uuid": "9ae68b1f-b289-42bf-ae77-b59b0d8f2024", "comment": "Malware payload", "value": "5529bf48bc1eefc22ba63b19cbdaa0c92146f1493ab34e79080c5a573835535a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383207, "uuid": "91ed5dc5-8f63-4a65-8797-ef826060da2f", "comment": "Malware payload", "value": "de39609c51497ec3f80c34da4005385828ba26cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383207, "uuid": "cab7e49e-2e6f-468e-9cfa-aa60eaeb1314", "comment": "Malware payload", "value": "d3c2fae6993017397b7965df27a2af6d33fd4d789e0fc87521fd82de276cea35e7bea9b781cc1113143fbe3a0b023b5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383207, "uuid": "ed568724-203d-4839-8729-8d1c6df53757", "value": "T170C53352D302DE33C11291F19C7DA720953733A299B4AE2AF1EC15E62E932CE9D167D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383207, "uuid": "3eac3705-1661-4fbe-b51a-11a2538e3449", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383207, "uuid": "5e4c9c53-47b6-48bb-9383-299032c5d7df", "value": "49152:Z2/LUv8kJOiv9ghh5hJNMjraG3FgqN42Q5zhKIg/JuxYA5hq:MTUv8iOivGRhIX3Fg+Ml6ExnDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666383207, "uuid": "40f40b8e-a42e-4c5b-8514-572eabfe90d1", "value": 2540088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666383207, "uuid": "0f10ff23-a303-451d-890f-71928a39fa16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383207, "uuid": "38f629e5-9cee-4257-8c3a-87a79d5484f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bca45c5-5169-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666374900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666374900, "uuid": "8094ef2f-e35f-44bf-a05c-769cced409cc", "comment": "Malware payload", "value": "0def05268b0108b6ee9cd20ee4765856", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666374900, "uuid": "51f53301-6580-4984-83eb-a0c6c2c74f49", "comment": "Malware payload", "value": "569ea2229b464fe4cbffdb473cff09912f91fb593a16be9003f38dc8c083a62a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666374900, "uuid": "7e5819b0-e833-48af-bbf1-cac6854be5fd", "comment": "Malware payload", "value": "723bacbed4e4a638a0cb7cf3402887b2854d35c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666374900, "uuid": "73dbe816-a127-48fb-90f1-96806b1811a8", "comment": "Malware payload", "value": "13d2745e3d4deb25f7348f7818b87e1273b5420495d279e457a1d8b9163a504736ba57b23c9d357a0c84b0ab2a959dea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666374900, "uuid": "1c873d18-e10c-4757-b7e8-530bbf0e9850", "value": "T183B4BF1071D0C172E6B3083B49E456799939AD528B6766DBE3F43B6DFFA02D26230B34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666374900, "uuid": "299bd477-c9aa-47c8-991e-4222981c5418", "value": "787d271a2df462be9e8efbef70e9c88f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666374900, "uuid": "a2428c73-f328-4b02-b201-f7443bbe030b", "value": "6144:V3QZl6E8GjAK563R3MQDkH2eLnCm0AOvbOVpHwZljHHzKCj2USHs7tzoekTEACRD:V2l6E8GjAVR3JpZBOHeT2vsBZkKdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666374900, "uuid": "3aacdd58-2881-4630-a427-cb966caf5098", "value": 515584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666374900, "uuid": "94ba00cf-050c-4eaf-a690-7d817025d7c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666374900, "uuid": "63a61d37-5d68-4281-8062-b914b06ccdbe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b952d4-50ff-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666329528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666329528, "uuid": "99e05c68-eb7d-42e5-a881-ac63b8949d98", "comment": "Malware payload (AgentTesla)", "value": "4ecc0deeac5999d60c82c0ec125b779e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666329528, "uuid": "e53aaeb4-ecd6-4807-831b-ad9c68570b50", "comment": "Malware payload (AgentTesla)", "value": "57738a5a9d55ed30d1abc9fa9fd0e1ed7a3b2f3bdacdbc836d246f7361b92e52", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666329528, "uuid": "14d73c12-e307-4318-9486-52ae287c5201", "comment": "Malware payload (AgentTesla)", "value": "b51dd16faefb6773fc76edc86e99e5a0cefc3211", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666329528, "uuid": "a575eb74-1029-436b-814e-30b3e3f0c37d", "comment": "Malware payload (AgentTesla)", "value": "af8b4a1aa51ba10cb79c21816add1db3dbe6c5a22c4ed398339378d456f22f0139e25c71055c2d6221219d2493896ec6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666329528, "uuid": "4fdaa0c6-4ada-4f97-9417-60c49c479ada", "value": "T167052A2829EB421CF83BCBF99FE7B4CA49A7F6212129B59E14AD43464533E44CCD3635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666329528, "uuid": "534de1f5-66fc-449d-8f1c-2e48765f81b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666329528, "uuid": "02c78014-8df7-4dd1-99b9-6356703aaf70", "value": "12288:2gfA7bzCQo4pNMD9dIqz1sqElHlswPeLPiKq79UPy328+BM2:J6e0a9neqEdl9W+9UPy3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666329528, "uuid": "6f496856-74dc-40b4-95b7-85ca625e6b73", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666329528, "uuid": "2e0765a2-80b5-4491-a1d3-4385230a7f34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666329528, "uuid": "179a1e3c-3f5d-480b-991e-791ca9fe8da7", "value": "statement of account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45befc4-5119-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666340636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340636, "uuid": "79c12ec3-48f1-4d6b-b82e-729995cd81cf", "comment": "Malware payload", "value": "e94ed62a28a9fd6f714c3e29b3636788", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340636, "uuid": "8a775e30-c55d-4bd3-bfaf-69f46f2a8098", "comment": "Malware payload", "value": "5787723b2221464337e6bbe4200aab912f1f711447224e4e6c4c96c451ff41bf", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340636, "uuid": "b905cc39-b28c-4e10-b349-08254bfe03a2", "comment": "Malware payload", "value": "f79fd307847deb43025017da5821700d7d83bc3b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340636, "uuid": "9f704aa2-d6d3-49e4-898e-3e8c6d60cb0e", "comment": "Malware payload", "value": "28c3f3c67fdd6545dd5fc5f89bc1e5c6a0861bcc5803210adb9ad110129e55f7d24113976d24b7c907cf1cbba90c37dc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340636, "uuid": "857e160b-3de0-47a4-b37d-4071b8b24f6d", "value": "T110D5338C67D1A9A2DEA9813540F3D703A3A2DFA843C38B03355E3608BF76A547E6F155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340636, "uuid": "e8d927de-8b0f-47c4-946e-8e9f812ed616", "value": "49152:3t2omVymGc1x/IE4ESJu8iIZrMPUAgoPqqEu7EuOLNOAqdWrhErLSq9:3t2ZVyYzasyZoUoP3E+HAqOML1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666340636, "uuid": "3c9d16c0-0a25-46f3-97a7-5eacb7c9d49e", "value": 2965114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666340636, "uuid": "222721c8-b5fc-4a52-bcc2-0a6157997972", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340636, "uuid": "ff90e939-752e-4cfc-9933-507f2e007fc6", "value": "5787723b2221464337e6bbe4200aab912f1f711447224e4e6c4c96c451ff41bf.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce91ca6-5165-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666373292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373292, "uuid": "2b5cce43-4e09-4a62-8b99-ccf7c79bcb6b", "comment": "Malware payload", "value": "dca8874e7ef84de8531847c7d9845d0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373292, "uuid": "bff9114e-db5f-46b3-92fe-54d0407f53eb", "comment": "Malware payload", "value": "5868fdc73540194a0a69ac637958c52041e971e1f8f70077424df3fb6c0e9a70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373292, "uuid": "c0ddaa28-403c-4f83-9bd3-5c4a355f3335", "comment": "Malware payload", "value": "aee2357b594552c465e705c08a481c84392cf87d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373292, "uuid": "79513469-e4b1-4539-afa9-84ea6d51c1cb", "comment": "Malware payload", "value": "94b43c05d806a3bdd4c8ce4a8fe959cae5015d7dc706711f94e15c426c375e71d4999b50e5660acdc05544087d0c7d62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373292, "uuid": "4c7568d6-6ac6-4c74-86ea-1c3cea39db05", "value": "T14C7633D0B4D582FAE4434639C8782EC572FEF4B00E525E83A35A5C0DCE39AD4F5366A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373292, "uuid": "909ea56d-69be-41ba-87bc-32fdd327ed41", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373292, "uuid": "18514e27-79ca-4c10-8da2-9dc71da5039f", "value": "196608:91OmVqHPQ3tv43/bErB0YgEpC5s60/jVYHp4Vew1:3OFQ3tQ3A1EJ5s60KpB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666373292, "uuid": "af6b706b-aa79-4361-855d-f68b6a29b26f", "value": 7582917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666373292, "uuid": "8c7c8c37-c267-4244-89a7-e4dabbaf3e38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373292, "uuid": "668ee709-14dc-4187-8188-37b31af67199", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275ec8a2-5116-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666339111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339111, "uuid": "f09ade15-7c71-4331-b2ba-148fd5d4b5b3", "comment": "Malware payload (RedLineStealer)", "value": "1121f73a2a3d21abc0a62bd18555921b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339111, "uuid": "63b83456-4a1d-41f1-a578-9b9c18eaf560", "comment": "Malware payload (RedLineStealer)", "value": "588572e37df45867b14d17b7892c5337ecce9e618b43ae6aae8ab187c35bbc92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339111, "uuid": "3cfa2219-959d-487d-9df4-8902de1855af", "comment": "Malware payload (RedLineStealer)", "value": "9ddaa8f63fbb75e6a1d28b4bda6fe5493f70c87b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339111, "uuid": "028d19e6-1496-4f57-bdd1-68921febb5d4", "comment": "Malware payload (RedLineStealer)", "value": "e59c49a2ed87422b9087a6165f47829ab0c698f3835d7d7583eccf0d24f0f0b14c3b776be24e2600813f2bc641b78c5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339111, "uuid": "43b1392b-7182-4938-b7f9-fdefd2869fdf", "value": "T145846BC533949053EC675A304EA383DA9769FCD0AE34719B2364F76E0B3B9D26E64B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339111, "uuid": "5f547e17-2395-451f-8397-d8d8643c20c5", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339111, "uuid": "fe00deb6-fbdc-4cf8-bf0d-8f7b495377f9", "value": "1536:Wrae78zjORCDGwfdCSog01313js5gMbqUTr:uahKyd2n31o5+kr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666339111, "uuid": "524a6f59-4200-41d8-acad-73eb5141582f", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666339111, "uuid": "0e7d4467-e882-4ebe-8907-edfa0c8a8e4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339111, "uuid": "8dcdd4fa-dc0b-4152-9a0e-843c7f6a3596", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b18bb3-516d-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666376553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376553, "uuid": "109edb3f-7c8c-4582-ab10-d8e336d887cd", "comment": "Malware payload (Mirai)", "value": "0ba936707e8026075821ce14b6a92b3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376553, "uuid": "b61940e1-088b-4743-b559-f226706692fe", "comment": "Malware payload (Mirai)", "value": "5927ae89f1997c035a180def3d0ddc4f28c66a55e12c471df8bb6e837ed58172", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376553, "uuid": "100c5954-aa0c-41ef-91e2-2b9589f30a15", "comment": "Malware payload (Mirai)", "value": "fd98c914247ef6c4d8c754ff018e00a691608b80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376553, "uuid": "5f7ba4b5-37bd-42ee-8d45-1d999b8c7808", "comment": "Malware payload (Mirai)", "value": "e8fc7809985a095d9679758ac2e075a001d65a236f9d19ab07f92531964edc34558e942aa065cda76b969e27f93b59a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376553, "uuid": "636e8fc9-dde9-441a-b004-42fc5a43795a", "value": "T1DCD34B46EB808E13C4D5177ABAAF41493322E754D3DB730699185FB43F86BAF0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376553, "uuid": "f97847ee-24fd-420b-875e-6a5fd1e78044", "value": "3072:ho9lg+zhz3sJu1NHLL8XmiC/glLCZTuHHlOM/9d0Yj:W9lgahz3sE1lcmiC/g1CMHHcM/9mYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666376553, "uuid": "448e806c-9711-40d8-b96e-431574785c6d", "value": 131898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666376553, "uuid": "3087bb87-c2b5-403e-b1ad-fff199a32a05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376553, "uuid": "819e4419-1a79-4809-b352-4039fc40d730", "value": "0ba936707e8026075821ce14b6a92b3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0fc4655-510f-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666336335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336335, "uuid": "8f002f34-efd3-4dc5-8b82-ad0c717cccd8", "comment": "Malware payload (Formbook)", "value": "818f5b36b251c2a72dfde9b6a3a44090", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336335, "uuid": "4fdae922-b212-4cd8-ad20-a8b72bc623e3", "comment": "Malware payload (Formbook)", "value": "59cb035dba6e6398c3edf4fc56fb6ef4092a6326d8b7b53dbd3460b9456ef90b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336335, "uuid": "1df8ad3e-088b-47aa-96dd-ec00511b78f5", "comment": "Malware payload (Formbook)", "value": "21f4ec67bafdb3fc23fd50b0ca53b99afe87c84d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336335, "uuid": "aacdb84b-48ca-4bf5-8c96-bc28f93bace7", "comment": "Malware payload (Formbook)", "value": "f76b68e96fa8a0e9e6a001923f5acebb9c66ffb03f43a72e727e10b138bd0d658170b03095260e4184e50f80ee9711b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336335, "uuid": "b4751c96-f764-4813-b08f-51c150674cdd", "value": "T13FE4122C97E98F67CEFD1779C066541003719212B453FB5F4E82B4FA5E63BC8840A7AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336335, "uuid": "8cc18cf6-7aaa-4b7c-b55c-46ccb36f7498", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336335, "uuid": "bb751f4b-e561-4cee-a6d5-d521b84de6c1", "value": "12288:ChPzIcDieU4+eeeylNeEwcSspu84aKmwFWCBqiKe3D343TQ:CLBeemMEwcSiBGlBZKereTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666336335, "uuid": "7528b854-5eb8-4bcf-8e5b-577f7289d8ab", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666336335, "uuid": "a422a720-7a3f-4355-86e6-ea3a18357be8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336335, "uuid": "8d3a6972-4015-4c93-b6a5-a5eb24595152", "value": "SecuriteInfo.com.Variant.Tedy.224685.12212.21294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9ea9b7-517f-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666384243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666384243, "uuid": "c337a009-9aef-481d-bfc4-ecfe4d5c25a6", "comment": "Malware payload (RedLineStealer)", "value": "0537d73e9e3f688f1ebad3d897e638c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666384243, "uuid": "5157846a-6424-4f5f-b22b-ee0a36a8e261", "comment": "Malware payload (RedLineStealer)", "value": "59f1a071b00725e2e13f6b2bb8c94d78fbea03d26143ce402d7c2c03e95cb703", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666384243, "uuid": "7968c572-e152-4247-9e63-94b06a05fcbc", "comment": "Malware payload (RedLineStealer)", "value": "6ebfda88106023ea6e7deec954ce3a1824eb202f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666384243, "uuid": "a4ad636f-64da-4d1b-a219-da772d89723b", "comment": "Malware payload (RedLineStealer)", "value": "7c315a904f632ebaff7af578ddbb64c0b52ccf99383ce7527c676245d4c119fe8cbe4c0625c99ac1e236609edf2ddddc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666384243, "uuid": "90ba6e53-8ab9-4be7-a4a5-7e8f2e90c10a", "value": "T1999402307691D871C74A22704416CFE16BBEEC35196489473FA63B9E6EA33809A7731F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666384243, "uuid": "6eea441a-7f35-4b75-8775-049ea64ddb75", "value": "22a7089b68e70e7355f6bd998fe94868", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666384243, "uuid": "1045ad75-7b23-47d9-97cb-94755feada7b", "value": "6144:sGB+xgGJ/TAmTduK5UgU10eBESLZEFrAbbz7ryxf3XbqNrwVfeXO:sGQl/T1TdueUR0UxZEFM/zKDIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666384243, "uuid": "c0dc9bfd-ce56-4cdf-9b58-20b2fb0d9573", "value": 430592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666384243, "uuid": "f665c838-fa8d-465e-953d-005283225543", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666384243, "uuid": "f213a97f-6aba-4ef6-8066-8b3951c522f7", "value": "0537d73e9e3f688f1ebad3d897e638c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004aa3f5-515d-11ed-9266-42010a9c0072", "comment": "Malware payload (Cybergate)", "timestamp": 1666369539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369539, "uuid": "2628f9fd-65fb-490d-a4aa-0479f3c58271", "comment": "Malware payload (Cybergate)", "value": "5016295a0a49f354e1e22c6facc9d512", "object_relation": "md5", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369539, "uuid": "bc7dda17-0192-4aa8-a5a0-d2517c95b220", "comment": "Malware payload (Cybergate)", "value": "5b500c33e381e9bfa47439dc512a8ddedfe9e5b863abd968d3010f93dc4f2fb7", "object_relation": "sha256", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369539, "uuid": "0fd8adcc-e10e-4170-9017-98a85dbc4c37", "comment": "Malware payload (Cybergate)", "value": "9516c14403bb6aa7e456a74e98f4b53b7950149c", "object_relation": "sha1", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369539, "uuid": "ae1b5f8f-1610-4892-b870-e45286d18b43", "comment": "Malware payload (Cybergate)", "value": "a4a5d5464643f0b2172f14e6cc8afffc02e86bb7f092b73f2c95c1c88ab1cb0cb33aee415b5580eb026537bd3fc532d2", "object_relation": "sha3-384", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369539, "uuid": "942921c4-5a44-476b-afd5-b396ab4a1368", "value": "T1D605015BEA612E27C61C8A72C43B6C1C1270D5497C4BEBCBD5C8A03237F7798994B5AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369539, "uuid": "85ccdd4a-e127-478a-a973-ddfb5626eee5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369539, "uuid": "9526e3cb-6c6c-4fb7-8da5-368a8e286b4c", "value": "12288:GGEwCgvoSMM3lCWRT/vTE+ZLFPQ+73snobrFePxkwAV+s+H64uHTZPs89Qfd:LC0oSX3lJ7BhVzsnoUWHcnDuy89Qfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666369539, "uuid": "74579818-25ae-40bc-b764-bbbda4aaa716", "value": 800272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666369539, "uuid": "b718de2e-20b9-4fb0-8442-f38730c8565f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369539, "uuid": "6e147f6c-b1f7-40a4-8611-8f41a9d528a1", "value": "5B500C33E381E9BFA47439DC512A8DDEDFE9E5B863ABD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afe172a-5160-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666371060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666371060, "uuid": "003477b3-4738-449e-b877-62cca701d82a", "comment": "Malware payload", "value": "9ffa7fa33dfbc4db009336bca1a6d6b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666371060, "uuid": "f12d6f63-ba37-46d7-a77e-942750b5478c", "comment": "Malware payload", "value": "5b733f8eaee2c273a506e307e7431305454c2bf208a1cf2e516d0ede416f2080", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666371060, "uuid": "157b8b60-6c7d-4df1-a2a4-38ba66d85df6", "comment": "Malware payload", "value": "ad83e0ca02f5731eea9891e1b500bec6f37b97c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666371060, "uuid": "746d1fc4-ca05-448e-8280-b7a091515821", "comment": "Malware payload", "value": "3f63024f4939db8c197c229992eacf82283b374e321545638d111f9f514a6056e74d22951873d0fd8f0efc86b88361fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666371060, "uuid": "433e81c5-1caa-4613-9ad5-3e8d030a1800", "value": "T172C3C011B983C472C446543548A4CA60ABBF783222BA5D5F3FA4177D9F702E19BBB34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666371060, "uuid": "1aaf10c8-a1e7-45f6-8df6-a291dcd05f39", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666371060, "uuid": "53602511-5ac3-47fd-acc7-b3b5447f5559", "value": "1536:qQukDi4JKrL47JmGMaBcnNRNP2nGFNO5JfJO1gSa2CwuxpT3ueJMfrI49fSa:qXSrsLAvlCQnEO5JfRSaIeHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666371060, "uuid": "636bc6c5-f997-4335-9dd1-8e23f9278b72", "value": 126091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666371060, "uuid": "0e80b739-911f-4d53-9688-6900bac8080f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666371060, "uuid": "564cff5c-8599-41f4-84c1-2a4cb6b5120b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9e847c-516d-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666376569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376569, "uuid": "3188edae-4999-4f31-b2d1-b1439d8f631c", "comment": "Malware payload (Mirai)", "value": "38ec71d968cfdae0e77ab6c58ca6ecf0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376569, "uuid": "08a7b029-bc9d-4ed4-a47d-9aa37377345c", "comment": "Malware payload (Mirai)", "value": "5bdb3840c81f328fc8185f4a4f2f9233b475c78dbe6bf803951f22939ce3f0be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376569, "uuid": "ed449d76-3a83-48d8-aeb1-fcca9b18b5dd", "comment": "Malware payload (Mirai)", "value": "94cf9940c646926b4bdd0642197d8ccc35af1bc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376569, "uuid": "582b1486-6cfc-4acc-8c46-57b6fa41127e", "comment": "Malware payload (Mirai)", "value": "bb9ec774ba6109982ab5dcb0c875a67c75920e4aaa61774e0169a88fedc78d4b84c6f0933a9bc9d43e71e214e4de9448", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376569, "uuid": "7ab07445-2177-4eec-b23a-24019d834a16", "value": "T103432BD6B801AD7CF94FE6BE8023090DF661335051930B2B67A7FDD36D321A86E12D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376569, "uuid": "efe262ea-978f-4987-81a0-e405a3dc7414", "value": "1536:uc4QFpUZAJIwvfjYjD1yIo8Wh6fBqozrG:XfFpUZGIwvMjD1fO3oHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666376569, "uuid": "55dc2487-5093-4177-aad9-9642d64e1ce3", "value": 57092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666376569, "uuid": "d71bbc57-d5aa-45d7-a60f-6425cfc2090a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376569, "uuid": "4d6b69ce-863f-43cf-bd0c-d18ded495281", "value": "38ec71d968cfdae0e77ab6c58ca6ecf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a91a276-5109-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1666333586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333586, "uuid": "9c4dfcc0-2cb9-44de-a3b9-37929ff2fe01", "comment": "Malware payload (AsyncRAT)", "value": "6158c0682f86511060619bba0fe864be", "object_relation": "md5", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333586, "uuid": "01751d7e-0fb9-4e00-9b95-4daf017cc526", "comment": "Malware payload (AsyncRAT)", "value": "5bf4fc2c4d3115229d60511cad1af48019a4c291ad6144e73393e88e319f80a5", "object_relation": "sha256", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333586, "uuid": "39d52a80-797c-483b-a6f0-5763c519b2d8", "comment": "Malware payload (AsyncRAT)", "value": "63a1738c87ba9449b1d572ee470da2b242742643", "object_relation": "sha1", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333586, "uuid": "785005fd-22e4-4313-a181-d46aeab13605", "comment": "Malware payload (AsyncRAT)", "value": "a96048a1c08d2289e282a6a9827d3094528750859783e3e3cbbc53c0b3a9053065ab472ab26db6d967da8df71613c92a", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333586, "uuid": "574a2140-5fd2-4f4d-91e1-e65dded91c86", "value": "T137535C423B68CA62E69C1EB96DF3420602B0C1975162DB4FFCC844D9AB57FDA16123DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333586, "uuid": "df85fdc0-9a53-4bb3-a841-272605deb3e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333586, "uuid": "ebe6b7d4-a2ad-4a2e-a88e-11955d69140a", "value": "1536:8WP+BbY58krxvI0TTCNsOoIK7q6LgRAIM8pqKmY7:8WP+BbY5xrxvI0Z7P8R8Xz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666333586, "uuid": "6e4ab8cb-f779-4bc7-89ee-3d42becfbc14", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666333586, "uuid": "78a1132e-e6fe-48d7-9ba7-ccd333d13863", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333586, "uuid": "7b5adaaa-4369-45fe-879b-4a12c3395583", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e930881d-5178-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1666381526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666381526, "uuid": "d538d8c4-53eb-47e9-8e6b-0201c98c6d6b", "comment": "Malware payload (DCRat)", "value": "ada3035d6add08b0d83895a4eb510e2c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666381526, "uuid": "4dbfc943-d605-438a-b0ad-69d686030db1", "comment": "Malware payload (DCRat)", "value": "5c963d9299ed5c2de48b7c1ffe51c2ea491799dc692b2a45860bd7190167df83", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666381526, "uuid": "9173274d-309d-45e9-9193-732cee5a3a2a", "comment": "Malware payload (DCRat)", "value": "9cd5f7d66735d53a59e81c4eac0928140bcf9d23", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666381526, "uuid": "6f4c5376-ac31-49ae-9ed2-5bc4af6b63d9", "comment": "Malware payload (DCRat)", "value": "1ab05704b75b8950f25d4dfd36d45b0e2d75ce6951cac2f0de2992b8f4acd811da1f4c4df45a48755aff1fe45dd1d3cf", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666381526, "uuid": "be98543b-5f78-4d42-b7df-fc104c95c957", "value": "T13F34E011B6F2D872CB4744354830DFA056BBE8323570899B3B643B6E2E70DE25A7A357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666381526, "uuid": "43c94ab1-7a9a-4f78-b1bd-86d5f45f3995", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666381526, "uuid": "53dc9c09-7f53-498f-af28-4821ab5bed16", "value": "3072:7XO3/LgCj3CkfQIO51LL/UC0NwGKpj+a/bFP/6YnH2UEG:T4/Lzz7fQI2L10NwGYNPnWBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666381526, "uuid": "b4beb9a6-4d41-4630-96a1-88cb98e1aa24", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666381526, "uuid": "dbc9086c-6b32-45d0-8ac6-c287f9e6d6cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666381526, "uuid": "f7e566fe-c377-4407-ad4e-025f3edcf8a0", "value": "ada3035d6add08b0d83895a4eb510e2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30af364-510f-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666336365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336365, "uuid": "7cb7bcc4-324e-4c46-a5cd-7501d24e513d", "comment": "Malware payload (AgentTesla)", "value": "aa1f98954ec5eda44a8ad2d8003d922c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336365, "uuid": "6fbbcb74-0107-48f6-9932-6b29bb8961f3", "comment": "Malware payload (AgentTesla)", "value": "5d7da1def7b8cc73748360cc8d3a1f67b9e1eda832d6d45a780b42e76db74ad3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336365, "uuid": "a7935244-e349-4c95-98be-c9e3daeb2904", "comment": "Malware payload (AgentTesla)", "value": "a62cd835d2af3b5b8a0a2dde96c783744dd64dbb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336365, "uuid": "1027a346-3e5b-4436-bec4-f7740a815efc", "comment": "Malware payload (AgentTesla)", "value": "933b633c78e143e4933a9aa534f4d50a7cebb15717ec18192f6f79eec79efaa86e112fc7e89d43183a692fa6b7c5d660", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336365, "uuid": "c88de31c-af9b-4041-ac9f-84ccb96f2a10", "value": "T12DB14C709D8C6EC6C39B7505CD82FE16D632B6AC17C3B8B822A9F98006973276D22556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336365, "uuid": "183f4b56-f1b3-4de8-8738-7c4f01c993a6", "value": "96:MruBFLfWQsUQ+KMwhGlNgE+HDJMMu2LvvEMuP7aeF5X/RZ:V58+Uh6uJZJrvErTaefXZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666336365, "uuid": "fd089c0a-1ba6-46a5-9d89-6547bf5f233b", "value": 5249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666336365, "uuid": "00abcb1d-e294-4150-9c68-968ca5cdf755", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336365, "uuid": "7e4c2845-03b1-4a6c-a11d-0fea01a10f2a", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.16235.2157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b138913-514c-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666362336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666362336, "uuid": "dbf00d9b-be48-4e13-a222-0bf220e9b58f", "comment": "Malware payload (RedLineStealer)", "value": "380007828de867ac3df1eb69843f8ed7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666362336, "uuid": "baff58a5-0710-4d80-9c4c-849a9f9fc4b2", "comment": "Malware payload (RedLineStealer)", "value": "5d950bf571f9f3b9ce6b21e701c533b7b2b0ea33d77830fafdb37f71e334aee2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666362336, "uuid": "7c5e92e9-fcfd-4c02-b25b-3a380efa44b7", "comment": "Malware payload (RedLineStealer)", "value": "a411ff61a9e4f58a68c710facd9238949b530194", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666362336, "uuid": "4045cc88-06ba-4f19-b956-49126b9c30da", "comment": "Malware payload (RedLineStealer)", "value": "f9af4db78976fbaa21838a9457b29c1044296929b70c304ecd0805b3397d9476ee83caf9d997722411f26afeb4cba0f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666362336, "uuid": "c27ca6e2-4ae7-40c3-93fe-6e731673b11b", "value": "T13D24E01176D2D432C88A41354434DBA0167FFC3256BA5DA77BA83BAE5F702C21BB2397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666362336, "uuid": "2f275d9f-4bc8-4c62-a3de-691a7ec2f02e", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666362336, "uuid": "e87bd6c0-5bb3-41ce-b3f2-b513161f0bf0", "value": "3072:VX19cLz4WkQBz56VFCO0Ff8rx+vekMnHICUZQgJs+k+er:RvcLzvkQBuz02+4H3UCd+Per", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666362336, "uuid": "10672056-178c-4b91-97d5-018ef4513665", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666362336, "uuid": "1b7a9b93-8159-439a-b4ef-8ee91aa17359", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666362336, "uuid": "de096108-5b2d-428c-bd6a-710695288661", "value": "380007828de867ac3df1eb69843f8ed7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d7911f-5137-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666353474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353474, "uuid": "bccd0a9e-1d14-4bee-bc30-aeca4259f399", "comment": "Malware payload (AgentTesla)", "value": "b47b682e637346e747a5a160ed4e2cb2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353474, "uuid": "9d0b1ae8-e985-4e2a-9aa5-8054d65afbde", "comment": "Malware payload (AgentTesla)", "value": "5e4886a8b5241de384098909a07a7e140ffdadb95d93c69c72ec27ccb1b32eff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353474, "uuid": "7dfefa3e-a059-4944-801f-5f10f4addd75", "comment": "Malware payload (AgentTesla)", "value": "853eed71b39d66687104076e2d1b9db4ec05f517", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353474, "uuid": "b1d24de8-a4df-46e2-bc44-0071a3a8e5ec", "comment": "Malware payload (AgentTesla)", "value": "8b0b6dabde1049bb62a458cad636fbdcfc133c6f591e71228715dcbed0b2c327e0a5f789d08813a385d81275b2e76712", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353474, "uuid": "df5f40dd-8bc5-4d5d-a0b1-6f77c4595d7b", "value": "T159C46C3DB0F4C9EEDBD53EB2CC02350229E39DE2D38A921997A935653DD1230674E85B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353474, "uuid": "a2319d1a-dd0c-4635-acf5-fcc45ac3844e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353474, "uuid": "95a35c76-ce80-4683-bf24-79afc5d3de3e", "value": "6144:IPLLHbe1/M9eVB5EVkJhb2pXQwCye+M44JcrFnH76fpdNWvX:sfHbI/IeVOab2pX5zep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666353474, "uuid": "d9bbe55d-9495-4b96-b0f7-5a97fbb61fcc", "value": 554496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666353474, "uuid": "be47a787-1a27-4b87-9a2f-de5e5b527866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353474, "uuid": "64da4e8a-e449-492e-bb59-bab427b7d736", "value": "SecuriteInfo.com.Trojan.GenericKD.62968381.7124.21999", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27034e06-517d-11ed-9266-42010a9c0072", "comment": "Malware payload (njrat)", "timestamp": 1666383348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383348, "uuid": "6d436400-237b-402a-86c9-c41d34786bee", "comment": "Malware payload (njrat)", "value": "104debfb1a106d378c16228bfb148706", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383348, "uuid": "298d97bc-1707-4e71-9127-356d016fbdd8", "comment": "Malware payload (njrat)", "value": "60c1ff1f3a1fda2426711567f6700b70f90afd5183b2f023da2cb9047240b174", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383348, "uuid": "b3215314-a98d-46b4-8792-8347013e192f", "comment": "Malware payload (njrat)", "value": "fb2f5858c30bb24d338a949e514fcd805b616d11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383348, "uuid": "0c855313-9c1c-4c5a-9d5b-46d511beaf24", "comment": "Malware payload (njrat)", "value": "d3c2f963b7556976d96e349cce6eaac12f2973408ffc6a4e6ba7ed3290011ca28b209e6f9ace09250f5425b4386c8b72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383348, "uuid": "76a5ef90-d364-46fa-90ea-288f39a00a66", "value": "T1E1F3C72B7588CF15EA582871C0DB953003D5ADDB1B32E38A3F583B5D19423E75D8ABCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383348, "uuid": "3811e2d1-eb03-4437-928e-040475207adc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383348, "uuid": "b6366aae-68a0-4c1b-ac9e-2a9933f560ac", "value": "3072:2e+03M1rodSuvDqy29gdAo+UaCqHPDZ0LX1wNA3/7:oog4qy29wAo+CqDZ0wNa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666383348, "uuid": "9f7463af-fec3-41b8-9981-f558884c917c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666383348, "uuid": "8ac02c96-f29a-4247-b7fd-cd58ebaafab3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383348, "uuid": "470eda35-2ee1-4188-a197-d34190de2b8c", "value": "104debfb1a106d378c16228bfb148706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79092004-5128-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666346978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666346978, "uuid": "7b012990-3fbb-45b5-ae2e-4f17303ffb93", "comment": "Malware payload (RedLineStealer)", "value": "98530920bf3d800cfd8a9ba3528b6c48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666346978, "uuid": "bcde1a61-af3b-4e7c-8fb1-bc3d87e5aaff", "comment": "Malware payload (RedLineStealer)", "value": "6114d04d095e231fc5a98251743511492a4b5e45572edf6993d48b49faf7a3f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666346978, "uuid": "d212dab1-38f8-4d7b-ac24-6767ea549df1", "comment": "Malware payload (RedLineStealer)", "value": "1d3a2ffe01e1a9858e2d2ec36beea2a198572d6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666346978, "uuid": "5f1c45cd-d5ab-4029-a616-fad7996e1433", "comment": "Malware payload (RedLineStealer)", "value": "d6841f99e6a277838925031c47a04e99a6cb6b89052dd1f0e2f315dcdb14802bd15f4cc1165e5ec86c53fc8cfe180e93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666346978, "uuid": "4b526d81-2985-40eb-96bf-cbaa422e9fe7", "value": "T193C52B139A8B0D75DDD237B4A1CB633BA734ED30CA2A9B7FB608C43959532C56C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666346978, "uuid": "2bb8efba-9c55-4045-bc3a-eed90833af58", "value": "29677885c0fdc7680e2620d4335d1995", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666346978, "uuid": "67ba4b21-93f6-4871-95a8-a2e967cbad23", "value": "24576:DI+rO0XWGlUHzo/OhjHG7sjYyY5jWXIOMPpwSedqpMHx+aPAGLY/r6Tmehzkj3Lp:US1UHzo/OlHGKYaPqrAmehzkj3Nl3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666346978, "uuid": "a9a1f7b1-01cb-472a-aa69-4d174d7e8ec5", "value": 2732956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666346978, "uuid": "e46daada-d34a-47f2-9805-ed77860b17ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666346978, "uuid": "b343845c-8201-484d-ac6e-4d297feb1a27", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43df34ac-5119-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666340447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340447, "uuid": "c3836b4b-00f0-492d-b4c8-c6b9461fa56e", "comment": "Malware payload (AgentTesla)", "value": "6a43c2abe0ae89637fe4f80ed1dfa378", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340447, "uuid": "fbd829eb-4e56-460c-a62d-0856d66f31ac", "comment": "Malware payload (AgentTesla)", "value": "61164f43a704fbbf9535d07668d9c750f7f7ad8f041590eccde573aef5da281c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340447, "uuid": "4836938a-7bff-4122-a118-9f6ab02321e9", "comment": "Malware payload (AgentTesla)", "value": "fffc29f8c664c54e18e724e718b4feb4e8cd1dfe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340447, "uuid": "7ef13b02-adb5-4f87-894a-e0677c61988f", "comment": "Malware payload (AgentTesla)", "value": "b6765da7881df6f128a0c923be190f25f74e5eafbb4b0cc1299e7dadb26d882653809a22c887a608d42551ab6843741c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340447, "uuid": "64ddbdd5-7e7e-4236-a51b-ddf1888dca03", "value": "T124351242B3C28872D4722E314A35BB116D7C7D302F759A2FA3D8796DCA796815131BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340447, "uuid": "5a3b171a-3f34-4fbc-860e-4d203ea0b2ba", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340447, "uuid": "853ee0f5-b6d9-4a95-bc18-cfaccf516383", "value": "24576:JAOcZLopo+6Y/7SIdT/eoK1V0JXaCZ73QqQ5SOb2eYzWD:jO9Ye1V+XBbJNzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666340447, "uuid": "8eeb7710-3585-43e1-9868-db3e72212485", "value": 1145286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666340447, "uuid": "6aba7f7f-4134-4a99-b415-67a9491ac4fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340447, "uuid": "71f0fe32-0669-45ca-8ec9-7cf2eec29694", "value": "MT0013562700.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33605541-5175-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666379933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666379933, "uuid": "1a070c7a-02a5-4fd1-ab02-ff7cd06c4ea0", "comment": "Malware payload", "value": "fbebcd5c7a966ce0d0e1ba5455a7477a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666379933, "uuid": "a9da832c-41db-406f-92d4-941e78dd9275", "comment": "Malware payload", "value": "61b84d90adfa62413c6fdb5915da34961239e9a10368ae7397f7c6821b8a5a5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666379933, "uuid": "c0b21512-ef38-4f7d-b492-9d6b99cdc0e7", "comment": "Malware payload", "value": "3431896c7e0f87cdcea88c48f62f017ff89bf373", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666379933, "uuid": "a26060fc-b08a-45b5-98c1-ded84b709f0d", "comment": "Malware payload", "value": "360f70f1841873b8c420bf703a5744c11553f28ae139bedaea2754085920ed2f190310955532486c2fd4c1257a356599", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666379933, "uuid": "524516ee-b7b9-426b-ae06-ceb278841e30", "value": "T1C434E011BAB2D832C8831430446CDBE176FEE83255754D9B7BA43F6E6EB03D15AB2316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666379933, "uuid": "0e601591-51d6-4d49-97ff-88a2becaa155", "value": "bc5a05e947eb61731a4e3024a4f4b617", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666379933, "uuid": "c3e129e7-2285-492f-9b20-d52b929e664a", "value": "3072:kXSmhLYrMT2ABE5xVgJCNqSK4rHblr5rm330usDYS:ghhLYIT2ABEKcYibl9KnhmYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666379933, "uuid": "1f15b12a-c1ed-44f5-96e6-f6a2a324dc1f", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666379933, "uuid": "20aac1e6-0420-455f-9c7a-e328cb8b1708", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666379933, "uuid": "cef3f480-91ed-43cb-a8fe-22ab9eb7348c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290a5b76-5135-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666352428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352428, "uuid": "3a28b4ac-1dae-4fc6-8533-09d8dced603e", "comment": "Malware payload (Smoke Loader)", "value": "6fce318bf663aa43ea1eb9c31cba0718", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352428, "uuid": "89c39765-0752-455a-8ab8-3a75211823af", "comment": "Malware payload (Smoke Loader)", "value": "61db5bac5e9f5e757e9a2f650a67b0b3c1f207f8fe3237786ca14ac098a71c0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352428, "uuid": "3ff132fc-36d1-493c-b216-557a8ad780ff", "comment": "Malware payload (Smoke Loader)", "value": "4cc89b4485c5b6ed22ad826d3e054b5b6efdd6b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352428, "uuid": "1adf6913-5bec-49ea-908a-419922af80ba", "comment": "Malware payload (Smoke Loader)", "value": "5a2d70e2eb3b577a7b31be2fa2adf757c4747d51d6847bf2450e2a44dc96b91f5a8380ffb3c1c3484de1b3e04ea52c82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352428, "uuid": "1837d069-2c48-44ff-ad3f-0bd84b18bbf1", "value": "T10224E0267A92D831C44659304421DFB47ABF7C30A672476B3BA43F2E1F712D24AB6386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352428, "uuid": "f68aa27d-925b-4e45-9b38-911b04d6303d", "value": "965326d499ea63bde30a73f94c3886cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352428, "uuid": "3a9639f2-df76-45b5-8e80-f83cda5484e9", "value": "3072:vXS4jL/J0RgL5RiwN8FAFOucg3KzL9/FFv9Cd3BRn0K9vxGWf5Py:fpjLR02jJXR3KzL9Dv9yn0GV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666352428, "uuid": "7cb928f3-ee1e-4fa7-86e6-be3e80cf202c", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666352428, "uuid": "aeb407c5-c655-4a2f-98a4-0d5942a99b94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352428, "uuid": "3d014b0c-a850-4750-959e-877883951adf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7961a9c4-5151-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666364588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666364588, "uuid": "25d8de40-9324-439a-8397-215d47f066a2", "comment": "Malware payload", "value": "edbfc2ae4a9d3a186ca70f0f5689f041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666364588, "uuid": "2dba2196-35dc-4f0a-8b84-603ecaf86e9e", "comment": "Malware payload", "value": "62627117a06ed31dc7ffee25e04cc58cdc80dc116449d2fe06cb9009d5c81c81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666364588, "uuid": "db486fef-0576-4620-9c42-494161a92ec8", "comment": "Malware payload", "value": "5922791086ab4237d07cd8b2256484bb578571cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666364588, "uuid": "16793e3e-d237-43e3-bfb2-2b455d692d9e", "comment": "Malware payload", "value": "ce90f2c04d8478d3d7bd714b6e7adca220ca47389dbc4a851f1f0f3d5d45ada38cefe100062ad01e576bf2f6ad485f7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666364588, "uuid": "3b42d6d6-4ab9-4e9b-9d28-4a4267aaa51a", "value": "T13B76336636F510F5C38302F1693ABF8AB2B2EBA04FA27547F344471C0D618F28695ADD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666364588, "uuid": "3ffff6ee-a512-4d3f-bc07-4f39b0a29ab4", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666364588, "uuid": "0034bdb9-ecce-481e-a8ed-f7b3104f7f32", "value": "196608:91OvMnN/5qrdfi3uhdJq2kFOcNJk46d6/JFojou08+QkSY:3OITYs+hulFLe46+FpuYQk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666364588, "uuid": "bc032818-ce3b-4db1-859e-de5e68cab7a9", "value": 7609774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666364588, "uuid": "fdfcd22a-1876-4111-9ae5-bb0c17ffab60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666364588, "uuid": "fbf85183-ae7f-471c-a545-cb5736db2f4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846a3eba-511f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343132, "uuid": "01327469-5958-462d-aa6c-7a12dbe236fa", "comment": "Malware payload", "value": "dc030bc6a84e1ca817f0a4611a239c91", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343132, "uuid": "09d298b5-4349-44df-a2b0-4e1d66941aa6", "comment": "Malware payload", "value": "62a48bcb2d2f22017ce67b853654903464c19892a07a3c0ca020048cb049f0cd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343132, "uuid": "9c6edb35-6be6-4b88-b7d7-44d6788809f4", "comment": "Malware payload", "value": "e9145d232a2efbc0bf6625af218a437489ba5e7e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343132, "uuid": "8f13869b-d3d9-42c5-bb92-f5c8664ed72d", "comment": "Malware payload", "value": "59bd084034cd7cae0e16aab846b71e05b1fff622032a7f3ab87b8bfb817ed5f872ccdb534545367bc16058493898998d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343132, "uuid": "23668d84-1f9e-47cf-b8bb-824d189ecb6d", "value": "T1EC85F193FB14E86EC8F387368A76062645165C568783D34359A5733C3DBB9C09E8AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343132, "uuid": "eeb20064-b16f-494e-86bd-c378a9961077", "value": "49152:OQrlfUHwgCVCBP68COeD/WbBejDgBiD6b+gC7E:OufOrCV+P65O3bQjD6bH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343132, "uuid": "89b2f01a-e5c5-47f4-816e-d4f051fc77d6", "value": 1805770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343132, "uuid": "1fadbd6c-1378-4a28-a628-fd7307188d1c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343132, "uuid": "61619467-cdbc-4e6c-bb47-68c3898be909", "value": "62a48bcb2d2f22017ce67b853654903464c19892a07a3c0ca020048cb049f0cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3948969f-518d-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666390251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666390251, "uuid": "e7d88800-ab35-4610-bd50-484886766176", "comment": "Malware payload", "value": "8da18da9b74dff9a85e985da16beefed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666390251, "uuid": "d1533a4d-fec9-42fc-9c9c-92a1a73f9296", "comment": "Malware payload", "value": "63120e5c842c133f20881b9127780b9b97862cc128610b560300fb2232b87138", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666390251, "uuid": "26a11d9e-0fd4-4b19-8ff8-e8627739bfb5", "comment": "Malware payload", "value": "871067e1bc7595b87857c87f3e353f406347d885", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666390251, "uuid": "3aecb180-ecf7-4d91-a1a8-63353506adfc", "comment": "Malware payload", "value": "26e67948da6d1241d5154f731c1072742275451674511e901091b536cce1d6a865bb1d624fed88008648adbbd530bd5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666390251, "uuid": "6135753d-59d5-4323-b640-38c517925853", "value": "T1A934E0017FD2C871C4B241354871CBE0657BFC72D665899B3BA4FBAE5E302D29AB2316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666390251, "uuid": "802b15ca-5315-4f97-9b7f-4d0e6ecb4291", "value": "bc5a05e947eb61731a4e3024a4f4b617", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666390251, "uuid": "7fa5fe7c-2b30-499e-b626-a0f61dd0a08b", "value": "6144:4vrYLmjWAtmPlmvAPv+3VeOivStEUwchPS:4vrYajbt+lmF3VeOiwwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666390251, "uuid": "e390c6ac-99ac-4cd0-afea-fc60c2713dfb", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666390251, "uuid": "badd6823-c58b-4282-be59-d39958c556aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666390251, "uuid": "1433a62e-c751-46e3-80de-fd93849cca46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c66605fe-5113-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666338089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338089, "uuid": "735b07e1-8fc8-4038-9bfe-52cf77b5dfbd", "comment": "Malware payload", "value": "fdbb577e635cd70eea98ecb7401dfc18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338089, "uuid": "9e322ebd-d6ea-4370-bc28-8fe14113e974", "comment": "Malware payload", "value": "64854c11c2c3c634f7d18cb2bcb8890edb99ef0361c07863225b4a47f74a0c8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338089, "uuid": "75a1ed1e-4f7d-4f4d-a705-8dc88b8cc5ca", "comment": "Malware payload", "value": "65b6b11e8e05327e7f587f585121ef25f6e1a01a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338089, "uuid": "9554fa4b-e72b-4674-a105-cae0a16ba511", "comment": "Malware payload", "value": "5e3103f4882c8e26681abef407d44c4fcea8b28cb94d859f10d3e80b81d04b49db76751a403fe0dec2c0f76d24278b84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338089, "uuid": "ad790d50-91dc-4080-ba37-4d728e3d519c", "value": "T13AF37F7362FD31F7E5A80B3814072B2A1F207F76AA33990E6A7679F56375F910426D80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338089, "uuid": "168da6c9-ce80-4eb2-8dde-33b52d3c4cda", "value": "192:Mk4Ffu2jLN/umEOK3VTiTdGXRagEillaPUhUhUhUTUUnSP/KZ8qfX:CFFLN/ulO4V2leWWWDrZLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666338089, "uuid": "3e8742f0-b65b-47bd-b965-a5cd7051f1ca", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666338089, "uuid": "be107d8c-e836-4449-bde5-8296d38d0264", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338089, "uuid": "8b72c9f4-4a1b-4991-8796-922e8dc5c479", "value": "Haridsen Trading & Ind Service - Items List and Spec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ee5e40-517c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666383269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383269, "uuid": "cebaab57-f4bb-44e2-a14d-246f12f14be4", "comment": "Malware payload", "value": "0a93ad1cbe55fc9ef5c426afc116bcf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383269, "uuid": "d14e6d5b-a157-416c-b27c-8434f0734041", "comment": "Malware payload", "value": "64fd129ace1b08512ac0ffa8b8151d56cd6e45ef5cc6859391467d6b710c6a96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383269, "uuid": "6590ed18-67ea-4992-a664-45157f7fdc03", "comment": "Malware payload", "value": "84ee30cb89bb64f3df019f45512659dd29b95506", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383269, "uuid": "fb63938f-cde2-4d86-8fc3-9363368f1a7f", "comment": "Malware payload", "value": "efaac3db87d3f29d2c0475d8debb0596450d419b60c866e12badf7226fd082991b4843683dce5805d8bd7e2987802b60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383269, "uuid": "4b627edd-56e5-448e-bfe7-dcfeec0cf6c1", "value": "T16834E011B6D2D872C882593088A0DFA425BFBC72657699937B583F6E1FB03C15FB6342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383269, "uuid": "67f3ee93-dcb0-4ff3-bb96-62b91820be8a", "value": "bc5a05e947eb61731a4e3024a4f4b617", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383269, "uuid": "b02b44d1-1289-4286-9125-cd4bd8322c4f", "value": "3072:UHXibYLXmH7uA1E52FZ8fVl31uzyAWLVJ6ZQJwCmdICCxE/shH0JzS:A8YL2buA11CfVlfAOVxhmd1JAHeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666383269, "uuid": "86863967-0f0a-45ce-b1da-bbec94d6edce", "value": 231936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666383269, "uuid": "009772e7-91b3-45dd-91c7-5b07ac37e798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383269, "uuid": "9fdf61fc-cffe-4557-a11d-d2d0c3ab9adb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d0b132-5113-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666337907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666337907, "uuid": "83a9c18e-b4dd-43dd-ba81-a1fa14a16b98", "comment": "Malware payload (AgentTesla)", "value": "9f34c3b02ab890422c0579c376c3b7a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666337907, "uuid": "dc9cb974-78fa-4707-af76-49cf24b392b6", "comment": "Malware payload (AgentTesla)", "value": "657c17e064db45fbcf242d3c80641d50dbcc6ee1e2a63c3775acd2d025b832bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666337907, "uuid": "958a9c9b-9692-4a6a-b8a9-24fd2c1eff52", "comment": "Malware payload (AgentTesla)", "value": "d08e3a387a4e11f5181bd7bef0a9a93c62561046", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666337907, "uuid": "9eac3c62-db04-49ff-b0f8-056fac733706", "comment": "Malware payload (AgentTesla)", "value": "ed0ff9c3bbaa07ed0ddef826db3f0552d686d7c958e8c952085d0831aae293c81fd706bca71837e480b0a86593eaa274", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666337907, "uuid": "82605cd5-fe85-4c17-977a-9ee839dfa04c", "value": "T14AB4236AC709D478EDC5940E2690C22C7523FE72FB6EAF22DD16BE4885FA09056CF453", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666337907, "uuid": "5141a2f4-5bb0-455c-90db-e6cd83c372ed", "value": "12288:2TXPdLcbo3smAn5rl73n500rS0RmnU+ioi4hIiIdysjA6fq3Odj:27PB98mA90wS0RQUjPyQvfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666337907, "uuid": "75db81cf-9a16-4872-b550-fec7c44781c2", "value": 535343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666337907, "uuid": "3616695c-7f2d-481c-a869-82966ef9345e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666337907, "uuid": "e1cf4699-daac-4a6e-bb51-9c7010bbd835", "value": "bank details.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e70c369-5117-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1666339525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339525, "uuid": "4cf2c322-db10-4d26-a2f9-1259c6c74822", "comment": "Malware payload (GuLoader)", "value": "b8e69b16870a738aee08306442963f1a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339525, "uuid": "40ae49df-e094-4028-8921-d33af5f744f5", "comment": "Malware payload (GuLoader)", "value": "65868b2e5ecf57c5c0cdf2f926331d6a1b22621562dce45712ce301878601a31", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339525, "uuid": "24e8210e-4066-4beb-923e-014b5c15f275", "comment": "Malware payload (GuLoader)", "value": "b28529daceab16f43748f2d16b9eaed928522b01", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339525, "uuid": "eed784b0-43d4-4b2a-b793-932c765010c4", "comment": "Malware payload (GuLoader)", "value": "a9b5abd08f58d227a2df3adb9ff774ddc9cd4b05e5ef1ed5d4ac38c48b06c80ebe8b4c9db93df56fa4f6f5a501c1ef09", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339525, "uuid": "2bcf4ef1-8627-4b02-a0c5-b135fd2272e9", "value": "T16DE4E1C5AD670E1ECF6923EEBC4A0E594D7D815AD204027A3DD8358CB90B36D21AF36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339525, "uuid": "455603c1-4195-48a2-84c3-d83858f651b3", "value": "12288:g7RRZ8lS+8CMbwwlVvFin7TipN0ae4QnNYTxA2lx:6Tp+XXymnnjxnKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666339525, "uuid": "93009095-eab7-41b2-860e-47ec9ace21e0", "value": 671821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666339525, "uuid": "6a023849-21ba-45c2-bea6-d03ab4d60f4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339525, "uuid": "eeafaa06-1fa0-43ea-bd8a-433b97b84123", "value": "RE DHL Shipment Notification(BL,INV and PL)215158433805.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "012f4898-5102-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666330457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666330457, "uuid": "6a9a129c-8066-460c-a19d-9a7a4c359afc", "comment": "Malware payload (AgentTesla)", "value": "85230ca9ac36a964607c95e1ca852110", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666330457, "uuid": "369881a8-016a-48c2-a65e-801b8ef442e0", "comment": "Malware payload (AgentTesla)", "value": "66ad671957356b0a979ac4ce68ade78f8ddfda2dabd4e1dc0b1ec68a1ac6dcf5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666330457, "uuid": "05927546-ff9a-4743-9ab0-83be8368361a", "comment": "Malware payload (AgentTesla)", "value": "68a593c534df9153f79a164a11c930d509684f1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666330457, "uuid": "282c64da-a358-40bf-a422-5add9e57bd8f", "comment": "Malware payload (AgentTesla)", "value": "6877c9ea604b4aa1e7383bad555bf034068aa230489961772ae5811f5759c828fa5684c9dc9943822ec3371327f27c5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666330457, "uuid": "4e10b113-d978-4f54-9614-c2f6f30a3c10", "value": "T1CAE4E0BE5B444ED7CD2C997EC4A2916472F0FDAF1102F64E7D9320D90AE07DE8392896", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666330457, "uuid": "0bf958d5-40bb-4eb6-ad53-4b4e5b2de450", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666330457, "uuid": "5f09cae5-19ce-4169-870c-4e700732d8c9", "value": "12288:I0JjowpCQo4EGM2kfRL9doYyFjnQ0Bv9+EGvH7yNHH2gtZE100nX:1EVPGYyhHF+HWF2uM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666330457, "uuid": "9bac80fe-c471-4367-923f-a4917d8dd679", "value": 666624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666330457, "uuid": "32739d52-fe58-4cd0-9173-4bcb47607ca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666330457, "uuid": "b70d9bdf-35c2-4399-a0d0-92ff03e7c8ab", "value": "BALANCE PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a50654e-50e9-11ed-9266-42010a9c0072", "comment": "Malware payload (Kaiji)", "timestamp": 1666319869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666319869, "uuid": "dbcb1ecb-24ec-4fa1-bfa9-c90c830702b6", "comment": "Malware payload (Kaiji)", "value": "525b03f54f61cdef758e36f577236c1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666319869, "uuid": "ae029693-9115-418b-af9a-531e6cee5305", "comment": "Malware payload (Kaiji)", "value": "6700a6f0f01b0b4f7cc195ab9f24da95301b428b32addbe6913628d35f2345c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666319869, "uuid": "160740b7-16c5-472e-b0b2-a6b985a463b6", "comment": "Malware payload (Kaiji)", "value": "f8510fd80628e051d1db28c24796396b8ec48435", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666319869, "uuid": "122926de-8e09-40b5-8808-565363ea51c4", "comment": "Malware payload (Kaiji)", "value": "44cd6f9385fc49c4804d30c2234e0a888c595bce6e97934f89af27f3983b287b00631c02bc81e32952a872eb85baa1a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666319869, "uuid": "5fa37179-93da-41d0-94ae-c8e9924be754", "value": "T165364A10FECB54F6D5031D3044ABE2AF67316D064B25EB83EA047F6AF97B6A51D32209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666319869, "uuid": "7fbf696a-fab5-41db-a0c9-5b6e405134ae", "value": "49152:E33d0lGt6UHcFL7Rn2o03wiEhiDmzzd/9sARlBs/00Cpfx9a9uN3p9hW16klbU6V:E33GlbU8FwmzzRDZ9m8qRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666319869, "uuid": "68520afd-c380-44a1-bd81-696ecb6bba02", "value": 5251072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666319869, "uuid": "001d53bc-88f3-45f3-9c5c-14903205fc6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666319869, "uuid": "00b3101d-6adc-4c41-90c3-cf5551b342ce", "value": "linux_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48019bc8-5121-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343890, "uuid": "3fb09f44-b408-4bc8-9f96-3e1f2c3d9f9e", "comment": "Malware payload", "value": "a4c47367783405929e887ee955e21357", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343890, "uuid": "19348cbf-fcea-4626-af1d-ea1d16f75af6", "comment": "Malware payload", "value": "68a1452172636b081873b9f7c1ae3794035c4ff50d5538b656caf07016b74d07", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343890, "uuid": "a33b5e2b-8267-4562-848b-6d41602559e6", "comment": "Malware payload", "value": "424e86bb95dd9c18a0c576ff09bfb78433968ecd", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343890, "uuid": "94a981ab-0914-4bb8-ab5e-56641924c516", "comment": "Malware payload", "value": "3a358a5894f195d90d700225e4728afd99cb439226ce54c96e75933cae645c1af9f696cf7457e31da2e3eb1abba17024", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343890, "uuid": "b4a12f49-7c3f-4764-9d84-8a81bfca9001", "value": "T1AE66E196F390EB22E0BE9B32CD76C2D1712E6D40CF0EA6773604B32C59B39C54D56A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343890, "uuid": "bc090368-5874-4c86-b4ea-607cc46b16b0", "value": "98304:a3T0gL6HG6n8ZfpBR4bZcXxGaABrk02+D9sYS//75jRVMNN7bL/NLycThT0A7i1P:a3T086H1S4bZ6G2LSunhMLhT0I6QpeJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343890, "uuid": "695cef40-527f-4141-9015-1dbc52d328f5", "value": 7012876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343890, "uuid": "a36e9bda-637d-4202-88bc-4adad93fc95f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343890, "uuid": "a5159205-330d-4b59-b7a5-7c83a710c39e", "value": "68a1452172636b081873b9f7c1ae3794035c4ff50d5538b656caf07016b74d07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23e2f8b-5138-11ed-9266-42010a9c0072", "comment": "Malware payload (DarkCloud)", "timestamp": 1666354027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666354027, "uuid": "7b5aaac5-b6f2-42ee-a79d-0a68207ab837", "comment": "Malware payload (DarkCloud)", "value": "d9495232010419da4ccb8fc1252e0cd8", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666354027, "uuid": "58cf49a7-703d-463c-909b-dc2bfb323c79", "comment": "Malware payload (DarkCloud)", "value": "68bef7d7a6c7e720a00ff6c2807eeaa770021c6369c8d915d6a173099dbf5b18", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666354027, "uuid": "0e1f8f82-3c7b-43df-8465-cacdd0c86e7e", "comment": "Malware payload (DarkCloud)", "value": "4fc56d189dc7209d745dc0427605826c11c1e0f3", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666354027, "uuid": "0b09bbda-0f65-42c8-827c-6152de66fea5", "comment": "Malware payload (DarkCloud)", "value": "e551a1a666a98b7ee71516083e6d4088ce9e364d385efa41a54533a162600f922d650e4e91ccce639d290bffa046ceb2", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666354027, "uuid": "85604c23-b8c6-4232-a194-0ad11a6f2c38", "value": "T1BF05CEA03F8AAD5DC8CE0C318FB1DE14FD23EE55187AA6B72749736B69F269045D0132", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666354027, "uuid": "3e297cb1-4c90-4b7c-b62f-a48576f16993", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666354027, "uuid": "91e9c366-ec0f-4997-b774-29b32c2ae910", "value": "6144:FygMAUbotTVmWzb0xz8s21/3qY7+OBZpyNbUzQaG4QOudmqBl:M71scu4xN21CY7+aZU2zQDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666354027, "uuid": "ea3cd8c4-71c1-4c19-ab02-900f4cbe564b", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666354027, "uuid": "331156fd-6d36-467d-94e1-5b161d8b1a96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666354027, "uuid": "8b9b378a-d45e-4caa-869b-214158324988", "value": "Collective Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65a3d09-50e9-11ed-9266-42010a9c0072", "comment": "Malware payload (Kaiji)", "timestamp": 1666320050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666320050, "uuid": "16fb858f-ca72-4ef9-be72-fbd35bb344c9", "comment": "Malware payload (Kaiji)", "value": "f615f8f3eeaf29fdb6b9281e3586d02c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666320050, "uuid": "d14f7ac5-d451-45b1-a508-1bab4c784e4e", "comment": "Malware payload (Kaiji)", "value": "68d16843aea8a23600ebfe142a74212ac2c1fa6d67f188222c3354274345acb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666320050, "uuid": "794d99f8-a1be-462b-aff1-69dea69aed22", "comment": "Malware payload (Kaiji)", "value": "7f37c08759cf7bf370d143939e74132823ddf52e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666320050, "uuid": "66447aa8-d276-47da-8639-dd672011b94f", "comment": "Malware payload (Kaiji)", "value": "07395b61e93856b373da74de33052eb3fc1744a8bb10819eef3baaaa5ba2377370787a864263bed95cd27265b16d3499", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666320050, "uuid": "c2fb5098-abf3-4a66-ad46-40c7945aa991", "value": "T1A8364A10FECB54F6D5031D3044ABE2AF67316D064B25EB83EA047F6AF97B6A51D32209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666320050, "uuid": "5dd61793-c1f8-42b9-978f-c3a826df7e8e", "value": "49152:E33d0lGt6UHcFL7Rn2o03wiEhiDmzzd/9sARlBs/00Cpfx9a9uNIp9hW16klbU6V:E33GlbU8FwmzzRDZ9mbqRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666320050, "uuid": "df871a39-d489-4ca9-9a6d-43e27cea6e0b", "value": 5251072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666320050, "uuid": "5948ec62-6b50-48b3-a07a-9aefd1770b19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666320050, "uuid": "3d1a8ad4-4939-4009-ad02-4b8756dced2a", "value": "hb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5540f4c-5166-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666373708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373708, "uuid": "b515afd3-a97c-47ef-8f6f-a5eaee73c57b", "comment": "Malware payload", "value": "4cf7cc220ac7067fb426f142abbc9468", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373708, "uuid": "a6ebdd28-76db-4f8f-965e-2b083539bf62", "comment": "Malware payload", "value": "68ff988170989b1c7fed3a926fbd9ba6dd54fb43f05d03d1f49ad7d84a830cff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373708, "uuid": "7c89f0e5-38a7-4be8-9e58-e5b1f655cc8d", "comment": "Malware payload", "value": "3de8c3ad3b04a1772e7e22cc0d2eb56295bef4dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373708, "uuid": "96f70bca-3e6e-46bd-8463-8517391b04de", "comment": "Malware payload", "value": "068051b8617e1366b93b821366832b946839529836cae537b0d6df62e81ed9f42a6b97e4ab2e11bc45105ee3564fa6a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373708, "uuid": "6d9e5ff8-1a83-45b8-828b-4dc505695991", "value": "T110844AC573949013EC675A304EA383CA9769FC90AE34719B2365F76E0B3BDD26E64B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373708, "uuid": "0994385f-61a8-440d-80fe-3cdda7f88cda", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373708, "uuid": "d2a4d1c9-25af-49a4-b90f-1e2997a32327", "value": "1536:Lrae78zjORCDGwfdCSog01313Ks5gHZKur:hahKyd2n31z5wKur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666373708, "uuid": "15e140a1-f724-44ad-9984-853feecabd41", "value": 373760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666373708, "uuid": "b3ad0dc0-6827-4400-9d2a-de661ea4e4fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373708, "uuid": "4c4cb885-b3a6-4703-9a33-be5b9691f987", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b543f2e-5132-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666351143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666351143, "uuid": "9c1160a2-5a4f-49ad-a0fa-a6b1da54cb2b", "comment": "Malware payload (AgentTesla)", "value": "a59d28fc6616da79baeacaa49bc57d36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666351143, "uuid": "69a6efab-9acc-4f84-acc1-b565dc836239", "comment": "Malware payload (AgentTesla)", "value": "69ceaaaaed6dc134f41a15ec83229bf59ab748d331119243b1d92b4ec70271e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666351143, "uuid": "1e2f7793-cb84-421b-bcef-09498847a481", "comment": "Malware payload (AgentTesla)", "value": "63e09151683106fd29dadd032453353cc264b0b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666351143, "uuid": "1939d5d8-448d-415d-a14d-3704696020d4", "comment": "Malware payload (AgentTesla)", "value": "6e385a2905c33ef86e4fc4f28008ec265bebd767c5aa8fb1bb1bf8145d677500684449b66535a576a9ce4cca8b282007", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666351143, "uuid": "97b2023a-eaa2-4fbb-9bab-f020d63dd775", "value": "T11A15CFBE96484E9FDC280B39C032112142F17C5376A4E7ED6E9270F75AF25845F63E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666351143, "uuid": "8fc70e79-7f55-4d1a-b963-e151e6e3ef40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666351143, "uuid": "2f2a1089-79cf-4b61-bc6e-b293cd242450", "value": "12288:k07MtLdEM2m/6A//UCd2+9gJCmlN8cn9fVHLDiXto1M309C9/5:RMtB1/nn8ZJhlZhv9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666351143, "uuid": "f77d694f-76ec-48c7-a958-3f0b270ab4df", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666351143, "uuid": "bdc900be-a7dc-4835-80ae-89d4727e4a9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666351143, "uuid": "b8b868f1-f98a-48a0-b977-7ebeb417dad6", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4c54e7-510e-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666335715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335715, "uuid": "f14125a3-5817-4fc9-a112-ce626e1fb075", "comment": "Malware payload (Smoke Loader)", "value": "f0aa206e4e5998dee5331a7fb6ff8a41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335715, "uuid": "0f246248-5abb-4e64-a574-fd285dae2200", "comment": "Malware payload (Smoke Loader)", "value": "69d5307af780dc9394947be77256a8e600ce21e59a5e64306b6a916966656d9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335715, "uuid": "bf6dedec-8da6-468d-b143-1e9f95e35ed6", "comment": "Malware payload (Smoke Loader)", "value": "adcdd975a88ddb50b5b975bcc36cd99a95d79285", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335715, "uuid": "dcd2a12f-36f1-431f-9b48-a2016d6b4992", "comment": "Malware payload (Smoke Loader)", "value": "eb56001b83c725e8e1d37cbb67abafb08b3cadaf43c0bb7de36fa8dae747ca7d1cb4c77053b3662c0c6d09f6dacd9c55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335715, "uuid": "dc837a66-3bb9-4fbe-8759-12ca39a9dd6a", "value": "T17E14D022B59EC8F1C48645308868DFB0EA7FA9302675899337B81F6E5F313D156B6386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335715, "uuid": "4bc4f5bf-5d57-4348-94fc-0cd3e5d04e3b", "value": "3e6038f4356f890c26b700ce3212574e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335715, "uuid": "bcc38f3d-7c96-444f-b908-93fd3021b321", "value": "3072:kXDHmLoMqSq5rc7mAvC+/cYh1EJ0Kh5rhU:grmLvj08mAv7cYh1c0urh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666335715, "uuid": "39909510-335e-422a-b5e8-8302eff3bc46", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666335715, "uuid": "44c08889-1aed-4708-b032-0761806bd3fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335715, "uuid": "9c38d124-517d-4d46-b467-ef50a45405a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "294281ed-50d8-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666312485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666312485, "uuid": "a7070661-1ec0-4210-8245-dc681159944f", "comment": "Malware payload (Smoke Loader)", "value": "0f16aa74efe0fb345f7caf0b7f859f97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666312485, "uuid": "e4dc87bd-8471-4792-b1bc-b17b6e44b4c2", "comment": "Malware payload (Smoke Loader)", "value": "6a9be8647b71d4463dec44b721a27a29739881980420eac9b90e425bcfc41c93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666312485, "uuid": "f5ea228f-e8a0-4eae-92d8-4f776ca4415c", "comment": "Malware payload (Smoke Loader)", "value": "37d91fc1efc257269ae7c5fdb8ad566ddfcd2c75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666312485, "uuid": "b33ae35e-7db7-4b47-b227-fa495c9d0df4", "comment": "Malware payload (Smoke Loader)", "value": "a196f0d558e4e0910c22daa0bacdc56ade35b2ef55a992e61a69d68a6756c9cd37008b54a9235368e4ab271883212b91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666312485, "uuid": "e48f7ab5-1cf0-4f6c-9cb3-bffd0a5dc8f3", "value": "T1F614D0157582C8B2C08554704864CFF5AD3FA830EE718AD737B56B7E5E313D2A3B628A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666312485, "uuid": "dd73def9-4f60-4c52-af83-411445989414", "value": "ee783376aeb5a6ccd1e2676f1a5f0e82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666312485, "uuid": "3251412a-fa27-44b8-9997-c9160a1f9a3e", "value": "3072:DXJODLMFFHN65Eqvz6uPsHmqFbJMqli2Lqt0KcXC6by:7gDLMbtcuoebJW0YOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666312485, "uuid": "fcb4dbbf-2b70-4c34-8fb4-68941510bbd9", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666312485, "uuid": "6e1b316c-34a5-46ab-8139-ca6aa291ff0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666312485, "uuid": "9b2b48cd-acfd-47e6-84f1-0e6c9ef362a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f30b6a-514b-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666362222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666362222, "uuid": "08b60009-6c4d-478b-838f-214b2cafa24e", "comment": "Malware payload (CoinMiner)", "value": "593b717044ab45c77fbe7a20b5520eb7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666362222, "uuid": "00c0bf00-6766-4b25-90d9-0aaa50765e9c", "comment": "Malware payload (CoinMiner)", "value": "6ac2f6ee9985ce4d851363e44d1addd6e7ee21567c9f90383e31620289efe8f1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666362222, "uuid": "ad465727-c655-4a1d-bf2f-63b55d34f06a", "comment": "Malware payload (CoinMiner)", "value": "de721d6812e5e189a9fd929685b24cc832f778f2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666362222, "uuid": "78454b55-9439-41bc-8cad-3ee4bfc8b741", "comment": "Malware payload (CoinMiner)", "value": "506680edf9fdd89522dd35538784843354b378d8cba1ab2453a2a7d3d7c31706df9a9e717237750ef5f3583d224c4870", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666362222, "uuid": "7b4aa851-a8b5-4d48-b49b-74c5ced4db00", "value": "T12024E10176C3C87AC44610354C74DFA11ABFA8325235998B376837AD6F702D26AB6FDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666362222, "uuid": "a1188940-6b01-476b-832d-0cbac4be4b48", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666362222, "uuid": "3855cac1-4964-412c-9e6f-e58113d17115", "value": "6144:zcK5tLp5IhQXcJ7LmEXPVW/h/44G+dNueElaa:zcK5tF5ImXcJ7LmEfVp2dNa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666362222, "uuid": "e9c1853c-4fac-45fe-85ba-badf4c285c63", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666362222, "uuid": "a40b9836-ba64-4a8c-9049-07da4cbd8de1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666362222, "uuid": "734eb22b-ba32-446e-bde2-f1479147e865", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aff1e2f-5158-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666367624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666367624, "uuid": "d93ab7d5-3747-475a-ad8f-9d121b6db6e7", "comment": "Malware payload", "value": "368c4ce6979e785101dffcd1aed9388e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666367624, "uuid": "3e93df41-e530-4629-b351-67b1fc9caa49", "comment": "Malware payload", "value": "6d54b83f59de5a2ed9ffa13fc40c65fdeebc14d9e0c2f9417f326fc9c58bdbf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666367624, "uuid": "12940aec-32dc-4157-80ab-86aa0d0d521e", "comment": "Malware payload", "value": "1440168c4391194c6ca1734c98cf607e5963ea20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666367624, "uuid": "af7212fc-fdce-4559-bfdf-858d8aad70fa", "comment": "Malware payload", "value": "263906f28e1158b08303dffdf292186992e29a474ee776dd0459feaf7430e07904f318ad30cf85e505eeecd4677bb906", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666367624, "uuid": "2239d66d-42e5-443a-b5bc-d6a2d920e36f", "value": "T16D740211B6C2C431CC17A9391024CE55AE3BBD3252B54E6B77987B2E5EB02D39E7630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666367624, "uuid": "a0187da9-4af7-497c-9dd1-95d9fb1b8f9d", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666367624, "uuid": "1e8b3dac-893e-469f-b795-ccdfc27430fc", "value": "6144:CKfLFh6uQ9GsYSIV54ANMmKZ4qc6MHTqvMXHAQPBU1IBlRoz:CKf5h6b9GsoVyQsIcMXAQPs6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666367624, "uuid": "54c5686d-a6c8-4942-946a-4d79d3850fc2", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666367624, "uuid": "6dbd4514-2ef9-4fa0-b48c-36b85dfe1557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666367624, "uuid": "9969de24-c9c6-4ded-93f6-b304005bc194", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c4731f-50e0-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1666316175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666316175, "uuid": "315c55d2-81dc-4d1e-bff2-7b8c07b69875", "comment": "Malware payload (RecordBreaker)", "value": "b6f0a3edaab0dd74128bbb8d5f1a005b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666316175, "uuid": "5fffe3ff-687b-4ada-a001-998c215a231c", "comment": "Malware payload (RecordBreaker)", "value": "6e1a4fc37e91f501718aeb4b8d8ee705735a4c7fffd67873d528493e17477a49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666316175, "uuid": "f9d8ac71-3db5-4132-a6ef-2978e6d7b377", "comment": "Malware payload (RecordBreaker)", "value": "9ef5c5bf58a0ea3a1ea1d2f6459903011f767c89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666316175, "uuid": "bfaf3b32-0d59-4db1-baf8-2f1fd56611ec", "comment": "Malware payload (RecordBreaker)", "value": "5c4ef410d2a7da4cd97d568bf9231393574a591a9d1fbbac55dcfdaa1c0b0180939deae67c90f599c8f04c8657e39932", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666316175, "uuid": "e62c925f-e641-463a-a089-6e64c9faf6cc", "value": "T1D314E025BAC2F871C44654708455FBB1273FB93226F19E933FA527AE2F302D16776282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666316175, "uuid": "004fd3c8-7457-4959-b1c7-ba6de6b8f080", "value": "ee783376aeb5a6ccd1e2676f1a5f0e82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666316175, "uuid": "ad1e2ec9-3210-4d0a-ac90-dbff23cb8742", "value": "3072:LXSmILINq3e5QyMt7syN7nwgLG5yg2yPUYXYIg0Kxk5h:jPILGKXyM18pIgBdg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666316175, "uuid": "aee245e8-6c00-4b4d-9121-795d6c61b4f5", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666316175, "uuid": "2cc3be7e-3055-494e-b8bd-60bcce28698e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666316175, "uuid": "dfa6b219-b1c6-492d-8c72-c758b67be4f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221f277b-50f9-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1666326646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666326646, "uuid": "33b5b68a-8912-4289-956b-763467ff3604", "comment": "Malware payload (RecordBreaker)", "value": "0e70c10f110a8d3ebd896c096e509315", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666326646, "uuid": "8d62511c-af6c-425e-abb3-5e315f3901ef", "comment": "Malware payload (RecordBreaker)", "value": "6e7b67782565701d2a06a8f63e297ba7b68c656412f91d1ea16aeebe4c46f6fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666326646, "uuid": "6a7ee462-d1dc-48ac-b8a4-d6f3101182c8", "comment": "Malware payload (RecordBreaker)", "value": "8cb3b618beca9356c4830fe997203b28502f8592", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666326646, "uuid": "cfcbac9a-d0df-4a82-af22-20227f457384", "comment": "Malware payload (RecordBreaker)", "value": "2f31f197f99303f9d2efeb046c35b35522e6cc108ac2f1d563d2d9d2a1c0141bbaeb2c30ccb19adc021041048f1dad52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666326646, "uuid": "d793f0f3-d307-4f0e-b510-36002c754e02", "value": "T1E514D01E79EFC0B2C04618744435DBA12A7FA831277D8E573B641BAE1F732E11A76386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666326646, "uuid": "24c52b6d-cc71-406f-9c79-ada4f995d0dc", "value": "3e6038f4356f890c26b700ce3212574e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666326646, "uuid": "4333bbb9-d944-48f0-85f3-1f8a21df5022", "value": "3072:QXDvCLgLSYD5aKKhhhV57isSO7kcxcDPf0KpYid4:EDCLY9wLhvmCFxY02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666326646, "uuid": "31ea9788-54b9-469a-8cb2-3442464332d1", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666326646, "uuid": "ed712091-775e-49eb-a1e8-471b86a707d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666326646, "uuid": "55ac63c3-cf16-4858-931a-0b4f6e27f19f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60315bec-50f4-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666324603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666324603, "uuid": "85260025-1103-4c5d-be30-d73fc8a0e293", "comment": "Malware payload", "value": "726c6f3e4483cbdefd244aaad1e460f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666324603, "uuid": "f800d773-5751-4007-9e44-835536d2b2b2", "comment": "Malware payload", "value": "6f57f5e9ffc2a1fe68a368d66c647a9d0eaafa4684322f4d2ae3115ac8c889a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666324603, "uuid": "05c03c35-f69b-4718-a178-2f77a4ef1fe0", "comment": "Malware payload", "value": "51ada0a53201bfe242b46a8b37250dd9f040789b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666324603, "uuid": "fb5ee6e2-a609-459c-aba9-5fa84bc78db8", "comment": "Malware payload", "value": "6b669c23df8b0e70eb21eb43e51ed04914a3b563c4cf57815561024ce415b06b2727eaddb4546eecfdf4c7836847076b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666324603, "uuid": "7eb3420e-82a6-45d1-b282-73f14abbe571", "value": "T186F31E211503D429F2C432F6456756FABBBD3C037D94D89E22A8B92B442D6C3AF07B5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666324603, "uuid": "ca332177-c148-4c3f-bf52-73095c716a85", "value": "384:6Qf+70+7L+AqqQaRRYLRRp/KRRHjb7dNNYrLCFxlDxaRUm0U5:j+OAqqUKFxlDxesG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666324603, "uuid": "27987d60-14ce-4554-a21d-5f5ccd92fd85", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666324603, "uuid": "d96bf9ae-3376-4ba5-b907-75a69c49892b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666324603, "uuid": "ed5f10c3-0e36-40ca-9aab-08ebcaa53ba6", "value": "VANTIEN PRO JSC - PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07ee188-515c-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1666369378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369378, "uuid": "5692bbc1-8e14-4929-8f0a-cd32c33cb6ea", "comment": "Malware payload (Loki)", "value": "ddcfd17ce2e015b728b67c603acc6ea2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369378, "uuid": "2218eba6-e637-4e0d-82ea-41fd746077d0", "comment": "Malware payload (Loki)", "value": "6fad980be503879043508f87004593ee8344b765157fe787cfef4d64bee02dab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369378, "uuid": "3fd9cc08-ec99-4367-a1a2-3c769a045594", "comment": "Malware payload (Loki)", "value": "a2c8a2c58a121e7cd6276d9da3d5caee2b718803", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369378, "uuid": "fa99d1a1-9722-4826-84e7-fe5cd627b09c", "comment": "Malware payload (Loki)", "value": "6831dc40732bada8e84d7bf553f269e924383a1b644d134c485de2711c232bd07cb67dcfaa28501efaada779ab11f431", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369378, "uuid": "a57bcfc5-d5cf-4655-ac72-da620970dca2", "value": "T1940402106722E677D8B257755C31AFFA07FB022559A25F430B40BF4E39722E28A1E762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369378, "uuid": "ed96523c-e6d3-4e45-ab9c-fc84a5e57a13", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369378, "uuid": "3311a394-a4de-4303-a388-c7e93237d654", "value": "3072:mbG7N2kDTHUpou/bOyoZo7GtT79by3cjvgkO3mjTNGNI2DWcOqN6ZaWj:mbE/HUbOPXbaevBKmVP2HOU6ZaWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666369378, "uuid": "a6e2e081-6e16-4958-995e-ae14daa63838", "value": 179424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666369378, "uuid": "44b7e35c-e299-44a2-9e35-ee3fe8d4fb27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369378, "uuid": "f2894d70-8a6a-4681-83bf-327f3f50efbb", "value": "13-10-2022_______________Remittance copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29165553-5148-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666360588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666360588, "uuid": "18de8bb8-6809-421b-bf99-4dbd450c2930", "comment": "Malware payload (RedLineStealer)", "value": "421f43f211064a2f164968306b6fa7ec", "object_relation": "md5", "Tag": [ { "name": "fake Zoom", "colour": "#7321DF", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666360588, "uuid": "cd016565-03a0-4f66-a1cc-bf9d063af718", "comment": "Malware payload (RedLineStealer)", "value": "7024a53fd9f7d3b6504a5eca3abf8195de16aa061d9bdcdd6fe47a22359a6962", "object_relation": "sha256", "Tag": [ { "name": "fake Zoom", "colour": "#7321DF", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666360588, "uuid": "12a3120b-521b-421c-9824-f000bcbf3d00", "comment": "Malware payload (RedLineStealer)", "value": "583b1399c1d850a46d6708a54e80083d527deda6", "object_relation": "sha1", "Tag": [ { "name": "fake Zoom", "colour": "#7321DF", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666360588, "uuid": "c034bb6a-8e80-4a56-948d-2a93b8525d0a", "comment": "Malware payload (RedLineStealer)", "value": "b18580b07cd76895c012610a33f9aa9c510ee5b55f39330ad6a44b91a6e9f45e68f64b8a04c6c9e9beff73592c116837", "object_relation": "sha3-384", "Tag": [ { "name": "fake Zoom", "colour": "#7321DF", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666360588, "uuid": "ca512d40-8dc1-49d4-818a-f8a82dc925c5", "value": "T11B95F09758A34F99CC59107C84DF5F433A9AAF0A4852936B5331F36FBFB2AF49924804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666360588, "uuid": "da3710c2-083b-404a-bd4e-10f44381f7ba", "value": "24576:vi9dTaRpS/TO1m/EuM+EqcCreOrPATRihcZv6yDWN03vxSfwI7RLhu:vi9dTaRpSL8HP9qE3ZSyDWN0pSf57RLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666360588, "uuid": "faba5831-197b-4ed2-9a89-a691cffc0400", "value": 2036516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666360588, "uuid": "8ddfa6dc-5239-4944-b600-92b10826236a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666360588, "uuid": "c8191a02-1283-49da-81c3-ff2cb1ccbca5", "value": "AppSetup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ca9313-515c-11ed-9266-42010a9c0072", "comment": "Malware payload (TeamBot)", "timestamp": 1666369223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369223, "uuid": "6908633d-08c0-42ab-85c9-b25a99fab46f", "comment": "Malware payload (TeamBot)", "value": "63432d6ad5779ea84f3cc02914b27ad1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369223, "uuid": "3f9ae911-8796-43e3-ad3e-b4273cf83d5e", "comment": "Malware payload (TeamBot)", "value": "7056525891cd72c3a0284a3703b95954b6e696f099405072119af7c94dd49ed1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369223, "uuid": "05ff2dd4-4aa5-4d90-b036-9591854270ec", "comment": "Malware payload (TeamBot)", "value": "460c1eea03a2244e91522e55f6ccbcbb1957a98e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369223, "uuid": "2984c919-e825-4010-a1e1-2a3435d374a7", "comment": "Malware payload (TeamBot)", "value": "f289ef9677c8622fd54cd61e2d96606a772f0fb49c7194ba435cc8d016bacf17348fee68c3783297bbdbb628d047cff4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369223, "uuid": "eaf3e5f9-4b5c-4ac1-a032-596a74602b3c", "value": "T12D34E01DFADED472C886443188F0DBA41A7EAC32257518D777643B6E2F702D15AB234E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369223, "uuid": "d6405564-7dbf-4c77-a8d3-71fe64fdef3e", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369223, "uuid": "365f9415-d36a-45c2-bef3-1cf2e22e682c", "value": "3072:NX1RcLz4WkQBO5Eayb04Sh/B09y986L7i2kPey7V:J3cLzvkQBR1RxM9xS2UV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666369223, "uuid": "10b20df0-90ab-4e37-bbbd-57c6a6dd3e69", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666369223, "uuid": "7b0e7fd3-3cbd-4aa7-a896-cd438596b31b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369223, "uuid": "1c5d509a-00d4-4616-abb7-453e206b55c7", "value": "63432d6ad5779ea84f3cc02914b27ad1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0231453-519b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666396436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666396436, "uuid": "afd54b65-8a84-49c6-af5e-b023db814bad", "comment": "Malware payload", "value": "d08f40dcf58576210cefc57ca730afed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666396436, "uuid": "6424a515-e021-4c40-bab9-93b05d48b901", "comment": "Malware payload", "value": "716bc5fe428a0a1731e106c077509d4d8e3eb3a4406435d6e32e6651795e5110", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666396436, "uuid": "b85aa47a-84c3-4dba-8d2f-326f750f4253", "comment": "Malware payload", "value": "09e2bc916e6252e35a9e41ed117073644d8b99eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666396436, "uuid": "86e3777e-e4e5-49d6-977b-de9424cfeb45", "comment": "Malware payload", "value": "4991667af483262ddd968220af926bfdb43fcb256b3d5f935734ad75c46513d4d2214e1b53fe067156e7153b0352b6df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666396436, "uuid": "a2fa85cc-a7df-4460-8fe4-5f24dd0f186e", "value": "T1BE34E0117992D872C88658348860DFA4167FBC32553948D77BA43FAF6FB03D25ABA343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666396436, "uuid": "1dba7bbe-f5d3-47bf-957c-85833b7442f5", "value": "b7130d64e41e1f3aeb19371c8fcd9d1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666396436, "uuid": "e2f12bb4-cb85-44bb-8c73-239ad7ede67f", "value": "3072:5X1K4LaFLD8Y9r5qAJLM9NCpZDAJAPt9TRasisEkB0RqMS:do4LaF/8Y9gKLdpyGPTR7i9kBoVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666396436, "uuid": "2ed93586-66a0-4b22-9979-c208c1896094", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666396436, "uuid": "6b1cfabd-9bf5-4ac0-982c-ebd47783aedc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666396436, "uuid": "c9e8de25-fd8f-48d7-956c-2cb626a0942c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecefd319-518b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666389693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666389693, "uuid": "74370221-8618-49ea-9802-123c3074db38", "comment": "Malware payload", "value": "9f3d97a301e69c315e3cd5b2effd8257", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666389693, "uuid": "89701a75-0af9-4aae-bb11-b247029caf63", "comment": "Malware payload", "value": "7285212dd10272ce52b5fa31b295c52170dfa4fd1cb1ace8427230b641e0a538", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666389693, "uuid": "c879363b-6dfa-4d0a-9584-2d6750c36a4b", "comment": "Malware payload", "value": "74b2bb96482f67fe3604a2825ec927e10fc1a90c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666389693, "uuid": "f7480d38-4dac-4726-bd62-aa9d61dd6c1b", "comment": "Malware payload", "value": "b8eb073d7347fa4367ac8a9cae3417aeb60374baa755fd07ad2452d6eb6ddfdc478be3eab1828167163403dec3b0f875", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666389693, "uuid": "7653ff80-b398-4a85-a8b3-43ce68100ed9", "value": "T1DCC53326CA358AB1D0E5CAFE2AF99E144AF5BA55113D708F73DF90C402BB2C491793C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666389693, "uuid": "8ecfe42b-6d2c-4742-aec2-3a9b569042b3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666389693, "uuid": "f342119a-a6c8-49c2-862c-6e7a9f4ebb32", "value": "49152:Z2VFaQuOTZvoVuD8/pAgSjTH3+jkvRTxEtTNn152A5hq:MVFabUBoQw/vSjTXVvgtTZjlDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666389693, "uuid": "2f4d5773-c6b0-4e56-ba4c-9cbf11c2fc14", "value": 2555260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666389693, "uuid": "c366f13b-5e24-4d16-ab23-b302aaac2089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666389693, "uuid": "57e6305e-fd6f-40a0-96c9-3ec3016bbe81", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06dfed4-510f-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1666336415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336415, "uuid": "aff34c2c-33fd-4c8b-8f5d-d34a61690ccb", "comment": "Malware payload (RemcosRAT)", "value": "5248246b95659d7c17f1874c7cf10676", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336415, "uuid": "50d5a5e6-3728-4246-a106-704107f39f58", "comment": "Malware payload (RemcosRAT)", "value": "72c3d2d704faab4352ac7a4dd9a7b21501e07aa8a6f9fa9f1ea7f4d0849cedda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336415, "uuid": "e7e3ad29-a405-4016-b066-5c14756b0e74", "comment": "Malware payload (RemcosRAT)", "value": "65e851156932ba4a32472930d0096a0a87fd08af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336415, "uuid": "64c25888-9434-4686-8d93-8894e1547c80", "comment": "Malware payload (RemcosRAT)", "value": "e6e017262f6c294b8ae8d8358b2e5e19d7970604e4c3fad889f38910917b2ebbbba39eccb5ed855505307ffc1fccacae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336415, "uuid": "ac4b5bfb-c504-4b0a-b97c-2edf753e9df3", "value": "T11F15F0BC27840E63CD3AC27DC4A9419B03F6D98E7515F38D7C93309A56E8B9F42925B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336415, "uuid": "660165ab-fee6-488a-95de-ff9edfe1f598", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336415, "uuid": "4c3c1a18-9f9a-4122-9309-c78238a97503", "value": "24576:awMHcAb9h58soGDQbvvvQ6I68fSMVuAXG:HcckfoGDQbHQ5SMVuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666336415, "uuid": "878527ea-2f1b-4c3c-9988-e09f782c5121", "value": 907264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666336415, "uuid": "4cd3c61d-02ed-4b54-90f9-b2c4602954a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336415, "uuid": "44144d73-2537-4909-8884-92120606f36b", "value": "SecuriteInfo.com.Win32.PWSX-gen.29934.32578", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa98b25-5133-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666351813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666351813, "uuid": "eddcc46b-2d8a-447a-8b9b-5f28ca776798", "comment": "Malware payload", "value": "6622c31f3c0ac98f22cb5b20136a2644", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666351813, "uuid": "913d9e2d-a6eb-4f97-9e83-7cddac6fd00e", "comment": "Malware payload", "value": "74c96067aa4030357746cecab525f3b94094a697ad12420f90705ba3167c9213", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666351813, "uuid": "8b356b17-3ca4-4c4d-a218-2c2125410deb", "comment": "Malware payload", "value": "f1e277855019bc8e70a2fe5b48e0077c7a5b0deb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666351813, "uuid": "c5dca5ac-84f5-4fcc-8495-1dbc842d0dac", "comment": "Malware payload", "value": "93dea5d24bf81f8cd951f8f3e7c71da0dfe768a861e4e891a2b312236419b96ac2f960f5cb2862c7ab13825890701ddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666351813, "uuid": "3732fdc6-0b65-4139-858d-da3b185d4e5e", "value": "T1396623BE52A4336CC41EC4745137EC44F3F6152F8EE999AE72DB7A806F9B421A901F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666351813, "uuid": "bcd5aa5f-23c4-48e6-9fd9-4496d88fa9c3", "value": "d910780e43eb6473c6ca334d8a16a8af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666351813, "uuid": "8067b718-98ff-4f20-a721-fbfe05093fd6", "value": "98304:RcL4aY4DETOmOirHVq0lLk2urFhuOxKWZsgUl5PcGWuZD5I64dVi7oedBysmbj8S:DBEbmRviXLxnZsj/c7uZlIzedtw8aRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666351813, "uuid": "7aec0332-67d4-47cd-a66c-92f91611b31d", "value": 7005184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666351813, "uuid": "d00761c2-3f0c-48e2-86ad-b005aa4da282", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666351813, "uuid": "75ba2fa4-c6d3-401d-85bf-1d1a1483b7b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b17b6ec-5119-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666340405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340405, "uuid": "8abcc184-2766-442f-9385-a0f95ab1b69b", "comment": "Malware payload (Formbook)", "value": "2456d577247184d16655e6818833a7b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340405, "uuid": "90af1948-4808-44fb-bbff-36abeaf347b9", "comment": "Malware payload (Formbook)", "value": "756afd5279f32f281ffd21bdfa2079123cee745c813d3b07d0f3508c129a2bd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340405, "uuid": "2367db26-f487-4574-9acc-650dfa929a8e", "comment": "Malware payload (Formbook)", "value": "f357b03c9241c8280fa88117d5ab71b246ad6afe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340405, "uuid": "b506402d-043d-4183-bb9f-35559de7cbd6", "comment": "Malware payload (Formbook)", "value": "2fbd7b4774f153a346dd84576ac271bcfd3747c895a4b234669f9faf742276e7b879007123e9112d4861b1ed618ccee7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340405, "uuid": "62cb3b97-227b-476d-862d-3234eaf6c7eb", "value": "T101E41219876E8617CEBD1B75E42123140736D2A6F443F3DF9DC1B4E80EA33D888656AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340405, "uuid": "bc933086-65a1-465d-9c30-8409e72f4d7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340405, "uuid": "745b22f0-1db8-4b21-ba96-0ad3f9457d45", "value": "12288:5SOKVnDd+01wsAkoVGcegy0mroaoXLzlzuocMMC7uFgRLuAMQ:5LUD31wsjoVlegyxsaYlaoqgRaAMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666340405, "uuid": "da22cbfc-dae4-4fc1-8cf5-1223d80307ce", "value": 666624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666340405, "uuid": "763daab1-89cb-4e9c-9f75-01df2b2dd748", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340405, "uuid": "2f5681a3-a649-4d18-b00c-eb2c9af0d153", "value": "SWIFT20221021876543234567897.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2989fe14-5160-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666370897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666370897, "uuid": "bcc20da9-4900-4810-91a3-b1f060da8fa7", "comment": "Malware payload", "value": "59e6cb1fc72e84be8a129243db13d684", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666370897, "uuid": "ac66bd0d-5951-4888-b0cc-9772db08d862", "comment": "Malware payload", "value": "7607504b0b1aae9ee5297bef8d4de4a6599f922453d7306315a4342e57eec8a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666370897, "uuid": "0aeeadd1-e701-436b-86c9-ef98f3274444", "comment": "Malware payload", "value": "87fd8234667c26637e67368036eaccbc7c59d091", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666370897, "uuid": "c75baab2-75fd-41a8-9342-4dac3e1bbf80", "comment": "Malware payload", "value": "408880aaf22c3fc4cd0838a30d10243f414a9c5cf741dd21a6b3da01cf4c5d7ee53cabb0e429b01cc903a76f2e9c00e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666370897, "uuid": "f23f333e-6d9b-41c7-8d26-4cd196f53869", "value": "T1F0B50903AACB1E75DDD23BB4618B533AA734FD30CA2A9F7FB608C53559532C4681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666370897, "uuid": "9b74fef6-218b-41b6-8fde-9616bd84b3c8", "value": "c30adf91ebe9d66e552316724764f4c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666370897, "uuid": "3b9ba553-bdcf-41d2-8232-15e260b3bec8", "value": "24576:byY2YIY7KFXJuMyC/CYYIdeC7euFy3ygMAXfWLLaBl0tl3RuQ55313W:byKmPbgMAXfWQ0tl3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666370897, "uuid": "7d3c94f2-34aa-488e-b72d-3160b8acf34b", "value": 2456235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666370897, "uuid": "89033349-6c43-44ca-881d-4c6c968a30ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666370897, "uuid": "4b09135a-a8a4-411b-a2fa-8fd58bfcddbb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca985d8-5125-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1666345911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345911, "uuid": "8e81f6dc-5e70-4672-a556-6a38d4a9fa70", "comment": "Malware payload (AsyncRAT)", "value": "6751335755193398993879419aa053c1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345911, "uuid": "4edfe8c6-8207-4e5e-97d3-6e60ce1e2297", "comment": "Malware payload (AsyncRAT)", "value": "7715c84b2504a1cb0a5cb7f3ac93f838ee1b30acd915d45f4b16549b0c55dad2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345911, "uuid": "fe0c62b0-a5e8-467b-b505-b372134fbeff", "comment": "Malware payload (AsyncRAT)", "value": "d3d8f9f9d9be38138f8c5e4537c542c6fdb11400", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345911, "uuid": "18efda19-f88e-4bb1-a191-7d6106b3e39c", "comment": "Malware payload (AsyncRAT)", "value": "a9b16de03768fa1168a9dcf21ba2b1f4f1277c41a063921ebc3dc25de07cdad9c4f089c6afaee01505298af8b627ae7d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345911, "uuid": "183fe0fc-f58e-4e82-8054-2a13f3e73e3d", "value": "T18B9512648B42E319D05FE0F95274A1F44F74F133800024679A9B2BBA6FF36E855B92BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345911, "uuid": "8e745ac1-5b20-4d72-95e2-a2e970d8fe5c", "value": "f5e458212cba64557a5a7b3c273ab5dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345911, "uuid": "96a30464-7e0c-432a-803c-97041c4dddab", "value": "24576:1YjgljdELPXMkSejU7JJB2YOTIM6bWMu4ilcd1hQYrN1d7n9aahDLI8rsy0ebopR:1Y/D6JnOT1h6/Qg0oLI89dsOB3EbNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666345911, "uuid": "26e9c700-a9e7-47c9-bde9-edeb21e338bf", "value": 1943112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666345911, "uuid": "9e9aaf47-e5a8-40b2-85e7-8767aa824696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345911, "uuid": "3e50b939-4f5e-47ac-9d47-b3900a6b126e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6284a23e-5135-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666352524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352524, "uuid": "d803238a-e278-4f62-8610-21fca3f74598", "comment": "Malware payload", "value": "692df7eec33cc20d3ae1d52bc8601d3b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352524, "uuid": "8d207237-8701-4433-9bf3-947a83d9c925", "comment": "Malware payload", "value": "7798a238af4b543c17d12a96ae6d91481d8d2a13165c53f781f74fc81c3e2a4d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352524, "uuid": "38db7dd1-b0ab-44f7-86f6-b38c74e13c76", "comment": "Malware payload", "value": "6a61b64bfd10b2609fa761b868e3411625f844d9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352524, "uuid": "d2231190-f704-46aa-8d97-72a24a65fc3a", "comment": "Malware payload", "value": "e0ca509044572900d2b2d5ef9225f9660256ac8222d3af90101576f97cf4009eccc1b073653cb4f4432dc80d84ddc06a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352524, "uuid": "bbd58a6d-7715-4311-afc3-1286203974b5", "value": "T13E14125DC78F49A1CB499277132A5E0502FCB33EB60192B634AC53B137EEC3E59A54B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352524, "uuid": "a2303f51-8870-400c-8157-9a7af9c6068b", "value": "384:e3xpm/UFYOo2cU3KGcBelpCPBLjsqsYZJ8NdGC9JP7AVOrnz:WpmsFM2cEBcBkpyBLj7BZ8d19JPbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666352524, "uuid": "f6fb40e1-a3e2-455e-ae7f-66ac9efd33f8", "value": 206318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666352524, "uuid": "d758339d-c082-4066-a63e-0b2992971013", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352524, "uuid": "6015c50e-b172-4ff6-a3c3-0d5560eda62e", "value": "enquiry202210.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5708b2-5143-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666358559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666358559, "uuid": "4828255e-52ce-4edc-841e-d3982abe2ff0", "comment": "Malware payload (AgentTesla)", "value": "069b2d5dc58f4319986b589fb5933ce9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666358559, "uuid": "63ccb3a0-d686-49e5-a63e-2a60a4fc68d5", "comment": "Malware payload (AgentTesla)", "value": "77e60f86df5027b5cddd14fb1e0acc3e9a2c5456efeea831118d36180358c591", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666358559, "uuid": "a56b9381-dff7-4901-a4fe-3f4ab4074a7e", "comment": "Malware payload (AgentTesla)", "value": "e6fa6fd5ba31f7d647c28c492b1746169edb3f40", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666358559, "uuid": "48276211-d57d-4d63-b30f-4f5584293f97", "comment": "Malware payload (AgentTesla)", "value": "32a6a420d2a456458a45d36c09cf2d53414eff7a060fe58d51c168827fa8f1a53d218796c3af26384d48a0eaf70a94d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666358559, "uuid": "b29ee6e8-a4bb-4952-aff2-29705ef34b06", "value": "T112E4E0BD17414E53DC3CA17DCCA08154C3FCE8EE6415F69E3E9330998AE57BE42929A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666358559, "uuid": "c2de3647-7703-46af-bc68-9cda3850fd9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666358559, "uuid": "a3474b0b-56f3-49aa-96b3-89a0a03534e3", "value": "12288:HN2W9PCQo4EIY5r6Hv4094l4EH6S889SFLDSnM2CAzN5UZJWPjZW:Qbb8CH6xLDSj5eW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666358559, "uuid": "33bdfdd7-2f7e-4774-bf8a-e3019c6adc32", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666358559, "uuid": "b6890ac8-f8dc-4ef8-9dbc-e34f67285a2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666358559, "uuid": "ffbc5fe3-69a3-4d38-8f2e-ee15f6d1d838", "value": "chim.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8c4d68-5182-11ed-9266-42010a9c0072", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1666385449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666385449, "uuid": "07da01e4-e7c9-4145-b412-5a3dbeb69555", "comment": "Malware payload (AveMariaRAT)", "value": "07752355224460dc2dafc3875b5fd16e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666385449, "uuid": "534fd24d-7b90-4e0b-8e44-6a89ca35bc5a", "comment": "Malware payload (AveMariaRAT)", "value": "789ecc091a14b9f90e2bb4d004885ee517aaa1bc67b393ddc2077b4c98dd9f90", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666385449, "uuid": "37b72876-670d-422b-bd39-de63266f76f2", "comment": "Malware payload (AveMariaRAT)", "value": "1f71904b402cb928d515ce4db7083d4134a045ec", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666385449, "uuid": "f9528811-f73e-419e-9aaf-4ddf447725bd", "comment": "Malware payload (AveMariaRAT)", "value": "50491fe5e183023831daaf370cf11111ad91f126e266fad8f57ec62de7201fc45b4d2ab45cef4866765bc554db68d4b9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666385449, "uuid": "043115b9-4c93-4a21-8db1-bc3f6f7350b6", "value": "T10E05387A12D64607E8297275C8C3D2F32AFB9D607061D1C79AD76F6FBC400BF9612286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666385449, "uuid": "f7b3c3d9-479f-48e0-a8fe-09e5eb978f8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666385449, "uuid": "653f6e09-90e6-4aa4-bc9b-824f9c0d7aaf", "value": "12288:G9Ls/vT2i8i2UZz1GkYU032ExTSSqqfwmggvVtNs:G9W6kZskYURE0k4mjvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666385449, "uuid": "a95c23bf-465f-41e2-9148-aeee58ced19e", "value": 822784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666385449, "uuid": "d2fbb6cb-5319-45c4-ac15-20b7ec463a01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666385449, "uuid": "46af74d2-5db3-49a0-82ac-83eb16e880b2", "value": "07752355224460dc2dafc3875b5fd16e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281c46a5-5113-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666337823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666337823, "uuid": "0246f3d0-3cb4-4b3a-b0ae-80f6e3da84fa", "comment": "Malware payload (AgentTesla)", "value": "dd1d52b8f484ccc25b35b1c33032c9a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666337823, "uuid": "09f08c39-e911-43d1-bce7-08c90f40ac4d", "comment": "Malware payload (AgentTesla)", "value": "795fd720d4bc05edcd0c56c4421527846c057ed35ae79d0fb3afb5d3e1d3f0ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666337823, "uuid": "e3583635-7708-4dff-86cb-1ef219605dae", "comment": "Malware payload (AgentTesla)", "value": "ed0797e9d291cc1619e3d6f31820e15c198a9093", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666337823, "uuid": "8255d084-d125-43d9-9b68-b01e7c202915", "comment": "Malware payload (AgentTesla)", "value": "833b758fe8f26c33dcf17378ee34be64bd77d1aa61139766ff53699f7a1d7885f09f63d9f639105c37fcb0c671018579", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666337823, "uuid": "29075d6f-21e0-40a8-85f1-a6d31a4176d5", "value": "T1BBD423E9870D85E4D5DF22E15F1288D9C4B33F2B158285D82712191B7E8E7FE79EEA00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666337823, "uuid": "bec2579c-4b8f-4ac8-8aae-c7f0e5cc87bf", "value": "12288:IquAlGy3VXr8mW8LyhTNicglgOzvJi/dFVYISYlqS0gX2+IAn+tk2RCRcpUcCGW:DFh39TLyLicglCpdSYwS5EAKRCYU+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666337823, "uuid": "12d68112-640a-49dc-925e-c6ac89d53e5f", "value": 639770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666337823, "uuid": "468f420a-154a-4a2f-bfdb-013090054b8b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666337823, "uuid": "d5a9cd46-7f5d-453d-aae2-d348fb3178b9", "value": "proforma invoice.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c41f420-511c-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666341830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341830, "uuid": "88966e57-72f1-40bd-8bfc-213a31a93b31", "comment": "Malware payload (AgentTesla)", "value": "4757bf10e11b9231651491c9f06fdfd2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341830, "uuid": "754863d0-e2d1-4a78-a464-ab4962e00fae", "comment": "Malware payload (AgentTesla)", "value": "79ce7bf9135fe898db020a36c73c12f10f39fe3546f8d688dd3d639bf3cb8f18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341830, "uuid": "9b2e54c8-2ba2-40ff-9c9a-4b5f045cd6f0", "comment": "Malware payload (AgentTesla)", "value": "d903f30abdeeaf5c4220d264267259835dd03b31", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341830, "uuid": "b70d0540-2ac1-4d47-8113-d126a300af0c", "comment": "Malware payload (AgentTesla)", "value": "2b347e7e1b8a5bd93889eb1a829c7406772a966aca4bf0388a7ff51eb5622f3bbc309b8097537652d53c5d937881eeb1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341830, "uuid": "d24f1589-9386-4f4f-b020-85539e1fe5ec", "value": "T15A3538BA26D50147E8263A759093D1B366FBAE516445E1CB64C32F2FBCA42FF8113387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341830, "uuid": "42560056-c437-4ddc-bebd-ac5d1e62bab3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341830, "uuid": "a8c4d6bd-a853-4265-bcf5-a9b4b2c749a8", "value": "12288:zIlY04043YY+ceZhvqVlfEuh4miQCFShGiHa0CgVpicxIe0v3pKKaDSKjkU51IP:M0xiHF6ARgarTvZKKzUPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666341830, "uuid": "94879e48-4e2c-45d6-9cfb-852649ae9a45", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666341830, "uuid": "251454c3-5819-4e96-a485-00c4507a6259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341830, "uuid": "0b304a0b-eaef-4f7b-9698-c3c2af89f8bf", "value": "4757bf10e11b9231651491c9f06fdfd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ba3549-5138-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666353764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353764, "uuid": "7f32a7f0-d589-40c2-96f3-d25f76af56e6", "comment": "Malware payload (GCleaner)", "value": "950bf5c1d87b63cfccea6a1d7c3d534f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353764, "uuid": "02d35d85-e1d0-489d-b871-a72f805bbaf6", "comment": "Malware payload (GCleaner)", "value": "79f7d6b4ee9a5814bef83796f6050ffc9affbde75bcce35a6f84dc74c24b0e14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353764, "uuid": "93dfc921-cf4e-4cc8-be3d-d522394e6cf3", "comment": "Malware payload (GCleaner)", "value": "9190b2294c89ed8475647eb577f93e1817bc2ec5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353764, "uuid": "a243f67f-5061-42da-93ce-afaa09f05122", "comment": "Malware payload (GCleaner)", "value": "4b0bb935db58ebccf058cd0c889cbd096ffa6e958279a77c1ba8c978246dcd5d3bc6a1305d6efcda23134a4bc8e59a65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353764, "uuid": "45c4303d-b027-4ec7-ab41-7f7fda4dace6", "value": "T1E6C53376C7F045B0D055EF78EC6BD674D621A8626AB8B82061ED5F8D2F37C876044BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353764, "uuid": "ede8ceab-51a5-4245-8408-28cba9596417", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353764, "uuid": "d82d27e9-b3f3-4fd9-bd4f-4b05f0615bf2", "value": "49152:Z21aKGAHQdBoAth2av+e94CjBnyeFPMSBPye6kv7Wu9+tiA5hq:M1aKGAHQQAtcamI44BnyeeSBPmu7RGDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666353764, "uuid": "5663e1a9-ce3d-4e44-9573-0755c324bb7a", "value": 2545648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666353764, "uuid": "83918fa6-3493-4ea7-9760-3c5f96504da1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353764, "uuid": "46ad6a71-3746-470a-b991-a8b886a88544", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae19a4d5-5190-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666391735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666391735, "uuid": "717e7f71-d4f8-4e9c-bb0d-80baae23db68", "comment": "Malware payload", "value": "b052063f1d20b1a45caec63898db7f95", "object_relation": "md5", "Tag": [ { "name": "2010m", "colour": "#F53636", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "pw 1022PD", "colour": "#5B4241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666391735, "uuid": "b3f51fc0-47f9-45df-99fc-1e7f9b2b6989", "comment": "Malware payload", "value": "7a0196965bc66b8ade75f5f65ecb8f987dc696b1a48b1d55a1ed17e4118dbec0", "object_relation": "sha256", "Tag": [ { "name": "2010m", "colour": "#F53636", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "pw 1022PD", "colour": "#5B4241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666391735, "uuid": "410624c8-2324-4c0b-a8b5-36c15e805074", "comment": "Malware payload", "value": "6feded99247db16b1b4c612090d86556a00cd695", "object_relation": "sha1", "Tag": [ { "name": "2010m", "colour": "#F53636", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "pw 1022PD", "colour": "#5B4241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666391735, "uuid": "4a281911-bdd3-45d2-8761-b38e4f4f848f", "comment": "Malware payload", "value": "8ddfc952c1697d2dfbc0070d19634e457c7628f757c762005823a06d1478a23d2d5ae01e79773d1dce859d937ada341e", "object_relation": "sha3-384", "Tag": [ { "name": "2010m", "colour": "#F53636", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "pw 1022PD", "colour": "#5B4241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666391735, "uuid": "6a652a93-452c-46dd-a36d-f669e3d5c647", "value": "T1940412955830862C7A5C63CB879ACFB0D81B93E3D36ECE4659C31959F266E83C312A35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666391735, "uuid": "2c7491d1-4aaf-4f71-887d-12d4df1830fb", "value": "3072:sNdNEfMyfzKtROLlEiruk0MBlW9HIAEuvR06pafTDp3cfSBRWdu1VvxavkW:sNdNxy7KeLqbk0HREuW6pabDpSSBJAvp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666391735, "uuid": "39d2305b-3e8c-43ff-88ed-493074c755a5", "value": 179924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666391735, "uuid": "98f49b92-1ccc-47b2-8afa-0c5ec4be19a4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666391735, "uuid": "7bbb4423-509e-40b8-a2d3-627e431cab9c", "value": "LDEF-2480652.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cfbb57-50e7-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666318972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666318972, "uuid": "cae969b2-c83b-4226-be58-4933b2c3f1b3", "comment": "Malware payload", "value": "0eb7140e9438c4a7e6e1f13a52608355", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666318972, "uuid": "bbdc0b6f-9e32-4ad4-9c91-a3233db6772b", "comment": "Malware payload", "value": "7c272fcd86c404716b9d95517760d4b8890897682badcd4fe6130092d7186f96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666318972, "uuid": "1002a3e5-8e11-45e6-b370-3a3c7fadabe2", "comment": "Malware payload", "value": "3e952d93e930e68b15059bf6c681ec8c1b603926", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666318972, "uuid": "4f1c4f55-4b5f-41cc-b1b8-b7f9625349a5", "comment": "Malware payload", "value": "35d17328f370455172dbf48f0976474d2b3e804f38a5c3ead4c64b2c692aba152e63be025aa09d4e44330f83b7034ad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666318972, "uuid": "a51c2fb2-abdd-4546-9ea6-dcad425caad9", "value": "T13A76339336D590F3C47120B27CD54F74A0DA8CB6021058EB0FE2AD4E6E3E954A5EBD9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666318972, "uuid": "7869fe22-29ac-4888-bc07-4546c9d85dc7", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666318972, "uuid": "0ff47247-9cc1-410b-a6e6-3f7b7bf9e74a", "value": "196608:91OmWAiy6EQbZsyeNiEQGUE0g/FjcUZcSIriQaUjO:3OmNz6pJeNiEjD5LhYaUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666318972, "uuid": "2ca545c3-2e91-408a-8ba1-741a0a0c4528", "value": 7586153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666318972, "uuid": "0f08d9bb-3fd3-408c-b40e-d531800ac29a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666318972, "uuid": "a396aaa5-5f5b-4245-91c6-381ee2bf8f21", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ff2054-518c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666389970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666389970, "uuid": "6da5afc4-20cd-4b77-a06b-c2a682a8289d", "comment": "Malware payload", "value": "c06c53469b573cfc8b3b8a081589c658", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666389970, "uuid": "dc7374b9-35f1-43e5-8277-9f8d077580b0", "comment": "Malware payload", "value": "7cf1a8faf54b7bbdb71891beb5032201a66d7d354fadaf81d14073b32d55f111", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666389970, "uuid": "7b213ac8-8862-47fb-a96d-c95bd83903f3", "comment": "Malware payload", "value": "02e43ca93a21f9608cfe64f6de19b3b07fcd013d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666389970, "uuid": "1d1a8e1e-4ee5-4065-93b8-f4ab172555a9", "comment": "Malware payload", "value": "e1ae8032fcfd092928e6f4de5b13ac141613c987e4bcdfebe25f4b29e52567c4fc895d5d33d647fa329dba25d1db1d0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666389970, "uuid": "40bae01c-db73-41a4-9c8a-f2b679369d1b", "value": "T15A34D001B692CC72C48244344830DEA426BFBC765578599BBB983F7F6F712D25BB234A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666389970, "uuid": "996a52f3-b5f6-4570-bfba-2328aed43ce1", "value": "bc5a05e947eb61731a4e3024a4f4b617", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666389970, "uuid": "d9a2f298-682b-486b-afcf-cce9327f5a9f", "value": "6144:WT2LLzvHPAto3Joc3qJRH37vXEy6/2J4wS:WT2L3HIt2Jt3W37b6/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666389970, "uuid": "097a53fb-2915-4b34-93af-455d3ba81e86", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666389970, "uuid": "61812320-6f08-4a93-802f-7ac9af5f46d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666389970, "uuid": "35e69020-8ae1-4914-838d-c8f47343e1ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a3383d-5124-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666345282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345282, "uuid": "91b485ff-4e2a-417a-811d-4dbb311c5669", "comment": "Malware payload (GCleaner)", "value": "9cb53941ba0b62f4bf79a60bd18bec9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345282, "uuid": "edd92ecc-bf96-4fa2-8b1c-52356b4abfdb", "comment": "Malware payload (GCleaner)", "value": "7e0ca53ed340b9480f23ff32543821de56ee6ff93c9f68d9f328eff7c4fabd69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345282, "uuid": "c4ad7eaf-8ff9-4cf6-82bf-60e148169bad", "comment": "Malware payload (GCleaner)", "value": "4d368eec16955d29cd15f0f5501d90da7fa2d999", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345282, "uuid": "1f05330e-af0c-40a7-a617-37f64ed53545", "comment": "Malware payload (GCleaner)", "value": "5e313f0761daa06ec1c722ace40430cacdbda7f21964d187691185dd423083c9e7a9bcee69a9e925b2deceb738504fe7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345282, "uuid": "7a679163-a921-4c66-a398-1c1f9a3b201d", "value": "T1E6C53341E7A5F532C0608CF2AEBA9D06D2B77F515836A43978D8807D9FFE5D4A004F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345282, "uuid": "93781387-351d-4ef0-97d1-52d40b76514a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345282, "uuid": "73846c45-c149-4a95-8e6e-ab9b3251bb9b", "value": "49152:Z2TnEnztr8Ck7wy6G8VCWxNZQvxGkdN9ifgHST9f8JQ55XQxpA5hq:MTnEBrPIyPCBJGkdN9iY49CQ55XoSDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666345282, "uuid": "ff5c047c-7b4e-4029-9a85-84aaccf7de54", "value": 2559512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666345282, "uuid": "ac6464a9-90b8-46ef-aad2-12deca9b4381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345282, "uuid": "f5e10d98-b710-47cd-b664-8a1fe4b5047a", "value": "9cb53941ba0b62f4bf79a60bd18bec9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4fd93f-5144-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666359037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666359037, "uuid": "301afdd8-fdfd-4838-aff1-a9f9b8c6052f", "comment": "Malware payload (Smoke Loader)", "value": "4500806e7a18ed04415f759aa8399aab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666359037, "uuid": "d859ee7d-0004-4110-9ad0-64801a491df9", "comment": "Malware payload (Smoke Loader)", "value": "7e33162c7a2545cde7956cb206942b5efb0679547dc11df2bb522df90e305ae7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666359037, "uuid": "49e7af70-f475-40c7-9694-036b77214af2", "comment": "Malware payload (Smoke Loader)", "value": "5f143c7f5f74455223175bb6d640f8576019d56e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666359037, "uuid": "4febab3e-7ea4-44f8-9360-4dbced4edefb", "comment": "Malware payload (Smoke Loader)", "value": "64eaf91c0331ca526aa431be6c239f292a666dd0c8dccac23de89cf392248662efc0352e3c93fb8577da77be92db43b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666359037, "uuid": "ca9a873e-1326-48c5-98a8-701dd69ea5cc", "value": "T14714E010B8D2FC72C44745758474DBA02ABBF8321574899B7FA83BAE2E702D15FB2257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666359037, "uuid": "c2932a53-1467-43c2-8881-e4fcd8ea2c1a", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666359037, "uuid": "d3b1fd98-874a-4225-95e6-1630afadc248", "value": "3072:CXGwSLBlYSQiz5oU37kHacAUFxWgoOdO5tHcCTWOg:CfSLESQirKAUrm7HcYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666359037, "uuid": "48bd34e1-2296-4f8a-8b6d-051f6a345259", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666359037, "uuid": "7325b8db-4423-46d5-88b1-751882c53e6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666359037, "uuid": "caa1f364-9de3-4893-82c0-fffefc541f81", "value": "4500806e7a18ed04415f759aa8399aab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7888a363-518c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666389927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666389927, "uuid": "076189b4-fb92-42b4-a0f4-ba07baf09ce8", "comment": "Malware payload", "value": "38a1e53271113bbd7a59468b19d0fd97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666389927, "uuid": "37084f02-72b6-4d8e-ad5e-36d8a321d82d", "comment": "Malware payload", "value": "7ec22cd6dee5a73cc941ca2e868c625903bd857994fc261ec4b2a671978f4459", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666389927, "uuid": "0f08cc55-98a5-41b3-be68-12f333e6904d", "comment": "Malware payload", "value": "741d8c427fcc69b4c4f8d30d0d86edcf8d4ec2c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666389927, "uuid": "58ace1fe-2db5-4dd2-90aa-a3e7d72e9bd2", "comment": "Malware payload", "value": "5fe149c28a78b31609b3610ae4a0742bdd5c820ad1cf1c06524513563b2e84e87f8ce2b37eba92183d09714c2e06dfcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666389927, "uuid": "17d95d03-64f0-476a-8620-3573b7f19cba", "value": "T1967633397DF9E870C1412CB6DC7A1F55A28CE3950F2BA8E74B4C806E6A34507DE374A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666389927, "uuid": "575cedba-4cb6-4eaa-bad3-392566358e2f", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666389927, "uuid": "bfe023a1-4362-4f8e-8690-8b8a89ce280d", "value": "196608:91OUsA/npvU4g6uBI0lGSiyHZv1NpypwD8TSKx8DB9otYhO:3OUfnxU4g6oGIYlS3cZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666389927, "uuid": "6de6282a-d73a-4102-b580-55e0f29c69bd", "value": 7617810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666389927, "uuid": "141e68db-c2ca-4c38-bd83-94ffca82d65a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666389927, "uuid": "b641dcc6-38ab-42ad-a44c-9b5251b9503d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302f7a9a-5121-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343850, "uuid": "70517d53-19cd-434c-9f7b-a4790ba85323", "comment": "Malware payload", "value": "43bd113a0952172bcba57055f5a707bb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343850, "uuid": "d4e05890-f49a-441a-88e4-5df8aae1c207", "comment": "Malware payload", "value": "7f603216a0a7bae2c8cec65a800608ac22cfff8cd98c699677e44d36267a9798", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343850, "uuid": "f5d5b0dd-cf7f-4b11-8699-b95334c92756", "comment": "Malware payload", "value": "accdbdc724fbe4a45c4de5f9f0bdfc369e8fb35d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343850, "uuid": "0e11956e-ed4c-427b-b065-3baa2b93d180", "comment": "Malware payload", "value": "273b669ec8b8e9c1992e18be796eddd0b62fca41a163cf6fb346d4d57f33578441460b87c93b4181fa644fd0e48f3c1e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343850, "uuid": "b845fee3-4b05-4fce-abda-97db60abd49c", "value": "T1F06623C7E309E866D5A7C53B8272465BAF154C444E42F7532E8AB12C0FF76C08A9DF89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343850, "uuid": "b485302f-95cc-472e-971d-8f8b319b312f", "value": "196608:wJevH3JnYUuWf6p0JyzMJh0XPfZWxFiFyTnf:wJev3JYUuZylGf8Cyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343850, "uuid": "2aa9607b-744c-4b9a-bf6a-5f3032d24871", "value": 6975479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343850, "uuid": "61cb8e5f-9a5c-4573-9776-7b931f534854", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343850, "uuid": "b7dfd00d-8b11-485a-83c8-93cd2f6a80f4", "value": "7f603216a0a7bae2c8cec65a800608ac22cfff8cd98c699677e44d36267a9798", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8434b5f5-5128-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666346997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666346997, "uuid": "9a7ec8d2-7d18-46f8-8306-c51da835a4a6", "comment": "Malware payload", "value": "8bda519e8283d8557d7c44d4e76e8c63", "object_relation": "md5", "Tag": [ { "name": "drivetools-xyz", "colour": "#C903D6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666346997, "uuid": "6eeb07ae-923a-47b9-aebf-87a230c1d8e8", "comment": "Malware payload", "value": "7faf92f9f44c336fa6fa52a88974b56e71850672df2ce12dbf3e96a445388e2b", "object_relation": "sha256", "Tag": [ { "name": "drivetools-xyz", "colour": "#C903D6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666346997, "uuid": "6060e4c6-6ebd-4b4d-953b-62d51eec09db", "comment": "Malware payload", "value": "866b2d269d8754daba31655fc96d7f1edf11c63f", "object_relation": "sha1", "Tag": [ { "name": "drivetools-xyz", "colour": "#C903D6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666346997, "uuid": "2719005a-bf96-49f9-8b0e-89366ce5d8ae", "comment": "Malware payload", "value": "1db2f3d15a4c4fc71437948916d75af14095f9c34fa857289381600db9d2c37b6b0f789fa8972ff1acb694745fa8201e", "object_relation": "sha3-384", "Tag": [ { "name": "drivetools-xyz", "colour": "#C903D6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666346997, "uuid": "847d41bc-7070-4dd6-91cd-0eb450c28818", "value": "T115D533816DF4C78C4875A2FFF0EBD0BBA9478B02C9B911C599365DF42A4B3127931E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666346997, "uuid": "d938390a-3bd8-48c7-bb00-620998537df2", "value": "49152:IWUN4/qqxplIjBG6g8+kuY0aS+ycBHbD4QbWKRTg/RDsR8Htz6KZlzBLsATG:ISCqug6tOWvb7RTmIR8HtDV3TG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666346997, "uuid": "ab634848-eb01-4033-bfb3-d475901eca48", "value": 2790162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666346997, "uuid": "93e61091-c4bc-46e0-91ad-051028335c34", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666346997, "uuid": "96b86559-04fe-4ea8-b8a0-026eb6816412", "value": "7faf92f9f44c336fa6fa52a88974b56e71850672df2ce12dbf3e96a445388e2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11cb5d3b-50e5-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666318029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666318029, "uuid": "275486b2-6b2a-4bb3-899f-b383d53e69a2", "comment": "Malware payload", "value": "c392d8ff917964abe60186c4f69c86e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666318029, "uuid": "7c1bbbf9-25e3-469c-bb7b-1b9de0995354", "comment": "Malware payload", "value": "7fed67c941c2bb56709a049b961e5a21cd2420c1933557520c4064e5fc9a18a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666318029, "uuid": "ca39b119-b532-4dce-b88b-e691252da8e8", "comment": "Malware payload", "value": "86124efd3084892fc215d4dada45f9af8f387be7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666318029, "uuid": "87f9e2a2-d688-4a30-b284-c6b5ec46b108", "comment": "Malware payload", "value": "6475a3eceb36f613d1b59d4635f9f0712844f83ebf24d8e9efc168ac8f9655271af2d50d8dcfa4fabfd402156f1cd279", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666318029, "uuid": "349868b6-87b0-4802-ad32-96971981c73e", "value": "T185B402753F80D93AE3A585B0E167C24C8EF4F81119563B0BF7ADFB6E66B5350E90A102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666318029, "uuid": "8a818d21-6b59-4045-8115-67bb0724723c", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666318029, "uuid": "cbb1bd03-0510-4923-9fc7-d908289ecd36", "value": "6144:8Dfe1yeAal9SHYC9xsIxJKZREuBtljUr0g0ZSj9AsxdM/qt/yAHMDbUAJKBhW2Zj:04VAalM2IxVuVbg042Ed5HMDmE2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666318029, "uuid": "41d69358-6694-47cd-b44d-6425683633ca", "value": 517048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666318029, "uuid": "1f035c3d-4aa7-4d02-afaa-f4435b7347b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666318029, "uuid": "c54a409e-4e08-4325-bbe7-429641e2ec0a", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.12538.31347.29034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "206053bf-517d-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666383337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383337, "uuid": "c39b2b18-afff-4b6d-98d4-91234407f0ca", "comment": "Malware payload (Formbook)", "value": "ae99ccfb05fbcab6d0d68bb336ee6682", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383337, "uuid": "18eabcd5-4967-4d6f-a11e-0a5f758b4f13", "comment": "Malware payload (Formbook)", "value": "803e9ac4f84a0c64b7f2e62f7d8d1852d0e4d9e9d7f956a5cc3f1898e31c1609", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383337, "uuid": "c4cd9cb3-983b-470f-819c-b1432bb4dcc5", "comment": "Malware payload (Formbook)", "value": "b254535627dd7a4543aa0d5f6bb377e97f013637", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383337, "uuid": "37bb34f3-0645-4c7c-a0b0-8fe635776874", "comment": "Malware payload (Formbook)", "value": "bc6d1c12cb1470d3bfb5732d64bfb243fcf5157ef50ec3d011d0a6b2fd08090f16cdedd063ad459ddd6c75f1fdb8e32a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383337, "uuid": "972ab6c2-cc2d-40da-a193-59dc0c10497f", "value": "T167E4121D57BE9E33C5AE47BBC4925A110372D409B012E7EF0AD6B8D52E673488816FCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383337, "uuid": "6ebc017b-a0ab-4ccd-9042-7a9eb9e990e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383337, "uuid": "2fbaa228-f0fd-4a1a-a331-9b28408ffccf", "value": "12288:eqSTlQ7Oago9Q8YoaOtzk6Gan2ozdJOCsGqMrtT/tARxlBBlM+Q:xS8JkNtozzOCBqMZ/tAdBw+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666383337, "uuid": "3dad4395-2caf-4871-aa4f-2c297da65b7f", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666383337, "uuid": "488f13d4-28d6-4c63-88dc-ca02894cc760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383337, "uuid": "08cda8f8-5d9d-41c8-ac53-c5345f8df43f", "value": "New Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208d3239-5121-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1666343824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343824, "uuid": "62618328-c1b8-4874-b7ea-5c8dfa339ce0", "comment": "Malware payload (GuLoader)", "value": "a9a4484606aca984b87cac70049a39b2", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343824, "uuid": "2fa2cb9e-d960-4b80-a7ff-2349db1fa191", "comment": "Malware payload (GuLoader)", "value": "80be1dedd44975066ed4731f0a3b43e00b31811d8f11317beedbafac75a6b50b", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343824, "uuid": "7688c045-88e5-47c6-83ae-71aee2abc562", "comment": "Malware payload (GuLoader)", "value": "333d3c3212760f270763091f51ffb3335d7896cf", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343824, "uuid": "722f6591-b946-48c7-867a-8a4631ad49a3", "comment": "Malware payload (GuLoader)", "value": "d22daa1c555b773ec2b0a8c5a78e13483fa6f1ed41bdb27d2022aae1d8ca9e7d700c11f66cb8d9339184b17f56236fdd", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343824, "uuid": "987e7a51-3129-42cc-830d-9ef846cb8071", "value": "T101D4E1097D330E2E8FDC22EE7C1B0E5A1DAD0199D14847BA3D9620C9761B77D209F26E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343824, "uuid": "a70288b4-8f52-4547-be22-124999f22673", "value": "12288:0QWVtDR4hZik265C0qOUObloyt93WZiGNDjMfMGdg1ZNnynVneos6W:0Q+P+C0qIowwjWMxKVnsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343824, "uuid": "3b2b8e1d-4129-4e1f-b127-19d606b5309e", "value": 642735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343824, "uuid": "79f5d88f-d8f2-4152-a03e-eef140be7ecf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343824, "uuid": "f3d4c3a2-2ab1-4546-8afa-93f613a78640", "value": "BEST SOLU.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfff5099-517c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666383202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383202, "uuid": "dd5371b9-d0b1-438e-92aa-2d093d6abec1", "comment": "Malware payload", "value": "18d35811102fadf2d17f9d1048f2d77f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383202, "uuid": "b0de5960-e85e-4d82-b230-6f901c87f2ea", "comment": "Malware payload", "value": "80c14f11abdee9ebf4aa7aa074674d1b6c381081157642af861c2674705edfee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383202, "uuid": "14427c72-1414-453d-8424-846238a56d72", "comment": "Malware payload", "value": "9c656f4ecfc82f2628f642937f260565358b8a34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383202, "uuid": "3aca2483-0e5f-4923-9b7d-43ee3a5d9c47", "comment": "Malware payload", "value": "9bef9f462877d15a412dc953029b20d10b9312536a6fcf6bc808dd44208d1b71b162f887a6ab45cd4f3008965a8db7bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383202, "uuid": "4c727d55-43ab-4fd0-b33c-7e53449bb50d", "value": "T1B134D11CB6D2C4F2FC8615358474DFA056FAA832563059973BF43BAF1E702D16ABA306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383202, "uuid": "c36637c3-ca8e-4633-b380-34d06eb01c95", "value": "bc5a05e947eb61731a4e3024a4f4b617", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383202, "uuid": "f709393a-a0ea-49c4-991d-edf9450eb1d9", "value": "3072:UXSPLLJlLXTAhE5NHbXHvWVU5nOj+cCpMKnDiFjDSjK3xlQhS:Q0LLJlDTAhKSU1DfpVDiFajKvQhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666383202, "uuid": "a1c729e2-f323-4d4f-b372-ec9c8a62dd91", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666383202, "uuid": "9858dbec-f92e-48a5-90bb-671be061a213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383202, "uuid": "8ee8aa90-a45e-465a-bd22-797755474816", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6553a377-510e-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666335778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335778, "uuid": "b40fdde2-58ca-4d7f-b7c6-394d8c4f7aa3", "comment": "Malware payload (AgentTesla)", "value": "ddeb8898159003f47d29e3be9691613d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335778, "uuid": "4ccf6ba0-60e4-46b2-9dbe-d00a4587f443", "comment": "Malware payload (AgentTesla)", "value": "80f3254414e1632e3ead91bb231d9d6c2d12df032d7f565ed292bf99048d5a29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335778, "uuid": "999a3e55-adfb-45ba-9128-c42b06ca1519", "comment": "Malware payload (AgentTesla)", "value": "201c7d8bc1e280aea78d7196db82f4dcab2342c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335778, "uuid": "f31ef5f6-e4dc-4fae-b745-94bc64d49797", "comment": "Malware payload (AgentTesla)", "value": "24b63ef7421d4feae20be7a9a5552cd7ce70e768f806ef2d5b51ab1640bd28ac8d8293681a9bbfcef904a46267164b18", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335778, "uuid": "592e8420-7496-4fc9-a207-c6f33b98c526", "value": "T1AC73D90D76C390DFCF5947783951C1A429E16C77AC9286AA34073F8ECC7E5A089A3367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335778, "uuid": "aa9df12a-a121-418b-a663-6773bb148931", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335778, "uuid": "bb5b9e2f-bf2d-4c8a-99ed-a36079e36854", "value": "384:wXES18SLM/uqY9CLEQA3Hus5rD/XgKy26:w0EYUCRA3HHnf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666335778, "uuid": "d6dddab3-1baa-4f42-9198-84e37380f600", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666335778, "uuid": "895dfbaa-61a6-43ca-a87d-c700944fb6a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335778, "uuid": "f732895d-d935-42df-ae8f-6e26b22766b7", "value": "03022022_parsed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf67c63-5129-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666347415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347415, "uuid": "c9d39c15-851c-4c58-9192-1a922e339137", "comment": "Malware payload", "value": "9ab89fbc0f42a1843f6d2240b411a3e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347415, "uuid": "3f13b54c-d7b1-4d35-a403-15d4a4385cb7", "comment": "Malware payload", "value": "81e189ce22bceb8e6c3d3616a2408ecdcb88da0bb6cac98e68a14ef35999a646", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347415, "uuid": "d6f05992-bd7c-4840-bb25-012faa6ce1a0", "comment": "Malware payload", "value": "67f4b652a0b6deecd6e3b24fa8e7dbfa063f0029", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347415, "uuid": "baaf6cbb-dcf5-488d-8ca7-364ce8a39929", "comment": "Malware payload", "value": "5b2d321d8079f054d9357334ee5d549b50a6d98754924dcf90669935dbf5fab1d708e411fa1fea73e3cc9040f1e30bd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347415, "uuid": "0f7115db-d51b-4620-b5de-07524af8e7f6", "value": "T1CC43599102D7032FD904E9B1D68D4594D9DFAE22389E8FC6940E397FDC39AA107BBC19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347415, "uuid": "4e517961-707f-4bb9-8b38-7faff01780b9", "value": "73858c607b871d83732e8bfb406488c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347415, "uuid": "83bc10d8-8654-40c3-8a24-6e6ac374fca1", "value": "1536:y1ep1tOKxVeU01JVlG9NSstFdGxveJh7LY0hRcxfWh:y10tOKinJlwN2yphRmfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666347415, "uuid": "1db4cfbf-f7da-4ca9-8e35-3316842cb010", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666347415, "uuid": "bf8ff42c-c76f-4ed2-8da6-758ea98bae86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347415, "uuid": "2e7ee098-7d6e-406a-a9d2-26b60ba3062c", "value": "SecuriteInfo.com.Variant.Tedy.223993.17567.14091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62dddf8c-519b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666396333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666396333, "uuid": "4e081b5b-00d4-4145-b167-385be1d2df8e", "comment": "Malware payload", "value": "2f9b853df61d9bd36074db39c088d59b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666396333, "uuid": "6f482f0b-ea88-4149-becc-90771494e448", "comment": "Malware payload", "value": "81ef289117db84443107cf4deb77e628dd21b97fedb506f344841512f5b526ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666396333, "uuid": "7e5ed063-5ffe-4e52-8fac-db66e5b825ca", "comment": "Malware payload", "value": "75314fa2c37938aaf72f89958cef22cdf5db2edd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666396333, "uuid": "e4c0ae10-90e7-4907-8529-3df5b5d5f2f0", "comment": "Malware payload", "value": "3a95c97d1b10de32d1e1759a7cafc17525cf4199489a9614f4ec0e56f51a550e07c74ece1de50c049de6a2871f02f82f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666396333, "uuid": "fae7b5bc-5458-4776-83e4-25227072b5d2", "value": "T139740110F562C073D582517508B0EBA559BBF9B126308A5B37643BEE7F302C35ABB726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666396333, "uuid": "f8be63d6-bf92-46de-8ae3-2ddd9b4ab9e3", "value": "b7130d64e41e1f3aeb19371c8fcd9d1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666396333, "uuid": "f24e1dc6-a877-4df5-95b8-9aeab4cbe6b2", "value": "6144:wblLTv4Ynvo2wYMX/uJa1TUz7PSr2nWIIrPc7rDS:wblvvBnQ27MPu4g6qnIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666396333, "uuid": "8741fc86-9e02-4fc6-9d46-e12a39e839d2", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666396333, "uuid": "25551521-edd8-4506-8ae9-bb627f551710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666396333, "uuid": "56c05587-504a-45c4-b19a-4edfaa71c40b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5ee28c-5163-11ed-9266-42010a9c0072", "comment": "Malware payload (DanaBot)", "timestamp": 1666372484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666372484, "uuid": "84cc19ed-c5e1-40f5-bf16-e14550d71fd5", "comment": "Malware payload (DanaBot)", "value": "9345832a3823d9f08378ba32e4a179f5", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666372484, "uuid": "1609ce94-b096-411f-8cb0-064722f41c4c", "comment": "Malware payload (DanaBot)", "value": "825d8e7afb11042951c61102a283326dfac5f1b0c6f990aadde69410ba250bba", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666372484, "uuid": "25a7b4aa-8ffb-457c-ad8a-51221d7137b9", "comment": "Malware payload (DanaBot)", "value": "86624e41f92eab4e30db0192720a095d92a6f16f", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666372484, "uuid": "c9548ea1-d645-47f7-bc35-f40d24c5fe85", "comment": "Malware payload (DanaBot)", "value": "318f7e9fbb574d14f9a73919a97382d993898a8c4de07a2ec7de2e5be9353a85f070a68674fb8ff13e89864f1ab66d61", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666372484, "uuid": "11ad9e8f-7f39-49af-aff4-e2b013fcd66c", "value": "T11A552321B581DC33E84EC8369075DB91BD70EC360456C68367B87B6E9D252E02BB778A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666372484, "uuid": "d6c10ad6-5bf4-4219-9cd9-57b4364c7440", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666372484, "uuid": "5314145c-47a8-4f28-9498-f5dd175e5855", "value": "24576:L2sTEwAcizJ5xMwYdMUi/LzaKFx61I8ufBzXYdpBL9miB1Mhm5KiszO:L2sTTMzJ5xMHdMUiyKF+7u5zXYdpZFL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666372484, "uuid": "183cca1c-fa69-4f34-b356-5806eb59f700", "value": 1345024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666372484, "uuid": "4b160a4b-c353-47e0-8d2a-79ebc3f0e3b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666372484, "uuid": "a9832d16-d4d7-4e98-976e-2af95ff3a7c7", "value": "SecuriteInfo.com.Variant.Babar.111863.28690.26612", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13633dd-510f-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666336416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336416, "uuid": "201267af-dca9-434a-b889-8a35271e4a6a", "comment": "Malware payload (Formbook)", "value": "05eb94f1ea741f886fbf182fd0d27973", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336416, "uuid": "f98832c1-4c06-4cf0-8811-430564930c6d", "comment": "Malware payload (Formbook)", "value": "825e7297a0269120fc2030df3a6e1f6bd912ce2458a867a6ebfa3422d7925f90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336416, "uuid": "609c6ea4-1926-4fe5-9fd2-d7a6f40c4223", "comment": "Malware payload (Formbook)", "value": "d5f51fa31d625c6cedbf774cfd6895e0c51397da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336416, "uuid": "d1af42c3-40b5-4f9a-b54b-d856482cc52d", "comment": "Malware payload (Formbook)", "value": "467f17f0751559f1fb1c1f3bc6a235eb320492d219524dfe65c16216aca1df4a3cd4c00b32d1219b0dc34e9dc1236667", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336416, "uuid": "796ae889-76f1-4f0c-b3c4-26d6cb390974", "value": "T13EF4012986DC5CD2C26841BA8C2235613337FC7AE825EF6F1D87B8981A727461533D6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336416, "uuid": "d190a328-2edc-40c8-abd2-e4e39d8cbfb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336416, "uuid": "957e131b-3612-42e3-b7d8-8ade641af481", "value": "12288:ueeYzZpfqxHu7NNBNEiZxlqmCmOz4SwbfFF6/1hivgK9A+CQ4I:8iXQi4mk2Zk/1hP4A+CQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666336416, "uuid": "7bf49b72-6a89-46f9-9842-aaa809e96913", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666336416, "uuid": "3f1291a8-aa79-42e2-975d-cdc2afed4f6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336416, "uuid": "13c8a02e-42c6-47ec-b929-4a7c86a500d6", "value": "SecuriteInfo.com.Variant.Tedy.224685.23091.25130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182cebfe-5121-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343809, "uuid": "de5f616c-9e02-4367-987e-d4b48845f8a7", "comment": "Malware payload", "value": "86da3a7378e17b51ba83ba3333e86a32", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343809, "uuid": "9adac52e-d838-4fff-a17f-0c7a38422a9e", "comment": "Malware payload", "value": "8324266e25d6a8dbc6e561e035b9e713c3bd339ba9bb5e5b9d4f0821a0262510", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343809, "uuid": "fa8b875a-702c-4829-8f4d-bb5c9ee827e2", "comment": "Malware payload", "value": "e09c6fdc034da5c5cd1656a7b3b49116db575ac1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343809, "uuid": "983b9b2c-c466-4dfb-91eb-037f728d8eba", "comment": "Malware payload", "value": "37f06ea1a2201b6541ba8c927b3b5014a67a6d0f4145b93867d1ee6174b9c6a0dc5adb07f7f9cf8d47f141e2277e8152", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343809, "uuid": "0ebfd448-47a5-4592-aed4-7c6e08e8a4b2", "value": "T1696523D2F92DDA91D5379B386223A07F98193F0552CFF98B3601B7980971DD00B8E69E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343809, "uuid": "52d4e23d-34e3-4976-acdf-dd2812c8b2ad", "value": "24576:TyDre0Wdj/xldIocaP/cfUZnWNruf7r50+89Woaa60rLrLUR07DthTRVXFO:Met9xjnEfUZgun970TLUR07HTHXFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343809, "uuid": "f5b69496-014d-4eab-b0bb-30f4208224e6", "value": 1516924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343809, "uuid": "ebc11bee-09d7-41df-9447-f7b02264a2f5", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343809, "uuid": "4d72c430-fb54-42dd-8ec3-90c44e977db5", "value": "8324266e25d6a8dbc6e561e035b9e713c3bd339ba9bb5e5b9d4f0821a0262510", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a0c4e1-512e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666349444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666349444, "uuid": "166271cb-3fb0-45f0-a5ba-e03623df2817", "comment": "Malware payload", "value": "19af13cadf84f316cadb52d2b72b37f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666349444, "uuid": "2f4262c1-5b41-4948-b573-535e59cd4354", "comment": "Malware payload", "value": "84103df35fb10d7045ef98daa14a78f906287c6e9e226d7bf08753bc0722cde0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666349444, "uuid": "a95f81da-c3be-4397-8fff-07838cc66965", "comment": "Malware payload", "value": "913104e19e6efeff85eede5e34479fa63b5359d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666349444, "uuid": "3f9cb081-8d68-42d1-ae92-a85feddb0d9f", "comment": "Malware payload", "value": "18816d6137831b798c993fc94531a6d6ffdc44590965712c808890390042a52ec0ca7f3d858fdb396fa61d53e470ea61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666349444, "uuid": "2e402eba-65ce-4435-bdcc-26ce3d916d90", "value": "T193A4E0C651629C1FC3CABD7FD8E3046BAD748718AC0DB24A9248A5674B57B804E18DFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666349444, "uuid": "72c4ba2c-34f5-45f2-8458-2157cd4a0883", "value": "12288:yzOPdnH6JY2HIvXDaz7MinKIPMxRMP3oAZTxpemveMrRi4U+s:yKlH6W+IPDanMmKIPMxIXe2RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666349444, "uuid": "d49ae9e1-571e-49c1-b09d-a1e29a7122dd", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666349444, "uuid": "5aecf431-0cf6-4878-a63b-5bef1e216b9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666349444, "uuid": "dcc145d2-1f33-4e4d-8ed6-ba662330fa80", "value": "9b7200b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45d8e8a-5168-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1666374646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666374646, "uuid": "a862bef9-3f0b-4f69-b6c0-59aeabf1636c", "comment": "Malware payload (DCRat)", "value": "18e2fbc204f190723b7baf77a35752c3", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666374646, "uuid": "19180b86-ab00-46d0-9481-09f2a16d274c", "comment": "Malware payload (DCRat)", "value": "851ec341760139a4b59c5a07388b975d0b1f508eef8d5c3a9e2ec64f3ef4a16c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666374646, "uuid": "5397c38e-5e62-4c7c-94e3-daad50d786c6", "comment": "Malware payload (DCRat)", "value": "1f0463085088cf2afe2eb8197caf0a74738782ad", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666374646, "uuid": "edbbc77e-bfc3-4836-a795-8ed90a2d157d", "comment": "Malware payload (DCRat)", "value": "e6d5403f243429d38b4138a4c9acb8f915e1084d256d22ebc8657df14373924958c5b5da92bd336ab56554fe8e02b443", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666374646, "uuid": "f159be24-e6fc-4215-a8b3-c2ed758e8ff7", "value": "T19DD5DF027E44CA01F0195633C2EF454887F4A9512AE6E31B7DBA336E59133AB7C4DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666374646, "uuid": "be486e80-6fa8-4c29-acb0-cfeb7c6250f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666374646, "uuid": "4b051302-f42f-4d5b-b939-89f164811a4f", "value": "49152:Z6isctL3DxiZWjU81PnUxfRkj4RjZT8iw9zeADpewwwUqr8N:Z6JMLFQX8uxfRkjoC9zpdewwxrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666374646, "uuid": "744b8260-9029-4df1-a721-16ad5c023e25", "value": 2897408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666374646, "uuid": "2963b40f-2070-4f4d-b605-3978a309c9f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666374646, "uuid": "87d1f325-745f-4e3a-a59a-71e8162d0963", "value": "18e2fbc204f190723b7baf77a35752c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1bfe718-5189-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666388708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666388708, "uuid": "f1242ecc-ca78-4a67-861a-5660f6b6a1b8", "comment": "Malware payload (CoinMiner)", "value": "0aa2ce5aa03b2ab6ae2a237df03a4749", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666388708, "uuid": "11127b65-76e1-44a8-96f2-dc8115a436af", "comment": "Malware payload (CoinMiner)", "value": "8553c192946ef081746e0576669a2b623739c09f1e7f6abd28b2bbd9913d7b60", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666388708, "uuid": "1d8d2211-bbc5-44ea-a842-c2d96ee3ce3e", "comment": "Malware payload (CoinMiner)", "value": "e02f18371accf99ea2ac9249e36514457505f8f7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666388708, "uuid": "e5732d41-c277-4742-870b-efcada34b6aa", "comment": "Malware payload (CoinMiner)", "value": "bb8114a36b3a1686e24b3464340a657da610581aef81c380a49d387f79a417b69abf2bdc20823425702171ef880e7f98", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666388708, "uuid": "bbe5adfa-4bd3-4c60-9463-93dba7c69f20", "value": "T1614523253541D5F4C4A602F51C3ECAE23D3A5CA25E20494F3B392F5F6E722D26A7A38D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666388708, "uuid": "d9ca2dfb-0f89-45f8-9b2a-5993bbb5bf5e", "value": "882e681a084840290020f3f1495d29b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666388708, "uuid": "1aff9abb-0266-4c93-90b2-da8dd0ec6804", "value": "24576:zDRfA1dI+v0BpQf5AFKYnpqLVwoGe+g18KowLpQWicfLXQD4i84L:z9fA7lfePpKVwJe+mrQWNzXQD4iN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666388708, "uuid": "c2aeca39-5f00-4ce8-b209-5237ea21c515", "value": 1261056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666388708, "uuid": "d68bea37-3362-482f-96d6-baa33b1ff968", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666388708, "uuid": "72a42d4e-3359-406f-a480-488e341b2fbf", "value": "0aa2ce5aa03b2ab6ae2a237df03a4749.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7945e1-517f-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1666384324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666384324, "uuid": "ce6fd2ec-dcf9-4d17-9946-994c37dec524", "comment": "Malware payload (RemcosRAT)", "value": "b487f37c840351981e5e6b77742a3433", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666384324, "uuid": "38f4eea6-3a77-4f75-94b6-d46e7c6e7e3a", "comment": "Malware payload (RemcosRAT)", "value": "8573105c4b67affc024eec0b64c4f4c2f2e7f52d31b5eec059d6d8dc6f0a3743", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666384324, "uuid": "6d699f5a-035b-4f9f-b920-72b2f1d2e1d8", "comment": "Malware payload (RemcosRAT)", "value": "2f2a65843556d39752e4d1d762a9a06aa5ab858c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666384324, "uuid": "a42b9132-85b3-413e-a37f-d265da5cba74", "comment": "Malware payload (RemcosRAT)", "value": "be79f505e33dfcb92b328ccea2e7534003ede492ff68d9401ddb57beb96506feedc7fcbc7dc11998480021dbda075b24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666384324, "uuid": "c69dda2a-82b1-41ec-83fe-6c5dd5ca9045", "value": "T1F9B4236BB7B5D16BCCB300B629321B5BDF6B981220609B4B87416E2D3D53D32C61F663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666384324, "uuid": "4056a884-f4fe-4cd6-8ed7-694c28104be7", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666384324, "uuid": "87a3a2a0-1951-49d3-960b-530de9b79816", "value": "12288:mb/1dU3WO1y8+7CUErBO5woYl7yXYC3KL7UyxmZo2P:mb/1632CNNdtC3mEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666384324, "uuid": "ec6722d8-075a-46db-bddc-486266e33431", "value": 525653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666384324, "uuid": "61b19142-b4f5-4780-b7fb-b3ae24e285c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666384324, "uuid": "49633e58-79a9-4c59-aafc-15dd2566094c", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2eb217-50de-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1666315228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666315228, "uuid": "fb620c95-0a36-472f-953a-73fc804eb510", "comment": "Malware payload (RecordBreaker)", "value": "34d9078e1eb799e114682743c092dc74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666315228, "uuid": "81c04334-5801-4768-a784-811ab4748902", "comment": "Malware payload (RecordBreaker)", "value": "85e9c2683e21ac4ede85dd17040a376b59e2ec1e1064a9930e269413c11abfb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666315228, "uuid": "a1f0b540-c049-43d4-8436-3953d4475c82", "comment": "Malware payload (RecordBreaker)", "value": "3122ff696ea90e1a676823610bc13ca7df476863", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666315228, "uuid": "a8fbaa03-25f2-4c89-9969-a07df7abbd06", "comment": "Malware payload (RecordBreaker)", "value": "f26128f25a9064ed8573a1416fe2e868748593d32b4b61fa0e1d59d98f71b8c0aa05c832f7136b921274fa077f2128c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666315228, "uuid": "c61ecdf0-2071-48d9-bf91-6fe0160afe4b", "value": "T1B335952E6EBD0737C469E196CFD0C067F160D06330629DA95ED743908667E862ACF2BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666315228, "uuid": "014ef423-6544-43aa-a68f-6b6344cc9316", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666315228, "uuid": "5ef657db-cc8b-480a-8708-3842a41c5b0f", "value": "24576:3v8D7N7lqMIO3Yqsk2yqODwpDKB2di/+v4WQ8Vl:ED7gKFWQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666315228, "uuid": "1c613628-0533-4731-af97-32eb85008875", "value": 1099680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666315228, "uuid": "36164023-d0b8-4e18-a48a-2ea21457e29c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666315228, "uuid": "df2bbd9e-d092-4665-b6bc-833ae26af378", "value": "34d9078e1eb799e114682743c092dc74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7963e0d1-5124-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666345261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345261, "uuid": "e4b92de1-d8c2-44d9-8fc7-b112e4d78d61", "comment": "Malware payload (AgentTesla)", "value": "b23419bf3315e3d8b6360a9218ded0d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345261, "uuid": "3e05f66e-7d80-4f73-972b-69e7dd09ce39", "comment": "Malware payload (AgentTesla)", "value": "869a4c154042783ef017239565cd78b6961c5750909664fdf9a76ba9ef94a17f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345261, "uuid": "c9e66190-13a4-42cc-a6c4-6f48f7558464", "comment": "Malware payload (AgentTesla)", "value": "2075b602b3f2d84b441a913d156d7d2e27c8ae7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345261, "uuid": "6e739af2-3116-41fa-8b06-91b426e5406d", "comment": "Malware payload (AgentTesla)", "value": "4eff06c06e9ba647768041db01dfa0e1f3a3ba54beca51ecbaf716690a8226ceeffcf9582ac7f8ddec50ff4d620186b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345261, "uuid": "c5df0a93-cbe3-4109-ac4a-1ce79296a5da", "value": "T10D3549BA26D50147E8297A719093D1B326FBAE416446E1CB64D31F2FBC842FF9613387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345261, "uuid": "e28adc32-6df1-40d0-8f5c-9f6c31093201", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345261, "uuid": "cdfa3df4-ea36-4d8d-9f2f-57ab48889b7a", "value": "12288:1aATBouhvqVlfEuqc2yU7XQyDBBomP2cIkU2uE9a0XyF9airewTPk:9NuqomP2E9Yaiaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666345261, "uuid": "664270ac-f2f8-4eac-bb40-223db1e79287", "value": 1058304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666345261, "uuid": "51c232a7-4e2a-4643-84e3-533d508abb94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345261, "uuid": "114a6db9-488a-4ad4-a3b2-39c7e4b126fc", "value": "b23419bf3315e3d8b6360a9218ded0d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd7cf77-5120-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666343688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343688, "uuid": "3a943783-ccaf-4937-8394-5efb2124ac36", "comment": "Malware payload (Mirai)", "value": "baa472692622c35fc7446a46b5ed901f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343688, "uuid": "acf0695a-bd54-4be5-9c5a-8d182f78db8d", "comment": "Malware payload (Mirai)", "value": "86ea06894d141955a3a681ef1d45e692bb9267baae06e546739e04ac5002bd68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343688, "uuid": "a64cd84b-7cf9-456d-8619-394b22b30210", "comment": "Malware payload (Mirai)", "value": "a309634e55b15bb8e61e04d19cc0ee74254497bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343688, "uuid": "defeb605-65d2-4e3d-a949-ad05ec3945d9", "comment": "Malware payload (Mirai)", "value": "560fe650e5b043fed68942d13477185a99571bb37c2162aadeb60f9d84484d1622180da9ffb04080add7e6d455e7162a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343688, "uuid": "175d0bb2-fa29-4efb-b2c6-91a1566ae019", "value": "T1B5D2F1BDF9C1AAFFDD57D077731EA471608AB8B892406315B36A8D4287F1610FD8284E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343688, "uuid": "ac7f0c91-fbbd-4c0c-b057-e93939f93e1e", "value": "768:0lxKd21RhxEKNlWTOK/XozjxaQNKFUYJxwr:Rd21/DNlWTOKfEjsQNKFdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343688, "uuid": "b37346fb-81e7-414d-9423-e3e62f96c553", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343688, "uuid": "be1e9bb6-29de-406a-a104-cd23db472291", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343688, "uuid": "e14181c9-70f1-4256-ab31-3c43bd1771af", "value": "baa472692622c35fc7446a46b5ed901f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f5a4e1-517c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666383219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383219, "uuid": "e76af8ce-83b5-42b9-afaa-ac603456960b", "comment": "Malware payload", "value": "50de7e3526d9c8ca6d7c12ac3fcbfb9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383219, "uuid": "0e90e409-d024-4abb-9771-dfa65e2a45c6", "comment": "Malware payload", "value": "87d58ca41fc4ce528c00b0b3a3024fde0b27354850fed855fab1d28cd5aa12f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383219, "uuid": "5915e93d-2e5f-44a0-9298-d6e0c871a85b", "comment": "Malware payload", "value": "28cb1b9fce293efd00623f0b913e4c9c61d255d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666383219, "uuid": "c5ba1582-9d3a-4c31-89d6-654bab382d07", "comment": "Malware payload", "value": "cc8140c2b3b88594c7d4022b09bb057936aca3d88df57e74449d6b7a86bdbee431d8876b19990e6d56e0552e9a0ac185", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383219, "uuid": "6f0aac95-c22e-41e9-bacf-06a7601ba4c2", "value": "T1067633253BF011FBF78E0230994C5ADBA3F9E57109116433BF98872EADFD081A659936", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383219, "uuid": "1e2b3098-1d93-420f-a2a0-ee9469478f90", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383219, "uuid": "cd1fa3f2-8f1f-4519-8a25-f287a2976453", "value": "196608:91OR2dPGg1un8DaIc4xpkxpaCcGzLq4HzOmvepl2:3OR2dPGg08Dab4XAaCcGzLq4H62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666383219, "uuid": "1404fc2a-cd9b-4ff8-bcc8-21c34caa7696", "value": 7616488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666383219, "uuid": "fc10deff-0f4a-44e5-a350-afdf2cfe1ec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666383219, "uuid": "02061e96-8845-4476-9f25-9b6b49bbbfa6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac13dcf-5135-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666352565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352565, "uuid": "2050ab4e-665d-40e8-9def-887f01f8dcb0", "comment": "Malware payload (RedLineStealer)", "value": "db1fe3788f6ba8e8c46bdebdc00ce3c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352565, "uuid": "8703dc5d-3366-4e00-87d4-e4cf1c51880b", "comment": "Malware payload (RedLineStealer)", "value": "88728adfa648a9020c5aaa7147589a247c5ec262419355cfe3e5655c17927d05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352565, "uuid": "6974af55-255c-40e7-b277-025bec8b9227", "comment": "Malware payload (RedLineStealer)", "value": "a0ec982b7a2e061bf0d916baaf82b1c6dcac8bfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352565, "uuid": "d2e9f41c-5694-4c4e-a912-bf072091d185", "comment": "Malware payload (RedLineStealer)", "value": "ff63504486e3eae93c1d07ac1544c65dd547e0a14e7351bead07758afa2250f02bbf7147c9283f7b10810148e15638a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352565, "uuid": "49b57375-891f-4f60-9418-158afee64a8f", "value": "T12634BF2236C0C032D2AB16788951DAB46F7B78701B7966CB77D44B6D9F353D2AF26302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352565, "uuid": "866f86b8-dc81-4a15-96fb-be64522a2083", "value": "a7a46e8048e804699368d22fff8c2cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352565, "uuid": "d05f3e7b-7594-4170-8e72-8dd39e5cc0c7", "value": "3072:thNv4A+b3TRrCLIZXKr/qVXR0mxvTx8XDNS0LPEr12RGIJ4e:tPXOT0LIlKrqtUNJor12k7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666352565, "uuid": "daba6266-e433-463a-83e6-42f657b2afef", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666352565, "uuid": "1afd1330-4365-49f4-9610-67359d97d6ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352565, "uuid": "b76f3133-dff3-49c9-a7a6-7cfbc04b3b85", "value": "db1fe3788f6ba8e8c46bdebdc00ce3c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed01c846-5166-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666373802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373802, "uuid": "88700787-64a8-4571-b243-195327e4a999", "comment": "Malware payload", "value": "523fabbf71ed79d8d0dfd02ecbfe8ef5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373802, "uuid": "8fb4a634-4770-4f07-a5af-70126ff28af5", "comment": "Malware payload", "value": "887802a18a5fb53e65c384a17d2a89b01117397d673846f7374ce9cc5aff47e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373802, "uuid": "482a8816-47ad-4849-8e63-9fc99d99f52f", "comment": "Malware payload", "value": "f6363e200fa91c3a0950559645e5a9198bf4d471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373802, "uuid": "42e28df7-b4f4-4cf2-a6d3-969528480597", "comment": "Malware payload", "value": "c6007332739f398c87bf4babf1a274fe660493230b9bf9bc8af3745fe546aa60255dc9f303d6e0439b0c06a51c9fd371", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373802, "uuid": "1f748817-260d-414a-ac9c-a050e9de15f1", "value": "T18934E031B681C873C48254355424DAA0357FBC325A35959B37A83FBE5E702DE9AF630E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373802, "uuid": "3e0af941-58df-4375-be7b-8e0a07a8cc7b", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373802, "uuid": "7dfb3e19-3165-4882-acdc-528f8f70dbb7", "value": "3072:pXSmELL+/YnLQhO54qj+/TMcUHxIuw1jhOD4CLFgUmtEt33I:N1ELO2LQhK+7cHxIuw1NErmeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666373802, "uuid": "67ca6b14-a87f-481a-a7b2-3a1087545711", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666373802, "uuid": "ce81a3b0-29d1-444a-b5e8-57edbe00524c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373802, "uuid": "d7bb79ad-1af4-46db-abc3-cf70dea95aee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9883cd03-511f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343166, "uuid": "0eb7b242-f945-4ddc-b402-760acf5b25c2", "comment": "Malware payload", "value": "6d9512776c224ad17a26a1ebb11c4057", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343166, "uuid": "5b0c9e15-3534-4721-9282-0e97fbaca189", "comment": "Malware payload", "value": "88d03e683c01d9979c752844579bd367892edbbdc876b03df8e1d09412f761c5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343166, "uuid": "ea9b4d39-bf60-4169-b2e7-b96e6c90b961", "comment": "Malware payload", "value": "79e2ee36a8004c37eababfcdb399fff0af324b08", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343166, "uuid": "6da2340f-7071-4656-89bd-88d815c483db", "comment": "Malware payload", "value": "df66439fab5adf4579e95285b3f48a26dfc543671f3883f46a58466ab6022d8713ed5fb90c876eab7f7e1161953fbbcf", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343166, "uuid": "1ed342eb-ca10-483c-b5bb-80abc2472221", "value": "T17886F04BFB98E85AC4F3E73289715222525B0D558B43E6876E21727C1DB3ED04B0EBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343166, "uuid": "cc238225-4926-41af-b8b2-dbb0105cbea7", "value": "196608:WIziv9G4YTq2xAhvGhAHXx7s/J3dgCCf8UqIalm:aFGRTqenhsXS/JiCIalm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343166, "uuid": "c73b2305-4571-4f47-8cda-2c35e7ed0b0e", "value": 7909833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343166, "uuid": "c7df6fd0-8360-4b2d-92fd-0a59163431a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343166, "uuid": "7ecbbfa0-6b66-423c-9964-5106d26225a4", "value": "88d03e683c01d9979c752844579bd367892edbbdc876b03df8e1d09412f761c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3762937-5144-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666359076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666359076, "uuid": "29b76955-ee32-4e1e-a080-bcb0ef4a22be", "comment": "Malware payload", "value": "23100db360d83c7c79434610edc61f14", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "fake powerdvd", "colour": "#1D4D84", "exportable": true, "hide_tag": false }, { "name": "setup", "colour": "#94C509", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666359076, "uuid": "375afdc2-6049-4cf0-ae0d-b574278d1f5c", "comment": "Malware payload", "value": "89149df9b65b18fc7eb95175830a8e397511e6a335ec7baf7bd60c85f7676486", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "fake powerdvd", "colour": "#1D4D84", "exportable": true, "hide_tag": false }, { "name": "setup", "colour": "#94C509", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666359076, "uuid": "32130af6-8b75-4073-8bff-4c463fad3417", "comment": "Malware payload", "value": "eaff0ae4b1094f9aaf1c53177ff87a8ddb571f8d", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "fake powerdvd", "colour": "#1D4D84", "exportable": true, "hide_tag": false }, { "name": "setup", "colour": "#94C509", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666359076, "uuid": "6498e429-b985-441b-aad8-12d9ee4abc9d", "comment": "Malware payload", "value": "d513bf4b305095463e3ae84db4826aa273005e8fbae76c750f6af18a19071084ea9da1d0e891c8869b6720cc0217ee4d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "fake powerdvd", "colour": "#1D4D84", "exportable": true, "hide_tag": false }, { "name": "setup", "colour": "#94C509", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666359076, "uuid": "cc7e5fe5-07e2-4453-8f42-6968502a34b0", "value": "T1485633F17BE91B63A483328D40DFDF8813817E44EC5769A939B631C12E7356A18C9ACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666359076, "uuid": "b1155bd5-199d-409b-802d-65d270529334", "value": "196608:e4uICdXR0ZaAeoxjlZIQIpf5e/7E8VYfINGYlmhBGYlmhBGYd:e13X67eClqpf5exywNGYlmhBGYlmhBGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666359076, "uuid": "535bb19b-e792-406d-84c4-00129905e850", "value": 6467907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666359076, "uuid": "e32f6d59-6da4-4d98-a29d-a6f59c1c0958", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666359076, "uuid": "6fc076c7-b8f0-46a9-a218-8e357f28d510", "value": "Ful_Pass_1234_Setup.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da60de5-514b-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1666362045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666362045, "uuid": "bc2059ca-4995-4f61-b6c0-c2cfdac97118", "comment": "Malware payload (AsyncRAT)", "value": "5b1002ababf87b78ceb0b485229f0042", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666362045, "uuid": "7938b9d7-3bef-4b3a-9eb3-20e898299d83", "comment": "Malware payload (AsyncRAT)", "value": "893a006c74fe543890b125cb86d6ce1316aa783691ae28654c685233fa02671c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666362045, "uuid": "388da08b-a6b8-4018-8417-b8608082ef41", "comment": "Malware payload (AsyncRAT)", "value": "11d787291a5b7dc356f7021c8e9946a589a4efe9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666362045, "uuid": "2d20e2e8-626e-483f-8cb9-3f94b47c5a16", "comment": "Malware payload (AsyncRAT)", "value": "6bce12b0d36b0e62dc9c2890a0d62e444aa058a230a234dba03dc1b21745e7ac38f5609a467da1ac69b08abb839abb0e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666362045, "uuid": "b1385fa5-858e-4d60-8a69-4f4ac4166044", "value": "T123230A003BE8822BF2BE5F789CF26145467AF1A72603D54D2CC451DB5613FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666362045, "uuid": "2eeff084-fd47-4758-b2d2-c88856cf1db8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666362045, "uuid": "a80bc40a-32e1-4010-b3d6-7f163eafcd07", "value": "768:Hu/6ZTgoiziWUUM9rmo2qrrKjGKG6PIyzjbFgX3iHzOJt8dBDZjx:Hu/6ZTgle2mKYDy3bCXSHzWazdjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666362045, "uuid": "a301d931-4451-47eb-afd8-5769246202eb", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666362045, "uuid": "5c13ceeb-94a4-4274-9635-6365ecdd19d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666362045, "uuid": "fa3d7acd-7371-40e1-8637-9e425e1211de", "value": "893A006C74FE543890B125CB86D6CE1316AA783691AE2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d263035-5151-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666364568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666364568, "uuid": "bd237017-5b6b-43a3-844b-5163a4c93919", "comment": "Malware payload (GCleaner)", "value": "f36a13f6e8ae91604ade8ba9debef047", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666364568, "uuid": "8fba27e8-ba20-41c9-a8a8-b90905eb16bd", "comment": "Malware payload (GCleaner)", "value": "899ba3da76e6c3c2ab2999d83e23c8b1094931d64d81151b23454d72e6d109a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666364568, "uuid": "9f286385-94d6-4798-9669-e87fbe5dd155", "comment": "Malware payload (GCleaner)", "value": "cc630211dfdd45a7415f975467f0adf95ee267cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666364568, "uuid": "ca88bc7c-ad8d-4bf8-882c-80d52a339abd", "comment": "Malware payload (GCleaner)", "value": "7d36e344109184132877d915f5fe6a792a58ab6b97ed564f28f18152c5eddc5894058c58706198e5364e692b0e613ccb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666364568, "uuid": "eb27c6db-eeec-4eee-996b-9819f31dafc5", "value": "T140C5330705884D33D164AAF1ED27FEB148536F90243F695B72FC81AA5FABD284E142E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666364568, "uuid": "06461683-1e6b-402f-ba9d-cd70ceacd582", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666364568, "uuid": "1d2bdaf5-0164-4014-beca-9a0c48db116f", "value": "49152:Z2elQ7iFoxsXoSui8j/6H0tBvFSNJHbiNG1OHi9wsLMvl+4KaUuOOA5hq:M+FoqXu/6KRFSv7i4EC9wsLM04tOtDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666364568, "uuid": "341b855c-ff3c-402d-bffe-e813414663c0", "value": 2512999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666364568, "uuid": "59cba009-2230-4791-b83f-cb3152eb5420", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666364568, "uuid": "15d712af-e7a3-4620-ba5b-0e7791a27813", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1d6932-512b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666348116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348116, "uuid": "d037f59b-42d1-4cde-b439-a13e6bc2ce01", "comment": "Malware payload", "value": "8049fd958582563e259c03194fbbb868", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348116, "uuid": "2bcd9ae9-8214-4a30-8254-3244458979a6", "comment": "Malware payload", "value": "89a8e60e76d8b381b9813d0da3168daea3aae23d8bb810166e3d5ac264eee7ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348116, "uuid": "53ec6d2c-6efb-4d55-b0ef-c2ef95269ba4", "comment": "Malware payload", "value": "33d83cfae0b38f9542833ef67de98238f14384e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348116, "uuid": "320abd57-b2f7-4512-afc7-bf2c9bd3aec1", "comment": "Malware payload", "value": "b39d198be1c4c88f23e11df43354963f225bb5f5cd28fc40073e7b4609ed55bbde9bba346d9556bd1dbddae9034aa71e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348116, "uuid": "c5d7ac19-fed1-477e-9b94-85be3793ec7a", "value": "T1CD2633E5F86335F0CB91FB3DEF4D815BBE9976168644AD724E9012B18A2497B0E3C80D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348116, "uuid": "31f93bfc-e808-494b-9eef-7a4cbc1ab296", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348116, "uuid": "fdc63dff-8485-490d-890f-cebe37aa5427", "value": "98304:Dy55KLegRIaA+YN1fY6bb8THy8+QjBPdm12ElLFFA:DynCYN1lbAbyOdmUElR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666348116, "uuid": "75ea275b-2781-4a7c-a53c-82e59886a158", "value": 4488704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666348116, "uuid": "c2878c62-1e16-4c45-b262-f090e24f2608", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348116, "uuid": "5d361d80-5368-4159-b1cf-b75b8780b292", "value": "8049fd958582563e259c03194fbbb868.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37975edd-518d-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1666390248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666390248, "uuid": "4648c234-ada2-4405-9f24-bbc6adc9109d", "comment": "Malware payload (DCRat)", "value": "23d4e0f1af6e1a03cfad56b8089b06aa", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666390248, "uuid": "ab5e44c5-e0d6-4bdc-b32b-1de6dc5a8f63", "comment": "Malware payload (DCRat)", "value": "89ea1a96d2c142622a9824e924ff1803cae03513a2820bf7d7c26a5e1e931119", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666390248, "uuid": "5478c011-72f5-443c-8c5a-233b2d180a2f", "comment": "Malware payload (DCRat)", "value": "54da7ed165a78af513a211bf444114ae4db09165", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666390248, "uuid": "1751aaa1-013b-47f7-87e9-af235cc2c119", "comment": "Malware payload (DCRat)", "value": "363b9a47534881a0db29222cb572e5ede56cb3b82909293c8fc4d01a93c12bc58d4e4ecbba04d7773a1b69fe2af59e21", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666390248, "uuid": "e92b3817-1310-4370-a31c-b6a955cf28f8", "value": "T12ED5DF027E44CA01F0195633C2EF454887F4A9512AE6E31B7DBA336E59133AB7C4DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666390248, "uuid": "38523069-9dd6-4b57-a0e3-93add523873f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666390248, "uuid": "214bbda9-6184-4cf3-a983-980501dbe89f", "value": "49152:Z6CsctL3DxiZWjU81PnUxfRkj4RjZTsiA9zeADpewwwUar8N:Z6pMLFQX8uxfRkjoi9zpdewwxbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666390248, "uuid": "0bc29fce-16fe-4308-8951-826bf0d1df23", "value": 2897408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666390248, "uuid": "3e930d9a-e022-4b07-980d-6c270947b383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666390248, "uuid": "623737ce-3cba-4bc8-93d7-9ff087082ee7", "value": "23d4e0f1af6e1a03cfad56b8089b06aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6842c2ff-516d-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666376586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376586, "uuid": "3d7d6e88-fee6-4077-af07-377d261070d3", "comment": "Malware payload (Mirai)", "value": "9c335ac38f2dfafbad969c5b050a36b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376586, "uuid": "64ecd5ed-890e-4263-b5ae-21f7e11f5516", "comment": "Malware payload (Mirai)", "value": "8a79c758b44870174c1ceb94b60f4db459325c7a4076e1c172ded80fdf54a604", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376586, "uuid": "0a04b9b0-af38-485b-b324-6e6946aada1d", "comment": "Malware payload (Mirai)", "value": "f6c7e17be99bc0b5dc6f6aebdaa877480e68141d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376586, "uuid": "debd73ae-d647-4a5f-aeee-cde387de984d", "comment": "Malware payload (Mirai)", "value": "0fb0bfd0c612c718e7340fb6313c9ea9d6b013064f8141e60d7eca2c2f4f42883513941ab1076b5aca79e5a62cea3ef3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376586, "uuid": "69287c6e-e70f-4aeb-9a45-980f08b4901a", "value": "T14833D79178D15A2AC6E423BAF9AE40CE3321B3E8D1DF7217CC241B047AD552F0DA7B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376586, "uuid": "cbae90e9-ded8-4369-97da-41cbb7eddd60", "value": "1536:YGZh1mxMBEfiJo25+J+KEwrKdqnKKUWhK9RP:YGZ++tS+KEwwKPh6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666376586, "uuid": "aecf7130-6260-4c00-ba13-bc89a4b6355e", "value": 51172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666376586, "uuid": "09ed9ab7-519e-44ab-929b-b566a48b0471", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376586, "uuid": "b82e0171-e94b-4546-b2f3-044457efeffe", "value": "9c335ac38f2dfafbad969c5b050a36b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e5dd09-5196-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666394142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666394142, "uuid": "d4fa4048-4d6d-41ca-b2d4-b25ff9544863", "comment": "Malware payload", "value": "85ea457269e0c0bb8b0c31537b13d508", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666394142, "uuid": "aa891f36-ba47-4e57-ad7a-402b436c1544", "comment": "Malware payload", "value": "8aa756861fa362d33327021ba0d875c6b1475c53f2808d16f817be395d50bddc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666394142, "uuid": "3b603e01-377d-41a0-805c-7c812bcf83f8", "comment": "Malware payload", "value": "b22af4f34b007d39f141c0e901bcb2e4ea697ebc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666394142, "uuid": "1f7e50fb-75f6-4a83-995b-19b846b3855e", "comment": "Malware payload", "value": "34148ea23bfcd9f26aa19233d61ec31771ffc2e4a2c3b2aeae107b9bb89682f8bfeadba7e3344cf495e10018ac1c1f62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666394142, "uuid": "b6dcd698-98d2-4e61-a780-ad03f2dfd47c", "value": "T1D9C53324EF061CB5E50495B56CB9DA248A363F3261387D67F2AC97DC0E1E49E8106BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666394142, "uuid": "f79b680c-4dfc-4e32-bfdf-90b3c696a8cb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666394142, "uuid": "1c960181-f846-4d6f-be62-b0de2cfa0434", "value": "49152:Z2gMa94p35P7vBoPJ1lAs5MugFMZ9qTe+P+esYCAG9UPkRALtNuD+uA5hq:MdHFoPJks5MfXe+WesJcLt++NDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666394142, "uuid": "84a7d6fa-540b-4f5d-a76c-ebcd6b9fffd4", "value": 2536228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666394142, "uuid": "d688e4bb-0123-417e-b0c4-33d23deedcc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666394142, "uuid": "b2f95a5d-ffe1-414e-be6f-b0ad24af04c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d8061f-515a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666368391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368391, "uuid": "7b55361c-c258-49f5-bd89-37aa13d69b76", "comment": "Malware payload", "value": "94a0af5fa6eb17cb1e8f63f82a293bea", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368391, "uuid": "b8c30aef-c1e2-413b-9138-6ab491c9d0f3", "comment": "Malware payload", "value": "8b02370293edbe009387a04c8279f24d21e1e07499613d09a9aa1befbf097d15", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368391, "uuid": "e76d57c8-fb61-4c09-902b-26cbee5b0d45", "comment": "Malware payload", "value": "076912df6028fa313a59c61b57d497b3ab91e564", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368391, "uuid": "4172ec76-9371-4e92-aa98-765d366f2a63", "comment": "Malware payload", "value": "74af93ac38177ecebdec79feaa63f15706a46a281bcf979d488dbdb129ab4bf99af5612a5a1a85485c0d58e206e2aa88", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368391, "uuid": "0cd2b88e-2608-429f-984d-e8c48385784c", "value": "T1D584558B91530C4BB372652B78447FF8A3B99843BF850C53052176C4982DFBABE58D62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368391, "uuid": "39f8422b-d183-46b5-a263-417839222454", "value": "192:2UPPPau57i64N7lz+3ckbG6HtFP8vWFF8rcv30w/Ki3o5XXWAX:2UPD57f4NlzCFovWCrG3Kyo52O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666368391, "uuid": "0c28d7f3-0758-491b-abc0-75b431e79ffa", "value": 405509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666368391, "uuid": "727ad8ad-ee19-45ae-a55b-be4a387847bf", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368391, "uuid": "854c0069-3879-4322-9adb-3297310a21ba", "value": "SecuriteInfo.com.Trojan.GenericKD.62968857.31231.11879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73356c13-5169-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666374886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666374886, "uuid": "9b7d336c-01bf-49c4-b14c-a0aba073852d", "comment": "Malware payload (CoinMiner)", "value": "f823c3617733486da4d4b770aef17367", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666374886, "uuid": "4eb450f6-7d4e-4f85-b4e0-1a090b4d4547", "comment": "Malware payload (CoinMiner)", "value": "8b6c5982ded40259679360855e6e4a01fc3e7922a4249593068047ea80d25544", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666374886, "uuid": "92ef7415-062b-4a56-bd0f-a82a6347fdb9", "comment": "Malware payload (CoinMiner)", "value": "4a56e48ef739b80701b321a80fab2f69791b11b7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666374886, "uuid": "98356e5c-370a-4966-812e-89ce50e17367", "comment": "Malware payload (CoinMiner)", "value": "a74bce3c1bf898fb484bd05fd636fec85391e3317d78461f85b6ac47164696c8998232b3afe0ce20feb6de4cbfe4a4d1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666374886, "uuid": "9a3d96e8-812b-467e-bd3c-a05360d5d353", "value": "T1C434D011B6C3C873F886C5324834DBB72ABAB832156549973764F7AE5F301D2A7B6306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666374886, "uuid": "9bb64f4b-3616-44df-abb4-b9b67543b44b", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666374886, "uuid": "d768464a-6192-4306-9e0b-ed4265b0f80d", "value": "3072:DXSy+LGkbx/QvO5VtyLer/iO/iMG6IVv5eNrBzhuoKxUrhiMVV+N:7l+LGkl/QvtLe+ii2IVwNrVhc8Ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666374886, "uuid": "cdad5927-265e-4b3d-9e30-2198cc239b57", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666374886, "uuid": "6fd91894-4dbd-41c9-a4f8-4ed284a4b170", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666374886, "uuid": "66638d35-5dd0-4f70-88fd-58c8bd985883", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d84d4d-515c-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666369225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369225, "uuid": "9c6d7978-3743-4ab5-8737-f7d01a776559", "comment": "Malware payload (ArkeiStealer)", "value": "1e7428a5338a36f3139142eea4cd7501", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369225, "uuid": "9e944461-61b5-466a-96e3-50b6bb4a8478", "comment": "Malware payload (ArkeiStealer)", "value": "8bb2b3b5725fe1eb24d7b735d7d1a7f190de9a3ec9829fbe3eba3c79bdbc97e3", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369225, "uuid": "1796a714-e86c-4653-8d54-d50bb4cf6751", "comment": "Malware payload (ArkeiStealer)", "value": "665b0fee184d48456b10ed478a212f05c41c9e8d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369225, "uuid": "871b33d4-d695-4336-b325-02b5184684d5", "comment": "Malware payload (ArkeiStealer)", "value": "0fe51f71a861730a11e31b85dfec056a761d226d60fa11ef6aa0d3091ec9d451f8b10cd6940b074e9fa5a95d9bb3e5db", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369225, "uuid": "92bb7660-fbee-4350-8cc1-a2ec44b30710", "value": "T16E24E10276D3C872C88615310874DBB01A7FB93216754A4B77A43FEDAF702E25EB635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369225, "uuid": "e31dd677-a92f-42dc-b129-d3750aab0310", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369225, "uuid": "c1b443fc-b6e1-4809-8e3c-8204d475a094", "value": "3072:RXZAH6LgSmVQ3O5yefMhfUJLujpQxHawTT:1KaLgpVQ3JGTlGmawTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666369225, "uuid": "d265b200-94f6-4c8a-8b63-c5dd771a6aad", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666369225, "uuid": "7379670e-9b64-44dc-bca5-0df245b84ceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369225, "uuid": "90482265-df85-4aba-8897-e021641cc6ca", "value": "1e7428a5338a36f3139142eea4cd7501.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0689dcfa-5119-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1666340344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340344, "uuid": "1734d06e-429d-4da4-a500-8d6dd8a3c572", "comment": "Malware payload (Loki)", "value": "71b376bb593f0138ab6810a40a7e2e26", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340344, "uuid": "3778723f-2dfc-473c-a72c-2e375499efde", "comment": "Malware payload (Loki)", "value": "8c3521d67ca686858fc3575dab75da18bdfc3c3425a1530e943caf907a8af69b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340344, "uuid": "4bb0c603-32fd-4f18-81fc-49c5fd9ec10c", "comment": "Malware payload (Loki)", "value": "20bc5f2f9001dcb29d770ba375c5adb88b8a6c00", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340344, "uuid": "5ca7efc4-2515-4dbc-a20d-081c8061f7f8", "comment": "Malware payload (Loki)", "value": "3bc75edd7b4a868ea56b2dd470338468cf9579b81e91770d80434c85fbc983334f289e2fb4bde326b6152ee533c74134", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340344, "uuid": "ecd4bdd4-68a9-4b08-af97-8dfcfe987528", "value": "T1A0F3236DCB8B44A58F549376132B4E0806BDB32EF30192B2386C97B137EDD3949A54BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340344, "uuid": "4b0913fd-f663-4987-9501-c848ed339c3c", "value": "384:2flqbdUnvfnh7sXZcuisB9REYrVuW4ZtyKbk2crDsH:olqWfds2uJB9RbJ3utyKbHI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666340344, "uuid": "080555f8-12ef-44bc-8f91-6905521828b6", "value": 166886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666340344, "uuid": "e68eefe9-57d1-4f79-bf15-fb698d7d0f18", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340344, "uuid": "57f34e17-232b-46e4-97ae-7ee9effa074a", "value": "NewXQuotation.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1ad3d2-511c-11ed-9266-42010a9c0072", "comment": "Malware payload (StormKitty)", "timestamp": 1666341831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341831, "uuid": "3a78c3f4-6625-4896-83d9-b080dc026041", "comment": "Malware payload (StormKitty)", "value": "e2419d65e2d88ed19b494daaccc05712", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341831, "uuid": "55721ae0-130d-4913-9d08-db2c1c240fd9", "comment": "Malware payload (StormKitty)", "value": "8d07cd7ceb888ec77c8f28fc6f3e61791605c4c2cdaad7ff31450cb9c94358fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341831, "uuid": "d28c4177-82fd-4053-a874-17c2b0c70725", "comment": "Malware payload (StormKitty)", "value": "3e3db7a4f0beafa3c41827020b76b20d27cb6767", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341831, "uuid": "2a884e82-2931-4b38-a8ec-7757f49f0c72", "comment": "Malware payload (StormKitty)", "value": "abebaf388fa6dbbef646d33ee23e0ebf5696ce7667607dceb7f9d07acaf951296dfb0e03d4aa5a65c0100c2eed148e89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341831, "uuid": "3f783f90-fd65-4391-a05b-2a392ef16c8c", "value": "T16FB30EE2D1804298EDA95F7564379C2A017BBEBDBDB4F64DA85DB0716F732D30022A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341831, "uuid": "37f90d08-79d7-4044-a02b-8677058f8645", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341831, "uuid": "ae9f8a43-9be2-45d2-acbd-6688ec97988b", "value": "3072:9Cc53RIZ2BtFUQd7JrnQjm7szl7sC7wwn:lIZ25UUQj9zl7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666341831, "uuid": "eced155f-4464-4640-910d-463d16c6d9e3", "value": 107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666341831, "uuid": "c0e34c3f-3a8f-46d6-a403-1fbc8f8e279c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341831, "uuid": "24a59ec5-0365-4296-9867-8b0b876e8992", "value": "e2419d65e2d88ed19b494daaccc05712.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b8ef79-5152-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666365012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365012, "uuid": "1221fb19-24b0-4ecb-b3ee-9fb1d29080f9", "comment": "Malware payload", "value": "00bcac755b3169681a48c5ce2ba28d19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365012, "uuid": "1d43aee1-7e97-48ef-873c-71cc3df40568", "comment": "Malware payload", "value": "8db23c75df03d4a3abf25119de03d1f507ef4234b632af955be2d9b2ee611ed0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365012, "uuid": "e129ca5a-f857-4c2d-90b5-a172b563c76a", "comment": "Malware payload", "value": "95f8aff93cd38c1441bc948606b6176be3d25811", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365012, "uuid": "757d3e06-d7bb-42f2-9a33-85fe47eaf07e", "comment": "Malware payload", "value": "7ca424871125d6edb7288eb30c2b4da02f121ed9053b5cbcecd6c6ff5c22e0277c74559905168714d045033311afcef2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365012, "uuid": "42ac2c02-1e01-4be7-bebf-259c6be9a9a2", "value": "T167A423C89511358DA4F08769B789DCBF9F22FDBD4FEE7013E05490FA6AB4C12AB16508", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365012, "uuid": "bf31bf78-ec8f-4040-b0b1-c2fbc54a45ac", "value": "12288:IiFv9MLS5p52ezbGVfPgiub/zCwHTIECSjJ5FoPn0q:IQMyp52ezAYVzzCI9CS15FTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666365012, "uuid": "4f603002-5e03-4d63-875d-0e21a40833c1", "value": 448952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666365012, "uuid": "73262f8d-41c7-462c-ab1c-cecfd383a98c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365012, "uuid": "9fcf7999-dc21-4bf5-a340-9cab3f856456", "value": "00bcac755b3169681a48c5ce2ba28d19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4ada4e-5121-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1666343954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343954, "uuid": "644a4de8-ace2-41ab-94a7-83a9f8a2b034", "comment": "Malware payload (GuLoader)", "value": "7c17f8dee2c709cf412183fada603e66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343954, "uuid": "fda48184-406f-49fc-98e5-7876a3440232", "comment": "Malware payload (GuLoader)", "value": "8e8d820ff20cc0740604c1a2ec0a9c9a6ef979caf1e0e0b9c518d5f86e1a67c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343954, "uuid": "3c301fe8-c277-4643-af90-9516e09ef1dd", "comment": "Malware payload (GuLoader)", "value": "c5d81b2bf0e264a635fee8cdc3cadb725c9fa1b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343954, "uuid": "25dc97d6-7c4e-4bfc-8a08-644d5ade996e", "comment": "Malware payload (GuLoader)", "value": "3c9915a6c5742b08c7ede0fdd7c140f215ba81f96e432fbb789e3db6b1b9fd236821c3e4227fc2a92cac8a1d38eeb972", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343954, "uuid": "7593be5e-c298-46ec-a2bd-11d2df4b9546", "value": "T1BBB412267B80DD36E3A981B0E677C60CCEB4E40119527B47BBADAF3E35B5351DA0E106", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343954, "uuid": "b12f6687-0306-4a20-9caa-ffe725636af0", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343954, "uuid": "0869bff0-712b-459f-8989-059394646007", "value": "6144:7Dfe1yeAal9SHYC9xsIxJKZREuBtljUr0Dis+nL7a2xHOGzc3killHMDbUAJKBh0:f4VAalM2IxVuVbD7+nL7ZillHMDmE2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343954, "uuid": "d14cd755-dff3-40ad-b614-eab81c13e19d", "value": 517888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343954, "uuid": "67de710f-d877-42b3-9ff9-fc0584921be4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343954, "uuid": "524b5ead-1d30-4c59-beeb-9a488bd636eb", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.12538.17658.28693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cdd19fc-516d-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666376620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376620, "uuid": "e864636f-cf5b-44ab-bb5c-b29eff59e713", "comment": "Malware payload (Mirai)", "value": "5b4d0f0ac6e011cc7d22f41f6b1f5d0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376620, "uuid": "8924ba19-09ee-46d1-83ef-ce380348bc7b", "comment": "Malware payload (Mirai)", "value": "8ee5f09d526b18dfff1a5892c3d22c792bd5e1db930daa4e6d134584eca3da8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376620, "uuid": "9ab08a3a-a430-42d4-b66e-2f3b2cbc0141", "comment": "Malware payload (Mirai)", "value": "38c7552102be80f281435a7a49b421431e4b1a11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376620, "uuid": "6421f057-073d-4f9c-9f2c-995713512ffc", "comment": "Malware payload (Mirai)", "value": "16dd010fa77520c33460016b49ac811be04f0cc14449c42ed354b5e3b216a6ee3c1d0f90bbde756da6c3db9aaab2b9f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376620, "uuid": "42aaffb0-ff92-43f9-9354-5cbd2616e901", "value": "T10A63F852B8C18E15C5D813BBFA2E018D33126768E3DFB2129D116F147BCA92F0E77A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376620, "uuid": "cce39a68-8e23-4ba8-97b2-f1f3de11a0a7", "value": "1536:StnER4jL83+4/ZZM0mA8w7lR5vzq91dO0nz/IziSX+1/K:t4jo+6ZZBLbRd29P2X+1/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666376620, "uuid": "e0e14acc-25dd-4824-a43d-3887ede0a343", "value": 70960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666376620, "uuid": "8c2ed75b-24b1-4b0d-9418-5d1b85eff179", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376620, "uuid": "40b73813-b7cb-4463-8e22-bb5cec38de82", "value": "5b4d0f0ac6e011cc7d22f41f6b1f5d0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efe6ef9-5103-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666330909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666330909, "uuid": "e998d793-66d2-4ee4-a81a-9640b6759a5a", "comment": "Malware payload", "value": "98ab6f06e69b6f1ba449538577cebc9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666330909, "uuid": "815b9cb7-12ea-432c-9179-fc35ff3eb8a5", "comment": "Malware payload", "value": "8ef6f610e35b7017ab6f4303db47179ae75bc72b966b68003caa2fc1dd1b0add", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666330909, "uuid": "26769645-44d9-4c45-89a6-92711c7a07ac", "comment": "Malware payload", "value": "614c0ad978f577a0461274f317f3ed6f6cb97637", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666330909, "uuid": "02803da7-e574-44d1-b0a2-fa520ff5c273", "comment": "Malware payload", "value": "ed06bc37124e629851f79cc52f1bc0cd8ca061acef0d0ac01f55bf842503f83da15646b441cbd51ec3def5901a904aed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666330909, "uuid": "7cd6a5cb-178a-470c-8cc2-77ae0f115b68", "value": "T1D92512BC71E3CF22D3A89636D0D3CA14136A9947A272E7562D2041D98D02FF5D98ABC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666330909, "uuid": "a7e0cb5a-ff7c-41dc-855b-c39d48214fc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666330909, "uuid": "5550d221-8b99-4371-b619-685bde3c46fd", "value": "24576:2np+DkHrZJQNdHimKoFT4ANyWNpSv54tohrxM:2+DkH1J2dCm54AUdeexM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666330909, "uuid": "8d8798b9-1492-4dfd-8677-91cedb687bd7", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666330909, "uuid": "9cec3f31-537d-486e-bd84-3c15a37a4c32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666330909, "uuid": "154534fb-b0f7-48d8-bd00-04b22afe6c3e", "value": "9001021.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68dbe64d-5138-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666353823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353823, "uuid": "404fa5a2-ea7a-4d55-931e-760473623526", "comment": "Malware payload (Smoke Loader)", "value": "fb6c53deb7f5c6a1682328c88751ddec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353823, "uuid": "4e329903-4b20-4060-9887-25a48e0ef4f8", "comment": "Malware payload (Smoke Loader)", "value": "8fe888167e7096db5d6aa3d3bc64998cd8fd43bef3a83fc6d3c40ffa903891f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353823, "uuid": "3614261f-c51c-407b-a87f-27bbbad05a8d", "comment": "Malware payload (Smoke Loader)", "value": "c51305e18f73eb82fc34bf116e5d16e76a2db71f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353823, "uuid": "b8751e3d-c417-4333-b2bf-766d9bb4c361", "comment": "Malware payload (Smoke Loader)", "value": "539412a294e5fcba29a721ce83af9503382105e5c7bdedc7f0610022c6b2874db7386ee0db3579fa09de780663ba7776", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353823, "uuid": "24864cf9-47c0-4980-be97-dcf5dd7e0fb7", "value": "T1D524E0117AD3C872C84114764860CF612B7F7D32A6748A977BA87B6D2F302D25B763CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353823, "uuid": "be413909-919f-4321-adff-a0259b19b6db", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353823, "uuid": "ebaf713a-9b0a-47c2-8685-84e0ef3c51d6", "value": "3072:mXDiMLikYQfz5ZkXVebbehEftYyIM3i2oBpLOMSYBqeVh0KCzAC:OmMLvYQfiVowrZpBpCMtBhj01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666353823, "uuid": "265c97c7-9c08-4e50-a4b5-2a759d9969a9", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666353823, "uuid": "5e6d44db-704b-4d36-ac87-281e7203ff0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353823, "uuid": "f1faf488-555f-4891-8678-4a08f78f19e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4f7d71-5114-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666338233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338233, "uuid": "ce6c0feb-7d20-48b6-9653-eb315d06fe20", "comment": "Malware payload (AgentTesla)", "value": "bfd128de9adeb46762540aee07409350", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338233, "uuid": "551a1ebb-a76d-4e12-9890-f4ee29e5f5c7", "comment": "Malware payload (AgentTesla)", "value": "8fe933e8bf76350e1a991f00cb12b9071ba17f5586a001e17da49e6892ac34f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338233, "uuid": "df36f5c5-833a-4608-91f2-e7d65c6f6e78", "comment": "Malware payload (AgentTesla)", "value": "93513c5167cdac29e143f8e261919444f0bb0086", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338233, "uuid": "f62f90c1-9264-4dde-8ad7-8618c02bcb9e", "comment": "Malware payload (AgentTesla)", "value": "0cfd6dd2f6310516a72cbf8d28a5f67319aa4d238b9f9cab9609e4abc2b94de79243f76ad6f2a85125d9c96ffb7c6f22", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338233, "uuid": "47c540b7-ea04-4508-bf8c-eccfb5a88619", "value": "T1BB25F0362D73A029FEFCC0357DD4B391426879BFA9C90F86E604B9CA31B36C21A75561", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338233, "uuid": "d23dd0f9-1b0c-4909-af82-2fb97df26890", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338233, "uuid": "694f2fb7-0cc6-4df8-aaeb-0cea43acb445", "value": "24576:XblNEEKXxjasYwA1OorUsXQAKZNA46jgPdl:LlXKhj2V/g9uodl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666338233, "uuid": "96d18763-bc28-46c5-8453-6d9fc545ddbe", "value": 973565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666338233, "uuid": "1e36bfe9-e2a5-4cb6-9bac-4eb986359baa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338233, "uuid": "054bd3d9-c2bf-4177-a9f7-89fa38514271", "value": "RTK-0983456709.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56493fdc-514e-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1666363241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666363241, "uuid": "a66c1bd0-23a6-47c9-a2af-d0189cbc9a76", "comment": "Malware payload (RemcosRAT)", "value": "e47dd0676f4c42fb276f31928739e49a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666363241, "uuid": "742d6936-f04a-429d-b6e7-98f8e0284cf7", "comment": "Malware payload (RemcosRAT)", "value": "906264b2666e009b0d567a50c2b176266b0ced7c9bb685fc6b66aadb7f4ca18a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666363241, "uuid": "99a65208-0920-4907-aa36-eea97eeb252c", "comment": "Malware payload (RemcosRAT)", "value": "9bfd68f045c980caf4caff9689bc66fbcfd8ca0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666363241, "uuid": "2436e9ec-6857-4a9d-85e3-80679aa62d41", "comment": "Malware payload (RemcosRAT)", "value": "d724d2ed9b351793cf65d8e4fb6f8fd4331091fe179ba5302e19045e4dab764454611b58aa7a814bbc73bf6486925a87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666363241, "uuid": "2d94f58e-3e37-46df-984a-b35f4306e8af", "value": "T1A9F1C911A7ECC733DF6B0B76A9A723500739B7551852CB9E68C4A0CB6E136400A727B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666363241, "uuid": "0a08487d-cf67-41da-b6be-fa7e1193e9d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666363241, "uuid": "969fc2b6-14c2-463b-8d4b-edc6c23b10f3", "value": "96:Vi0tKZes0U55tP12oGeLXefwK+2zp7JJhN0sdzNmzNt:XtKZNv3d9GeLXefwKJpdJcAZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666363241, "uuid": "daaf7f12-a761-47c2-a755-fd5ceabc64d1", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666363241, "uuid": "94f61ec1-3c6f-48f1-8dcf-9f4ed88259b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666363241, "uuid": "95f4fb46-a689-4e90-8459-b45e00ddeb6e", "value": "IMG0011D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "206a3b5f-511a-11ed-9266-42010a9c0072", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1666340817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340817, "uuid": "af5d80b4-06aa-4bd7-a2f9-a60107285297", "comment": "Malware payload (AveMariaRAT)", "value": "28f1f4975b4325c7a6797f78e761ff4d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340817, "uuid": "f8766a1c-b769-49d9-9458-af95ae350022", "comment": "Malware payload (AveMariaRAT)", "value": "9084c814a32922e82c43792a58f7cc7e59cae2f52f6a968124ca4177d2e54b63", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340817, "uuid": "fccabe93-24d6-4d62-9f34-485f3dc70c99", "comment": "Malware payload (AveMariaRAT)", "value": "78876b69e29c9d6840cd39582442aa0c6d88e145", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340817, "uuid": "537f2cc3-0aec-4a2d-8495-4639bab9ef20", "comment": "Malware payload (AveMariaRAT)", "value": "bb924e90c83dd3a895c9e05cadef9110fa84765dd672cc14853950301f381807b2072e7d9e7153fd75c724c3f26ecdd5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340817, "uuid": "b95c1618-0373-4cf1-b534-de32fdad2f00", "value": "T192351202FBC68473C5B226311A39F715797DBC202E399A5FB3941CACEE355816225BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340817, "uuid": "5c1382f7-a4e3-4787-bceb-05b6a6a28fc7", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340817, "uuid": "005d1621-b87f-42d7-9524-217a32a84784", "value": "24576:CAOcZXbHlzZs5skMK8rJ0z+B8YbhNsEuSBqc:I2td8eNvFBqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666340817, "uuid": "908d5878-f62c-419d-89cf-bc6f219e1203", "value": 1086812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666340817, "uuid": "a24e4d3e-c6cc-4ddc-a6fa-f1961968ea1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340817, "uuid": "fd4c0e22-dddb-41e6-bab3-d2c16485b389", "value": "DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dcd44a8-511f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343175, "uuid": "6c6a062a-05b1-4d80-bc50-f48221c82b1c", "comment": "Malware payload", "value": "9d3ca081e7fe27e44707d8634c22fc95", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343175, "uuid": "e076471a-e26b-481c-b0ed-b479810e4ce0", "comment": "Malware payload", "value": "9156f5bd322306c9038a3bc830e53e7b13c272e121fb70b3b8d7d9968fb97e4f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343175, "uuid": "584f1079-5d5b-4524-9be5-306fd1cf6d3d", "comment": "Malware payload", "value": "dc0220f9a43989a4628f4eabd5e963fd80d8f698", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343175, "uuid": "8d959e72-447e-4542-959e-691469f29d50", "comment": "Malware payload", "value": "d19c4596c4fa8ac984634d53c873154660d6f06d382298b680d72cbcbb3c5d4bd31e52b6bbe5ab24b50ac2bed7c1e148", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343175, "uuid": "057288cd-a2c3-4d16-b571-86ddaaa6f441", "value": "T1F96302F9EEECC483DD2F7031CDA101885ED8F4616329AFA195E4D645068C52EB9C2F93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343175, "uuid": "e3693e35-a75a-432d-ad1c-2e3bb8a31ce8", "value": "1536:Ycw8O+xAvWi3ajP+LCQG2IH/EordhSIZjiJWHErXU6/l/vLSKH:Y9IjiCQEfE2MIZ2JkErR1LP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343175, "uuid": "8ee1d78a-f866-4121-a243-6b551d867158", "value": 71422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343175, "uuid": "5f78074b-250c-4664-95cc-4c66d86947d8", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343175, "uuid": "93b819b5-d151-4c0f-8256-e98d29635e57", "value": "9156f5bd322306c9038a3bc830e53e7b13c272e121fb70b3b8d7d9968fb97e4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5eaa57d-5109-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1666333874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333874, "uuid": "a6338595-fb4a-442a-8913-68b67a66ef1d", "comment": "Malware payload (AsyncRAT)", "value": "f4fdcb900e7af47100ac9e46945fbd55", "object_relation": "md5", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333874, "uuid": "4410922a-00a2-4009-9049-4d5cebf2fc11", "comment": "Malware payload (AsyncRAT)", "value": "9160b90fa4a6a9cf22f943dba92cec64e2dc03c2317b5d9ab50a753fc410ce43", "object_relation": "sha256", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333874, "uuid": "e410c595-6322-4ab5-b735-88812b99708b", "comment": "Malware payload (AsyncRAT)", "value": "c1d235a9a2cae8d5a8d4f6ceb4eab9417e1b1fb2", "object_relation": "sha1", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333874, "uuid": "24898712-2a8c-4635-8bb4-27f290ab8204", "comment": "Malware payload (AsyncRAT)", "value": "7694d02a6559849bd392abecd61fbfeaac888f416ea690f66ea78a0bbef123e5b9e9c5e22bd7bb0fe26bbcf9d77b857f", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333874, "uuid": "f968a635-b1d0-46dd-8d9d-889f49d12d7d", "value": "T1A4E3F9243EFE501DF177BFB86ED07586997EF6633603945E2480034A4B23B81DDA167A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333874, "uuid": "113db46c-510c-4d6a-aae4-c6d2d33f6bd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333874, "uuid": "2c246cc1-fd05-4bd5-90f0-454a69ddb22f", "value": "3072:Bsp9iv+DYM5ob0HGNSKsstcnZTJQDgWPaySsdH5boWz:Op9iTMSb0mgKFcQjhdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666333874, "uuid": "327898de-3437-445c-876b-de2b59fe3114", "value": 147968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666333874, "uuid": "5a6d8f0e-1467-4f73-aa1e-ce7fe751afc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333874, "uuid": "c0edbb4b-5662-4764-bbc8-35a16b5df390", "value": "client.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd1a091-50ee-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666322262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666322262, "uuid": "cd745d62-35e9-4e2b-b027-86527f793ae0", "comment": "Malware payload", "value": "9dfecad48f3b016deec21c85d84f1f7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666322262, "uuid": "4cf25cf2-7502-4112-b7fb-65fa69d3d934", "comment": "Malware payload", "value": "91c36243e3f586205776f31407f5f2722a1432f5804aed287d3834f894210cd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666322262, "uuid": "2c3e5b10-2bf3-4427-a46d-4f953d683678", "comment": "Malware payload", "value": "1e521d5f27ecb130a7875c7cdae0a1958e6f625b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666322262, "uuid": "8a6aefb1-49b7-40eb-a32d-36333decd4ad", "comment": "Malware payload", "value": "951e1ceb46b4be6afb0391c31fa735d572a84dda90760c152e3464fdbb389070e4df19e84b1f7aff25292077ae3ee48e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666322262, "uuid": "a3001df6-015d-46d5-a391-b38f4260d1ff", "value": "T18DC1D601A3E48337DEFB4BB5ACA343102374F7946957CFAEBC99614B9D12B010962A79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666322262, "uuid": "b9cca5b0-c443-4d77-8fd4-822d45e17591", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666322262, "uuid": "557d0b99-c7b2-4a36-964a-dd696e3c52f2", "value": "96:AutMkJPE/0YdH4ZB23L0/uml+NkITZNxisB+zNt:zpO4z23L0/umlzITZz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666322262, "uuid": "31072caf-e1ca-4a45-b341-29b1b1bf30b8", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666322262, "uuid": "d0227815-66eb-4870-a3f6-726afa5a3cda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666322262, "uuid": "4e7d5bec-c1de-4a5c-83e4-05d743fa230f", "value": "SecuriteInfo.com.Win32.RATX-gen.29089.12010", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908caad8-5113-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666337998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666337998, "uuid": "37e90ae3-d264-49dd-8ef3-86df19f42984", "comment": "Malware payload (AgentTesla)", "value": "8d360dbf5a3fcae0649cdae6474b1b3d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666337998, "uuid": "c7f70808-3e15-4920-9a4e-647f24c850c6", "comment": "Malware payload (AgentTesla)", "value": "91e16945b693892b1f645be69f4abfa9d7c88e2a0c58854fb68b8bb636bcf470", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666337998, "uuid": "d5434088-d5f6-416d-9412-46c63de1adc0", "comment": "Malware payload (AgentTesla)", "value": "d317d6326cebee33a2663dd638af87275fdd6292", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666337998, "uuid": "2f3ecf1d-eaf7-451a-af43-a003b7104f26", "comment": "Malware payload (AgentTesla)", "value": "7f76bf4201dbf852f474e1350fb028bb5dea6103575077e52df605b3b829444304f37925eb97850834b7f39fea306ab9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666337998, "uuid": "a0529afa-cae9-4e19-9af8-439e27e91351", "value": "T105D4235E4DE4C41C9119C9217EDA1D9A33370512E60858BDAFFE4B7636FDA0CA2D0F68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666337998, "uuid": "d9130240-d2e7-40f8-97cf-c0c2ba5e132b", "value": "12288:K00CofHFnhYisk9c/6BukHM8/ftbLRO/rqWbbfEQQRWR304TvA:KytYe/6CEVPueUb83g3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666337998, "uuid": "48ef222a-b979-4096-92d6-7107e76a113e", "value": 636356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666337998, "uuid": "1b50c149-8f30-4073-9686-4cb23ab07965", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666337998, "uuid": "0daa2583-ceec-4a2a-a4e8-87a8a898bc79", "value": "TT COPY.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8eccf16-510a-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666334281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666334281, "uuid": "3e3b71e0-95ce-457b-b583-374083ae0ccc", "comment": "Malware payload (Mirai)", "value": "05458aada2079b338dafa8373fe3a71f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666334281, "uuid": "d72b0fed-de87-42dc-9931-cf8721f6d2e3", "comment": "Malware payload (Mirai)", "value": "927bcbda2ebaec02a38d1912f52f3c4c7e6b4cf6070496f5bd66a6d7c1826235", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666334281, "uuid": "e5f5faa8-06d4-464b-9d4f-5bb0f39f50e0", "comment": "Malware payload (Mirai)", "value": "702d1af7daaac3ec9ec52855639baebcb2a862f7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666334281, "uuid": "5de11e2f-6b2c-4ac4-ac3c-3258aa96c8be", "comment": "Malware payload (Mirai)", "value": "a8c44bbc68930c363f97af76fb4851f5fc462afaecf47ae0899278b643d7189d38a92dad518501f9720c073858c7c32c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666334281, "uuid": "da7f7f94-87a1-41b8-a4cd-e569081c42eb", "value": "T1AB63B71E2E218FBCF76C873547B78E219758339636E1C285E15CEA015EB024E745FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666334281, "uuid": "fa70c5e6-8072-4757-a3d9-12a510d31b45", "value": "1536:T1DiqSc+HcocEmCBE9AmtILtu++er6FnzRKVPKaIdij+A:5DiqScscocEmCe9htILtJK8IaId2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666334281, "uuid": "29f4eaf5-6f64-4cd3-a4f5-f287ffa2915b", "value": 71976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666334281, "uuid": "bf478c33-3713-4fc0-8d25-75d8caf4e282", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666334281, "uuid": "bb4edaa1-3895-4102-b805-4266617c2022", "value": "mips-20221021-0638", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efbafa64-5131-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666351043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666351043, "uuid": "7d9dd8eb-19af-4ef9-964c-2e5518cf1881", "comment": "Malware payload (RedLineStealer)", "value": "0a202940f8520ebdfdc09026651d0a53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666351043, "uuid": "8895f8a5-8bcb-4ca2-a0bf-c6dafd876709", "comment": "Malware payload (RedLineStealer)", "value": "956ca6ee42a69d74eea979206bc519792704d809faac56bde61157dd3fb3de49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666351043, "uuid": "d60a312a-4bdf-44b8-957d-65f932b3afd1", "comment": "Malware payload (RedLineStealer)", "value": "c57e9b5f80d30081cc6207fec3c894c2dfb361d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666351043, "uuid": "37f3ed84-03fe-49c1-be16-7a870c84b2c7", "comment": "Malware payload (RedLineStealer)", "value": "33b69a01dce9c88ae72f4cf701ffd75f3b77cf5fa0ff183dd524a144ae8254662c34de9ac5cef107393aa51d336c1143", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666351043, "uuid": "7a3af122-af86-46e1-8dfc-2997b8d1f6b9", "value": "T15EC52B139A8B0D75DDD237B4A1CB633EA734ED30CA2A9B7FB608C43959532C56C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666351043, "uuid": "59e7a87f-158f-45a2-b26f-2bf2180cd1a9", "value": "29677885c0fdc7680e2620d4335d1995", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666351043, "uuid": "54e9c635-9881-4a8e-9226-97e625862e55", "value": "24576:zGeukZRD/qCSvbcSm7sSYCY1jmHoxMPpgSedqdzHx9BPAGLY/r6TwpxkzJDWLetS:zPRDqCSvbcSmWMBPqrAwpxkzJDWq8l39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666351043, "uuid": "7026fd64-9c36-4d53-abe5-db43d0190f1c", "value": 2732956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666351043, "uuid": "c8440e9a-3f96-4bef-a7ee-cd60525815e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666351043, "uuid": "3095517e-2064-44ef-97eb-1983f1b1acca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7586f1e-5113-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666338144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338144, "uuid": "3d14a2c1-4a80-4774-a870-6cab26753c54", "comment": "Malware payload", "value": "46c29c6809b74c2c3a1c17f3fb27ed7e", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338144, "uuid": "a0b379ab-d4eb-41b8-bc4d-fc8952bcd727", "comment": "Malware payload", "value": "9615e387a4effe2bd176cc5a7998fd69bd8a6d1110a5523b9f0e4873968db72c", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338144, "uuid": "7fe2126d-284f-4388-bcfa-2bf55c20a4fd", "comment": "Malware payload", "value": "b0501d3a3af5d0abe74fba73e513ad0fd1774165", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338144, "uuid": "aac6e192-dda0-4532-8088-4a2005263d29", "comment": "Malware payload", "value": "8e66be936a8c36d6e0eb27da2829993c23c74cede3fc162b4587b9ee66f72192d4e2bbca428451dfb6df4e1091377aac", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338144, "uuid": "c8ea0d09-668f-4302-a04c-1c5b536b73a4", "value": "T1A305331FB08ED72354CDCDB868A465122D4DE0AAF7A3280D9F257C5D33925933BC2A68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338144, "uuid": "d3573619-b8e4-4f94-9181-74a3e3a13849", "value": "12288:oQZrUR+fp5KWRcGWDP4pXwV94NeZUR93C2CZLerKXgcNOlkvIB4oI6dRO0ro:oK0+fa7PcgMNeZUR92sKfNOeY3jzO6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666338144, "uuid": "5f7c3ab7-436a-4ae4-b9be-4c25cb7722c4", "value": 807082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666338144, "uuid": "29ee2683-79fb-4abc-b899-4be042b7b3f3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338144, "uuid": "4edbc0c9-3baa-4a52-b3aa-b81a08c1e167", "value": "PROFORMA RTN-098345670900.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21db8f76-516d-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666376467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376467, "uuid": "6228afe6-ec28-4b74-b97a-83c54d7bbb04", "comment": "Malware payload (Mirai)", "value": "1f608b30bc1e63e3f2a5c7f2b63480a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376467, "uuid": "f48e307f-ca8a-4172-be9b-ee56d4965c82", "comment": "Malware payload (Mirai)", "value": "96741f09179cd4a4d6ddb2cf6098b3d31f11f2d1b7d7127b76ac5706c43c1a02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376467, "uuid": "923608d4-dbcc-4001-a646-499096782928", "comment": "Malware payload (Mirai)", "value": "845f2db4b070fcdf6c0fa8273481b0eef42a4202", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376467, "uuid": "daa9d0a6-637e-4d43-8a4b-9d111651053e", "comment": "Malware payload (Mirai)", "value": "c68f1058e6f99213f4ab1d03f6d4cb57bf008176f9be26411edae7609e1179b23c1d21ac922493fb363731494eee60b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376467, "uuid": "5b86379e-96ba-45e4-a0e0-28b782f64947", "value": "T19443185178D19A16C6E423BBFA6E40CD372563E8E1DF32178D212F1177CA82F0DA7A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376467, "uuid": "4df7123e-413b-4e3e-8f42-140d235e21a4", "value": "1536:saEJMzL7BC+nfbXq/5XqbFJ9WhKvriEALd2:saDD2/kJQhYbALd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666376467, "uuid": "fab4f9b7-dedf-4dd3-a5fb-6b5c789328a0", "value": 59988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666376467, "uuid": "9b9b240d-9626-4a0c-b2c1-7ca083cfc6fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376467, "uuid": "6d593207-3610-4c7b-9cc6-96c97e01d70a", "value": "1f608b30bc1e63e3f2a5c7f2b63480a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "defb68aa-5120-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666343714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343714, "uuid": "6c4cd079-8cc0-4ba8-9e65-e2f381f745ec", "comment": "Malware payload (Mirai)", "value": "95e97dc16fb5d1a3648e053f943006b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343714, "uuid": "4b3daca1-284b-4997-8ee1-0fb0f19f94be", "comment": "Malware payload (Mirai)", "value": "96f3389e2cf1f1ed23cfabd1199f0ea9b3cbd48c34504e5bf9f96adb676b09a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343714, "uuid": "39eee59c-0c83-42dd-bb56-c0167ca2deba", "comment": "Malware payload (Mirai)", "value": "a31d4011fff59b61a4fffdd95dd26cde73787bee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343714, "uuid": "59c44716-a527-437a-9566-d239ff9cc3cc", "comment": "Malware payload (Mirai)", "value": "c4aa2762a0147ee887fe958d335dc91123978f4ce5a4e2d5bb511a76362d0f1e56cd7bed9f705ef70f63dd2d39035016", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343714, "uuid": "4acad00d-da53-42bd-b031-c2636b89fa7d", "value": "T1DA539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343714, "uuid": "340a1662-f608-44aa-8ac1-d7a29e82f3c9", "value": "1536:PaAtVnz1/mUUNztiYmW6mhiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwNgT0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343714, "uuid": "b4ab3a33-70e3-4975-aaf6-927a7dabd084", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343714, "uuid": "3d681d40-2f39-4969-9b21-f1fbee650ba3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343714, "uuid": "bf63e3a5-b74e-4cf3-8ffa-848bf3ec4fe9", "value": "95e97dc16fb5d1a3648e053f943006b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69468089-5135-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666352535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352535, "uuid": "65cb853c-ba32-4869-9691-f1d32996e6e6", "comment": "Malware payload (AgentTesla)", "value": "b2e14c1d246984a1fad197fd771046e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352535, "uuid": "83a03a18-c72d-4944-9227-698de62ceae5", "comment": "Malware payload (AgentTesla)", "value": "98aaa85705c2a3b84dfbc82c27ade35202fb82fb63018f86ec02ef8f11d7d3aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352535, "uuid": "36c6d02c-c16c-4111-93e3-d938f8fc0870", "comment": "Malware payload (AgentTesla)", "value": "b952b1bca21c96c71c72a3d604d944f497fd705f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352535, "uuid": "0d5f1c35-eb30-4980-b4d4-5fbc9c159b61", "comment": "Malware payload (AgentTesla)", "value": "2ade88e62b261c1d12fdb92a696faccfa988e08151cc8df6ad370ea053f5a88d8e462a05f1d13572c1956e4998909f03", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352535, "uuid": "9d9a253c-b215-45b6-abee-1e890f254dc8", "value": "T134B27431D68502A9DC960B799E734CB205E3FDF45B7245AD00ADB93A2F73391062A93F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352535, "uuid": "ed9db220-604d-4e7e-9867-260dcbc7d932", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352535, "uuid": "d74cd766-a705-4828-a56f-3fbea5287e74", "value": "192:Fnn1EXhHvXrp5GzTfWYA7GrOhwMf6tmTUwcekDlWVu+hzU+Uw74UmL4JJ:ZihHvrpUfWYKchwcZlWVu+5UjG47o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666352535, "uuid": "7b9d9636-0022-40cb-a720-bc273864911e", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666352535, "uuid": "d74d12a6-97fe-40c4-82f2-0381d13960dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352535, "uuid": "aab89043-b3bd-41cb-910d-0c4c4692d6ac", "value": "Quotation #7328071819-Xlsx.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234e71a7-5117-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666339533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339533, "uuid": "48688b68-25b2-4974-ae5a-1283ed7eed31", "comment": "Malware payload (AgentTesla)", "value": "6d80af358b0373d230356bc65722e8c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339533, "uuid": "2376498d-be9e-4677-b6cf-41981adf4cef", "comment": "Malware payload (AgentTesla)", "value": "9a0f2102df3379191269e606a3d2e8370cfcf3a640742bb45d73e63b82fc9a7d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339533, "uuid": "1f896eac-ad06-4b4a-8fbe-64467c2ede7a", "comment": "Malware payload (AgentTesla)", "value": "43289198a07085da1351b38d1d47ce63edd06759", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339533, "uuid": "75a7bb6e-885c-46b4-b1c4-5dd75a18c0c5", "comment": "Malware payload (AgentTesla)", "value": "c00b1111e656d5bf1415e9f53e2b2bbbc392cd317a14a7c32e146b3fb446a06e741c75e2197acecca6a602188f93c003", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339533, "uuid": "c2443683-a055-431e-b150-ca82fbfbf38f", "value": "T128846690AF6494B4E921FCB12799E734D25B6CA236206F526DC0339B75F36D0BF07268", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339533, "uuid": "eca2b7e2-6401-4dde-b087-0b0dc4a189bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339533, "uuid": "960c2670-624c-49c8-97dd-66043e7a9012", "value": "384:y+ZL4/uRloI/CTnyEVPTHWKtL2H0VuM358lZEew+yTzSK4JM54iICSCr4H444uiE:78zI/4nyAWkaHRQ2wdzd4H4447iiL1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666339533, "uuid": "74577516-0c50-4a01-b821-d5964ae03817", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666339533, "uuid": "136c582e-a664-49f8-a885-7e04982b4458", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339533, "uuid": "e607c3bc-6448-43ae-998a-fc082e5a6848", "value": "DB_DHL_AWB_00117390021AD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3c27d7-5116-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666339147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339147, "uuid": "e999e38c-26d0-4e7d-acde-dc6625acf6d4", "comment": "Malware payload (SnakeKeylogger)", "value": "1fbbf7d702299832aec04e3052d277f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339147, "uuid": "b4e57454-7c89-4047-a544-9c922e24498f", "comment": "Malware payload (SnakeKeylogger)", "value": "9aef671c3c46bb035c58777167f94b0806f774fcb002898d49f9f226b56bd0c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339147, "uuid": "e53c520e-573d-4762-9182-75a48f67a055", "comment": "Malware payload (SnakeKeylogger)", "value": "d5685be8ff206dbfab7a9cf4816f22c7fb97ee92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339147, "uuid": "2b31bc9f-f755-4853-8630-56f54a84c5d6", "comment": "Malware payload (SnakeKeylogger)", "value": "0e2ff441d4639cb43615fd3d26e8058bf612690ba8e1bc4066049ab2a82ae37746186193339c31be9dc5e396f47c74c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339147, "uuid": "c8a18347-d864-48cb-8843-15c1819d13f9", "value": "T142D4123D0B894F67CD5E0BBAE01686500336D159B943FBCB058275D62E937C88866EDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339147, "uuid": "6955da31-dcd3-4e5a-b625-915f8d53b9c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339147, "uuid": "5399f64a-cf3b-4553-ac36-7ebd9dc93cae", "value": "12288:TdgRhbzldGu1G2WqJAFuT+oFBSx5HRZf/VB4c2nK98blG3odAv2MhQ:ahHldGuk2PJAUox5/f/VBunK9slTm2Mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666339147, "uuid": "3c85777c-5619-4a52-b8d0-1d4362eabb7d", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666339147, "uuid": "e4abc419-d4b4-484b-9dbf-91ab4d6bfc36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339147, "uuid": "097d757d-8d54-4b5e-88e3-bdda26756ace", "value": "2yq14bZB8QG1jbU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c157c20-517b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666382578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666382578, "uuid": "d0dbaa15-f9a5-4036-8970-5ae8581585c1", "comment": "Malware payload", "value": "018b96b162c26066f79d45175fc23613", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666382578, "uuid": "9e3367d8-08dd-4027-88df-559738672424", "comment": "Malware payload", "value": "9b3c936ca4fe043d2de3842d446c5030d0053e8ac21c09b5ccf4a3eeda12b745", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666382578, "uuid": "72620d84-5af2-4477-a961-ceb2caaeabf8", "comment": "Malware payload", "value": "1877d9dd50ad0e2a08a5398e76b352a6e01b0646", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666382578, "uuid": "04165b62-451d-44d3-87fa-15024e71488a", "comment": "Malware payload", "value": "82b2aeb8ffe4b7f5dfee67d8135a7e2c345ef7c68dab552a6c0c8d806c014d447a4a2df06b62615d6397986e2361ed23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666382578, "uuid": "5e5a2760-4fc9-4b04-b00d-db26b9090005", "value": "T10874F111FAD2DC71E88346304025DB626ABFF9B125B15A5B7B856FAE6E341C30B36307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666382578, "uuid": "055636b2-883c-4624-a89f-ac6d2c6adbdf", "value": "bc5a05e947eb61731a4e3024a4f4b617", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666382578, "uuid": "e2863c81-8f65-4e3b-9986-58d5ac1453f2", "value": "6144:clULMsvAMFLhVKFNBMZCww2F1/Ip11dPjZ2QmdX+BNzpToLv9S:clUAsoMFLh8FNBMZAA/IvPjZuczk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666382578, "uuid": "928e2c90-df54-42b2-89a8-41a5fb479fb6", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666382578, "uuid": "1cc18759-1ae1-471f-913e-e160390ddfc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666382578, "uuid": "60519ae0-8f81-4320-894b-326e07f5a419", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90459b5c-5136-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666353030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353030, "uuid": "b7f172db-8baa-458c-b23c-810b9e04b6b2", "comment": "Malware payload (RedLineStealer)", "value": "e015ba6c5d4626b80158e35c82456673", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353030, "uuid": "f0e5e123-6d81-4cae-b07a-b10bd417023b", "comment": "Malware payload (RedLineStealer)", "value": "9b602d99ab81f82a3b5005a076352605b2804c9a7bdb14ad8397d12fe77b2971", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353030, "uuid": "51a14df4-6c33-4366-b0e1-bc891e28c0fb", "comment": "Malware payload (RedLineStealer)", "value": "b82bfa349c72d8aa9fa437348008769cc5bcd4e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353030, "uuid": "247a609d-475d-4de7-8e75-b5b172ba440f", "comment": "Malware payload (RedLineStealer)", "value": "143cfa1d6ca3fb6a3f0286316170b60ef81cb280288341555b3127759b7602391de04ee313fdae5fa3ff3aa0e904902a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353030, "uuid": "50bc3dd4-e070-4610-a5bc-2a7bf4a44964", "value": "T15DC52B139A8B0D75DDD237B4A1CB633BA734ED30CA2A9B7FB608C43959532C56C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353030, "uuid": "824af6c7-fdc3-429c-8487-8790c0249b71", "value": "29677885c0fdc7680e2620d4335d1995", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353030, "uuid": "78bd3502-7e62-46eb-afa0-20d191f3e85f", "value": "24576:mI+rO0XWGlUHzo/OhjHG7sjYyY5jWXIOMPpwSedqpMHx++0HOdlYS6lehzkj3LpY:nS1UHzo/OlHGKY+0Qeehzkj3Al3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666353030, "uuid": "4f0409db-79c1-4fa9-b8d0-7eb2a2add57c", "value": 2732956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666353030, "uuid": "ddde3275-fcd5-424d-9da4-a3d1b7e57f00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353030, "uuid": "37e2a43d-8894-45a5-8295-1ed909e7db4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f0df16-5117-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666339509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339509, "uuid": "ec8be2d4-c00c-4654-918b-b88ba7d193db", "comment": "Malware payload (Formbook)", "value": "f1d9c255d1508cbadc8aa27a1a5b92c9", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339509, "uuid": "b6ecd918-6ad9-4a15-8dfd-35a325e2287f", "comment": "Malware payload (Formbook)", "value": "9c7bd8d6a02cf494b749b61c4076a0aa0ac26a645a2edfdcfb9d4a82ea21b8dc", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339509, "uuid": "a6bbd0c7-6f15-4854-9708-81402b3898b1", "comment": "Malware payload (Formbook)", "value": "3b9e6af97123af323a1bf15622afb7bc7d8f6c49", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339509, "uuid": "2d99895b-a568-4c73-aaf2-e6fede48ba86", "comment": "Malware payload (Formbook)", "value": "995d5241c52f6041f57c048bf243d9ae2ed45b62b5f5862b80af168d9c85e06fa21677f8deaaaf0a5511017324f883d5", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339509, "uuid": "5000c4b7-2a63-4928-b892-b7697c11761f", "value": "T11184AE14D5489ED6E302B238A5F8FB1D0A548F66726EAB08D9317D4178727CF3836D8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339509, "uuid": "5f38a24b-3eb1-4e81-9e60-66d4ee500ea7", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339509, "uuid": "76e71136-1083-43d0-8e07-c61d23b3bbca", "value": "6144:wbE/HUlTKu1gRtv6cWGdW1zVP/FmeQwFzawPh5XVl76BTq1QjVtZ90I6ncOt:wbwv6cxdEm6RPh9Vl7SzjTZ90Ikdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666339509, "uuid": "5df70a27-4dac-4551-b834-83dfbfbaa411", "value": 399471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666339509, "uuid": "8674e789-dccd-48de-9715-0caba31a6e9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339509, "uuid": "66d0b182-ad1c-4ada-9b35-db1a654abf6f", "value": "DHL Notification_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d612a30-5187-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666387815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666387815, "uuid": "c1967b31-d8f2-4f84-9ceb-9a70d1b3322c", "comment": "Malware payload", "value": "80c6da752ce15a8910d9515a9692e948", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666387815, "uuid": "4aff96a8-e6a1-4525-8ec2-1b691adac992", "comment": "Malware payload", "value": "9d30d975ab3d7f6f4db3c1bed08e07261c90204e6f744dc8617aab7c34989a53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666387815, "uuid": "e7d6d985-b729-4a73-b14d-f8214427b765", "comment": "Malware payload", "value": "25eeef6c2fb98de0b634f58da4d45c052857e951", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666387815, "uuid": "6af4ceb3-e806-4d9a-8d7f-23f8cfd71782", "comment": "Malware payload", "value": "7ed23fa0b746ef9a07f3a04050c7231e98934a423925881786d92837efaa73031d451346101433f7da4f8b689420805f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666387815, "uuid": "0fc7948d-5b9e-48b4-89ea-33f48efdd9a5", "value": "T1AAB5337446C2E6B2E16067FA3C6085B649332FE440BA2A11F3BCA1DFCA365D2CC56757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666387815, "uuid": "b7334636-f090-4498-a7d7-456eecbd21e9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666387815, "uuid": "a8fb7458-c78f-4bea-b482-f9eb3172848b", "value": "49152:Z2D4yJNtjvkOInMQC8s1OX2zu99H182413RClk1mA5hq:M3rIzsmm24V6kXDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666387815, "uuid": "c9bc1dd9-c347-4104-9457-8d21efcb5bd0", "value": 2394472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666387815, "uuid": "ceb383e9-3e65-4cfd-af0d-e553d5a79f64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666387815, "uuid": "e379315f-f240-4514-adbb-7da1f8ac228d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7776c7f-5144-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666359109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666359109, "uuid": "ad62711b-d561-4847-8759-e2002d70c3cc", "comment": "Malware payload", "value": "23a1576d2c88e5642a70689be9b50440", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "extracted", "colour": "#045F7D", "exportable": true, "hide_tag": false }, { "name": "fake powerdvd", "colour": "#1D4D84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666359109, "uuid": "064ae321-cef8-49de-828f-cccca93ba1b2", "comment": "Malware payload", "value": "9d5059722c2c1f4cf1f0388f3a15da44b883a9ca9127b9347fdb4933cc1fa6dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "extracted", "colour": "#045F7D", "exportable": true, "hide_tag": false }, { "name": "fake powerdvd", "colour": "#1D4D84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666359109, "uuid": "54f5cbcc-f290-47d9-a431-acfd021d790b", "comment": "Malware payload", "value": "eb08c29b6af0355b0b9261cb2692ab067009f9fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "extracted", "colour": "#045F7D", "exportable": true, "hide_tag": false }, { "name": "fake powerdvd", "colour": "#1D4D84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666359109, "uuid": "53cdc917-4de8-4dba-aa89-a75ac975e197", "comment": "Malware payload", "value": "c8933d934828d9f4d8b5d7c4650d334f594b21616088c493ae619d36896d7baf307efdd835e43d8e734740ea79fd8ad8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "extracted", "colour": "#045F7D", "exportable": true, "hide_tag": false }, { "name": "fake powerdvd", "colour": "#1D4D84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666359109, "uuid": "81894783-f714-4260-a96b-f9590bdeadbb", "value": "T16D26333B166D9694E843213B858974F82E3EBA953138007D72A11C40D63FF72FFD696A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666359109, "uuid": "dc43d093-b26b-4f0c-8b7b-2212c8503d2a", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666359109, "uuid": "d217a7c4-b52c-44e2-afb0-717129ef852e", "value": "98304:z0XaLBcPJDQv6ye0KUqOIlyPOzoHqyZm7MXVfbVfkDM4z3MoL:AXK+JDK6yzNJw6qTMF1kDM4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666359109, "uuid": "af8e092f-fed9-48a7-a902-5918a4d4157e", "value": 4493312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666359109, "uuid": "76683402-78c4-40a8-9631-0cac9f22e813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666359109, "uuid": "dc88eb7e-36ca-4af4-9b8f-aeecb6288c63", "value": "load.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7331d5-5141-11ed-9266-42010a9c0072", "comment": "Malware payload (Vjw0rm)", "timestamp": 1666357534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666357534, "uuid": "f169135e-de79-49a3-88a8-a52480ab01cb", "comment": "Malware payload (Vjw0rm)", "value": "74d0eabf20cd753bef0fab28cc9930cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666357534, "uuid": "0180cffa-2a67-4d0b-a6b2-51cdec541ec8", "comment": "Malware payload (Vjw0rm)", "value": "9f11277408508861dee8aeef598cbee2af8d13b0e85c65fd5ec96cf5062e25fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666357534, "uuid": "b9ccfa62-2277-4247-9975-7b663fcbb05e", "comment": "Malware payload (Vjw0rm)", "value": "131c5dce13675994a53a3f68e5d6ad5b1fbe94e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666357534, "uuid": "961f3f45-d5e8-46bc-aca4-59a2869cecc9", "comment": "Malware payload (Vjw0rm)", "value": "9acec5f0a2132d6dab867dea2f7498fbf3c028d1e0dcd2f8ead48e98bfbcde034ba31ed9292bf58b3e215b0769b9996a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666357534, "uuid": "feb54f07-82da-41fa-bf8a-88f1ab77cbe4", "value": "T106F4AEE0317DC3D3E1B19EB10FCA867079F175ACA8C0560D61F59B2EA3D2395149CAEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666357534, "uuid": "47270b88-e843-4fdb-88c7-5cbeb4966d3e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666357534, "uuid": "9e6fa619-33f2-4f59-98f3-f466e55949c7", "value": "12288:/biQ2pSTPH3IkhjygJH2nzhXJXEQe3Xy3PiAo/LDRJkOBRo:/biQ2pgPjygk/EJaaA0L3kP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666357534, "uuid": "01d02066-c4b1-480f-80f9-33d7f1cdda04", "value": 785112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666357534, "uuid": "1e92e956-8192-4642-b5a5-cac98630d86a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666357534, "uuid": "12205c10-e6bf-4cc0-82d9-53986292dfed", "value": "Remittance advice payment notification as of.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d707bc-5114-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666338220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338220, "uuid": "08d7fd53-8c55-4a43-93db-d6a12210cfdd", "comment": "Malware payload (Formbook)", "value": "443f20873a076fb8c211051bf021508c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338220, "uuid": "6fa4b449-50b8-46bb-8c6f-e32633db7fc7", "comment": "Malware payload (Formbook)", "value": "a00c1acc8a2aa1c19112b0371a19fa0b6723807a89d2aa40d1733efae187451d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338220, "uuid": "42904dc4-20a5-47c4-a088-71b822d3b973", "comment": "Malware payload (Formbook)", "value": "c592bbbe8124236a1107f2462ce551d4a56ad5df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338220, "uuid": "75098dd5-d4db-4986-9cea-2f36f8d8e29f", "comment": "Malware payload (Formbook)", "value": "620f765553b082c853eaeb0e023d5449dfaf5ba303f4ae9d2f9f3b6ef4eb9f145b519800aff690a7608ec4c960bb603a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338220, "uuid": "5877aaa1-a9ce-4144-b1b2-673c76f4eab2", "value": "T18235003A29379065FEFDC1317DD4B391126839BFADC80F86E640BAC531B36D216B0666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338220, "uuid": "a8d2d616-d4a8-41ce-be24-ffa8f03cef5d", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338220, "uuid": "ff5d57bc-7ae5-4484-98d8-844fa190383c", "value": "24576:XblN0cOMT0j3ynyNw5orUsXQAKZNA46jgPd3:LliQ0jyyj/g9uod3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666338220, "uuid": "dbc23e7d-aac1-49c8-b3ce-1582df688aeb", "value": 1066270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666338220, "uuid": "f45ceedf-555f-45c5-809b-0e2a2f85830d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338220, "uuid": "2c0a2725-3d12-40ca-9af3-7fc7082457a9", "value": "D5678-9876500D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86197a79-516d-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666376636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376636, "uuid": "eee9c73b-383c-4d8b-97ad-baec0bc87900", "comment": "Malware payload (Mirai)", "value": "1baca9b74ac244451209f9a87c76c7fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376636, "uuid": "db16665f-40da-4887-80b2-9861b98ad47f", "comment": "Malware payload (Mirai)", "value": "a1653104d006b45c12c21e82911f7876d601ab1427b0f1ee2e5755d7085e73bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376636, "uuid": "86e5dcce-31d2-47b8-a899-735490ee57d5", "comment": "Malware payload (Mirai)", "value": "54ed5958e59b33a7b00383684ce72b2332de17a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376636, "uuid": "3d495e4e-bc40-49f9-84e9-6cceb1b1cf38", "comment": "Malware payload (Mirai)", "value": "4c462aee45b29b239e91bf295363871b7a5c36a08215996bdf071108707d8f0f439af3a753dd1299d8f621a58e2530f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376636, "uuid": "6576de5c-6904-4210-a635-8319d07ee61f", "value": "T14873A70E6E259FBCFB9C823587B78F21965833D626E1C644D15CEA011EB034E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376636, "uuid": "968fd748-54a3-4424-a9da-a7327b7a1581", "value": "1536:zoVvPLWTs7ys6XcniEyNMV3sDmTRdVSabdza3TTLbwXmP5T:zo5WTm6XouMV3sDmTvVSabQ3TTLbwXml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666376636, "uuid": "80369b6d-26f0-4639-961f-d89d5e41850d", "value": 75976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666376636, "uuid": "1b16cfea-048a-4a12-aecc-96ce89db4f0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376636, "uuid": "ff85c790-0ad9-43bc-addb-4387acd30470", "value": "1baca9b74ac244451209f9a87c76c7fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b063592-510a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666333936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333936, "uuid": "4d3ca91f-8c31-4568-93ba-5bfdd36c9a31", "comment": "Malware payload", "value": "4f846f2117c4eab285289b0090521b1e", "object_relation": "md5", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333936, "uuid": "b2982d23-ef86-43ac-adb2-7923d3c38079", "comment": "Malware payload", "value": "a17a5bf35d8b784c3111632ba7e0c30a2c1a9c2c95b549235affc16d6d055477", "object_relation": "sha256", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333936, "uuid": "82065d62-7f25-4d6f-8011-b7575e7eda90", "comment": "Malware payload", "value": "e25287c39bad32159417c5f0bf798625b6beff45", "object_relation": "sha1", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333936, "uuid": "722d24c0-4098-497e-8b97-9126736f4cfb", "comment": "Malware payload", "value": "1f9a21e921257aeb62c3d019d30f707fad1e6272806b34f7a1783ebb8538ec91eaeb71a530ead54479104333ef0da8fb", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333936, "uuid": "a6061180-7fba-4058-a79c-f63026438bed", "value": "T1C4221981B7E88675DD7927B6ACB347501A70E2055C77CAAF1898111E3EA72410F83BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333936, "uuid": "2af06860-3790-4e5e-867f-b21448bfa267", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333936, "uuid": "c7a5123d-17bd-4fa8-a0ae-bf1d8c6ad537", "value": "192:irtmcuq65SoDxi4maEYbRzmEsLkjgv5JHT1eJYHcwY7fazB+LEi:irtlF60GE9rUhVsLF5p1rYydmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666333936, "uuid": "0069c50e-797e-494e-8b1a-b93952c4e7fa", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666333936, "uuid": "5683378c-f20e-4dc4-b15f-fa9e36ee6905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333936, "uuid": "c9bc3b62-5911-42bc-8ba2-cfe06bd27899", "value": "Keylogger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadcef8f-5105-11ed-9266-42010a9c0072", "comment": "Malware payload (TeamBot)", "timestamp": 1666332137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666332137, "uuid": "fa41d0bb-4c94-4bd7-8459-31fbea2ce986", "comment": "Malware payload (TeamBot)", "value": "cf03e60663abf0534adf4080471759c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666332137, "uuid": "0ca83fb2-246a-4256-99c9-f33f7536879e", "comment": "Malware payload (TeamBot)", "value": "a2ad0aacdd54f925082da64f52c77eb56a472a55f9755b9cf76a6d3532af6361", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666332137, "uuid": "9cc86f56-138f-48cc-ac9a-a2cb2c5573cc", "comment": "Malware payload (TeamBot)", "value": "ff256a36684d65f3c7bb51f24fbe128324da98f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666332137, "uuid": "f057512d-413a-4f82-aa8b-16c4974fa852", "comment": "Malware payload (TeamBot)", "value": "86ddaa16fc8fc7ddecf40ef8a1c4384928522112c0bf3e7349021f5683e41c53d0eb1adc9ff1602bcf2b0092a4fe4534", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666332137, "uuid": "e8f99cd4-dec6-442e-8a6e-97f9b86a92a1", "value": "T14B14D035B992C470C4822870D425DBA16ABFB9321A708E873B251BFE5F313D157BE786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666332137, "uuid": "d7a2abaf-7a2b-4563-9606-71756ffd663b", "value": "3e6038f4356f890c26b700ce3212574e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666332137, "uuid": "16a18d21-39db-4a59-a5d9-88e6098c8e1c", "value": "3072:wXO50LAx9uq5jBDYwSGv08F/G/t6VIyc90R80KQxP4T:k00LeEWzF/S6rR80VxP4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666332137, "uuid": "1a5b98a8-b206-4ecf-9810-68a14b6a8b12", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666332137, "uuid": "0cd653c0-27df-4f45-929c-f9ce4ca340ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666332137, "uuid": "f41bcf19-06ed-41c2-8f04-c4f281fcc650", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07770ad-5176-11ed-9266-42010a9c0072", "comment": "Malware payload (TeamBot)", "timestamp": 1666380626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666380626, "uuid": "0df8a437-93a0-4fda-b4f5-99bf94b134bd", "comment": "Malware payload (TeamBot)", "value": "abc5ae53227a143e5463752959c6a031", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666380626, "uuid": "d1e2ac57-0f63-4fac-ac3c-5f2d1d6699ac", "comment": "Malware payload (TeamBot)", "value": "a2da28e9464e5195691bbd4d43f0a8778efc1769623972d16b56b249b8d7a79e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666380626, "uuid": "903bd1d4-9cb0-48d9-ad07-28a057cde297", "comment": "Malware payload (TeamBot)", "value": "4f5990ddd15fd23b0af13846eb9c4ccc15f79e5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666380626, "uuid": "ac212fc5-76d0-487f-ad42-5f49fa57995a", "comment": "Malware payload (TeamBot)", "value": "672130490b3ff4a9ff60807f39072954bdc781e55c590227396ab8db55a5482f6241fbfca745b1be7f55944bc04ac490", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666380626, "uuid": "618612fc-2e22-4ec5-a045-efab7f25f43f", "value": "T19C34E011B693C432C89744314470EBB06A7AEC3255B54A877B643BFE6EF02D25AB73C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666380626, "uuid": "13a95065-3dbd-4414-bf7e-92c984f25cc1", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666380626, "uuid": "0123d813-91aa-47c6-9c70-f105b2969874", "value": "3072:wXD72L/5I3QOO5Vxvbu2kz1VZH14clZL7hrndHWccfSbcVeEYdcU1p0:k/2L/W3QOAbnQVZV9D5d27KoVeEbU16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666380626, "uuid": "1826d756-9780-415c-ad5b-e0994588e1dc", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666380626, "uuid": "49383166-2e60-4043-921b-6f237863567c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666380626, "uuid": "2dd77d81-a48e-4b57-81ab-f33c33c01245", "value": "abc5ae53227a143e5463752959c6a031.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8090b143-5121-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343985, "uuid": "ee4474cb-d385-4c2e-8da6-6b3b901233e1", "comment": "Malware payload", "value": "ac15e3c8137a54cc43c90ccbf705b3e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343985, "uuid": "cc10a593-c14b-4291-bc48-d85670a07cfc", "comment": "Malware payload", "value": "a2ec53c83686ccaff6a1b3173e4dcf7e5d23a47d031fc04d20c9da23c39f9a5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343985, "uuid": "b7f9f767-7377-4663-8d41-5d385f02a153", "comment": "Malware payload", "value": "5a7411aad9fb6231fa9404692502a6c670c1fd5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343985, "uuid": "3baa7979-43b2-4c8c-a11e-3d1c3147fa45", "comment": "Malware payload", "value": "cbc39b63e57c76f8c3dfc5f97ad93a9fd6167e7c0c8954da86fc62075638a06c84e2d32c26590f9176b01d16849d1ee7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343985, "uuid": "d65b62ae-f5ea-4906-86bf-36fc07b089e4", "value": "T177E49D61F69A40F7EC81387411BAE7325839B2760334BEC7A7A42F791A211D2AD3D35D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343985, "uuid": "8eec83d3-f546-4983-952b-92a8899a8948", "value": "8640163fc2b92ed7911366198a2d1927", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343985, "uuid": "c88a41e0-e29b-454e-bf3c-5a0153f40178", "value": "12288:WjNWpMwtWSDotua6MR0IKWaEm7D7Zo5hVzmxxHGzyNzsA4+Tp4ZrMoiFip9Qmr4e:W4pMHtua6MmuaE2sqp4Coignr45tu42L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343985, "uuid": "d9a4c31d-f41c-4891-83be-14ef6c1b5dde", "value": 714240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343985, "uuid": "459ab935-39bd-4316-8a4c-5b5cf1e8049b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343985, "uuid": "d65e5959-038e-4f69-80bb-d0e89a5c8318", "value": "SecuriteInfo.com.Win32.Evo-gen.19836.5579", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c793289-510f-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666336274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336274, "uuid": "e7e10409-c139-468a-a06a-9e20811bb68e", "comment": "Malware payload (Formbook)", "value": "846639996d9c2476d142db742eff35f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336274, "uuid": "6a24502a-4b66-4d87-b6d3-8d8f7554a7da", "comment": "Malware payload (Formbook)", "value": "a319609cff7e85f39ca69cdafd98380c93a007c56c2a62f75eeffcc564a7412e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336274, "uuid": "e787ffd5-ff4b-4b06-83f3-a80dcf0416e0", "comment": "Malware payload (Formbook)", "value": "00739b66a63f768eb2a16d734b9e2931df7f98e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336274, "uuid": "7768068b-88c3-444e-9d9d-967f8d9d6ab5", "comment": "Malware payload (Formbook)", "value": "a7c9244281ff9d6a07a102d4cefc2decd260b86756cab18861a95e322882bd51496b4e7f4da6b0fc80b33d3c8981233b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336274, "uuid": "3e5fc48a-b917-46b6-9206-4adf9c17d285", "value": "T107E4121EABED6D3FCBFD4775D1150A200733D01A6882FB9E03C5A5E95E52384C84A7EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336274, "uuid": "26405987-57b1-4c43-9a70-200f611b89ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336274, "uuid": "2ae84583-e7d2-444b-b3c1-81925bec6f27", "value": "12288:/gtVwn373NOcjV0vAG+1+Aess3SIx/wArPUn+AaR0UmK22len/:YtV+3b4GVuxsSSI7Un+cK22s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666336274, "uuid": "700aba89-98e7-4ab2-bcfe-c6219337f45f", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666336274, "uuid": "a522ede2-176d-4e2e-b0da-07d32b173070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336274, "uuid": "56dff2ea-8ffe-4d52-9808-4800121d6862", "value": "SecuriteInfo.com.Variant.Tedy.224685.32292.5549", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ef2b67-511f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343187, "uuid": "096202ff-9331-4ebd-a56e-152cf0757b23", "comment": "Malware payload", "value": "6129cc4392d2e10ffdb80db67ca2534b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343187, "uuid": "afc7c317-d8dd-4ada-886a-74e91a10018b", "comment": "Malware payload", "value": "a3797856766fef6651f8c679febd12378fc3196c5cc74923d90377045107700d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343187, "uuid": "599dd00d-f7ee-4857-8efd-981f4592d6bb", "comment": "Malware payload", "value": "444f8a87f7c6c07be063b3d0b62f4c6dba0773e9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343187, "uuid": "b31b1ead-140d-4c86-9e59-1e323974147d", "comment": "Malware payload", "value": "19dc4f7fe23353073cb189bf83a6ce3d905d22375a37f55903df95284cb2d73c327331574ae912c52039a94b28fce1bf", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343187, "uuid": "60f632e1-e95f-4019-884f-f15d416b8cbf", "value": "T19DC512E7E30FFD68D266D6378332506BB92949544A02F3660A11F5A88EFBD50CA4CFC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343187, "uuid": "a52c5240-99b8-4b5e-8eb2-8646693f7259", "value": "49152:GYhyQc1ry4hxvXxZoPeNk+JyUE0GLNMLi6NER+JwyniEWWoXf4i:G6dWrnPQeNxETbN6i6NSLEToQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343187, "uuid": "ee0f47a4-ee35-4264-b16e-3efa80522558", "value": 2611573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343187, "uuid": "928ec384-5d97-4358-89f4-4d3a1d43250e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343187, "uuid": "c22c3037-7d63-4168-84e8-a9e1682d364d", "value": "a3797856766fef6651f8c679febd12378fc3196c5cc74923d90377045107700d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c38ae8c-512b-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1666348138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348138, "uuid": "f416cf82-1f6a-4beb-b223-0a2b7fdfbcad", "comment": "Malware payload (AsyncRAT)", "value": "49dab30234e9c906bdf2d3b46124b986", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348138, "uuid": "1bb49158-c4f8-4e92-91cc-8f83ff9e6575", "comment": "Malware payload (AsyncRAT)", "value": "a56014186e4aaf4a79217d5e1cae0dc0420309072e74abdbca18df7337ff6ea9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348138, "uuid": "a6a7ac8e-dcba-4acd-a61c-7a1969262fe6", "comment": "Malware payload (AsyncRAT)", "value": "b0a630b89cfbf257e2c65fd4c389e71dd8000bbf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348138, "uuid": "e1bd7653-2e5c-4189-89dd-729ea89fea0a", "comment": "Malware payload (AsyncRAT)", "value": "a1bb71faf6a7dde5ba24c3560795aa0933eb2d72e3f1fedde879536d40e2020f220ef37f1260d3df9336d3728d29588c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348138, "uuid": "9adbdadd-7985-4bf9-bf08-01c261300675", "value": "T14DB3C521DED76A0FD93B99707C91E010CBBF6816AE498F9A6885E0CB467F65131033F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348138, "uuid": "25aedd0c-b3e9-47bf-8310-88ef42a0cd48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348138, "uuid": "bf52cae4-6e67-4801-87cc-63a68e3beab9", "value": "1536:euYH9T34l2iCBEzZNb5im1xIF4WJndnp/DZmx:euYdT34l2iyEz/b5imUF1pxDZmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666348138, "uuid": "cbe92142-9a8a-4675-b835-e2296e2da68d", "value": 116736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666348138, "uuid": "2db9019e-5d2a-4c87-aa32-f34315bac333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348138, "uuid": "69683904-3279-4e57-a312-31ef144a8a9d", "value": "49dab30234e9c906bdf2d3b46124b986.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad85b29a-511f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343201, "uuid": "91699836-5272-41af-887e-7394528bc4d2", "comment": "Malware payload", "value": "21f326eef6fda2c5d544c2b5e6d21f34", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343201, "uuid": "a2ff8803-55de-4388-acff-023e74b15192", "comment": "Malware payload", "value": "a5b5f6027b463d82fded3c38153086d5accc466df33123070ea541e62124b943", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343201, "uuid": "acbbb3fc-8eca-49f2-be2b-e6137ed093b5", "comment": "Malware payload", "value": "c6d5a6a665ebaa80d1174ca3850f7af509bd027b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343201, "uuid": "2d85b6e5-d1e9-4cdb-b013-9f693f545451", "comment": "Malware payload", "value": "0ff72607840c10135f134c05646e30905dc033dee177b57951aa842b0c4d78c43229f2fd909293064c3abfb870dbf2b9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343201, "uuid": "c5b9c8d8-a49d-421f-ab6b-62242d704256", "value": "T18376128AF78AE99AC4F78B364776426615074C248B43D6433E0CB27C5FB7ED04E56AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343201, "uuid": "d13cd896-47c5-475d-b434-345de930ceb4", "value": "196608:IEIxhWPUkMgyy39KP6NKP2DlBhTtfEEgpBSQi63kV:ECtMC9wAKP2BBhTtcE8BiIkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343201, "uuid": "341426b6-837d-4908-a164-3f29a3bf3913", "value": 7284684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343201, "uuid": "7a524243-df2a-427e-9464-0926554aca74", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343201, "uuid": "2263cd25-02c4-4748-b46c-481a1b9f2547", "value": "a5b5f6027b463d82fded3c38153086d5accc466df33123070ea541e62124b943", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd28520-5129-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666347362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347362, "uuid": "30bebf33-dc6e-493d-b9a8-2512bad80781", "comment": "Malware payload (RedLineStealer)", "value": "604803f2ed103a19ca4b81b862b94368", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347362, "uuid": "6899e80e-acfc-4527-b000-42507905ce48", "comment": "Malware payload (RedLineStealer)", "value": "a788a19af1c4280c2b6233843ee89a5a2c6b44802e368672fa117d8c1c6da741", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347362, "uuid": "01e0a563-bf2c-486c-993d-113aff207640", "comment": "Malware payload (RedLineStealer)", "value": "0476208d1b7a52eb1d010f98d5e283e3a9c368d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347362, "uuid": "99c649ab-d2dc-45db-998c-453dca8e3b79", "comment": "Malware payload (RedLineStealer)", "value": "b5b4ab68a063323e1d33633dfc7114d2ea6e91b0c1171bbad28b55e5ba4d37151c83d99fcf2b3f42ddb5927b17b1dd36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347362, "uuid": "7a99d07c-77f6-4814-9dce-2138df0876b1", "value": "T1D164013EF58294B1C44B5478C814DBE09A7F68347AA54DA737341B6E6E703E1A37E382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347362, "uuid": "38a1b963-994a-4682-a958-54e0e7e0cc74", "value": "965326d499ea63bde30a73f94c3886cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347362, "uuid": "c4fb5b38-9640-4f84-8107-2c5e833d91fd", "value": "6144:c7wLgnPqVro1iBLKed+Jcfw8y0C+66oJt6PEr+N01Vt:cccnoM2KwCZ6oJMnWrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666347362, "uuid": "bb6b1858-dc16-4c90-a3b3-777fb460ed4c", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666347362, "uuid": "7e074a21-ed58-4087-8a43-842b496d8b50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347362, "uuid": "55e28e39-13ed-440e-9e45-dba1c742c41b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4233ad48-518d-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666390266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666390266, "uuid": "d850e541-835b-4130-8d2c-8307a3093e59", "comment": "Malware payload", "value": "9ccbeddfc2ca1e15fb2d2ff4b2981446", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666390266, "uuid": "920de810-be72-4344-960a-a3c7820139b0", "comment": "Malware payload", "value": "a7ae5bad78ab134ccaf6885c044b4f0687bd00453a3ae493440c8aab18f84aa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666390266, "uuid": "ffbe99b5-bae1-4d5a-824b-6ff9a581d255", "comment": "Malware payload", "value": "f560421dd3273920f8cacb591fe0a1d41bcd5b13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666390266, "uuid": "ccd92809-09d4-4e00-a21a-7777daa0bcab", "comment": "Malware payload", "value": "27ffea3b25c2e55ac6272099ab656457bae568d804df199f4281385bf0f9bca558e3f4dbc0a35c1f651ee82578054cf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666390266, "uuid": "4a88b19e-16e3-43de-b1bf-9b94596b42d0", "value": "T1D2740120BD83D4B2C58685364860EBA495FFFAB2213116577B547BEE7E302D35A7230B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666390266, "uuid": "f3b2b1cd-0d3d-40da-b8ff-75f795d7db0e", "value": "bc5a05e947eb61731a4e3024a4f4b617", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666390266, "uuid": "4e4360e4-c6ad-4235-8525-6eb952ccb7c8", "value": "6144:9RNLRVBAed7vzCjPK9WA9efiFPRg2NN85CmCuOBC1l+H+QKvuS:9RNtVeelLmCD22XUauD+H+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666390266, "uuid": "2b4dceaa-c8b9-4f7d-81ad-f88171099c69", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666390266, "uuid": "8613884a-14b1-4560-b655-9873fa5dae63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666390266, "uuid": "10e921ec-b87d-4a74-94b0-f8f4fd476166", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb95089-5181-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666385376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666385376, "uuid": "196aee9f-b9f0-4a1b-8197-5dfc3384733a", "comment": "Malware payload", "value": "021cae3b700881c211218386a402476a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666385376, "uuid": "ab981eeb-b255-409a-8885-e5e17e21c591", "comment": "Malware payload", "value": "a940f784320f83e3532a44fc1cbec0b2d9737a98b617d02d5e84134fa8f64c64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666385376, "uuid": "8ce4aec3-6349-465a-aa8c-195e4be0fa56", "comment": "Malware payload", "value": "e14f23f0d6bad99342698192b60171b3aa0fad77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666385376, "uuid": "f737c9e2-3bba-4d8b-bc7e-1ea43994f7fe", "comment": "Malware payload", "value": "7656337f01424d1fa67aa8e00795ab35a28c380a4429ab86cfb3e1f863e03f71bd726aa64c5bb9dffcd8168fd8d32c4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666385376, "uuid": "b75735c5-b46f-4df5-9457-f45027192177", "value": "T1AB34E000BAD2C8B1C48259780470DBA056BFFC32557545877BA93FAEAF702E257B6347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666385376, "uuid": "4819b4df-4f8c-499a-8481-071dae9e1106", "value": "bc5a05e947eb61731a4e3024a4f4b617", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666385376, "uuid": "4b203524-b162-4305-9886-88d337f20c87", "value": "3072:2XSz0LTqFDYATE5WxI4EZIopbkRsUchNduFP/As4wu4F6KjA3IS:eU0Lm5YATtxAlpbkRsUcAe4xFm3IS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666385376, "uuid": "dec153a2-2ae0-4669-b612-0f65c29add39", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666385376, "uuid": "0b7fe999-c1df-4d74-a700-d50e610fdfca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666385376, "uuid": "18ed28c4-ad44-4a32-ac5b-79f7c78e72a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d37ff23-5105-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666331765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666331765, "uuid": "61afee64-e385-4c0b-8a31-09bac03fdf83", "comment": "Malware payload (Formbook)", "value": "8d1335dbe1343589ca069a275108eba3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666331765, "uuid": "d096085c-7ad4-4f4f-8c36-cad67a26443c", "comment": "Malware payload (Formbook)", "value": "aa92be4b13120a9c6471189e528eec51836a2f2911362662cf21d0f2b992f0de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666331765, "uuid": "7ff4a11f-bf17-4644-a87d-b7ed2cf0af2a", "comment": "Malware payload (Formbook)", "value": "b6248f63c7c6e0f599a9f609603132488e27c01c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666331765, "uuid": "e1735527-f7f2-4a2c-8714-bc42481a6355", "comment": "Malware payload (Formbook)", "value": "f7311588b5332e6df88ab501add16a96a36fb4acf221fdd6471caec3dd47a83587120faa3c4dea01a7d0c4520f0c4d5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666331765, "uuid": "67b11ba8-8821-480e-a45e-b8261c31eb86", "value": "T1C0D4DFBE9365AF43CF7850B6D820054092F48A535A26FBAF7DC731EA40C1B4D57A990B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666331765, "uuid": "001d5ecc-808a-4753-ad37-70996b61b63f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666331765, "uuid": "e671cd81-a106-484d-84c3-7ce0a705b6bb", "value": "12288:cyQLM2hdkLMzGv/7oJdxEh30s15PpuxDT13Sl17aPqbKL:c9kgzu/7oJdI3tQhSlgoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666331765, "uuid": "7b5c8f05-1341-4225-ba9b-f2dc7fd85a50", "value": 623104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666331765, "uuid": "25d961d5-9e16-4947-87eb-abc6ae0c7f4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666331765, "uuid": "219b7107-2f3c-45ce-85da-eb2aaa60e974", "value": "Orden de compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69e0f82-50e3-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666317420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666317420, "uuid": "e4fc4467-8004-480e-b962-cba4cfb13c38", "comment": "Malware payload (AgentTesla)", "value": "506e12f796a8209b303ea918debc1699", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666317420, "uuid": "28a1ca98-2db7-47bf-bd56-c5b36f0d2bc3", "comment": "Malware payload (AgentTesla)", "value": "ab01b817f710920d1238ce1f3e1084ed249d0a49be7a156653a3d9e6ef93ed69", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666317420, "uuid": "a6d30db5-6768-4e13-a8fe-d26aa3661bfd", "comment": "Malware payload (AgentTesla)", "value": "79ef1891c071fccc33f45a1e12722c6b0956c712", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666317420, "uuid": "37825afa-8f81-4ad0-8cdb-d22f5c47ff13", "comment": "Malware payload (AgentTesla)", "value": "cdcd9076fbe0ce98649c30e9cbb41f02f9c025341ed05fbc671d69aee1e58eeea96c1c2e00b4ef8e54c0049a584578b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666317420, "uuid": "342dc666-f0ab-4ebe-89d9-c04378ec5e05", "value": "T15AC1B51063E987A7EE320777BCB367410374B3116DA2C7EE2DC8215A6C127980E626A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666317420, "uuid": "6c1d5a4a-9583-4f31-af69-b02e97570128", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666317420, "uuid": "f82d871a-7839-4827-8c8c-424db09f826d", "value": "96:dieteCmxIB8PILdavj+dJley3kaFOzNt:xtDOdvjQCyUEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666317420, "uuid": "c5685113-e8fb-4d17-bd9d-5ec6922e46ed", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666317420, "uuid": "99f23469-05ed-4294-bce4-4fcb9cde63f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666317420, "uuid": "09652c13-6991-4f33-80c8-5903d80ef4b1", "value": "order001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631ad01b-513f-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666356820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666356820, "uuid": "941a5ae7-4f15-4b52-b268-a4872f10069a", "comment": "Malware payload (Smoke Loader)", "value": "8d791ae1db7645061d1625ebba7defa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666356820, "uuid": "eb7a2396-42a5-47c8-9af3-e3029f1b312a", "comment": "Malware payload (Smoke Loader)", "value": "ad4d1854c6cb5461bed921811c3195c085a69c23442931303232aa27f9ac57f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666356820, "uuid": "df025918-b3b2-4f02-9974-2962e6509f26", "comment": "Malware payload (Smoke Loader)", "value": "d97d3322f9d620fb3f76b85fe3c983b0e86b0ecd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666356820, "uuid": "2a781308-df01-4908-b841-703111537c1b", "comment": "Malware payload (Smoke Loader)", "value": "237998ee30508589d4d8a5d9a4279f4a1297e2e2bb30bb8fdf232e56d477a69a5568d2a0801437b7c93c0b92e458deac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666356820, "uuid": "92c6054d-639f-4f7e-890f-494915fc6c1a", "value": "T18D14E1017982C471C88249354430EFA06A7BBC3249799A9B7FA47FEF6F702D256B6347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666356820, "uuid": "8a10d173-1a3f-4ecb-95b5-cd5ee3ec132c", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666356820, "uuid": "93a936d6-b710-4592-9913-6ad113157013", "value": "3072:4XS58LL3FQfz58SIf0K9qhCcYqI8jHAbFN1GTg2:Mu8LLFQfdhC2iFfGTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666356820, "uuid": "eec21d26-9f4e-494a-8917-fc1c8dc60827", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666356820, "uuid": "02d577d1-1962-45dd-8de9-07be056b30f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666356820, "uuid": "2e75ee6a-efa9-4be9-8091-9ef5fe935e25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbd8adc-510f-11ed-9266-42010a9c0072", "comment": "Malware payload (NetWire)", "timestamp": 1666336272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336272, "uuid": "0c7f2966-3e19-43ae-b147-9bc7684e2b6e", "comment": "Malware payload (NetWire)", "value": "91e64955817f4a2c4a1d39926ad0ebc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336272, "uuid": "06fea37a-7f4a-4650-b1b6-64a4280de1f6", "comment": "Malware payload (NetWire)", "value": "adcb4cadc4a186f55ab40167534aba3f36f43d716f3a2742942bcf73c2db6668", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336272, "uuid": "60e3bedd-afef-4535-af04-f393e98ed7d6", "comment": "Malware payload (NetWire)", "value": "705970ffaa5d04be9ad37c001430f58fddf79d28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336272, "uuid": "f8f67d3e-6696-4f25-bfeb-82e2ff95cbc7", "comment": "Malware payload (NetWire)", "value": "303b366d2abd12c1047ff9c57ea4d5dc4688379dd8942fcee6aa356edd77556643f2d7a065c8a69a0899ef0deef9733e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336272, "uuid": "a9e3cfd3-558f-46e4-878d-7ce1b343ea36", "value": "T19CF4122D5BED5E12C5FD5A3AD4B65A1003B7D12AF0E6F38752CA7CFC2E63380809195A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336272, "uuid": "ae9b333a-0fc4-4fda-ba8f-51976eefa75c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336272, "uuid": "5a53adab-ef9f-43b0-bec5-6cfca584af43", "value": "12288:EmxK67awP//KF5ccBBWGc2YQ5QFIgwgBzj+H9qqFf3L0bJprfIq0cT4rpFnL+hQ:Ex6Ga//KF5+2l5Qig/N+H9qAuDI3ckzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666336272, "uuid": "6f8f81a1-d5e6-469a-8dfd-c62c3f577816", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666336272, "uuid": "22891735-79e3-4e5c-aadb-8e196008aa9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336272, "uuid": "10b55ab2-f215-43c0-bdd6-6444e5bc95ec", "value": "SecuriteInfo.com.Variant.Tedy.224685.104.8005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad03b2f-511a-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666340915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340915, "uuid": "14ac3bdf-0135-4a2b-82ce-9e378f255293", "comment": "Malware payload (AgentTesla)", "value": "612cddddf70fed2ec457298a07e3f199", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340915, "uuid": "d38f431b-df50-4613-9f1c-4270269a3265", "comment": "Malware payload (AgentTesla)", "value": "ae242fa323e2341a1642e947097d38678148876b4465b979bf54d37cbd872a05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340915, "uuid": "751132a3-a33a-4895-8b06-baf26f3116ae", "comment": "Malware payload (AgentTesla)", "value": "1f7480757696d21fe85e8fd13a8ce5698b75b503", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340915, "uuid": "bbae5ccd-c9d4-4cf1-a957-ec1157604bc4", "comment": "Malware payload (AgentTesla)", "value": "5769c497ef859731226d22d746622656cdc2767c193e9937e61dc21b2770e48858f664fd29f856088cfce2fe4d281c97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340915, "uuid": "b698f4dc-4da1-46a2-84fa-fabcef127320", "value": "T1247413D83A03EA57C5F7AA3C46F051096551EE6CEA0FDAD733D1FA08B2767801A43E52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340915, "uuid": "430fb35c-f967-4197-bf70-b9b73f711583", "value": "6144:/Ty8ow5bFBlpLS9giEWhInbs0b7GNBBix3eQxuAUepqizG0P2Ux3wWFc:/Ty8ow5bFBfkZEWF0bSNSl5Esr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666340915, "uuid": "9d34a7be-5d79-49dc-b7e5-003cdebc8824", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666340915, "uuid": "3b51ec3f-bbf5-4667-8887-400acaf3b7d3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340915, "uuid": "19185b0a-b567-4336-850c-49f6e2b4493c", "value": "AWB#3462686975.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbcc8fdf-5117-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666339896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339896, "uuid": "e746b56c-6e0c-4e64-949c-9e01c37f3e50", "comment": "Malware payload (Mirai)", "value": "b9ebdd342d24b9e54eb7e028f3b84cc0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339896, "uuid": "86d0274d-dd33-40c0-b0f8-55d3fa77f0d1", "comment": "Malware payload (Mirai)", "value": "ae3ba9fcb80e8b7ebda84198cdfacd488b7781a13ff1648cab30ba9387265dc2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339896, "uuid": "92513896-c7a4-456e-86cd-18bb7ed1f6fd", "comment": "Malware payload (Mirai)", "value": "25d6e979b60929b5306e21ff8b183514648e5ae3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339896, "uuid": "f75f8e3d-43cb-4010-8532-fe8193ea41e7", "comment": "Malware payload (Mirai)", "value": "2e83457443e4456c1450a5a89c7c65e223cec6002b9c118992d51a84b2e96915312a16b75fdfb53506fbb2ec3d789391", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339896, "uuid": "266f8b6a-98ba-4c25-a6f9-dcb6028f0d62", "value": "T1E8C2E104D1918F42DFBB9AB26E74A2D27BE0250F6E83DC422B8597593709573E14DCC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339896, "uuid": "0591314e-aaf8-495d-ae97-cce1b5bbbddd", "value": "768:tVdafO76jpmNJcI6ybp6lsAZ6xcbJKiU/aIuZH4uVcqgw09w:Vam+AOlQ4zqiSaIQH4u+qgw09w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666339896, "uuid": "3ec6c535-1fdd-4aae-a034-fe1638318508", "value": 27064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666339896, "uuid": "9750e57e-565e-48a1-8e92-c1345efa8b69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339896, "uuid": "3b4386eb-6eba-41f8-a2bb-4b1a2d692d79", "value": "b9ebdd342d24b9e54eb7e028f3b84cc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b4d549-5166-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666373818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373818, "uuid": "957291c2-9e6b-4d52-b12d-195c3a190975", "comment": "Malware payload", "value": "8ec5212192459dfd815df48960fb21b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373818, "uuid": "444ff5e9-f297-48f5-9966-38f8959a2418", "comment": "Malware payload", "value": "ae5fa45e7af9a7fe4e5f96a38578fc7c065c2c4f438b3669f71b24f603188549", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373818, "uuid": "5504c6c5-27d2-4372-a54d-3c33766e2289", "comment": "Malware payload", "value": "cbaf2ce96d4b407001c767dff1c6662488a465fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373818, "uuid": "edaa366d-938d-4f9a-a46e-81eceaae259d", "comment": "Malware payload", "value": "4349599ed84cbb61150bb4e254e034790123c905e83325fc7ffa7d7a9c71af5488115a3c5858f47ed39467633b322dde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373818, "uuid": "2f3ac210-180d-4f3b-9c45-265a865a37d2", "value": "T1F1B4CE7070809132E4B6107249FF8AE50AFF7D616B4265EFB7844B6EEF206D16B34B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373818, "uuid": "07feb3f6-27b0-478d-ac9f-d6a960b51e64", "value": "787d271a2df462be9e8efbef70e9c88f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373818, "uuid": "dc979911-b9ef-4e8a-ae35-3ff77ad67b0a", "value": "12288:B2l6E8GjAVR3JpZRtfEyQup09wcF7jkO5Hdh:m8Gmp1HpOZFfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666373818, "uuid": "d7364a2f-7a06-42fc-ab98-310da05f07b6", "value": 515584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666373818, "uuid": "fe436cb2-7bc5-435e-809e-4aa84c3b2c95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373818, "uuid": "56faee2d-5eeb-46de-b7fd-b7c6ac2c61d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb1720e-511b-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666341512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341512, "uuid": "3c70fea5-0025-4081-899d-cd669f291827", "comment": "Malware payload (Mirai)", "value": "a3c547bf8726aa98bdebc484e392b255", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341512, "uuid": "4a436f6b-2b78-44f1-8bd5-b48fbde03e3f", "comment": "Malware payload (Mirai)", "value": "aeec81de4e7a4dc2ad0e886c748d31f683680e7df742b977b38b50b4017687d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341512, "uuid": "b867474c-c012-4caa-af4a-3432c37c06b9", "comment": "Malware payload (Mirai)", "value": "410fc46f900d9f1fedcb222ca94b6aac95f9f6b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341512, "uuid": "78b2249c-603f-4983-8933-82d565e2bc51", "comment": "Malware payload (Mirai)", "value": "cf55b0052082791d826678302f42e968ea6dc47c86cacbef92fffee0984e2ee11d239b030dec5f39379c2d2fd741728b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341512, "uuid": "87b6f01c-5ea2-406b-a735-1b3f3546029a", "value": "T111C2E1BC7EFB5F87CE1B00366958EA2381F065A5D35BB697B2484102AC130E1AE67CD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341512, "uuid": "5633ca04-78fb-46b1-89cf-7a71038924b0", "value": "384:MB1DMwk8JPyGNoDZsEXVZVBm6xIJSlSmknnLZddZ6TJfUVlMWEbo28tEe5mj5fwv:0Mw4DZdFbBm6x3K/KdWnH5Mw4U+0NP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666341512, "uuid": "da8e363b-7d76-4284-926e-b1b6cc0b90b9", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666341512, "uuid": "4d3df91c-1348-4de5-91a5-0e41f0ea019f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341512, "uuid": "36eaf192-e4c2-4581-a459-be51b021ceec", "value": "a3c547bf8726aa98bdebc484e392b255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323cd3bd-5109-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1666333545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333545, "uuid": "d4cfb126-7e00-49a1-a26c-ddeffe51b275", "comment": "Malware payload (AsyncRAT)", "value": "3ce7eda1d2489fb2a93bdd839699e64d", "object_relation": "md5", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333545, "uuid": "f671669a-1106-466e-8cf4-d98ea2710427", "comment": "Malware payload (AsyncRAT)", "value": "af2b52d74cb468b141d03dcd688cc0b184164c906464ba830ffe4b4ab7fc812d", "object_relation": "sha256", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333545, "uuid": "88274815-f730-4917-b479-7a6f928b4948", "comment": "Malware payload (AsyncRAT)", "value": "fb0e23aeec7d9204d863bf91945e76cb41fd5842", "object_relation": "sha1", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333545, "uuid": "aa8ce6b5-3f6a-456b-a079-c967b665fc71", "comment": "Malware payload (AsyncRAT)", "value": "7a6ff8a98ccda1a20907eebfa802e5486f52ae0bcd63b08fdd0d6a6c987a0eff5ea99731c13b6500b20fd4013a921d3b", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333545, "uuid": "7f30a46c-5749-4947-bdc1-77032b772d12", "value": "T1DF233C003BE8822BF2BE5F7859F26145467AF2632603D64D2CC451DB5613FC69A43AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333545, "uuid": "7725d31c-efe2-4abc-97e9-87a722a53f94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333545, "uuid": "09e6f340-9e2d-401d-831a-16a5d43c4eb9", "value": "768:vuwCfTg46YbWUn8jjmo2qrDKjGKG6PIyzjbFgX3iODt3RmRuuDFau6BDZSx:vuwCfTgp/2OKYDy3bCXSM3M09ukdSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666333545, "uuid": "30d9e931-8e0b-4f99-8b1a-36c89df99f75", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666333545, "uuid": "3c84debc-7eae-41bf-b023-8166562a9ace", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333545, "uuid": "32fd26a3-bb41-4247-b1d2-b5c865393f21", "value": "AsyncClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f2bc59e-517b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666382530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666382530, "uuid": "c3831b4a-d2f7-49e0-bca6-0399f834cc31", "comment": "Malware payload", "value": "a601b696337a923fcd43d9b505ddd8cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666382530, "uuid": "f9782248-df9c-4bb9-96c0-03b5de52b5ad", "comment": "Malware payload", "value": "b0e9ac1486908cd1351af5f5cb102d16ed197dee031f9f07d996f62248fdd481", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666382530, "uuid": "b0a02d16-d4f6-4c3a-8667-41d3852f967a", "comment": "Malware payload", "value": "2dd84fc9b48a70353466bd67bb5d3ee55055e0af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666382530, "uuid": "5c94b0dc-5428-4711-bf38-e49b82502da7", "comment": "Malware payload", "value": "3ea09299b9b5e1240f924ad1a448a40e04c7de0bf1e24ee10d8c8dc753db99a16239b4b04cd8dd7c9fecbbbb4ecdcd1f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666382530, "uuid": "fcbb7392-8286-439b-8dfb-37cd9af617a7", "value": "T17CA4CF7454FC6769F12A3DB950845F36092D2D52FCE8C0222DB815BA265F30E8DDE8BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666382530, "uuid": "3c2ea720-5069-470c-a476-4f007fafad90", "value": "6144:9GAT+L8NBMM4TJ0/WZEk2+NTUU16fvi1Im3snKJ2htSOiqBOUaN7amUZ:9W386N1D6fK+m3sKJc/BVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666382530, "uuid": "0d609ebf-bbbc-4e22-bece-d8bdbbb56afc", "value": 454144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666382530, "uuid": "36a249ac-2c19-4843-bb88-3543516d5a9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666382530, "uuid": "550eb037-f2ba-4364-8dc3-c27501736bd0", "value": "Order 40913690.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc30b281-50e9-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1666320033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666320033, "uuid": "f12d2264-a25c-4802-9ad8-c807a3ec2de5", "comment": "Malware payload (DCRat)", "value": "112487b13ebcb89ab5c481bbd53bff21", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666320033, "uuid": "a48e914e-b8b5-4551-91b7-319cfda0bc7d", "comment": "Malware payload (DCRat)", "value": "b171ce02608257ab163b0dcdf443a91a41ffe02e2c74597cdb829f5088a7ca94", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666320033, "uuid": "b712304b-764f-453e-9c15-ce292736839b", "comment": "Malware payload (DCRat)", "value": "85da3dc68dc1cccd2368de45d56854d238907610", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666320033, "uuid": "d224f1b8-544e-4d7f-b12a-dfafff657073", "comment": "Malware payload (DCRat)", "value": "2e3287216b41c3290ff899fc73790b610faaec0ac98e8f063668a542fe6dea8b0e8bc056b4c50eb2463c98c4f356127d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666320033, "uuid": "91811b77-b881-4da2-a603-b6223b7dccfa", "value": "T112B6331655F0208C8E14CD33C791C3EAD9C5EF841A2298256D6EA82D473F7ABD6CA773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666320033, "uuid": "b66f8ea7-d242-4e7c-936f-6744845b2094", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666320033, "uuid": "f68b2c7f-59ae-4972-a0d8-e9e276deba62", "value": "196608:arcZHC5bscZGF89WgnhnWE3BSeFqK4AjIjGSSq6p:aAsgnSX30FK4AUch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666320033, "uuid": "6c05d7a5-115d-4027-8a9a-405ced1924ef", "value": 10919424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666320033, "uuid": "edaf9526-fb71-4450-9e2b-5b4b82f4ae21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666320033, "uuid": "c9160add-8d9e-4a61-a712-437f4bcbaa38", "value": "112487b13ebcb89ab5c481bbd53bff21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cbd6b83-5121-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343898, "uuid": "978ef31a-69d5-40cd-bbb4-5c8db196d2c0", "comment": "Malware payload", "value": "e272df5c9abd7d4c03982bb506922428", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343898, "uuid": "eb43b330-758e-4633-9a09-33917904b703", "comment": "Malware payload", "value": "b1df569ad4686e16ec0c661733d56778f59cdb78207a3c2ad66df9b9828c84ab", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343898, "uuid": "a8e541d6-bffb-4cbb-9083-684aba901830", "comment": "Malware payload", "value": "c168f3ea7d0e2cee91612bf86c5d95167d26e69c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343898, "uuid": "19281f26-35b9-4e58-bfa0-1cbe8658928d", "comment": "Malware payload", "value": "b646c0116acaf5a78afd141d3622c03111e3b8257e3d102d90347201726f0cf9007b66b423a64046aeacddf3a5872469", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343898, "uuid": "73297a8b-88be-4fd0-bc1d-2bd691be7122", "value": "T18EE5BF5CF2625F24E968BFF8B2DED1230FBB17D1C7415894A9D618508EA137FC88E489", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343898, "uuid": "2d2b0482-d6f1-410c-9693-47a873681949", "value": "49152:ZpDRoQ0Ua6XsNp9E9IFzPyR8iBZrMPUKKWO7wgNrAhv708Vtq92Ky8AJ97U:Z/L0dp93uR/ZogwZhz08VtA2Kyh7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343898, "uuid": "4186958e-af1a-493f-b138-c1cf387555fc", "value": 3078488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343898, "uuid": "6a85b282-0df3-44be-b37b-77be699a8683", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343898, "uuid": "cdc9aac5-2cfc-4cb4-a632-3eac34d5dc3f", "value": "b1df569ad4686e16ec0c661733d56778f59cdb78207a3c2ad66df9b9828c84ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61327ac7-5109-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1666333624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333624, "uuid": "39c1a221-01fd-4cf6-8d4f-0c800cee87ec", "comment": "Malware payload (AsyncRAT)", "value": "529ca8a8c17f56d766bfc300198502f1", "object_relation": "md5", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333624, "uuid": "d646bfc9-3484-4704-9a37-2321cd684de3", "comment": "Malware payload (AsyncRAT)", "value": "b2a4aca9ebb9d8032d7ac5b426c3bbbfb59bff6051f963fc9d55239a48b06898", "object_relation": "sha256", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333624, "uuid": "a38a02ff-020d-41ce-a365-361109714b76", "comment": "Malware payload (AsyncRAT)", "value": "2f28360995b8f2473fe23efe335626b8e3527846", "object_relation": "sha1", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333624, "uuid": "c85431d3-329a-470a-98eb-657d732727c2", "comment": "Malware payload (AsyncRAT)", "value": "9712c3a03531709737b99391b8db3031f584408f4d83f962b92382fb88a9fd3827859adec2093f2e7611e31ccd7b48e4", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333624, "uuid": "9d08f7c3-815d-4478-9813-921b79c47101", "value": "T1D40733718AE6088ED9763D3AD289C9C661448B981A777EBD7E3D61DCCCCF65C4893320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333624, "uuid": "e490b89e-be07-41af-8978-184dcb26298a", "value": "393216:hwsddNTnQDFMY6LzdP6XZn4JvsJ3Wchth88W3K4gD4FwwKOkZ3BDGJy:2STQwP6p4YrH8f3Kfue2Jy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666333624, "uuid": "6feecd0c-dda0-4379-b9d5-6a907b7ab71c", "value": 17385072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666333624, "uuid": "95e58ac0-4445-4e3a-9188-3ceffa87bd2a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333624, "uuid": "9f2ed402-c09e-43a4-b781-45f638339bd7", "value": "Venom-5-HVNC-RAT-v5.0.4-x26d0u.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8b70af-5159-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666368192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368192, "uuid": "7c22e5a2-27f0-4db6-b719-8eacaffe2406", "comment": "Malware payload (RedLineStealer)", "value": "bcff20eb5ce3ae163372c34644df5625", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368192, "uuid": "1b6f8515-feba-4f69-a9bd-ed010f2d31f2", "comment": "Malware payload (RedLineStealer)", "value": "b2e47bc25c49e0085fe3cc8320d2fcb9d122e6afc5c3b56f4fc2a84e505d703d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368192, "uuid": "dabd9511-ce10-4025-817a-4344c6f87119", "comment": "Malware payload (RedLineStealer)", "value": "1cb47fc127e52bea60bf25efab3b9501260cd592", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368192, "uuid": "93a63301-27e1-477d-bb6a-080f3d69d7a8", "comment": "Malware payload (RedLineStealer)", "value": "512b61a6ff4597a2db892dd36da9d139726311afd43dad7bdce04ad0c2588f551ba702cc8461390f4888368a033e10db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368192, "uuid": "d81b56ae-1ab7-495b-985a-7d6b29fa2251", "value": "T1E8056D627618D542EA5C4132E942C4B55BA42CB9DAC0F23A70D5BF2FE4F3322494EF5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368192, "uuid": "bee0dd3b-f00f-49a9-a470-08b41f47688e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368192, "uuid": "25c866ce-fe5a-4e89-bdf7-3a8c7e3d43d3", "value": "12288:RTjpzDnSKV9E1KErALXeejCf7lW77gSshWwI:hj9HIryC7DnhWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666368192, "uuid": "de06a0a3-7d09-4299-b886-30407701fabb", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666368192, "uuid": "1fe541f1-6d1d-4837-814d-bc615e99a75d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368192, "uuid": "fe8f2707-fb72-4ddc-975c-23ef2d3dfd18", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd2d641-512b-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666348090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348090, "uuid": "76908c70-14f4-457e-ac26-cb0001790321", "comment": "Malware payload (SnakeKeylogger)", "value": "493ec38546c459a6c96d29187387fa1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348090, "uuid": "f32c8513-f1e1-4fdb-9a7b-522e02d2c2ac", "comment": "Malware payload (SnakeKeylogger)", "value": "b353a06289b9bce2f3b8b04f20f2b950cf484e66f05992e1a8a77928ada3a108", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348090, "uuid": "1e6ee2f2-4591-4d14-a19f-c5203517be43", "comment": "Malware payload (SnakeKeylogger)", "value": "62e5e88eb01c09308f280ade5f29a614a22182bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348090, "uuid": "527cd79d-b56a-413d-b9e0-209256db5f34", "comment": "Malware payload (SnakeKeylogger)", "value": "05b79533136e065ab1781f77b58cbb8a3a4493322cb7f9e58cee8c2a235e336f36a584ec64d7a9b0286be40029118380", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348090, "uuid": "d3b37195-ae47-4068-8ae6-3599aaa1710f", "value": "T1020506BA22D1215FE416B1758183E9B366FBAD516142D1C790D30F6FBC881BBDA1338B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348090, "uuid": "2ed7faa2-d622-4400-8f16-ebdbb5568960", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348090, "uuid": "13617dde-bbeb-44c7-ab8b-d4580bd6422f", "value": "12288:qwBVJ3em4LHBMoQU6imoCWcduw/wdbQ/JAgM3fEuOPM42cvAdZ:LilyaKoi5eFl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666348090, "uuid": "6cb2b54f-be40-41c4-9aa5-b78167a9c65b", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666348090, "uuid": "1967d422-7bf0-44ec-a446-f0c25370ce5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348090, "uuid": "f18e3586-ecee-437a-9968-4213e1a7ae83", "value": "493ec38546c459a6c96d29187387fa1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bceef469-5159-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666368138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368138, "uuid": "6ff5fa02-3578-4ca9-b316-106dd3aed71b", "comment": "Malware payload", "value": "85270630c529e1480e3b1df60a00e020", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368138, "uuid": "3ab5ab69-1a86-4bae-805b-4d1361e29325", "comment": "Malware payload", "value": "b369c9f34e7351fc2616f2f951ea429da6e635df522710e915c14a6b78429503", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368138, "uuid": "54019d2d-5986-40db-83b9-252a5bcd9081", "comment": "Malware payload", "value": "93867a17a40b5886a11018368df44e8cebe0ff86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368138, "uuid": "0a0dea53-0507-45dd-a398-67f544fdaec9", "comment": "Malware payload", "value": "1369e6ab2ff239c5da98c177630aa2013bdc72972e5a346e32866afcf28fbc8fc681f6a80204cbf64218ecc32cd3b614", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368138, "uuid": "5b037d34-45ed-49bb-9f59-acd1d4572067", "value": "T105A34B0174D1C472EA761A321865DEB58A3DFD305F21AEEB7398067B4F202C19B72D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368138, "uuid": "742da05d-ecd8-4f64-a5f1-c65a5d6d76a0", "value": "6926e710c611de96c47e8cc0bfcad5f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368138, "uuid": "f6885153-ae68-40b7-89e3-9d54a57a316d", "value": "3072:v1KJA+AXF3tsiUK90xIhG6SnGNHRtY5vk5a95P:v1Kfw6KXGks25a95P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666368138, "uuid": "a8cbc987-f20b-483b-b748-7b5a1af14506", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666368138, "uuid": "ee8d4bf8-4f8d-4d57-9dfb-30a1a939cd58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368138, "uuid": "e87d0203-4335-4455-b2a6-ea00bae0f6bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb22d56-50df-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666315767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666315767, "uuid": "d6ee8fb0-3cd7-405f-af18-b167ec1cb91d", "comment": "Malware payload (AgentTesla)", "value": "2770111fc7f990a66ed44a751327998d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666315767, "uuid": "f47b96c3-bbc6-4c49-9caa-b6b12bdda206", "comment": "Malware payload (AgentTesla)", "value": "b3e6c52a6c01d7b0d3b5eb3ca61b3615258343d3dae12c01ad0b71047dacec08", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666315767, "uuid": "ea7845aa-6b7d-47b2-94d3-bd539592c59e", "comment": "Malware payload (AgentTesla)", "value": "9a118f953c64c7eb14e645b8879789971ba5cccc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666315767, "uuid": "c2f31f5b-da8b-4c17-b87c-27c238642a37", "comment": "Malware payload (AgentTesla)", "value": "40f30db15314b8cab9b5907b5b39aa6060d3b28a739a4b7245d7cd0eaff24f4a34c8a09e07159b4877362189c243f679", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666315767, "uuid": "fd4c3d38-c7dc-42e3-9b61-7f94c8bfe85c", "value": "T1AC4402CB9ABC40A0FE6B423D7443154F94EEF1AF5B07A53D315603D3BB966A3A682530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666315767, "uuid": "c61fa3bb-6911-4574-a902-8d74c1ec6cce", "value": "6144:qzkU/3eKWkl/70Asa0KA6HEQVP1Ss7VMSU9xK/Gl7z:qzkAuKWa0A90KAZQVP1SwMSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666315767, "uuid": "f5efabc0-3267-4dd5-aefe-12c656ef5076", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666315767, "uuid": "c3b0d3d0-c9fa-4902-8836-d696d2fa1591", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666315767, "uuid": "db5cbcdb-b6b1-43ee-b554-2d844469d188", "value": "Quote 5190842.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1244775f-510a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666333921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333921, "uuid": "eb34c820-d9a6-49e0-99d0-bd73010bcc2a", "comment": "Malware payload", "value": "2a62b2d78f2c0f2efd39f07641d231e1", "object_relation": "md5", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333921, "uuid": "09bb8001-896a-4b96-bec4-931b29f75a29", "comment": "Malware payload", "value": "b4b1dd5fc206b0089ca1e7d613d6475a9a06bbcf4c207830d7c0cf02a94ae79a", "object_relation": "sha256", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333921, "uuid": "b0a72afb-26d5-4ed4-a07a-9277b69a7e6a", "comment": "Malware payload", "value": "30e17f27edb951a306fd907e37aacc170bf3c7be", "object_relation": "sha1", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333921, "uuid": "89b28a19-4c5c-4a03-bf70-edb402992252", "comment": "Malware payload", "value": "2056ab3c4272ef114568a452ecfaac6ed7d374b85651dd78d539b8d9a7eef67bec1e1a37b4dba3c24adbdc1f7dd1bdd4", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333921, "uuid": "853453f4-4374-4b10-9856-9353d2c7496d", "value": "T1B5823A2D63E6D7B5CEED5ABA486362811B32D30BA983FF1D8DE8807718777404B62614", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333921, "uuid": "64873591-b3fd-4027-9397-f1112cffdb07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333921, "uuid": "2b906e30-49b8-4b8b-9338-4fee67ad67f3", "value": "384:F4DIh6WG5tV+xSjdto26g2S0olp6NaUkBq2CimESaz+kz:6DIhK3gG/6rsYjEJSkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666333921, "uuid": "19c11f35-cd88-4795-b15d-daeb9b8e98be", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666333921, "uuid": "d8fbc5cb-b6fa-4dfa-9674-15fce5231eb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333921, "uuid": "66418ca5-023e-4ab9-9437-a86362bc42e0", "value": "crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a6d7aa-513c-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666355742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666355742, "uuid": "043b3336-48fb-4bf2-9a31-7479f51bf3eb", "comment": "Malware payload (RedLineStealer)", "value": "fde5a67a12c42f3b90c4bbd46bfa771d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666355742, "uuid": "3815cc5e-0803-45af-a13a-9106e06b1d1f", "comment": "Malware payload (RedLineStealer)", "value": "b6433f49d2d37c58ca132fd5bbca5ac07530969636d6af7c9db223bef32d5d7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666355742, "uuid": "c572c250-f570-4533-b538-1a4e346558fd", "comment": "Malware payload (RedLineStealer)", "value": "755edb4dfb7939185f04a643d900389f8d171cf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666355742, "uuid": "a6050ee9-8864-4047-acf8-7f482837290c", "comment": "Malware payload (RedLineStealer)", "value": "e6792c7d7ae6f8f2fadcca9059bb3e872704023671bb9a12a9035cba2dea99f8386b456bf40f468622d1e1bc5fde5a1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666355742, "uuid": "6a3eda36-9104-4477-b6ee-b2ca3b37b930", "value": "T1A924E11579A2C471C94F44348C64CB602A7FF93212754A9B3BA4EB7E6F313D12B7638A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666355742, "uuid": "4e084d46-d974-43fb-841b-dd3478084187", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666355742, "uuid": "49392741-7601-489c-aa07-4662b5537ac1", "value": "3072:kXmWbQohLMsbOQdaz5h4BvSkiCHVImsX/yvUKiXocpySsn0KVpKPNUT:gBbQkLHbOQda8BKkiMImcA5N0gsPaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666355742, "uuid": "453d49ee-6e62-4a96-9694-f596bf64f330", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666355742, "uuid": "892b8294-61b9-48eb-a8df-5c0e2a4e7593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666355742, "uuid": "2f7d3e4e-f7b8-45eb-8f7c-e73a7770f63d", "value": "fde5a67a12c42f3b90c4bbd46bfa771d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8af4dc-5197-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666394768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666394768, "uuid": "99fe562f-6446-433f-891a-16488e5e55ad", "comment": "Malware payload", "value": "8e9bc394f1be3b222be24fb716aaab95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666394768, "uuid": "36a4ab81-0cc7-4d2e-ae19-3372a0aafc08", "comment": "Malware payload", "value": "b66e3e1170c55fa676b0064b90df549c9d8b9542fb9ef470df6fdc8865c354dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666394768, "uuid": "6be833a8-6245-47ec-b832-d146509c695f", "comment": "Malware payload", "value": "02f638ecda95d7a764202b2bade88247527fb825", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666394768, "uuid": "d718c118-c8c0-428b-9c74-aa8735dbede0", "comment": "Malware payload", "value": "e6cf0c31c1bd89a5cf9e33f42e7bedfaf099f362ffbc6237c976e0ac3df3c02623edc204fa0ecea004e5a1c037896162", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666394768, "uuid": "af217def-0373-40d7-987b-a272ed0434b2", "value": "T17834E111B6C2D871C887F0348860FB9545BBAC3165B0C9A77B943B6E6E712C25BB63C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666394768, "uuid": "2f689298-303c-4a34-aeed-88e3420f1d19", "value": "b7130d64e41e1f3aeb19371c8fcd9d1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666394768, "uuid": "bc63af77-7795-42f8-9352-8a2f9255b54f", "value": "3072:QXO4fLtCkGak2Ygr5vV48zL7T0hg9bbmaHYUUefLh623vN4Fsb7jlS:EvfLI7D2YgVO8zQhfa6efLh66dS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666394768, "uuid": "0fb4db1e-6dc4-4f2f-9ebc-83ff5cc265b4", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666394768, "uuid": "b53cc30e-9a3c-4f63-9e77-dcf6eee1aead", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666394768, "uuid": "b96777e4-bac3-4cf7-82eb-f93d2005d7f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fa6169-5117-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666339541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339541, "uuid": "2a1c419f-b7b2-4195-a166-9f0849bd5762", "comment": "Malware payload (AgentTesla)", "value": "e9c7dc7bba8ee37ac7de7b7690f184ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339541, "uuid": "49055da3-54ef-4950-ac78-f1c84257f728", "comment": "Malware payload (AgentTesla)", "value": "b71cb5f3debcb1ca733e741808f3d68d96b92461c0f735ee36533171ebd92560", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339541, "uuid": "451fbe1f-6489-40ed-8afe-567623a3496a", "comment": "Malware payload (AgentTesla)", "value": "16806b43dc99077e5bd57b67b8dc7c12edc621ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339541, "uuid": "eb491a52-e8e7-4708-b10c-6576b9cbaf2a", "comment": "Malware payload (AgentTesla)", "value": "89154636b737c0f6e56e4ec5d81e55ab7879d72c63b794a8d81d0e7379f98cf56cd1f16c8187388dabb2176cc2ca7762", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339541, "uuid": "7a3ce91d-f76e-4c07-b20b-a216d94239fe", "value": "T16215D057F7DBF6F0E6BE827A82B1852C52B774520360A74F664076896D23392483DB0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339541, "uuid": "1c30724a-dbea-4ad4-88ca-8c36062bf0ff", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339541, "uuid": "e2530fad-df29-4781-907a-deeb49c4efc2", "value": "12288:un/zjvGHAykHJRLW/4+8bzbBSreM31OQwTOjt0cjk2c753pW6llKtElJrn6jitZq:sz7GHAzH7jX14BPJ42YlstCrsmIFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666339541, "uuid": "650ad73c-862d-4d39-b0b2-7798b6cf4c50", "value": 922112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666339541, "uuid": "fd829849-230d-4ac9-a50b-c46bdd2e9da3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339541, "uuid": "cbfa493a-3d84-453b-957c-92beaae10980", "value": "MOC 247463.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77376ec6-510d-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1666335379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335379, "uuid": "a2d338fa-5688-414a-b2cc-fad4732189ff", "comment": "Malware payload (Loki)", "value": "17e36993d889c30458c9c4b7b0fa0d47", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335379, "uuid": "4651cadd-64e3-48f8-aed4-f29795f118df", "comment": "Malware payload (Loki)", "value": "b7e15dbfe37eaa29a5ff341db4913246466b0d1acc5b5b71d85665a7a7a45978", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335379, "uuid": "8c516842-d29a-4be2-8e4a-9403c86b7f11", "comment": "Malware payload (Loki)", "value": "3c9235ba5876e895ec05536875f5145ab89c09fc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335379, "uuid": "1fe50517-8363-449d-8371-25099f651e19", "comment": "Malware payload (Loki)", "value": "72d9e23d067ecfd4c1bf220111d12ffac54ed817ec5693efc502ea74d1e20005bd8c1742ecba5e66d08548895f6cde81", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335379, "uuid": "147e73aa-74e1-4a39-b0f5-fb13cb7d6fe9", "value": "T124D3336DC79B45A5CF49A736036B9E080ABCB32EF30054B6706C937133E9D3A49A947D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335379, "uuid": "a30db72d-50f0-4cf9-a5b5-c792da3e4a3f", "value": "384:KZ4/IpRtbj9FqVYteUnu+vBQAnpK51xRlp2DmuqKj5uT:Ke/GRtlw6eUL5QAE72qKj5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666335379, "uuid": "9ae44fa0-a9fb-4f3a-9cf2-da6d9eea1fc7", "value": 140948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666335379, "uuid": "6624ac0f-c8a6-4724-b2b9-fc2a8b5d13db", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335379, "uuid": "04d79840-78c1-4b66-bdec-cb2d1ccfefe6", "value": "DOCUMENT ATTACHEWD.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91eaccd6-5114-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1666338430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338430, "uuid": "2b3a74f4-efac-4ae6-8271-744ae7e3a532", "comment": "Malware payload (Stop)", "value": "ad614cd101facf0f11c7824e54c4f663", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338430, "uuid": "7c9a9312-59be-4bff-8467-3efa361dac11", "comment": "Malware payload (Stop)", "value": "ba1ffdc17d60c36b8759362e9e3c14331eb6ed654b12298e42590de51f996054", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338430, "uuid": "fcf7abf7-7e81-4e43-8ced-929e160de6ff", "comment": "Malware payload (Stop)", "value": "cf22e7f34a6375538aca0eaeace001ed21047ae3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338430, "uuid": "43991f15-0482-4e83-9e22-4cc484c2906c", "comment": "Malware payload (Stop)", "value": "74c5ee1772244c52625575daafa1e5b14478a90b7c091dafbfeb518dfd74b7e1553c9d8e24f6821c7ebaa8291ca47407", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338430, "uuid": "3711a447-abde-4b13-b610-ca4b3db073b1", "value": "T114F42311B392C176CB862431702ACB907B3FA8F025B94D8B37753F6DAF316E192B6215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338430, "uuid": "cb1644b2-6bc2-409c-9844-8fa2f66bb9d6", "value": "ee783376aeb5a6ccd1e2676f1a5f0e82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338430, "uuid": "55b99b02-4676-4197-aa67-a5b11e52d7d0", "value": "12288:1/Rg6rhg1nLYmKYlI9UMmkV5vxcNPOVmuJxHQtURIX0d72m5fwod/f7EbMmZF:1W+h2nLYtEWxZHVqeQ0dqU4od31mZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666338430, "uuid": "fda9c697-b036-4555-b784-97addb791b3e", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666338430, "uuid": "8461e5b9-7512-43b5-a7f0-c1e2d32d20c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338430, "uuid": "74f20484-fe5a-4b7d-8dc9-1226b6efdc04", "value": "ad614cd101facf0f11c7824e54c4f663.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab426653-5154-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1666365961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365961, "uuid": "938c3bdf-ca50-406e-9361-08a449ff0973", "comment": "Malware payload (CoinMiner)", "value": "e96f21eb885413e3e27440e65bdde571", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365961, "uuid": "09f10a24-41e3-4dec-9d06-de47e035d64b", "comment": "Malware payload (CoinMiner)", "value": "ba45a8d99da2e43a3439c8dd3ee3fa3b37569b25b27c7544b478c0f67ecce2ce", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365961, "uuid": "95c32328-6a22-4f55-8b5a-f7fdd1109f92", "comment": "Malware payload (CoinMiner)", "value": "43c69bf94ab773e6be84db6157b771f8507c56ca", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365961, "uuid": "4a317195-a555-44fa-8684-d12a05772559", "comment": "Malware payload (CoinMiner)", "value": "ccb589454c7a419b4c41bdb681a46941ff303a7e021f94e9457a95290ee8f28c9bd94ebcfc99fcf5a93bfc6e05fcea5b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365961, "uuid": "2140628b-7b88-450e-8c90-727c854b709c", "value": "T12D34E111B6F2D873C88601344434DBE075BBB83136759A8B7B543BAE6F30EC16AB6356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365961, "uuid": "b13a890b-5b33-4241-b4de-5a7625d77e96", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365961, "uuid": "0f4b3be8-56b2-4dea-9f46-4357fb5e26c8", "value": "3072:jXGc4LAXdOQsO5m44BKgNXOOlAZty9yBg6f0/SYDiStxhQ:bH4LANOQsnsCOsWy9EKiem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666365961, "uuid": "2a0ba1d8-2a35-462c-9b11-ab02ec9a6774", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666365961, "uuid": "1e9be9d7-c057-4fe7-bb71-b13bf6a5f01d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365961, "uuid": "aa1cf87e-3378-4c8d-bdc9-cacc7c556df9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a7ed49-5135-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666352533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352533, "uuid": "75ab2a46-4935-40e7-9015-07c21ccfaa1c", "comment": "Malware payload (RedLineStealer)", "value": "0df61633eb3931ebe83f3c67f4ff843c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352533, "uuid": "4c26431c-23d1-48e1-9be0-ba4c982f20fe", "comment": "Malware payload (RedLineStealer)", "value": "bb997cbc8329ac47a1fb390fdda3c2c552446cdaf48193cd3a7eaa37df3f8a31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352533, "uuid": "ca14df65-2686-4783-9107-9deecd8a9727", "comment": "Malware payload (RedLineStealer)", "value": "22ef104755afd6a5d9d2ffd36429cf5566195f84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352533, "uuid": "e2c16486-7e81-48bf-bd16-6909777f7679", "comment": "Malware payload (RedLineStealer)", "value": "7c7b25b1cd789ac7f795013864b1069f3d490f42faa03fb60a3c52a73d619d93545ad5b3008bc4f4b26e491f4bca4bdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352533, "uuid": "615b2156-fb18-40ed-9cea-cc64ba3f964e", "value": "T1B73361DC765476DFC85BC872DAA82C64EA60747B430BC243A46716AD9E0DA9BCF050F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352533, "uuid": "19992015-9e82-4f10-a819-06cdc2ce8790", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352533, "uuid": "32fad26c-a993-4167-84c0-e9f2fadffb8a", "value": "768:rPVNtIziV7zKCeB2g2DjF7FFobq1beLI4ZcYViJS6UZWUeniOKiRPPrk+FP:rPVIziVaKnobobeLI4z+S6UZWNFKixPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666352533, "uuid": "1b9b0689-0794-4ea8-8bb5-2eb283061ae9", "value": 50496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666352533, "uuid": "acabdabb-3bc4-4c05-9d8c-c04ccdfa1bb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352533, "uuid": "ddf800b6-de83-4beb-a321-5b14db025c80", "value": "HGTYHUOPKMNHB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e06fda6-518e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666390608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666390608, "uuid": "3b43a70a-441e-4d54-8b53-e400e8837930", "comment": "Malware payload", "value": "51285bcf446c7c387dbd218331eb5997", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666390608, "uuid": "95eb9135-5a9a-419a-96ab-7837d97adb9e", "comment": "Malware payload", "value": "bc122b3b4f945ca4f77195d25fdf6828a75bbe37d45f48288e1d657a594bdef5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666390608, "uuid": "e7490970-e16d-46b0-beb8-83fa406ee859", "comment": "Malware payload", "value": "86e4f3486ec788e98b9dcc8e6f99573bd5fed6fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666390608, "uuid": "b244d29f-2f96-4bbb-8969-d3bfbd193f69", "comment": "Malware payload", "value": "efb486bf1869d8fffc731adf328a5fe59ffb86950f1e0fbc773ac0c14b81d41075f6d670adc9b4e851ca5f1a62fae3ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666390608, "uuid": "9a7b59fa-94b9-445e-a509-6a3c5c34d1e4", "value": "T1F6B53323EB918DBBE470E839773A8B579D213B071B6EA0C442CDCA6D6B3811694147F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666390608, "uuid": "da309715-d7af-4407-bf5e-934cc28a3651", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666390608, "uuid": "ab98b3f9-e00b-4c25-b9d0-f818ba8a8ebf", "value": "49152:Z2jRsFG2aNr1U7ZZxT+vKvoyGaeqzNpvOKFXYT8nGV2DvS3A5hq:MjTHGT5+Koyv3mK9a2JDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666390608, "uuid": "f6579cd6-286c-4e50-b9a1-ae1d226cc6e6", "value": 2368163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666390608, "uuid": "822a7953-3ba5-4e07-9ba3-b6f4a714f445", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666390608, "uuid": "49cfdb03-50e0-4690-807d-5eb18aeb078a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e30add4-50e3-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1666317244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666317244, "uuid": "c6c598e3-4b7e-4cda-bb45-982cc08358e1", "comment": "Malware payload (Loki)", "value": "535c64ba8dabf90d7e6cb6918a63bcda", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666317244, "uuid": "4bd939c3-2b97-4e8a-b452-c0c08eb49f79", "comment": "Malware payload (Loki)", "value": "bca934140f58b1e4756419c9e9b5639fb8b49755cf5844348f06fb44e3a45595", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666317244, "uuid": "a02a31b6-7777-446b-b6e3-072955224575", "comment": "Malware payload (Loki)", "value": "ff68eeb9c6470f5789e74d70835fbbd07e97ed62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666317244, "uuid": "e0e4b49c-d72f-4b24-b619-4c7d36c3b262", "comment": "Malware payload (Loki)", "value": "ecee4c2cc95f1e47b0fb71fac441eb257e625cffc23c24013fef6f5d40ba263ddb2f193c3fe3308f641b81b4d840d0b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666317244, "uuid": "14603aea-3f9a-4498-89b1-4213a4b29053", "value": "T1BD2517BA22C0225FD426B1758193E9B362F77D226116D1C750D30FAFBC486BBDA12397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666317244, "uuid": "06cf3d0d-22b0-4a36-b9c0-4abd28cf1c58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666317244, "uuid": "7dbb3f4c-b88e-4395-be64-0c1277c6a01c", "value": "24576:qxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxNusscmXmHE3V:mxHEm9BSfPjFdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666317244, "uuid": "38dc59b1-4bee-4f4d-9ff7-6eadd9d743e9", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666317244, "uuid": "4c2aff8b-4aa9-420a-94e3-a61dd4fb8a18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666317244, "uuid": "807ef8a6-62ae-468d-b63c-7fd1b3ee00c8", "value": "535c64ba8dabf90d7e6cb6918a63bcda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e330fc5-511f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343148, "uuid": "01216c43-fdfa-4c8f-addb-1265ff5b6a66", "comment": "Malware payload", "value": "2ed69fa2170e9d4570218d33f5f32d26", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343148, "uuid": "41fffb2d-a8c2-471d-8ac9-7e89a7ef410e", "comment": "Malware payload", "value": "bd7779e6100e07b3eae67bfcdc53f1f08468651240229e284cca60e2b953496b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343148, "uuid": "89313c82-a178-42c3-b871-386d986e6bfa", "comment": "Malware payload", "value": "5f6387ebb93d97b7a0a6e59a21bbd2a8bc600b10", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343148, "uuid": "3e36d735-78e0-47aa-81a9-dd199e0aa688", "comment": "Malware payload", "value": "dc9df8635acc15e4ed7bc768e6a0fa055018b2f0531cc4e529a1b153291b6717a4c37f6291789934937d090d0d91b6f4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343148, "uuid": "5eb7da92-7d3c-4d23-a5cc-107287172405", "value": "T1BC85E083FB14A86FC8F787368A7A062645165C568743D7438967733C2DBB9C05E8AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343148, "uuid": "54449cdb-0efd-4e83-825b-f53c600220ea", "value": "49152:gQrlfUHwgCVCBP68COeD/WbBi/gXEKqaS6gC7E:gufOrCV+P65O3bAGqaSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343148, "uuid": "36b81f00-0400-47c1-a1da-2850f2d7e806", "value": 1842287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343148, "uuid": "ea75d4a9-33fb-4a4c-9611-a4b8239dd72a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343148, "uuid": "65295065-fb60-486a-bd5d-45d04c75cd13", "value": "bd7779e6100e07b3eae67bfcdc53f1f08468651240229e284cca60e2b953496b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487ab322-50d6-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666311678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666311678, "uuid": "b89f1538-4982-4983-83ab-c9b5ff1a7c74", "comment": "Malware payload (AgentTesla)", "value": "b2f6a6b8d6b61d280beb7145ca34db34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666311678, "uuid": "73101508-7b19-4624-bc2c-ac4c7511f2a7", "comment": "Malware payload (AgentTesla)", "value": "be82b725c643ac9d30a503f2fd615d9bcd38ed9f0edbe53082d5743ded65e327", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666311678, "uuid": "89a8a8d4-9535-4c04-9664-b3424afc56c6", "comment": "Malware payload (AgentTesla)", "value": "85e85cfa30e12e1cb07024fe49a2be6622a9e073", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666311678, "uuid": "16b4771b-fcb7-4adb-8318-f7bec1c16678", "comment": "Malware payload (AgentTesla)", "value": "b5cd2c84a9c97ba995f54b9f071f9ed6aaf3eb430999483a1f1e846c422e496932c2a46d0e537a42619ec3e51a6b0a2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666311678, "uuid": "cbd64e0f-7b91-4b0d-bf72-780f971ad7d5", "value": "T1A4C1D51167D84337CEB6CB71A8A353501375E3009963CFEEACC8755FAC2AB510A22B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666311678, "uuid": "fc08ffcb-5e18-4352-9e43-a34c460938aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666311678, "uuid": "4f2c8959-a096-4cae-bcc7-6c0128a6a6ff", "value": "96:jutknIJtw+o9w+2jL3/umW+akMD6T/jle5zNt:soI0Jl2jL3/umWEMOT/he7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666311678, "uuid": "77251857-fcc0-43d8-aa3e-84167bfd6048", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666311678, "uuid": "c18c2730-cf43-446f-af2e-878d3c3e95ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666311678, "uuid": "b0152496-349f-4171-beed-dacde68c10e3", "value": "SecuriteInfo.com.Win32.RATX-gen.28731.10921", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0308347a-50fc-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666327883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666327883, "uuid": "9de896b1-6fb1-49b5-8ddf-fd2b0624f823", "comment": "Malware payload", "value": "e3274f0904005b1917b63c8c32061f2c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666327883, "uuid": "2b2d5ab1-b3c7-43df-b18b-7252a50c6108", "comment": "Malware payload", "value": "be8ab493b181637ec1547b7f9732d7b483cd9e796f3762b88f2d9fdcad9f38dd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666327883, "uuid": "d7142bce-67e1-4848-9532-a5e1333a0356", "comment": "Malware payload", "value": "25d188da5a7baf4b6dfe3fdae8a694855d093be9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666327883, "uuid": "82261041-a700-4825-8eb9-2749605bd062", "comment": "Malware payload", "value": "c8ac3253aa817070bcd95bbc9ba422a1848b8ac64d86cc347a7080749eb716476d9a8d4c52838ddbe205999547760323", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666327883, "uuid": "d1ee396b-5ded-4424-87b5-8fe9adf124de", "value": "T19354F160BB929031E27D0578F814837E8DCC2EB009D46ABB7354216E4AA59D1B73FE77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666327883, "uuid": "884df48f-c682-4b60-b303-6b00b9ed4289", "value": "d6d896896e42c143181e6972164c253d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666327883, "uuid": "e069998c-6040-4731-bf45-a13837652245", "value": "6144:6/xx5PUU6gmRVirhHpWgGBbJRmRIcTUM4LNYBBDlGZ:61169WsbeIcTP+uBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666327883, "uuid": "fdabf554-17d9-486c-b288-476f1dbd6414", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666327883, "uuid": "f6ed45e6-1347-4acb-9ecd-25be812984f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666327883, "uuid": "5257b005-6ba6-470d-bf73-23e3d9401c26", "value": "gorilla.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8bca9c8-5175-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666380130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666380130, "uuid": "a85c7403-b50e-475b-b0c6-9bd085c87fbc", "comment": "Malware payload", "value": "5858077c47e2f82f612b2ad4ac21e3ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666380130, "uuid": "4f30c414-4820-4dfa-8ed6-97c300d4e551", "comment": "Malware payload", "value": "bf10c7c4d99a0f38392a9aaa8f594015ab263f8720ab84b586cf5d9887a38cf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666380130, "uuid": "8e9a9981-f4d0-4067-830f-da1fb8f45fb1", "comment": "Malware payload", "value": "b75bc6706204813c28914ba2144b678c90c0e4e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666380130, "uuid": "8b1c2830-f6af-408d-8263-cd33eb843d05", "comment": "Malware payload", "value": "174a2b00c6c20916bc28863285c6566f25156edbf12f8adb6eeaab6e9109ee9be89816e41d3851c9efc254223014d519", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666380130, "uuid": "b9c448f4-7774-40db-a390-c37b5c8d60eb", "value": "T1A9740111B6D2C832D98299714021DF9791BBBD7225A0504F7F587BFD6E302931AB732B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666380130, "uuid": "5d969f88-e184-4233-98cd-fc7aeef7e320", "value": "bc5a05e947eb61731a4e3024a4f4b617", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666380130, "uuid": "3ceef6dc-e2e4-468f-9dc9-8414de071c25", "value": "6144:B6RLyBTAelkqD4uFz9bAouUqZ0gt1U26MLZSfs7ULgS:B6ReB8e7D4qznuUqZ0aO2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666380130, "uuid": "43db53d3-1275-46d3-a056-8b59e3662a61", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666380130, "uuid": "8572357e-6602-4357-8602-f10aaaea5ff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666380130, "uuid": "47c29791-ec06-4db6-992a-00e9c56bed33", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94adf3ab-5124-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666345307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345307, "uuid": "9d7d7515-7872-4957-a856-cf597db85e3c", "comment": "Malware payload (Mirai)", "value": "adcd839d930d7b972fa135eb3e3b16ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345307, "uuid": "3489168e-b6d4-4fba-a89c-fe04fb1fdc9b", "comment": "Malware payload (Mirai)", "value": "bf2b1f8649864baaebe045b08295ca4b405f0ed59ed63ee6eff4c209acebc974", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345307, "uuid": "7dc4c767-f3cc-43cb-afb5-d3a0a25d42b3", "comment": "Malware payload (Mirai)", "value": "716b4ae8e403fad9d9e950ffa7ab0500b216ce05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345307, "uuid": "09900197-aa85-46f3-8ac0-1c419654782d", "comment": "Malware payload (Mirai)", "value": "b80e54d2f8ba9743024184be7c6abeb22a2d1f4108db3a890403551c00d36e3c60d47625c0459ade0e19d31be4072693", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345307, "uuid": "93792e66-bad3-4c21-8d7a-074307c21c82", "value": "T171D2E03CEA6839A6CEAC3C7C01DE12E97C457091B34F454E02B6C6457B2675AF8A90E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345307, "uuid": "6310cf5b-20e1-48b2-8d0f-ca1896df8628", "value": "768:j1uUtLrVDsAp6tLMqTBpaIb6ogWEVCYlJbKWUZ:jbDs06toUPrbIWEd+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666345307, "uuid": "631e46f9-9627-4a38-9f9f-bfd3ebfe51ee", "value": 30332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666345307, "uuid": "ec91605c-6275-4994-b4a6-86ac150fde3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345307, "uuid": "f7f7bf81-11f8-4461-a6be-66ec2b5d8a5f", "value": "adcd839d930d7b972fa135eb3e3b16ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790218a6-510f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666336241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336241, "uuid": "00d9bf14-fd04-48f6-bc91-dc90d9d957ae", "comment": "Malware payload", "value": "873f2446be1b06adc9860969a6a0b06e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336241, "uuid": "10134dae-1ff8-41c0-b25a-8974edc978c8", "comment": "Malware payload", "value": "bf2f5509ce714735051669b6446e6f7c68f9cd62de589ad786c9572ab86c5bd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336241, "uuid": "3e91b0e8-77d0-4b82-830f-1eb64d39af50", "comment": "Malware payload", "value": "c1c478d4f55125e70faaff8645cfbee74cbb6877", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336241, "uuid": "ecbed297-2a8b-4054-bd85-d949e169cf89", "comment": "Malware payload", "value": "08a1149265019df2894b3b07a30b6e087ba7f0667853190abe2fac1af60460ed930801ede1bc84dc709e15c1259e9aed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336241, "uuid": "028669e2-dc04-4236-95db-4e08278cc430", "value": "T1DB535AA112D3035FD804E6B0D68D4594C9DFAE26385E8FD6940E397FDC39AA107BBC29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336241, "uuid": "6236d9d3-e02c-406b-8cd8-668ba7bc9a9d", "value": "0959c2c527fd27e2e3c5bd2636331b3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336241, "uuid": "354525f8-831b-461c-b34b-7aa55f71bfe7", "value": "1536:d1ep1tOKxVeU01JVlG9NSstFdGxveJh7LY0j:d10tOKinJlwN2ypj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666336241, "uuid": "030951b3-295e-45a2-b330-cca0bfd14f5e", "value": 60928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666336241, "uuid": "d0bdc39a-6c86-4e45-a36e-8646e6e16e2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336241, "uuid": "a6bedb5b-304a-487c-b3d4-c1c8f8766821", "value": "SecuriteInfo.com.Variant.Tedy.223993.24013.10699", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc3d46e-5113-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666338074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338074, "uuid": "e461811c-a274-4cf8-8ab3-2658adf30a75", "comment": "Malware payload", "value": "782cee7e86cb464d939c0d9e6c5c7a24", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338074, "uuid": "33a50ca1-c1fc-493d-9e1c-c8282c62416c", "comment": "Malware payload", "value": "bf4a2ecb6b10947bab6eac217c1f8882b9f85c67d296ed419f4a39c6951ad013", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338074, "uuid": "58a80dc3-7f7f-4ca0-8693-95b37a1e0f4a", "comment": "Malware payload", "value": "2849cd084b9d424fe7c017785ca3aed1e55b76d4", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338074, "uuid": "aea1cf36-b85f-4892-b2a6-e8fa617f6582", "comment": "Malware payload", "value": "2ceeb3a248e5e4944f256a01481e87f3cc9f9ab51570d8b250ea98d774cf3ef3477e78a63acd4aa5f31796e115e85db1", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338074, "uuid": "4457a74f-0aee-4ad6-b095-0b4829e59886", "value": "T109D17DC3D2E98865051F45D25C33EC968AC123216735329A427EC36D7F86DDE3988BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338074, "uuid": "6b5a9cb7-08e5-4845-a20b-76a474c74efd", "value": "96:TIRIU1aVrmHiYb6vDOId/G2huGdRG+q/8nLGC+VII5ldO3oxg2LAILXWdy2n:TTU17HEvSp2IGQP0GHzld9xgGAc/2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666338074, "uuid": "7b103442-730e-4bac-963e-37585b15c837", "value": 6620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666338074, "uuid": "ffe1289a-d432-49a0-bccb-2cad6aeddb4a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338074, "uuid": "76046626-e58f-48eb-a2ae-7856833be109", "value": "Haridsen Trading & Ind Service - Items List and Spec.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bcead03-518c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666389906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666389906, "uuid": "e49f635d-da8b-4d4e-a5a4-55fab0a583b5", "comment": "Malware payload", "value": "9d9edf6aced8c12db5a5f2889553a5e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666389906, "uuid": "368afd29-2ee0-4a89-adf0-aa8a66188cf8", "comment": "Malware payload", "value": "c06bdf22669c0c3575095612b52e1ad553de1515d18de9109d9172f916ce5bb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666389906, "uuid": "a47f7bb5-b25b-4f28-b095-520748968bcd", "comment": "Malware payload", "value": "d4502a9ec7b7fc409cc22f50c26561c264442dd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666389906, "uuid": "60bdb8ab-1c38-4043-8f24-79682fd8c5c4", "comment": "Malware payload", "value": "fa9d30863041f63fbb4154af0b8ce1942c9ff33ceb5971fe82cc0095c0c51fbb3469d41cb0eb7dc674adc16b2b7108fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666389906, "uuid": "16236396-5e3a-4ab4-9de3-dfa4f6c853e0", "value": "T1CB34E010BAD3C870C483153544B0DBA1497BEC7126685A9B3BE43B7FAF312D25AB6397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666389906, "uuid": "0bc7febb-ce9b-4899-9db8-0445c565c4d9", "value": "bc5a05e947eb61731a4e3024a4f4b617", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666389906, "uuid": "cd02b2ad-1646-4a36-b983-9ae20b52f45f", "value": "3072:RXDhGLbQokAYE5N06hPYJASxu3QVFjwoJk0hF4GsIS:1FGLb1kAY40AgAT36pwakeF4GsIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666389906, "uuid": "1548dc82-1dad-4940-aa67-853888321102", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666389906, "uuid": "53e5d544-c018-406b-9064-5adee3458026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666389906, "uuid": "973a2ab9-2cc8-4ff1-a7df-e28b44251343", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec00b78b-5195-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666393986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666393986, "uuid": "fd847ede-8745-40c1-a2b9-04fb99b65b2c", "comment": "Malware payload", "value": "7f8ef3a2ff7a7d4f551296698e8a005a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666393986, "uuid": "a063df3d-915f-4e25-bada-1fe201ddeeca", "comment": "Malware payload", "value": "c1bf9f51139db8a6617de3f172899299370bdd49aad7e506f3e02a02bec50f1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666393986, "uuid": "a448e1cc-25c5-430a-b0ba-1ffe1ae77d4d", "comment": "Malware payload", "value": "3629345309ef1033052473ebbd9b4042d4f74a1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666393986, "uuid": "5ddace19-2943-4c5d-8762-82599ee23954", "comment": "Malware payload", "value": "3ceb22e3e04a943a25bd65cf6b07769f1af0ba0109f599cf653572acaa740ec1571dc3ba76c33ef541e12232b5e1cce0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666393986, "uuid": "e7efdf5b-aa99-4d13-8f3f-fe2f06d17d17", "value": "T1FA74F121BA83C473C5C296754870E7A055BFF9702169598F3B583BEE7E306D25BB230A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666393986, "uuid": "c8a4cdea-d2d8-462c-9625-53751aff18b5", "value": "b7130d64e41e1f3aeb19371c8fcd9d1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666393986, "uuid": "3e6969d2-e342-4502-922c-41b5c64eb9c5", "value": "6144:vVELhYYYHyTOKMm8KN2R6LN5/48N/MeNCUaMwxAEkPFrCVrjQAS:vVE9YhHyTObK9N5/48SelbwXkRus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666393986, "uuid": "69d69b6c-71dc-4ddf-bfd2-ba6c50300fd7", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666393986, "uuid": "dc811c7a-3fa0-4a7f-af94-5d5821b597de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666393986, "uuid": "41fbebc1-61f0-43f3-81bd-83a41595edd7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d93ac4-5129-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666347408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347408, "uuid": "b33ad708-85db-433e-a44a-e7c7ec9ee509", "comment": "Malware payload", "value": "f2233c02cdcc209f493b624ff06654a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347408, "uuid": "a391a80e-ae41-4549-91ea-bd90e3d546c8", "comment": "Malware payload", "value": "c1da9847f734f3f35f6950613a51c1ffa9d4d43debc6302a7c6ce0f69a69f502", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347408, "uuid": "62064206-41c9-439f-9f8f-be593f47cd08", "comment": "Malware payload", "value": "5fea793ba7afb74c37ec447c47ae081c32a4563d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347408, "uuid": "2831631e-b192-436f-aa42-6337f258cfc5", "comment": "Malware payload", "value": "04f4f20594d97661dec5c31591dbe91ab97d76f1863f9187baf0bf7f4d885769b1c0321025a6e432b4f2132d4cc5c0fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347408, "uuid": "488e7afc-3923-417b-ae93-3a36800c37b8", "value": "T14043599102D7032FD904E5B0D68D4594D9DFAE22389E8FD6940E397FCC39AA117BBC19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347408, "uuid": "744183b3-a5a4-4d80-afea-317291db265b", "value": "73858c607b871d83732e8bfb406488c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347408, "uuid": "d13e2788-e099-40b2-9381-f1babccc30df", "value": "1536:b1ep1tOKxVeU01JVlG9NSstFdGxveJh7LY0hRWxfW:b10tOKinJlwN2yphRMfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666347408, "uuid": "9c5abb70-b215-4490-b823-ad009b4662e4", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666347408, "uuid": "5f073afa-d5e6-4482-8f1c-8ce0634ebc44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347408, "uuid": "ed367fea-518e-4876-8092-aa618816089f", "value": "SecuriteInfo.com.Variant.Tedy.223993.27642.8832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f4745e-5190-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666391745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666391745, "uuid": "47892ecc-69cd-4e47-9288-43d2844e3953", "comment": "Malware payload", "value": "98636e940474f0bebfcc03db617aaf36", "object_relation": "md5", "Tag": [ { "name": "2010m", "colour": "#F53636", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666391745, "uuid": "6da54473-7454-487c-b1a6-11b9688f1f01", "comment": "Malware payload", "value": "c25f5f86ab2aa4928dbc144a55a92ed5be6558787ac0f450d6411d85076547b7", "object_relation": "sha256", "Tag": [ { "name": "2010m", "colour": "#F53636", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666391745, "uuid": "6cd6176e-2d6a-4c22-a0ff-a9b1fbd2d9b2", "comment": "Malware payload", "value": "405dfe612512d6a0a04cb1fa8a9bd3238304edec", "object_relation": "sha1", "Tag": [ { "name": "2010m", "colour": "#F53636", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666391745, "uuid": "9c95dbf5-331f-4af3-a100-84e38d4c2e7a", "comment": "Malware payload", "value": "11f15719613efd97c087d0abad49342cbbc06e46aecf9a8d645fac16916f22628d965ee507c9c1e462ee6d99d0790651", "object_relation": "sha3-384", "Tag": [ { "name": "2010m", "colour": "#F53636", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666391745, "uuid": "3c76288d-4861-4ed8-9e69-346368b8747f", "value": "T17624DF0B980D5B52E8AD1275BE072D8C7F16165CA987B4BF00531DCB3BAA3736D4E06E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666391745, "uuid": "8aecabee-9666-4927-b861-2f432b82d67f", "value": "6144:KehHpGTRt0hgI/qm1Uz/SyQI9dTbmeo70uWoeJJggmA8:KehHYRt0Wax1ASrWfJaZA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666391745, "uuid": "5fd103fc-d275-48c1-8a66-3c88ce0113f3", "value": 213219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666391745, "uuid": "66131a37-1798-43cd-a763-741ca2528f36", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666391745, "uuid": "9831ff75-de7a-46cb-a3e3-e3b6b793fbd5", "value": "details.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc35962-50e3-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666317274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666317274, "uuid": "1709f4d9-dbc1-4fe9-a6a3-1e5e05d72900", "comment": "Malware payload (RedLineStealer)", "value": "776891428b5210d6c25e64e5a3791002", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666317274, "uuid": "fa0131e5-e38b-4bee-8968-391075ec9dbf", "comment": "Malware payload (RedLineStealer)", "value": "c33fa13197e5809c4dbf29cc449ee30fdef4ca1274be4c20b7ba5f25f9d5af96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666317274, "uuid": "40518aaa-48c6-46e9-ba26-72758793a45a", "comment": "Malware payload (RedLineStealer)", "value": "22e8a6164260fb042fdaf4c3762f98f1b94033db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666317274, "uuid": "3bbf1180-56a9-4327-b343-a213f0d3e303", "comment": "Malware payload (RedLineStealer)", "value": "1db8fadffbc6c3d6dc7d97597096df749f2d46a80e7096d1d7644dbcc60d13edab753450557e10ebbc6d6f3fd1c911e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666317274, "uuid": "68639616-a239-4bc4-bf3b-bd2d0b22b7ce", "value": "T1EAB401363AD4C032E6A711358854ABB0AB7BBC3016BA65973BD8167D4F707D2EE25307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666317274, "uuid": "fdc716ab-1e45-46df-abe9-076b840b0494", "value": "6146b67bbbd8b071bb2e0791b11c6903", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666317274, "uuid": "b57fcdd5-b65d-401e-b079-429b87507c14", "value": "6144:Vg+0RPPSLa1uyaOyO3baKngIoxB5f9RxEhPlRU5FgdYlya0UOLYK:VgHPPSO0yaGnlovVj6tlm5FZch8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666317274, "uuid": "8ff84054-025c-45c2-9dec-63af37215965", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666317274, "uuid": "7b4b99cf-0f34-4780-a70f-73387b459a70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666317274, "uuid": "0c732e1c-bafe-47c4-bd53-15ec1303dbe7", "value": "776891428b5210d6c25e64e5a3791002", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa78af54-50f0-11ed-9266-42010a9c0072", "comment": "Malware payload (TeamBot)", "timestamp": 1666323144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666323144, "uuid": "412bb707-f9b7-4ef4-ad5a-de6d7d14ccd7", "comment": "Malware payload (TeamBot)", "value": "45c256105d08937f2a5571b8a7827809", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666323144, "uuid": "bf96cf1d-bf96-4d86-a503-16e1c4031b75", "comment": "Malware payload (TeamBot)", "value": "c3a16379909ae505af3356c7d5be46cddbbb98be6a3a408d6d560b2046d1477b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666323144, "uuid": "b2323c89-b059-469d-be4e-cf6cf3b7e6f1", "comment": "Malware payload (TeamBot)", "value": "3228405c3507538b2417bf522b0c1e9343fdd58b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666323144, "uuid": "ce13d16e-207f-40ac-bd98-1e914d18a6df", "comment": "Malware payload (TeamBot)", "value": "8a181ab501fe9b7467382b861c11487fe2f37f23b848b749b24ec3d6cc4e3d373adcda34a8d427eec53039048f0f2c35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666323144, "uuid": "f305eb46-36fc-47d7-b47c-636dca23caf3", "value": "T1F314DF147492C8B1C4C445374468DBB4DA7B6A31F6B58A473B642B7E7F302D126BE38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666323144, "uuid": "17b6e739-1902-41e1-99c7-3890c5d9c83b", "value": "ee783376aeb5a6ccd1e2676f1a5f0e82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666323144, "uuid": "86a8dc16-254a-4842-a7d7-65b894b205a7", "value": "3072:cXOKILLxZOC5+uOYWKiBONZmEe6mNa7VjZYq0K/AMXXb0:YLIL9gmfWm/mEe6mNahjZYq0FCb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666323144, "uuid": "33101476-16fa-41f4-b2f5-bbf05fb92892", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666323144, "uuid": "5ff02c76-a8a5-408b-aaa4-c33e97bf7f68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666323144, "uuid": "48585a78-ce1d-4087-b28c-e164fa69171c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908a5d51-5114-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1666338428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338428, "uuid": "09961aa7-5825-41e3-86e4-50dffef7de03", "comment": "Malware payload (Stop)", "value": "e634525ae8aa58e72a9ec1b61aade37a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338428, "uuid": "f42ef806-1832-42ab-9266-6569665e7beb", "comment": "Malware payload (Stop)", "value": "c3b1fd53e7bfa4c081fa5ee393a9ea9cd3f52cde63664f7eca11c6b83a3dc55d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338428, "uuid": "271f2d93-4788-40a2-8d30-46b2bc4cac26", "comment": "Malware payload (Stop)", "value": "1ce5683544128ecec7aa4ba422381e0410b2fa5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338428, "uuid": "97b77bb6-6d75-469f-8153-e07b92122787", "comment": "Malware payload (Stop)", "value": "88e92288d65bd86514b90747c672951154fba56def206b9bcb58df7bc12104ae02ee4c76b65d2d6c382345a669fd80b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338428, "uuid": "2f425a1d-10af-430c-8162-371796ee15e9", "value": "T1DDF422293692D4B1C09DE6B45080DEB13A7AF9B9B7A48D83333C27BE1F7128157B9345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338428, "uuid": "9b974045-76c2-4533-b3f2-6a5f10ad1492", "value": "3e6038f4356f890c26b700ce3212574e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338428, "uuid": "7546cddc-4c30-47a2-9147-47803669994b", "value": "12288:eyq9M7BSZZlvrtIseaRl0TP/28cYkCvwvL3u9CXFIsdqihtxma:eNM7Uj5JWwl0TP/LcbUL0XFIsRbIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666338428, "uuid": "cd785649-a94e-4117-928d-bee158f62edc", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666338428, "uuid": "62da49c7-9bb2-4388-82e5-282791c64d63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338428, "uuid": "daa64239-7020-4c8a-9733-d1ce9a84ea3b", "value": "e634525ae8aa58e72a9ec1b61aade37a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f29ece4-5116-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1666339150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339150, "uuid": "83ec7fa1-ab8b-49d3-a5fa-973884adbf68", "comment": "Malware payload (SnakeKeylogger)", "value": "ba1063e8f20916b27c9c7408577ad2fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339150, "uuid": "f9d8f814-c793-4188-8d1d-b3118da33f9c", "comment": "Malware payload (SnakeKeylogger)", "value": "c4176082ca8e17ae498f26002b9a6608b1ebc07c2be9336599e761b6a0ef867b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339150, "uuid": "46b05790-35a0-48eb-aea1-f579effcb8f3", "comment": "Malware payload (SnakeKeylogger)", "value": "93942ac3d1fb712c866de9b429242f98f8e12abe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339150, "uuid": "15523bd8-0ea9-43a5-9cc9-8b91c0980b65", "comment": "Malware payload (SnakeKeylogger)", "value": "103ad91ef9c9862caffe800a50c0faeb9bb071adfbbdd11c991cd89cae264927e2166347735ea22ab6ba89a99a1732ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339150, "uuid": "abf79ee2-5eee-4767-a369-95de7e2af82d", "value": "T1FDD4121817CA8967CD6D4939E0326965033AC11BF452FBCF1AD177EA3F96BC0C40A6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339150, "uuid": "77308aa1-f311-4da1-a221-497be6e1e5a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339150, "uuid": "b53f1e71-aab1-4444-8a55-a90fd9a8d40a", "value": "12288:Y7/hvtELaS4p36pEvKtspKTNiISqIXCR3rqUVFVTLOQ:2VELaS4hAEStspefiXCZrb5TLOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666339150, "uuid": "e772d603-8765-422e-a3d1-7f816233f1d8", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666339150, "uuid": "a14520d0-8253-46a9-84db-fe73d9faeae7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339150, "uuid": "6c516515-da7a-44b2-b9f1-4e5121381c9a", "value": "NEW PURCHASE ORDER_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b565c31-50de-11ed-9266-42010a9c0072", "comment": "Malware payload (a310Logger)", "timestamp": 1666315226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666315226, "uuid": "aedfe2ea-795d-4153-95ce-45277a4aed40", "comment": "Malware payload (a310Logger)", "value": "0c7120a926f923404308474ca9f3981b", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666315226, "uuid": "36ce947e-d8be-44db-bf77-567cac3fd4a1", "comment": "Malware payload (a310Logger)", "value": "c486c3988825f5a4cc94a0b3172d7b20bf201774513ae2957893ae0a086aabf1", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666315226, "uuid": "e5a3eb37-a2a9-4db3-b999-7767aed3ac9e", "comment": "Malware payload (a310Logger)", "value": "9d4d4d5f64037d8ce49d4f22b525e17557fe9247", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666315226, "uuid": "21284576-d5c5-48fd-905f-0f37b349bbcf", "comment": "Malware payload (a310Logger)", "value": "44da96d261730921c8311c2e71f0f5ecba98f6b125275741bce60428f4d1a48a146f362ac79dbd47b82c2791147ff464", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666315226, "uuid": "0462f854-fe19-4c13-8491-c1f0ea82ec7f", "value": "T15393D7D1C2850AA4FDA51F369573AC19027BFEBABDB4A65D6859B4721F332C31022C17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666315226, "uuid": "64309036-2f4b-4016-af2a-cca04a1f4ee0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666315226, "uuid": "8da2a796-0185-4926-98a5-8ba0b804414a", "value": "192:2HtqaMqABEHYzXlPUN/4C/Cwuq7c7t9JdWqdjbGo1NeUyLy10EYVZpKkwSYWbecG:rUHaUI7WYLyLy10EyR9ZP4L2x+ZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666315226, "uuid": "a4ab40d7-6f95-440a-b8f3-6011607d8e39", "value": 96768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666315226, "uuid": "61477c29-5983-4308-a3b2-c27a6718706f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666315226, "uuid": "ef09161f-affa-4e32-b35d-6fd89356f8b7", "value": "cook.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b49658-5148-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666360613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666360613, "uuid": "d911557f-85ec-4be0-8e05-35ac6a34e46d", "comment": "Malware payload (RedLineStealer)", "value": "293725bce671026ada48b1f294db9508", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "fake Zoom", "colour": "#7321DF", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666360613, "uuid": "00ad824b-652f-444a-95c7-e19ac6617e54", "comment": "Malware payload (RedLineStealer)", "value": "c4cdf58a0c8f7f97d8a55adcd818f4ed64da13e715826e7ff7af8cc3ca46af7a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "fake Zoom", "colour": "#7321DF", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666360613, "uuid": "5194878e-c7c9-4097-8285-89d10cd666de", "comment": "Malware payload (RedLineStealer)", "value": "7fcecbed5b0616c48682eff9341e080f7f37389c", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "fake Zoom", "colour": "#7321DF", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666360613, "uuid": "197d955c-92cd-43b7-81fb-7cb0eec766c2", "comment": "Malware payload (RedLineStealer)", "value": "e6d8ae22e6efa980cc4fe2f072a9214cbdc163127521fc913a48e8a91a11ac5e24b3fe69656d162962f99a07d472a8a0", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "fake Zoom", "colour": "#7321DF", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666360613, "uuid": "f2aa163d-393a-4a9b-b3a3-56c197901195", "value": "T123E49F5FE8026F45C335D4AF198F99343CAB02BF9E82AF13756679439FC098AB02545B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666360613, "uuid": "56374919-ab7d-4745-ac1f-54075c37c413", "value": "12288:EN51syyGgQY59kPc9KZFavT8SLw8GRB1QxRIMKZdH1YnZ1WfGfZoqd:iVyzNkU9KfavgS88M1QxyVSZ1W+fZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666360613, "uuid": "19f4bea9-1cf1-4f71-b7c0-174a2cb0ae91", "value": 691759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666360613, "uuid": "f6c3be55-6f2f-4cd9-b398-4c484af2734c", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666360613, "uuid": "e9fdcd48-7f41-4d00-9ea6-03708b11562c", "value": "Setup.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285214fd-5162-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666371754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666371754, "uuid": "be285bfe-ac37-4ed3-90ed-2002bc4dac16", "comment": "Malware payload", "value": "0d46dd0f0b60f90963706aff893fd4ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666371754, "uuid": "8b1a77dd-18d9-4c5a-9ff4-87eb42e33826", "comment": "Malware payload", "value": "c62fad628cdc4b12c1ed5ff5dce30eb27637b8de6d33ef58ce039f5f7328d88a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666371754, "uuid": "79aa6431-16f9-477c-8bbf-64806f3150f2", "comment": "Malware payload", "value": "d5737c07033bfe26c77d67e987ced13f97e7f638", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666371754, "uuid": "b33f89c6-44f2-403f-828e-ad8c923eb5c6", "comment": "Malware payload", "value": "d1ec5fd827786a041f631e721115e81f08ec1ecd38607bd25b2adcf406f8813603b1d091969597fd25afb42eac651fba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666371754, "uuid": "b430b9f7-5be1-4b62-8554-3f7b902b0638", "value": "T140740211BD82C4B2D95250304495EBE23AFBE8B131A55A4B7E903BEE2E703D36677347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666371754, "uuid": "935bc641-3a12-4420-b3b8-70215183657c", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666371754, "uuid": "346e9055-4c6d-4e9f-89fc-114fd2e69246", "value": "6144:wOELbDYQRSwcBO9DfwVfxDf/j3vZw5xYHJhA7/zTm9xeRrF:wOEfD5RSwoOxfkDf/jfIxYHJhmce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666371754, "uuid": "50420d18-a5bb-4d6a-97ff-d5c7a2974ef0", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666371754, "uuid": "f1fa8bca-66d7-4ff8-935b-588440c00c23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666371754, "uuid": "f6be3392-ab7c-4b3c-8b0b-db914216409c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20a0bcc-5128-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1666347047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347047, "uuid": "3c670780-7cea-404e-a29c-5cacbfd725c1", "comment": "Malware payload (DCRat)", "value": "56d0ec80e05521254392da43c0df3f23", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347047, "uuid": "735cbb31-f425-4b6a-9b28-6505c0a1be70", "comment": "Malware payload (DCRat)", "value": "c64651ed20efd6af48a099aa9c27ac74dfb848bbac2ff1fc7a14711a94e0f16a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347047, "uuid": "3d89cd79-253f-436f-ab6b-8891d46283d0", "comment": "Malware payload (DCRat)", "value": "8a1a68641576a4d0068d4de2c3d027eed0ca92d6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347047, "uuid": "596eb63e-148a-4ecb-9008-e807af4bdf3b", "comment": "Malware payload (DCRat)", "value": "69420bf75373839fb01639030642c936f8d842b5e862fd952cafe724287149a545085682f638a78fa772ca6833effb89", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347047, "uuid": "78583f6f-af57-4dbf-a5ab-173bd1472b0f", "value": "T13524E026B582C7F1C4861178B314DBA46A7F783C26354B4723A42B6E2F7C3D1767638A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347047, "uuid": "a08e2923-a4ec-43bf-9efa-45acaf900a76", "value": "965326d499ea63bde30a73f94c3886cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347047, "uuid": "1cedf60a-9c1e-4d42-95ca-7cdf72d62d3b", "value": "3072:nX5UdLojjoa5CkKWtfaixgQ9creT/DdHjGpYoH2y3I/GFmd0Kn6XBqx9chH1:X2dL0sFk7f5mu/DdDOnH+OK0+I49G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666347047, "uuid": "41a2ae2e-8424-4a56-8943-a0d6671eac52", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666347047, "uuid": "6ed40ff8-6866-4d6d-a0ac-846bed0da4a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347047, "uuid": "626f1481-e292-4d4f-812a-0c209befcb83", "value": "56d0ec80e05521254392da43c0df3f23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131853b9-5181-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666385033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666385033, "uuid": "ddbee103-eb80-4bb2-8b34-fe9062bc67d8", "comment": "Malware payload", "value": "f66c2af72b1c9c8c88827250f51bfd12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666385033, "uuid": "334d2a10-1211-4ea5-a1fe-55d322cbf055", "comment": "Malware payload", "value": "c64b762308557295b6192c9a1d8193e94be595ec49fa953ca9971d555d1585f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666385033, "uuid": "33b01835-3baa-4d2b-b3f4-0acf0c5e2c81", "comment": "Malware payload", "value": "e2437f5429466e481b456b1063ce9123b6825246", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666385033, "uuid": "9028b260-4110-4d66-8284-81a19084a87c", "comment": "Malware payload", "value": "93d6946e4cbf35f1fb9a0663dd63e9536d91f61545c7a68f346fc2e46934095e6c317d3a21b88c3f24b791de791f312b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666385033, "uuid": "7feaa784-c9aa-4b1b-bb4a-efa995d56139", "value": "T19034E01D7AC2D871CC8705344870EBA4957BEC3256B5889B77A43B6E2F702D29BB7306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666385033, "uuid": "96524a06-168e-4b88-b561-1fa2b1233718", "value": "bc5a05e947eb61731a4e3024a4f4b617", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666385033, "uuid": "de243ecf-2e74-46b1-8689-d73a75a2570c", "value": "3072:/XD5ULaMk1A8E5dZbi1T8HjKE9idyE0Md9DTU0v6pNshiN1dShXS:vFULa91A8W0N6b9+yFQw0v2eASVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666385033, "uuid": "2100c478-9aa0-46af-93ff-b84878a11cd7", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666385033, "uuid": "bea90d7b-b8a1-47bd-8227-64e939bd8e9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666385033, "uuid": "09672467-2b14-41e5-8474-91a0eeb6144f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44626acd-514a-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1666361493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666361493, "uuid": "f4c582d5-1509-419e-a6ed-7027359c734c", "comment": "Malware payload (GuLoader)", "value": "6f43ada282d726138cfc876d364fc0be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666361493, "uuid": "3b5a095a-56ce-4e7d-8168-2a4bf6245cde", "comment": "Malware payload (GuLoader)", "value": "c6a5e1a06751fa24b4619968960698fb0ac9caf163f8b9b006abf54b1e3e6ab7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666361493, "uuid": "aecf78db-4381-4997-8c9b-9df8cbdf78da", "comment": "Malware payload (GuLoader)", "value": "c8b7420619f01418b543610692ad58142f4bb219", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666361493, "uuid": "be68485b-67dd-40e5-804e-aff1e7930bbb", "comment": "Malware payload (GuLoader)", "value": "341c084b13b4151f4330b69f45b6f0110e244b04afe416f41e4b0d545dbd76d0106a4350bdf545a0aeff08c70ade8ce2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666361493, "uuid": "900bbc6e-ca6f-4e7f-91a4-312ccabd7c8f", "value": "T1C6A4A022415692C5C53DC4F0CDFF7BF764624E17BFA22E3F0208B916AD252E948BD58A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666361493, "uuid": "8eb50bc6-8b32-459f-80f1-6bf56d174eb6", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666361493, "uuid": "55183016-a7d4-4546-9f4c-1729c6db1f12", "value": "6144:yGy4qM15TWJieVXJTzUrgxit9Y1BixKX0+w0kE1:y6qeWJBtJTGgotKiK/kE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666361493, "uuid": "17e4a37d-4ce4-412c-8212-bd4c303817f7", "value": 480856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666361493, "uuid": "bfcb1907-1f2b-49c0-9f3c-dd50a462d430", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666361493, "uuid": "e953dc12-5a08-4ecf-b373-741d74d7e4dd", "value": "3448s0657610032230b60113125662022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7acee356-5129-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1666347411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347411, "uuid": "c49154cd-c59b-4c4d-beec-aae932395ec7", "comment": "Malware payload (RemcosRAT)", "value": "41b6bdf6324808c6466607eaf7c9c454", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347411, "uuid": "abb19ef0-b0c8-488f-8c46-5568a582767e", "comment": "Malware payload (RemcosRAT)", "value": "c6a7b1ab6db84933aad4c59151545e217ad158dbf513d93c32498967bf92d0c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347411, "uuid": "7b0c928b-94f5-4430-bf54-342c08368620", "comment": "Malware payload (RemcosRAT)", "value": "8089c45e426e0b301a8944c254d4c7659060bdcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347411, "uuid": "373c661d-3933-4a05-a7cb-013b98204a4c", "comment": "Malware payload (RemcosRAT)", "value": "0a3bcfa2ba7b38eb017872bb11660479383bb6d34088b05f68686a4b6b46c3360913dc1c5f9ca0dd6c8ec09e82fcd44d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347411, "uuid": "c829ed39-ebba-4ad5-831c-fdabce03fad1", "value": "T1C332744FC3C9AA72C93B473EA85692B101947755DCBD8F2E2474B953B8337C20521D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347411, "uuid": "916fcd30-76ff-4ee0-8eb4-5b791e05ec32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347411, "uuid": "7e4df114-e8fe-42f0-be96-8f5995e8a059", "value": "96:jC0vxrkAfFxgcWpDLMrfWYAttwYCbIbGXlw+q5EwExot1YdaKNU6Ny3jabFnU:uap9xWGfWYAcYCoGXC+zecyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666347411, "uuid": "c1a1bf33-206b-4ae3-8d5a-90a61b461acf", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666347411, "uuid": "dde5e4c2-acb0-4ea6-a9a0-0e380f1abd28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347411, "uuid": "f8a87e47-37b3-42e7-91c4-6b019697de16", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.GYT.gen.Eldorado.23568.23625", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289eaaf5-514f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666363594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666363594, "uuid": "879af499-a6c0-460a-b7fd-7d0a902f8bbd", "comment": "Malware payload", "value": "af31b120497e9ac51e03b5653ae40262", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666363594, "uuid": "af657218-ba9a-4c5e-86b4-c35c35394c33", "comment": "Malware payload", "value": "c8c0137c70f3e3f55b1800b6742ab7032e357e6622d1d31a93267d43ef63b94e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666363594, "uuid": "a8255d83-6004-4725-ab44-bf8010d1799c", "comment": "Malware payload", "value": "95749cedb1679ee6994514d4c41d03ed152dfa73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666363594, "uuid": "b045b667-bc7c-49c1-98e3-ae1dea054514", "comment": "Malware payload", "value": "281743c15b653bf23a572c98cb96ea6ea25bb9be6bbe2bbf095c2a9e243d53a7b3345c9a054c0355008023d58441703a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666363594, "uuid": "0a730a4c-f429-4a68-9bfc-ae63d50be137", "value": "T12076333576C9D07BEAE611738B98B798B4B9F3506B324AFF221A415C4E3CA0CA41774D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666363594, "uuid": "24dc85fb-5924-4b47-bd75-a2f39362fde8", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666363594, "uuid": "f71fdb07-24e3-4f4d-951e-f0dc4e82b872", "value": "196608:91O3DQocuJ5slIqo0W7j+fun3ph+wGPh6Hx4Ag+ovxsSu4r8S3EZyHG:3O3DQojSOV0W7j+0/uh6HmA6sqhUZym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666363594, "uuid": "5233acd8-880e-4a7c-a477-36bd0d22aff1", "value": 7636130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666363594, "uuid": "5701d5b0-029f-4180-8bc8-0d0eb6249b90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666363594, "uuid": "6492408f-a408-4aed-bb1e-c3961a402c80", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410c64e5-5138-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666353756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353756, "uuid": "fe0ee2c9-bc98-4587-90a7-3f392c53c5e5", "comment": "Malware payload (Smoke Loader)", "value": "1e61f1d36a31fd04b78bd523bb3fae4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353756, "uuid": "38ee7cbd-b620-42f1-b08e-8aa8f728ddcc", "comment": "Malware payload (Smoke Loader)", "value": "c96ffaa4cec0f36a9ad216008b6dcc4ca6149e03be7d449ac5a95dc375bc4318", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353756, "uuid": "3308be8f-0a4a-4538-8ed9-c97aa5473872", "comment": "Malware payload (Smoke Loader)", "value": "fb74dcf0c06ea4cc6c52e5810a0b21a210ff7427", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353756, "uuid": "b2dbd9ec-970b-4103-a1a4-515d7a6cdfe1", "comment": "Malware payload (Smoke Loader)", "value": "b26cd4779045f38978441cc1829c4fb6305c594b55e6346b52d2a2c56f2df21fd5312b0f6f54b2305a59622de3a1208b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353756, "uuid": "471bb530-f46c-4da5-b433-79fe276b037f", "value": "T10224F11179D2F4B2C55B0C718828CB606A3FB83261B45D5B37ACAB6D5F3C2E166723C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353756, "uuid": "c1564a96-76ed-4d61-91fa-743d4b880774", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353756, "uuid": "d1b9e65a-29ad-4099-bf8b-7056b61c9e8e", "value": "3072:SXmBRsL4VAQgz5ZWmp6iuGQgd+T7L4FRvTjOg0K8k5+xa6:SCmLEAQg3Wmwi90+dTjOg0Pk4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666353756, "uuid": "ad97733a-9ce5-42e7-8060-e97085910c1a", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666353756, "uuid": "8367c33d-b1ac-46a2-a326-4ee861c8d77b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353756, "uuid": "eed90995-0f2e-4094-84c7-d011c18496eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0bbdaa-511f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343257, "uuid": "c4c84505-1017-485e-8494-0825db2892db", "comment": "Malware payload", "value": "50a9624b74624f99284b417b732b82af", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343257, "uuid": "c98459e6-4a69-466c-8b2d-a7949830a572", "comment": "Malware payload", "value": "ca730b8b355e44919629a958d940e77eb1b4cd0c1bbe2ab94a963222f2723f57", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343257, "uuid": "d8a9ccf2-ae9a-4aa3-bae4-bc0452d18521", "comment": "Malware payload", "value": "628d0bf29626fca8b66053597e310b2f842172d3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343257, "uuid": "b2800582-bae4-4b01-95be-c3632489327c", "comment": "Malware payload", "value": "6f98fa07db377c56b11d8ecec488bf324f1787645d96d29729d5dbd2151cea711d73f28b96d6b3a9f7f56c48052421d1", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343257, "uuid": "bbfb8beb-dbf8-4b7f-a448-873c77b3c15b", "value": "T1A0A612D2F356B8A2C8B2853642F15236E55EAC1D8747E30A352DB17E4FF3AC02544A9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343257, "uuid": "74b866a9-e46f-4d20-bcb8-a52222e032c7", "value": "196608:cZnPsYfRVZ7L2Lj1GQSlUWYE8Hl6t+QekSuw6Yfp:cZnBz0aSTHl6t+f3uXEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343257, "uuid": "c04fff30-1bf4-4232-ba6c-7d169c1b53e0", "value": 10261434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343257, "uuid": "1eb48d2e-f5bd-4d4f-8b26-b4b23a9b3795", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343257, "uuid": "ceb01060-aed5-44b4-a20f-247e38aed70a", "value": "ca730b8b355e44919629a958d940e77eb1b4cd0c1bbe2ab94a963222f2723f57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54219517-5117-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1666339615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339615, "uuid": "fc1f2044-a8ed-4aa2-84cb-42fade32e298", "comment": "Malware payload (RemcosRAT)", "value": "52dd46591005c5437119f8e8eed97f98", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339615, "uuid": "f33b0ae0-fb18-4731-83c5-677c2026f164", "comment": "Malware payload (RemcosRAT)", "value": "caafd5f6fd68c94051e4de475c80f51842e89b3aca2ee2db705a13b8ebd8e310", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339615, "uuid": "a9aee570-1a7c-48cc-8efb-b9ba543f72d5", "comment": "Malware payload (RemcosRAT)", "value": "556d66f348c31d0fc1803f0c1b0ee9f8ef3a1050", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339615, "uuid": "710424ef-f838-40c1-8a01-40f0d9539e89", "comment": "Malware payload (RemcosRAT)", "value": "91df3003ba590811c4f98428b0510219cace96ab25aa34b69279f5dbba3a53e730d795f0815de2cbf3df694c8898f4ec", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339615, "uuid": "e0885569-8ddb-4532-8caa-54d13643cd8f", "value": "T19B21E0AD698BF15C5F621F36971B840978E05A02B73C8550B08DCECC76ACB35C9A58BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339615, "uuid": "5e48a146-8b03-4446-b49f-131aae642b71", "value": "24:540a/pGBNUmR7mcO9TeI3HXyHVcPRFfphFxDX4EHSnVeWVAkb7q9M/ncKaCsE8t7:O0asZO9TeI3HC1YRFfPHPH3kbO9MECsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666339615, "uuid": "4274035e-bd54-4bec-a612-a7d74cf71f70", "value": 1246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666339615, "uuid": "f89e2444-f906-40fc-bd10-24e72356f608", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339615, "uuid": "d1009ebe-081a-4d93-b3fe-c73bc2c8e848", "value": "Shipment Deatails BL and INV222010736.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d724e9-510f-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666336367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336367, "uuid": "8b3f4de7-5561-4e4c-bf73-541ae2514448", "comment": "Malware payload (Formbook)", "value": "b52acb7592883b78298040e7cfc42781", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336367, "uuid": "a4e06329-36cc-4d74-aaf5-bd235c30b226", "comment": "Malware payload (Formbook)", "value": "cc5d301b7f301c29f99b304c7768abd2abbfbdd1e3af977b16de6cac6fe5a4b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336367, "uuid": "c7ec43d2-d123-4592-a57a-fa344b1103a9", "comment": "Malware payload (Formbook)", "value": "40ea494c4d558a2d45708a868ec161e5b6cdb909", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336367, "uuid": "b92c3b90-ff00-46fb-9386-2ad953068a13", "comment": "Malware payload (Formbook)", "value": "d7fbdd9ae7727f191bdd695591bd6a88f3922fd058c32ceeca2d5988c6e8f62059b591525c71c61811ab1e3defd65246", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336367, "uuid": "2da37895-4c91-4c07-8b43-01eb7d0a5d03", "value": "T19CE4121C57E84E23C6EC4775A0121A190376C117B88AF7EF5CC629FE9E03785C94B9AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336367, "uuid": "45d9801a-c30c-4952-8b7e-3603259b4ca7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336367, "uuid": "85e731ba-ccb0-48cf-ac0a-c34431460a60", "value": "12288:XmKWdmC2IFAF06mw/M29piytTEt+oPM6UnA47bpTArbSDo/b6r9aSyO:XmKWdr26AFh49ytojUnAKTArbSDlZryO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666336367, "uuid": "8c8ab3cd-9eeb-434e-badc-f6b15ac10874", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666336367, "uuid": "99cec58d-a706-4cdf-9d49-391a1283a916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336367, "uuid": "5a8766f6-e648-41d4-9282-8533e55955e4", "value": "SecuriteInfo.com.Variant.Tedy.224685.17802.25556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e4b1bd9-5121-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343820, "uuid": "b38f0228-4b34-4e86-be4e-d50be4114a30", "comment": "Malware payload", "value": "cc88f21406eaeed70a890f53e57c98b6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343820, "uuid": "4b37f6eb-0e68-4cee-bc8f-09f0f0b9f4dd", "comment": "Malware payload", "value": "ccef7ca705b899fe337eda462d38216c414c0cfe41052dec102c8f6d8876ad8a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343820, "uuid": "ce36df09-1ba8-495c-acbd-1872199d3c95", "comment": "Malware payload", "value": "1d497ae9e273441f1e800d3efafbf50119dd3242", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343820, "uuid": "5b0abf17-3ff5-48e0-bb6a-b56cc922cfe2", "comment": "Malware payload", "value": "209ee50da74abba0bfef367998bd29cb29bf3b03da45623233116f6f5860dfade1ef7abe96edbfca6edc0af25ae1b327", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343820, "uuid": "6454164e-9366-40be-8671-57543e30d46c", "value": "T10FF5F193F7D9E92BEDFBC3326375092A610A8C558743E3431981727E98B79D04B46BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343820, "uuid": "ebbc8d00-f436-49a2-94d2-4b6ccb5d4b01", "value": "98304:qUKK7hLGq0oAJBhjVNRqkfWj7kvHd66RyS97FcO:XKKt7cjVDqifySzcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343820, "uuid": "33598a2e-33c5-4faf-936b-e1deca07d70e", "value": 3407988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343820, "uuid": "335b24ea-f254-48c3-b1f7-a84b6a5c9a27", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343820, "uuid": "d0aa58d3-0eb2-4bd8-bc29-7dcd1f809b0b", "value": "ccef7ca705b899fe337eda462d38216c414c0cfe41052dec102c8f6d8876ad8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e5d025b-5148-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666360678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666360678, "uuid": "d47ae014-58d0-4e76-8121-86f46868b1c6", "comment": "Malware payload (Formbook)", "value": "06ce837a7f7b572f455956a31be3c466", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666360678, "uuid": "7975d1f0-3444-43ca-bdd7-304146a38739", "comment": "Malware payload (Formbook)", "value": "cd00b8251cf75f07ab9f96e3f5c296f3fbb96aa6ac2658348d1c05e45ccd71c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666360678, "uuid": "90144a13-70ec-4ed2-a1af-edee3752fc79", "comment": "Malware payload (Formbook)", "value": "79794d9101eb327a3834325e96524c7b5a9b9573", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666360678, "uuid": "1cae07db-b562-471e-830c-6f04a182f413", "comment": "Malware payload (Formbook)", "value": "884929c74073f1e456c810d4a9c927328224e7bc2890476623eb5666a967711d5001eae5e66ae5d0c522c28a6c810589", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666360678, "uuid": "4436eba2-e67f-4740-bce9-f8e3c11bb4e1", "value": "T172D4DFBEA2549F93CD3C51B6D8100641A3F59A866E12F78F7ED331EA00D2F4E935690E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666360678, "uuid": "3da4b11e-ad7a-43e9-855a-6ddf973cca06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666360678, "uuid": "36ff3b44-f8f3-4fe9-a254-6021298f805e", "value": "12288:ZHdqM2ZcozzuOJQeUIRaClJG7SIH2f00xP+1eVhQVZ45YUvB6sF:zq3quUI0CjGZWZFcUv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666360678, "uuid": "4c2ac146-56ee-46a0-801d-77766ace7948", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666360678, "uuid": "372ea963-9fe9-4f3d-9612-02330a04d766", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666360678, "uuid": "e7c6520a-2683-4dfc-95a1-622aaab5e5c9", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3468c53b-514d-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666362755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666362755, "uuid": "64ccc130-00ca-46df-a39b-4abb91a6f873", "comment": "Malware payload (RedLineStealer)", "value": "956559e15ffea5b93d328be46def91c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666362755, "uuid": "3af4ca60-4038-4cc4-a808-b7816bec6dde", "comment": "Malware payload (RedLineStealer)", "value": "cd3ec3921f09dbc5391d423dcb50e4cb4669bb1eb9741167626243d630c4c7ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666362755, "uuid": "8ae16993-0a6e-4803-a0ac-0d68a825995a", "comment": "Malware payload (RedLineStealer)", "value": "c7aa318ae06b0065ef4e42a65e02347656b83721", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666362755, "uuid": "976f3d7b-1676-4eec-b8b1-99b7af9bbdd0", "comment": "Malware payload (RedLineStealer)", "value": "65997eb36640dc1c4651c332dce8e561d69e4de2cd8e416edc9fa1178365e34a48e03ef8f9d10b72c41037929e4b51f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666362755, "uuid": "018dd087-6992-4486-bbc2-ae7c6584c888", "value": "T1F36402107A82CC71C8C695769060CFE22EBAF53226764D8B3B54376E7F202C166F735A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666362755, "uuid": "ec0649f3-1c22-44f2-8ac3-fc06c0ce4901", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666362755, "uuid": "f34fbb9b-ed83-44a4-bb37-d385b1115b1e", "value": "6144:nv0LdHFQNiDZaKV5iq9wwhf1YqO7b/Jo/KOn1SG1jmcko3ka:nv0RH6NYZZEq9w8fyqWbhw3S+qckik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666362755, "uuid": "9a864803-b93c-4838-ae35-144f0a00b452", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666362755, "uuid": "bbf1984a-e535-4973-a170-9b84793b717a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666362755, "uuid": "24db64de-ee69-4712-999f-bb3d0f02ab70", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47bcb88e-516d-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666376531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376531, "uuid": "09711195-3f06-4fb9-b047-ca76e270b24e", "comment": "Malware payload (Mirai)", "value": "05c6b8cbea178a7b73db7fbfeb75c577", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376531, "uuid": "cb74c230-ef9b-4f17-84af-240cba4cfb80", "comment": "Malware payload (Mirai)", "value": "ce92a608f1723343d9569b8243d6803d0c83bc68325d2466111227ed3b725df8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376531, "uuid": "25def9f2-1cc2-4b77-9813-7391687f93ca", "comment": "Malware payload (Mirai)", "value": "176f8f6504f2e30e0abfe88dca4a23a5eada4259", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376531, "uuid": "e30c1eca-d35e-4c7e-9c7c-e082a07caea3", "comment": "Malware payload (Mirai)", "value": "3ee3564c933e4d469efb0278a750adf8f12e61f9fa0934ccc646d7ad3054d87fbc685ad05a612a057fdaac4713da1d3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376531, "uuid": "ff2da196-7602-48eb-a645-2c3dbdf66307", "value": "T12F334AC5AB93DCF8ED1506713177EB328B77F03A612ADAD7C3899523A842B01E50729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376531, "uuid": "e6238358-eb40-4868-869d-13cadb9af709", "value": "1536:3hSgebzgP/AY+39afOsMJRdnhN/6OQ6xpwhNbr/+:xZebkP/Ad39UMJRlhNyL6bIbD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666376531, "uuid": "50e7e31f-8150-443d-9c06-f9dafa9b1baa", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666376531, "uuid": "daee3398-e16e-4767-8723-4193c892d75e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376531, "uuid": "318caa5d-1a6f-4fa4-babd-375c44bf2c3f", "value": "05c6b8cbea178a7b73db7fbfeb75c577", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f18c6e-5158-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666367594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666367594, "uuid": "f6098dc4-0862-460d-b601-736fde9a32c9", "comment": "Malware payload", "value": "b633741212383e5077cbf1e457ff47ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666367594, "uuid": "18f5487f-e213-4b28-b391-68c0abd69557", "comment": "Malware payload", "value": "d26ad3f25f97b7de0014864a9a8164da6346f506ab19f6fc09e15344b5e57088", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666367594, "uuid": "19d91549-228b-45ab-bcdb-cfd1687d89f8", "comment": "Malware payload", "value": "7bb8a7668bfde76bf33c412749c1865182ba7457", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666367594, "uuid": "6d6f6bb3-074a-4636-a8a8-088e822715dd", "comment": "Malware payload", "value": "693541e288572885cb5a25c211d954b13cbbdc2882a93f6c54058443e3b96cb66fdc6e1b1b0331f5e5504285cded5d01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666367594, "uuid": "6d36a22d-1c1d-4a54-b252-694f611e002e", "value": "T111463A51FECB40B6E9031D3154BBE26F27316D058B24EB87EA047F2AE97B5A11D3221D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666367594, "uuid": "4afbcc64-a830-4ded-a2aa-ca56ed2deae4", "value": "49152:fFehQIFSFhaQEedXB8Cg697hk1LlkDzeWL7EMcsjylRnBb8cTiR+JE4khQ3eUEKF:fFeyOoaQEIDzGMpxoZJ2VAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666367594, "uuid": "eb240670-aef7-4503-8184-1bf287148af3", "value": 5361664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666367594, "uuid": "00180a03-17e9-427c-b799-8ee5c27c3d12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666367594, "uuid": "e1b22636-6676-460c-859e-ecb1a23ccbee", "value": "b633741212383e5077cbf1e457ff47ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05854264-515b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666368689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368689, "uuid": "d28975c3-1d3c-42e6-9399-d96f82ce7323", "comment": "Malware payload", "value": "cd99de395a185e597e90049109693240", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368689, "uuid": "0158edd8-4627-4b4e-a69f-e24b3c6c754f", "comment": "Malware payload", "value": "d3b41afb03798c53bea9cc1f592438556c83a570526930a7b3025a7bcccd15d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368689, "uuid": "a5f2f898-59b3-4675-902e-d36c63373502", "comment": "Malware payload", "value": "daf4b8f554d275fe9a1d29055d2361f4d3e177e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368689, "uuid": "94403f05-f1d0-4c2c-8af2-0a25e39c1974", "comment": "Malware payload", "value": "e886f264375854b506d56ce9f32985672c29fc6c903a6b5c8434c3713ab96b6c6c661050d2f2fea55d18035540afc4dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368689, "uuid": "c6ace56d-e147-4ad2-a6df-73284c65ec28", "value": "T194740121F9C2D872C88266344C74EB6655BBB8B23175550B3B587BED7D302D34AB231B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368689, "uuid": "9d2f0210-847d-4a75-a08a-05de6bdab151", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368689, "uuid": "84bfc411-15c3-44ef-b872-e327061977e0", "value": "6144:KksLANCQEGfRkerqo9mn/bsdAO+iWFkmhP:KksENfE0Rk+0bsdAO+iWfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666368689, "uuid": "0f69f537-e16a-4226-8454-6856d8b1465c", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666368689, "uuid": "237b1260-054b-40be-a8a2-051cc070a092", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368689, "uuid": "5bdf4db3-a4d0-4ddb-bdd3-0ff918b9e2da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b210824-5132-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666351250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666351250, "uuid": "98c646bd-584a-4e60-a4ca-8bf7983ced1e", "comment": "Malware payload (ArkeiStealer)", "value": "192a51ce49ce579f5816a8a75586e048", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666351250, "uuid": "37c84796-d7bb-468e-849a-571dc0466435", "comment": "Malware payload (ArkeiStealer)", "value": "d3dd1a4eff9a3371d839a9cbdcd040edb03c5ac3140e142e6bf398905a9afad7", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666351250, "uuid": "0a28e6f9-b805-44f1-b5b3-5aaa885787b7", "comment": "Malware payload (ArkeiStealer)", "value": "f6074369b40edd8210a87b27cc0f20644def41e5", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666351250, "uuid": "e17acf69-c414-430d-9821-d9b3403edf6c", "comment": "Malware payload (ArkeiStealer)", "value": "5cb2128df1dad457b03cd4bf542a8b8eff5678715f19756e7142923168fd681d64748689519cb729a0b7911f7875c235", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666351250, "uuid": "8a024262-1e93-4123-babc-a3b260d36e61", "value": "T16A463303EE6D14EFF17C6C7001292E61A2125DC9D867899697FA3E8DEB3811BD8771C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666351250, "uuid": "39236529-0bc3-4448-8c10-1a2df10af100", "value": "7a3dc68bf97145dbfa49d8d347b80f89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666351250, "uuid": "197f5c3e-4616-4c09-881e-db2a5ff2b2ae", "value": "98304:BN5tzNYV3fp6KqaEtnyPh+ePqMuax7E/hToelmYigzFUcu0rln0aPE0:BZRY1fp6b0Ph+eLpRYhTonYigz2gV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666351250, "uuid": "6025adc7-c2bb-4517-a99f-66a4fcc8551f", "value": 5570744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666351250, "uuid": "63cf49b1-cf15-49d9-853f-9fe421db68a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666351250, "uuid": "de0a4ea0-a973-49ac-b99b-9b65368be12d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b71df2-5117-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666339539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339539, "uuid": "f3f4ec54-9162-4c54-ab06-e9e6d65665c9", "comment": "Malware payload (AgentTesla)", "value": "effe007a3406d1b994aef01fd892e486", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339539, "uuid": "9bca4de2-0a15-4f58-b547-d97c89039dcd", "comment": "Malware payload (AgentTesla)", "value": "d43fb9447a3dd06c6c43c2d793288d8b89fff1bd3d5fe58ed14b7b3a0ba7c34c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339539, "uuid": "4a61df66-0746-4e8f-b356-e30d31170153", "comment": "Malware payload (AgentTesla)", "value": "55b19f4419834c8a23557d529ae452115c41a175", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339539, "uuid": "69d8d286-7000-47ea-b0be-2688e2e9063b", "comment": "Malware payload (AgentTesla)", "value": "ee6e1cf038f58e67c3b8bd5d9eaddf1e66d29ab16c05aad4e7472bde0869622a5592e35de6e0888f105c230bd55d8300", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339539, "uuid": "1650ecb8-6594-4d83-a736-7eaa2d73c740", "value": "T13D25BF55BECA6EA1EF7F43B78361DA3D1226736D03A16ACF260305993951FC2443EA07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339539, "uuid": "e6aaca88-795d-4891-8240-3fc4bc37853a", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339539, "uuid": "978d6d96-01b8-40cd-a4fb-43fb038126f4", "value": "12288:Ix2s7IMrR4yVld8bzbBSrekOQwTOjt0cjk2c753pW6llKtElJrn6jitZyqZGDxt:Ix7PkX10BPJ42YlstCrsmIFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666339539, "uuid": "79888520-f3cf-4142-bc01-c18f3314576b", "value": 1007616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666339539, "uuid": "d1ab42dd-46d5-47ad-ace9-d1f04598e262", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339539, "uuid": "8b257162-1262-44cc-89a5-09fb3e5a909a", "value": "Purchase Order 247463.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46387fea-5113-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666337874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666337874, "uuid": "7cda68da-bff7-4794-9e32-5eb443252ca6", "comment": "Malware payload (AgentTesla)", "value": "e9818337544c22a50868e160f250d087", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666337874, "uuid": "d631aa65-c3aa-46aa-a2da-8c311607b622", "comment": "Malware payload (AgentTesla)", "value": "d45e5775d0d833995cf846f564dc8185ffaa53706a8c27cca07c941b1aaa42fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666337874, "uuid": "aaf6b70f-1c2b-4e3a-b3c0-195e3ad60c27", "comment": "Malware payload (AgentTesla)", "value": "08d5063575566b605703e5876a2d1f6df00cf9f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666337874, "uuid": "62d9cba3-7bb6-453e-b383-ef60b83b3020", "comment": "Malware payload (AgentTesla)", "value": "d4d436759d7c1d21c401a3bbdc42d744a6caf3861d366a49b7ab2b10221a8196e6200063cb797bfd63769784cc37cfda", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666337874, "uuid": "be0c0f01-f89e-40f3-bce0-5ae3a10fa765", "value": "T1B4E4132873EB5F63CA5E4A75E01353540371C226F08BF7975AC265FD39233C88446BAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666337874, "uuid": "773f5ba7-7270-4010-a594-0d9a64d84092", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666337874, "uuid": "b05c1951-9a71-4af0-92d9-ed5ce7688203", "value": "12288:Pq6oO31OnexIv6hqRBo7HKy97SPfqf8CnnX/YpLoEKmMxJGBgGbRk6C9K/P2xzqQ:PiMXIv6hqRBojKy97Vf8CnX/UhMWHGXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666337874, "uuid": "78884652-094f-4cf2-92b6-8579b1745cd7", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666337874, "uuid": "70cbdcfc-1dff-4c1c-a233-ef3fae314fa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666337874, "uuid": "ed3326a0-3ee6-4616-b54b-897344793d7c", "value": "proforma invoice.pdf.z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efdb3314-50f8-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666326562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666326562, "uuid": "e127adbb-d03a-4c9c-924f-b12e3be6c258", "comment": "Malware payload (Formbook)", "value": "fd66bd0d7e6f36fbafda1e5f874cbda4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666326562, "uuid": "f9c0721e-30fe-431d-8cd6-dd393d16ba88", "comment": "Malware payload (Formbook)", "value": "d5b506a06cd81e98b0ac084d04cf2eeb448dac247c0fe6570f5986c4dffd9554", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666326562, "uuid": "3c6c05b7-936a-4b56-9da3-878acfcc1cc2", "comment": "Malware payload (Formbook)", "value": "f4d1da7cc4d985665b7ed39699f3da088e0c35fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666326562, "uuid": "9ea42d0d-44e7-4edf-bda3-1deb8296bd63", "comment": "Malware payload (Formbook)", "value": "f7d1c76ace38f249aa0f0c0403891d71c00f492164d2572959243f603be63bd5cc55cccbdfe13516e4ccabf9900e40f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666326562, "uuid": "052afb00-d93c-4914-a8bb-1a46415bfe56", "value": "T1BDE4121C47ED5E69CAFD077AD16A9A040736D12DE002E7CF598C69DA0FB33848446ABF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666326562, "uuid": "b1ae7c19-40a8-4d95-9bbb-5dc76ffa97ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666326562, "uuid": "51cc757c-06c1-4e17-9ffe-083bec769012", "value": "12288:QIUwFRq3NmQPMaxXSa7yYOUUNMxOso6KabnVScWNJ+tPCOf5ultQ:hC9VksC7YOUOIKabnzWutrxcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666326562, "uuid": "81072dfa-b0c2-43ce-bb6b-1a9a3ea47f5f", "value": 664576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666326562, "uuid": "1c07997c-fead-4d23-aaab-916b1fcaca9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666326562, "uuid": "b4943cf1-ea57-4c6d-802f-0cf0bb0231e2", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.DLB.gen.Eldorado.21838.2483", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b22adb-515c-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1666369221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369221, "uuid": "b2e09876-a87b-405d-ba84-e25073bc45ae", "comment": "Malware payload (Stop)", "value": "456ba4280563e40da987d3402b777dfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369221, "uuid": "05e61e7e-4517-48ed-8cd1-3a38c9f4d157", "comment": "Malware payload (Stop)", "value": "d6aa3330313aa65c88f3ede92b2da692cb0682a27003da5125952431d8c89e3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369221, "uuid": "f2637c41-fcca-4e6e-95f2-d72a21d31ad1", "comment": "Malware payload (Stop)", "value": "0bbdcd4173bfafede77339d638cfb9c74bccf957", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369221, "uuid": "2cc3576b-4594-4070-9aae-a189cab12d72", "comment": "Malware payload (Stop)", "value": "48c07dc0b0a4afd8206daaa5aebf18c88baa31f31419d04d3f9c6451463c555d856ea4ed60913f26a97080bf09177af8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369221, "uuid": "d9dff473-b504-49df-941c-0201ef9bd370", "value": "T1DCF422D175A0C430DC9210B95470D3602AFABC33D768899A7F79376F2EB12D266B9327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369221, "uuid": "fe8a7f50-10f6-490c-ad99-407bfc99897b", "value": "ffafc7bbf025f864c5eae76fa1f4c722", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369221, "uuid": "5c868ffe-a98b-4c1b-bab1-43dc330aa422", "value": "12288:4tRVP7wh6kfuq0M2SfgrXOZAEw6DNeOoBPT31WKrRxl77XbU+GwfnI:4ZPc0kfhwZrXOm90JoBLQ2H7U4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666369221, "uuid": "6b40720e-0e1c-4c54-b963-3bbd4ff84240", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666369221, "uuid": "17998aa5-3360-4902-b809-94bb23c91588", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369221, "uuid": "0e2b864d-2a4b-4755-a89d-cf66a7770c84", "value": "D6AA3330313AA65C88F3EDE92B2DA692CB0682A27003D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b980b3-50e3-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1666317311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666317311, "uuid": "cd21d4ea-70fb-4e83-acf7-b9593693b831", "comment": "Malware payload (Loki)", "value": "748d9fa51b7b39ebb591ce0d57a0f5e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666317311, "uuid": "425de0f1-cb10-4aae-a4d0-84b3cb7ac1ff", "comment": "Malware payload (Loki)", "value": "d6ee7e162094507066f286166d32f20121d3b238a2dd28e9248ecae31cee2bfd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666317311, "uuid": "5754635b-bc32-4790-ac91-734f91ab7b0f", "comment": "Malware payload (Loki)", "value": "d7267a333993856a5e0bc5badff6c51f1380b56b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666317311, "uuid": "ee76b1fe-7e84-44c0-b750-22ab53434b7a", "comment": "Malware payload (Loki)", "value": "a2e17ab411eb241a20b52e62818b5124b5822db36a6d00535bd6e4deafbcee7dda398fe64eff007b0c0f95bbd61186f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666317311, "uuid": "6811e962-1c10-4913-a3e0-3cc8eaddcaee", "value": "T13B15C2BA2280255FD556B571CC83D8B363F7AD696236D1C370D31F6FBC490BB8A02296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666317311, "uuid": "1e5d21b0-ae8b-4d21-944a-1569a68ece38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666317311, "uuid": "bb37bb99-5e3e-49cb-b63a-ba8f22661710", "value": "12288:2dcqxBali2dexC7H2e4ueTJWn8KobtVVx4fEu5PAxEavHDRo0q:2dHbMiQexJTKec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666317311, "uuid": "d86aced3-d3a9-440c-9657-ce17f4347033", "value": 916480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666317311, "uuid": "2b1e0129-9936-46e2-83e8-716207a023e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666317311, "uuid": "c8724e9d-2edb-42d0-925e-c1e87c9e0d37", "value": "748d9fa51b7b39ebb591ce0d57a0f5e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216de306-5121-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343825, "uuid": "cbbdb05d-373e-4c76-af27-ef13ada40941", "comment": "Malware payload", "value": "fbd0afe5bd3d0d61feb21680b304d7ae", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343825, "uuid": "3d69e3b7-0845-4ff4-8002-e37f1984bd55", "comment": "Malware payload", "value": "d90168d1f3568b5909d2e14288300ede298f6c663b51e883e7eb5d8d70277423", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343825, "uuid": "d1fb75ad-280a-488d-95b3-0ced0e1329f7", "comment": "Malware payload", "value": "2c61d60f8b1b52688b5642f646c89dad124f466e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343825, "uuid": "3249c847-fcdc-4045-abe7-31b50b9feb51", "comment": "Malware payload", "value": "697473898d73935f3daa655a0bf0271a9ca47c104e3edec064aebe9db0789e38519a609764369f9efe229ce5f827c2ff", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343825, "uuid": "94925b14-8a1f-45b4-b15b-49c691b376c8", "value": "T13ED5E086FF54E82AD1F752374676822A55076C1A8A93D68339DCB13C0EB7AC04F99FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343825, "uuid": "2d15a49e-fb7c-4f64-9e81-d8bca70ceefe", "value": "49152:XY02enmQWMVAaKEHbdyC3QnFu6YwIa1pKaGT9x2LZCBi2gIR3KYp:XNnmQWuAKZyCMFu6zhpKxT9x2LQBrDRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343825, "uuid": "703e053f-5fc3-4901-8e7b-ab1eaa174d5d", "value": 2956414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343825, "uuid": "f16dec02-658f-4c03-af3b-67741e8b9bc5", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343825, "uuid": "6719124c-d960-40b7-89a2-716389dbb2eb", "value": "d90168d1f3568b5909d2e14288300ede298f6c663b51e883e7eb5d8d70277423", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f878819-5150-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666363981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666363981, "uuid": "5bce5670-074d-4166-816f-9e6c00a6df9c", "comment": "Malware payload", "value": "cb9040d1b595c9cd44fa975ee5f55485", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666363981, "uuid": "9f30a36b-718b-402f-b493-a013c9c6ebe1", "comment": "Malware payload", "value": "d9d896f992a41a0d6d776c5761696ba45c0a6d2b11bc3f650477d2cf6e79fd89", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666363981, "uuid": "e7f1f9eb-86c0-4cc2-9704-b23f5a5dcc61", "comment": "Malware payload", "value": "e6a444fa0d509bfe70864ddabb224ebd41200383", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666363981, "uuid": "ddfe679c-33c7-4e1c-b565-cb440b38fdb1", "comment": "Malware payload", "value": "92ae3f70749848da0a5e8d3820b8aa6db5717ca0bbcadd39d2c77e518d1d7e8ba97ab25c0a7151669d4d3412c21d6743", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666363981, "uuid": "6fce5e9a-b1bd-4c8a-a5b0-3ec00df08c58", "value": "T1A50523C14E5DDE99A214A368222731ACF3719DA293488D8F73DED1816F3A10486EFD77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666363981, "uuid": "f7db535f-0e88-4f53-83d7-05c4fbd98352", "value": "24576:UJ+Og0CHWGpMBc9qrLILzmRhnFVUKPp3EF:VVm83HoJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666363981, "uuid": "f7403cf5-7b9a-46eb-9de1-f34c4934cd36", "value": 819229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666363981, "uuid": "b29b69a0-7b21-4f12-bad5-26027d8b206c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666363981, "uuid": "aa51d2a4-c608-45e9-83a3-c940bde584c1", "value": "TO.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01fae6b-512e-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1666349728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666349728, "uuid": "1c3dee5f-207b-44f6-8b0d-cbd18a9e82e8", "comment": "Malware payload (RecordBreaker)", "value": "800687c66b176288d45e1a1b2fd59009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666349728, "uuid": "71d584ea-a126-47cf-9deb-94497ec4ffa8", "comment": "Malware payload (RecordBreaker)", "value": "da89897c55ac35e78778b19677afac92f5a08542492bf3dfa4600159f54736dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666349728, "uuid": "818eda9a-d1e8-4670-8e45-7c47554e31de", "comment": "Malware payload (RecordBreaker)", "value": "386b050115a3624751c825252931fe333d8cdcd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666349728, "uuid": "6d7dac4e-fa71-4b54-86e7-7d90f5561301", "comment": "Malware payload (RecordBreaker)", "value": "2b1f4407914b04f966d145415eb0f606dbb9ad8f4acf0680f8c9c3f3ac1593cbe27deed6f60179e77a1ff45172502725", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666349728, "uuid": "edcd94dd-6287-4b81-b7e8-ed2e3bd58760", "value": "T17224E125B692C871C4425B784461CBA1657FAC7227718A7B37782B7F6F303D2A376382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666349728, "uuid": "b2f79d1e-a1f7-4771-8ed3-8a85970c7db4", "value": "965326d499ea63bde30a73f94c3886cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666349728, "uuid": "6f8e21e2-38a8-4a9b-8a78-6f2ae9264f18", "value": "3072:xXtfbLDbwgRdWP5v1ScEep0K5+ajubuW9RgL3iRihT0KG3Lu:VxbLXwgRojEepZ5+a6uQi3eMT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666349728, "uuid": "4ff6ec00-4694-45c3-b936-f240d50d8be5", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666349728, "uuid": "ea0bfaa1-8e64-43c7-aba4-8a2fea64453c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666349728, "uuid": "62d1ca06-2fe7-49aa-8de1-e094ef957d17", "value": "800687c66b176288d45e1a1b2fd59009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e5e2b2-5135-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666352528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352528, "uuid": "610a05b2-9cd8-4f20-a293-3f624e8df883", "comment": "Malware payload (AgentTesla)", "value": "e9449c6438012364c6c1af1c235bd55e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352528, "uuid": "585f12d0-b140-4591-b4ef-85710e2b2a77", "comment": "Malware payload (AgentTesla)", "value": "db086dead4807a474e5dc0c5382af9269c4a6d45f12678d5b996f208c4d5e360", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352528, "uuid": "c6814bb0-0b4c-43e5-8896-91168cddd42c", "comment": "Malware payload (AgentTesla)", "value": "889fff2f1e81abc069f34fb5a426a0259df535f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352528, "uuid": "cd46f23c-bd0c-45d3-9bf2-5cfbf2518486", "comment": "Malware payload (AgentTesla)", "value": "2681001c771950087b6dd27d3865218235a1b340ad3c0b2aa8adf8d5056fc13cf8a1a15b12515134d2086f93f9e110e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352528, "uuid": "66b6ae50-557a-4e91-a3a0-6a5e81ee12fa", "value": "T17E351212BBD5C8B1D5771A315A39BB12193C7D211E74DB2FA7E4096EEA350C06238BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352528, "uuid": "aab90bb6-012d-4cef-a397-65c58128c85b", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352528, "uuid": "522e4b37-abee-4b22-bff8-5113d235603e", "value": "24576:0AOcZ2i7AuHZVd+NszxGjOTtbFI+toamgMObLVuzU0:iz0uYGiTt++to5M6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666352528, "uuid": "22f589e7-4f8f-47df-8934-7354e04b2dad", "value": 1161142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666352528, "uuid": "44a8d0ae-9108-49a0-96ac-488cb10a73ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352528, "uuid": "7641cd8f-9277-434f-82d9-4e81dc0f2cb1", "value": "Doc56023441.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9acc8de7-510f-11ed-9266-42010a9c0072", "comment": "Malware payload (NanoCore)", "timestamp": 1666336298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336298, "uuid": "9311953c-07c7-4ec9-bff5-36a5edac344f", "comment": "Malware payload (NanoCore)", "value": "283577808207c31484c8e9891cb2e6ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336298, "uuid": "5a6aa308-57a5-46fc-bb77-306104c7f3bf", "comment": "Malware payload (NanoCore)", "value": "dba4977fca4502e32071bcb088434cd1c9cd822a58ca5346c50b5f92e49bb3a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336298, "uuid": "5d35ca41-babf-43c4-b435-483b506f9d0b", "comment": "Malware payload (NanoCore)", "value": "f52e2651a40c85bb4a872a2707a20fb9a5b47555", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336298, "uuid": "fde15056-538f-4a90-80cc-4abe211f951b", "comment": "Malware payload (NanoCore)", "value": "b063dee6f329ceb8ff68bbd4d623702dd0d3c62d7c122700ce3cf42ad5c028ea8b78998bb4bda64afff66cdae19afc53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336298, "uuid": "eaf4df61-b755-42eb-9247-4f70e3c91ce6", "value": "T15DE4122C87EE4F0ACAED4A7D605248450773D05AF003F7EB4ECB65DC1E637A88495ADA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336298, "uuid": "74a5e3f9-4a10-4b66-8636-c7f9ede73f45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336298, "uuid": "76169aaa-933c-4c0a-9c5e-68371010d03a", "value": "12288:lPDDk/PSWdyWpm0T1Df4dr2+Ujd2eFQLzQksqiOXHMFnpYqQ:lYPSWf1r5FnksqfHSnpYqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666336298, "uuid": "c316866f-a276-4764-ac20-8241aeb7749e", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666336298, "uuid": "ae0cdbe5-9fc2-4aeb-b525-28a1cb04e9f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336298, "uuid": "b826f1aa-f4a7-4e97-9fec-74aa3b75a272", "value": "TNT AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7df052c-510a-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666334280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666334280, "uuid": "bcb144ec-7d07-420b-ac0b-767c0b2ba321", "comment": "Malware payload (Mirai)", "value": "009c8cc4777d469083defd0098743e83", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666334280, "uuid": "0d0fff28-6419-4efe-af5c-f4594c3b42d4", "comment": "Malware payload (Mirai)", "value": "dcb0a16916d06e7547d96bcf99df64e619bf099e7ba41bf2eeb97c500434f092", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666334280, "uuid": "fb277cc6-7037-45db-ba97-6345a628f8a2", "comment": "Malware payload (Mirai)", "value": "81a79983bbe695c8829eca15618f6ca5502c230b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666334280, "uuid": "c65488ee-7cf6-425f-aac6-0d17f558b306", "comment": "Malware payload (Mirai)", "value": "f5425993389e0c6bf97173a998d12113c13a02d6c8f8ba0783d2dfd75ae568ac3e206f69bfe6097ce65ce2b85e6de414", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666334280, "uuid": "8bcd46b4-9a90-4665-a3f1-f5fdfc6b8cc5", "value": "T187235BC19543E9F9DC1102B02177FB325B76E47A11A9EAD7D399E933FC12A01A60B38C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666334280, "uuid": "07d719a2-aacc-45df-a8e3-b1e6d1500cf4", "value": "1536:t5npalvtLbqyz6CXReS6eizqPAmPIyMY8L:t5pYtLbP+C4SycAmQ7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666334280, "uuid": "a1b634ba-46a6-4087-8c9c-1bdd06c1d21e", "value": 50032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666334280, "uuid": "b4903882-3157-4125-86c7-6e70b09b0805", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666334280, "uuid": "22c3109b-f547-4f25-b971-0febd0f1852b", "value": "x86-20221021-0637", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00612b47-5135-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666352359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352359, "uuid": "a6cc864b-ed98-46e3-af58-af84d816ce02", "comment": "Malware payload (Smoke Loader)", "value": "071e10852ab6744d7ec303aaa602f292", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352359, "uuid": "5fe7671b-db14-4c45-8f37-5b2da251394c", "comment": "Malware payload (Smoke Loader)", "value": "dcc4a4814089bb91a942f01e32dbc805f66cc5121c6a31d0fb42d4ec9f7a2328", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352359, "uuid": "8cc641db-9194-4c9b-897a-7621e4e16b84", "comment": "Malware payload (Smoke Loader)", "value": "41417927812c2fa7a11bde26f357e8d148671e5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666352359, "uuid": "9cf1e5af-9c00-4dc2-b567-26e12be08370", "comment": "Malware payload (Smoke Loader)", "value": "dc4719195b89e1f6a02b4211204e6ca3a028fd4104aab14aafe1295ecf97bd49f5466ef910db28bd2847501e3bf2785e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352359, "uuid": "884efc2e-cf7a-41ba-9a7d-530116667f9d", "value": "T18F24E0027586C7F1C44651307864CBA11A3FA93D3631897B37AB2B6EDE3C6E19672386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352359, "uuid": "af11f270-ac3d-496b-847b-467a24e8351f", "value": "965326d499ea63bde30a73f94c3886cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352359, "uuid": "cb475b04-63d6-443a-8802-12dfd413b61c", "value": "3072:+X58XfL9rxIf5mb8aE/6G2gFBF6X63Wz70K9wmN:G+XfLZKEojSah6X2a06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666352359, "uuid": "9fa6ccd9-021c-4626-8c40-806d48261cb0", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666352359, "uuid": "176d798d-64b1-4cc7-9e05-32c5728f9419", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666352359, "uuid": "e5ff4ff0-a8e1-40db-95bb-b72d3038c469", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8537bc2-5165-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666373338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373338, "uuid": "acdd622b-9489-49f6-91d2-d90678fd59a1", "comment": "Malware payload (Smoke Loader)", "value": "3954baeef03b6c26d051ebd9a701b23f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373338, "uuid": "5ce47ff9-feda-4244-878f-b8cf9ca524cf", "comment": "Malware payload (Smoke Loader)", "value": "dd6f00fd0ea49dc42073ac888654aec459d0fa364290650f27f6d340f01df626", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373338, "uuid": "965cabd0-ca78-4980-8ebd-878ad08b796d", "comment": "Malware payload (Smoke Loader)", "value": "2e2f502fb15bfa3eb5db4ae1ad1fad1988a387b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666373338, "uuid": "4c1c0885-a83f-4b78-96f6-12a4042dad6f", "comment": "Malware payload (Smoke Loader)", "value": "504edd6b287a31e8088663e7869eb7d99cfa5da42e6c87e1b05ececdb48468ac6f88e44c1d1f4b5e5468d91155eec075", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373338, "uuid": "a032c10e-12cb-49f3-8062-1ec890cbc844", "value": "T10F34E011B692C8B2C88749300434DFA0667BBC7252795A9B7FA43FAF5E702D2177634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373338, "uuid": "d748c530-8f88-4350-8cd6-bab9be199793", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373338, "uuid": "d9f51d92-a276-4a95-9664-423b1a2543a7", "value": "3072:NXSGLLSkYjOQhO5umxDISfgQ4xrmsnWwXckGXTEyX6g0s3OO8ur:JFLLSkCOQhMDjmmsnZckGT7ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666373338, "uuid": "f1ff7d63-b39a-45ac-a2d0-d73008aede5e", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666373338, "uuid": "d46cae4d-7664-404a-8cdb-62d5969a3a3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666373338, "uuid": "9dd0a693-799c-45bb-9ced-47c9679c581f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da40629a-5117-11ed-9266-42010a9c0072", "comment": "Malware payload (CobaltStrike)", "timestamp": 1666339840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339840, "uuid": "8d107bda-4fce-48da-b050-1fbff2fe2670", "comment": "Malware payload (CobaltStrike)", "value": "3d8509f639f7eeaa9bf68fa08e9282c1", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339840, "uuid": "dc3791ce-9966-4d3d-8470-ea89879956ab", "comment": "Malware payload (CobaltStrike)", "value": "dd890e4633721ea8a6ce1829b868ab4627aaa0bb173d00cb0ace3169ab981fb4", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339840, "uuid": "7a886f7a-f02f-4412-b84d-187f72515a9f", "comment": "Malware payload (CobaltStrike)", "value": "d7832ae3353b277b7aa8b042ea49ddb0829f5b38", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339840, "uuid": "40c4d545-6243-4175-ac52-40371822bda9", "comment": "Malware payload (CobaltStrike)", "value": "ca415885b154fd40db984676dedbede0c62ad0d5939b6e505a1777f41f14bc31de0921360f3ac86126a6d83b07aa2707", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339840, "uuid": "3ea999f1-6ba0-40be-ae9d-6e1418c37359", "value": "T1FFF47CA6ABB400F8E577D039C542961BF6B27855136097DF03B08B6A1F23BE95E3E350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339840, "uuid": "c1d4ed1a-d272-4ce4-bc3a-635ba083ae2d", "value": "7727da4df891bf38dabc2cab37b5d731", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339840, "uuid": "1c6bea2d-378c-4993-81c6-fe79a5ed7efd", "value": "12288:mhtJYG5pT783IhE6I+qWY5zWp4HW+V2A0+doE9:ktJ3rT783IhhqF5n5V90Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666339840, "uuid": "5f3ff066-a1d5-4366-80cb-20afe4f4335f", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666339840, "uuid": "349c49b2-ee9f-4e12-ad2f-189d189e4855", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339840, "uuid": "611f7579-e354-45f8-97be-d8dc9de7c929", "value": "3d8509f639f7eeaa9bf68fa08e9282c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90226fc8-512a-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666347876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347876, "uuid": "6777b970-fc40-462e-896d-cdd479c5ba44", "comment": "Malware payload (Smoke Loader)", "value": "8158c673642d2bc6cb2d2aa197a6b726", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347876, "uuid": "b7b2f85d-21b6-4469-948f-75298d0ef269", "comment": "Malware payload (Smoke Loader)", "value": "ddb2036265f0bb1defb9f402cd89d1014eec369d3bc31d95772eaaaab161d9a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347876, "uuid": "32e505da-6f66-4ea3-9735-5d3b666c8b8d", "comment": "Malware payload (Smoke Loader)", "value": "8c79a772a4f981e2ac5fae416851d58a41c010cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666347876, "uuid": "a4b6d334-6557-4ffc-be37-23a2ba7f76bb", "comment": "Malware payload (Smoke Loader)", "value": "e4ca776beeb845ecb098d277e02a9732ebfce7ccab3040d7ce2c8c2eb868c38fa4e1ada6609f518332235ed2ba533abe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347876, "uuid": "a3dc3e60-705e-4519-ba8b-9d35d2b2fa57", "value": "T16124F1127992C831C48A94344825DF616B7F6C3275714B4B3BA93F3E2F722E29672387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347876, "uuid": "13c384f6-7912-4168-9dfe-0b65c1aa4705", "value": "965326d499ea63bde30a73f94c3886cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347876, "uuid": "4665c5e2-c5a0-4584-9be7-63a4b2c05a39", "value": "3072:SXSkjZLGnW8r8L52viJLKVhbMSn7oNd2WfXXhvRSQ2hKAR0KaMmdNzogb:S9jZLlfcvkuV74fXxvwQ27R0SmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666347876, "uuid": "c250a9be-b4ac-42c4-b9b5-855ee1403579", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666347876, "uuid": "0ac565b9-a389-4063-9f00-48c58588d835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666347876, "uuid": "5b84dd24-065e-4ef8-9824-253db998f883", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdefe5af-5190-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666391762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666391762, "uuid": "d68d7465-11ee-475c-8a20-25061a5b22d2", "comment": "Malware payload", "value": "1e97fac877fd16aa937bdc35714cc058", "object_relation": "md5", "Tag": [ { "name": "2010m", "colour": "#F53636", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666391762, "uuid": "909383d5-ebcf-4944-8674-92e92a5f335a", "comment": "Malware payload", "value": "ddb9895f9e74d3e7db4e94aa77338fdc221ed29f29857a9752545cddcf8f45a6", "object_relation": "sha256", "Tag": [ { "name": "2010m", "colour": "#F53636", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666391762, "uuid": "37667806-2070-4120-8be6-1316ba42b99d", "comment": "Malware payload", "value": "ef7687fd12df2a102e443a9cfa6c09a1f16b0035", "object_relation": "sha1", "Tag": [ { "name": "2010m", "colour": "#F53636", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666391762, "uuid": "e849e4d3-4f2e-4467-88ea-0cdcb7f58f6e", "comment": "Malware payload", "value": "415cfd842f9769828f6b0aaac1b0f6463d7af9a972b6c9aa1a7fb63edafe59fa6b960f2edeede34f0b0dc52a4abacd3c", "object_relation": "sha3-384", "Tag": [ { "name": "2010m", "colour": "#F53636", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666391762, "uuid": "1ef54388-245d-4dc8-b86a-54f601cb4833", "value": "T143064C838A11DFBBCA5D84FF89BF160D43121377A9633D2B382ABC8415637016697B5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666391762, "uuid": "8add0976-53f9-4d50-8e0e-ebd0126ec0c8", "value": "25b614d05800ad54d250ce40fff8727c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666391762, "uuid": "3b8a7283-491c-4785-832b-3c6641f0399e", "value": "24576:E3RgLkXy4o8Bhf1d9I25Xroti/mb8RqrU9dveOgTRXfXAffHjonc64PZmwfzbpSc:EBgLOM8bfVI25lm6n9klBfGt6AZbZSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666391762, "uuid": "defdf74c-3865-43e6-acf6-e464638e3b01", "value": 3796992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666391762, "uuid": "33c1e4ea-a9da-44cd-a1ad-ecf910be6fb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666391762, "uuid": "28aef68b-c1fd-4a2f-b6c5-51d0e1a6e1ba", "value": "grasbly.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8099ee26-517f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666384357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666384357, "uuid": "ad2506bf-62ea-4d82-9057-eea0ea84ad9d", "comment": "Malware payload", "value": "665bcf1bf34ec1d7cca1ce0f906dd723", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666384357, "uuid": "7915b000-dcaa-4a7f-9951-d1dfe004018e", "comment": "Malware payload", "value": "ddcdb7d54bbf680b37ea66d7831f9ab35ff32dab21ea56452232df37ca92fef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666384357, "uuid": "359c21dc-33c2-44c9-9f89-325d3c903ca7", "comment": "Malware payload", "value": "14c4e47403946877cefbd4a92919853cce370439", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666384357, "uuid": "da3cc2e2-dfa0-4767-b70c-2b2e1169272b", "comment": "Malware payload", "value": "54d858ffa27272c617d2ca1ea0d63ede53296d68f296a82b9a1ebad5812d0f0bfb23a0f38252e56cb1b01b896a4c5059", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666384357, "uuid": "a5137367-fff0-4213-aa07-4ce4f76f73a5", "value": "T1B6C5335BF582DC31E0434EB44B3B61202333EB198632529AF5FE446EDF1BACA94587D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666384357, "uuid": "be725d51-6daf-432c-94f2-db28a8c75edd", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666384357, "uuid": "8ca8b391-c54a-4100-96de-ca216244bd4d", "value": "49152:Z2+3dz/4c/AhkUCUiwf6R7wo2wZYWE5C/bieptg2E98mm3zIBYA5hq:M+tTYVCUiq61wrwZFE52bnjg2EpmDIlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666384357, "uuid": "a8f8350f-a092-42fc-80bf-000a3f76fcee", "value": 2508978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666384357, "uuid": "252f5427-028b-46dd-8d84-08de8f65b8ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666384357, "uuid": "78128802-c30c-4354-9fad-e6329726c8db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0946c12e-510a-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1666333906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333906, "uuid": "883a25ff-8b82-49f7-854f-200579b398f1", "comment": "Malware payload (AsyncRAT)", "value": "8e9aea6e036889ae2696260c760e0d0b", "object_relation": "md5", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333906, "uuid": "6798a4f8-3b4b-4fcc-a695-5e45ec079d6c", "comment": "Malware payload (AsyncRAT)", "value": "e043879249a6a0f0461b9f0c20dbd92345f03b322702831612b286d129226779", "object_relation": "sha256", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333906, "uuid": "24a9ed53-94d0-4256-b897-40ab0f1bd097", "comment": "Malware payload (AsyncRAT)", "value": "6f0e2d2cd805f76233a68ae86a60bd8f24db55f3", "object_relation": "sha1", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333906, "uuid": "f3f9db0a-0ee1-4632-9f83-7ed2f7c4d7eb", "comment": "Malware payload (AsyncRAT)", "value": "720ba9abc14076b00618917142bdc38d8b255b15f5c4264ef53ee3ea33b887bd661265d83ca5d1c2396d6f6c8979e9dc", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333906, "uuid": "3e1261fc-6a28-403e-9370-bec824139678", "value": "T12D447D00A7E88A2EE7DF4B74F475462086B5F7973402E75E6C84A4FE1887BC086423E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333906, "uuid": "321a5069-8cd2-4040-8427-f30ac8f45e6c", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333906, "uuid": "5c08f732-b76c-40ea-a6a1-6a50a2b6790b", "value": "3072:LeruQlNGOhYq0AQcTvankc+8lbKta4FUPAT8xpRI454I/Kv6RpZ8dwPSgWQgn2gG:2W60VcTvakcXcApOQE2nUlbsHtf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666333906, "uuid": "96827869-1b9d-47c5-9564-9505c0f90537", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666333906, "uuid": "d332018c-51d0-4f3c-9f7f-9a74d50b7b84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333906, "uuid": "f39b77e2-140b-4b31-8b6d-bffcfb7c9d04", "value": "System.Net.Http.dll.F08D.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57b8329-511f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343241, "uuid": "94d98803-ea35-4a27-9b80-6b9efb05db9a", "comment": "Malware payload", "value": "155316526ff476698494e90efc1127bc", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343241, "uuid": "e7965d33-15fe-4652-88db-b59ce18f1994", "comment": "Malware payload", "value": "e069bcd473c83b937db46243dd53e8856b5be6d0ade880c0ec61107054a7e32e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343241, "uuid": "524eae1c-5338-400e-9020-16651a3d0bad", "comment": "Malware payload", "value": "be7bba8dc417a5cfa665d647ce7bafabb67a0d00", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343241, "uuid": "f4dbba96-9b6c-42cf-8f6a-4b1c03724def", "comment": "Malware payload", "value": "071078a095bc55de68f66072531e62389fff13c1f57e722576dd8a2de98fd9978d4302da2295f57edf9040f47c1bca02", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343241, "uuid": "9db73e57-a415-4382-8057-c53c0a9e8744", "value": "T113362292E395BC67D8F3CB365275CB6E86494D158703D2930891B17C59BBFC08A88FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343241, "uuid": "5f64f2ce-17cf-4cc7-9833-c7f3093b9838", "value": "98304:3E3k/OX8/K0hOl2VRh8ps1+q6Es6DaWbFXQSSPoGm46xl/RXRiDQczQJ:av8XIIVRh8OUo/lQSRx46xRlRiDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343241, "uuid": "769f4e63-7cfb-41ec-a43a-966adfc74702", "value": 5164067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343241, "uuid": "90f66cad-8fff-4e60-bd49-93b985bcea6d", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343241, "uuid": "701e0e6e-a394-4a4a-9513-12a8dc8e2679", "value": "e069bcd473c83b937db46243dd53e8856b5be6d0ade880c0ec61107054a7e32e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e3e789-5160-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666371132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666371132, "uuid": "6685edec-93de-4d99-bee1-ca59e517be7a", "comment": "Malware payload (RedLineStealer)", "value": "6b58a13e5a62e1fa045dce483588c074", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666371132, "uuid": "3e93fa09-5351-4512-bcb9-b074a5817c70", "comment": "Malware payload (RedLineStealer)", "value": "e128b88a7314743d8c3e4b989ee280fdae64bee91c82cc70622be24066c93f4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666371132, "uuid": "4c66494b-2cc3-4096-9548-4f15b5961731", "comment": "Malware payload (RedLineStealer)", "value": "57190894ae5000a7cbd66579c195475362f46881", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666371132, "uuid": "df659f21-c86b-403f-ae44-6660bb4eb277", "comment": "Malware payload (RedLineStealer)", "value": "04f809d842177dadd67d6f383c568998f8b36335d907ed8296547cd807765a507cf76d8e2ef8c43f75fafb55693b8c60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666371132, "uuid": "17ce0aee-35ca-4a48-90a0-a33518724eef", "value": "T101B50913AACB0E75DDD23BB4618B533AA734FD30CA2A9F7FB608C53559532C4681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666371132, "uuid": "f45a1ec6-80a5-4c86-bae4-6a7e8ee95cae", "value": "c30adf91ebe9d66e552316724764f4c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666371132, "uuid": "90f0b30f-ac07-4a03-8515-69ce8fc7b8dd", "value": "24576:PnY4YIYtK3XJuM9Gi+YX/0eCQDuFymF6CAkerLpaf/Cl3RuQ553130:Pn48qn6CAkerGCl3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666371132, "uuid": "2a580a66-a722-4d48-86ee-41736a32a92c", "value": 2455723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666371132, "uuid": "8342f820-0835-4300-9b74-50571f93339e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666371132, "uuid": "edcb4b38-48f6-4be8-b0e8-74ed1458b32b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf26d54-5174-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666379707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666379707, "uuid": "9160a0be-1471-4f4d-ba99-45f36fa3f255", "comment": "Malware payload", "value": "64ef32e337aaf3c66bca1935117701b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666379707, "uuid": "7791182b-6cf6-4e24-9583-bdb84718a415", "comment": "Malware payload", "value": "e1db6a5d3acbbef1205aa4cd613b0824bf9236311df8b8a17b7cd6718f65df79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666379707, "uuid": "63d901b6-ac76-4ec0-8850-c012f1ca1149", "comment": "Malware payload", "value": "febdc0041205aa8546117c30b4bc4eab1f182e6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666379707, "uuid": "a16d3e6a-1dc2-47c0-8ed7-20cd4c82cd73", "comment": "Malware payload", "value": "a1ee17a85d28240640dfde8354c1196c4e89a5837dfcadec408c5aed4d78ef15f08b7538315bc7ca98ab29e70d32ccad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666379707, "uuid": "f7e63c8f-b48a-4391-9fa8-3140e39256fb", "value": "T12BB50903AA8B1E75DDD23BB4618B533AA734FD30CA2A9F7FF608C53559532C4681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666379707, "uuid": "0736f9e3-87a6-4958-9c24-93efaf65f6a7", "value": "c30adf91ebe9d66e552316724764f4c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666379707, "uuid": "540ec871-4df3-4611-b6f3-198347c94f81", "value": "24576:MQYoYIY+KPXJuMNyEpYBk0eCWJHqmlgIACwxLxaDHFhl3RuQ55313z:MQjiRFgIACwxaFhl3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666379707, "uuid": "29e67355-2f11-4483-a6ea-7cb80df21926", "value": 2456235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666379707, "uuid": "da148465-6e65-4a0a-9b36-2a287b955e29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666379707, "uuid": "8fc6c1c2-5a70-4196-a189-499e9e50c832", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c32a06-5127-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1666346542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666346542, "uuid": "74ffcb0f-bd6c-4764-9889-5251b19ec9dc", "comment": "Malware payload (GCleaner)", "value": "c26150c54b9e01478607c8d3930c7c80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666346542, "uuid": "6bb166b2-fe33-428a-852c-161fee2cc840", "comment": "Malware payload (GCleaner)", "value": "e2bf661ca3f0914d03eebc96d6e07c3109fc2909fd015da420f12d05e5d0b919", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666346542, "uuid": "ce30d16d-1f56-49af-88c8-5d33b19c40b3", "comment": "Malware payload (GCleaner)", "value": "38d7983cc59d3e2998fd020ce1f47115ef20c945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666346542, "uuid": "7bbd830f-5f11-419e-9189-d6f418cba9e7", "comment": "Malware payload (GCleaner)", "value": "18b4b3f7c0d31195cf9bf73ea0085c899d3f33fee72dc9df40889dc6322f4be979986f268f23f33fd9134ba51a98fca6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666346542, "uuid": "af228eb1-0801-4476-80f8-8a338c6aca03", "value": "T1DFB5330B5AFCDD39C2A3D8F18E5596648877BF83966F781931EDA8468F37700C089762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666346542, "uuid": "be8922e8-cce2-4238-98e4-1c72a38dc9c8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666346542, "uuid": "9418875a-34fd-4f41-873b-c6928fd127d2", "value": "49152:Z2NL5vfANyCQjABqKrclbCdkijr6FrDePAhZtq1Cv6iYDndmxC5T5A5hq:MNlv/3jABqKrqC696Ktq1061DPiDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666346542, "uuid": "b3de7773-7bba-42d8-8c2e-9db99c22e547", "value": 2487429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666346542, "uuid": "7a109ef5-1a7f-4a02-9266-3572c4122d31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666346542, "uuid": "c77f79d0-74ff-4460-8ec7-4479b2f35186", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef249b0-510f-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1666336305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336305, "uuid": "3eb05453-08e8-45c2-9769-79d4dfe155f5", "comment": "Malware payload (RemcosRAT)", "value": "cda79ec08565e004e6e8b333e42baccc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336305, "uuid": "6a332c24-eef0-4ea4-9d18-213085ba2285", "comment": "Malware payload (RemcosRAT)", "value": "e2e6004aae374b8c7d91b2c66c2bb887f4318cc9ff037317a500bb6bc44ccd93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336305, "uuid": "648e1bbf-9e89-4e68-87db-02dc10342cea", "comment": "Malware payload (RemcosRAT)", "value": "bde6e278a97ba024db5c52bd45535c7b4b64bed1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336305, "uuid": "96a22fbb-5fe3-4dad-b348-b0e68e03121a", "comment": "Malware payload (RemcosRAT)", "value": "d0a3b21d547c8376efbc3b7ebb132c4b9facb274c9dddf7ada48b9c50a564c5cb98a0ec8f265500f53f50648779163a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336305, "uuid": "ab5b991e-de26-4874-bbd5-8e16b1c01bf9", "value": "T1C7C4C0E5A740C625D8979179843BE6A76423A10E9CA8560D3DD6FF0F3C7338B8027D9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336305, "uuid": "c6aaea2c-9438-40fc-a584-f1eb9eb9a0a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336305, "uuid": "c523cc7c-db3b-458a-afaf-a674bf639f74", "value": "12288:SuxXiqsrTlxxBTK6TXceAWfFkrrrrrwrrrNdhJrrrr9rrrrrrrrrrrrrrrrrrrri:SUXi7rxjxTbdkrrrrrwrrrb3rrrr9rrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666336305, "uuid": "adc58e46-05c2-497d-9d4a-dab2304449d0", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666336305, "uuid": "28e936c9-e275-4d42-b177-1fd340bdfd65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336305, "uuid": "394b553d-995c-49fb-84ed-8586863a1360", "value": "SecuriteInfo.com.Variant.Barys.34076.23160.31198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45124481-5109-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1666333577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333577, "uuid": "e50528a6-22ea-4eb2-a2f7-15aa92eb478e", "comment": "Malware payload (AsyncRAT)", "value": "038ec1563e25dbbd899d02556ac12040", "object_relation": "md5", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333577, "uuid": "53c9f52f-aa33-408a-856c-03898366c414", "comment": "Malware payload (AsyncRAT)", "value": "e50769658be91aeaadf2c0066534830b6621a32f8b96e84ad1e44bf71afbec0b", "object_relation": "sha256", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333577, "uuid": "1d981fc4-5aa7-4034-b423-90fb00d78c0d", "comment": "Malware payload (AsyncRAT)", "value": "e25ba22e1a620546119ab16a42c834c7ddeca6f9", "object_relation": "sha1", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333577, "uuid": "c2285fd5-3371-4fbc-8d71-d6f61d90ff26", "comment": "Malware payload (AsyncRAT)", "value": "8b1f8d62dea68d34fe6ee5340b6092f7c345fd344bab2fdd9c395ea3c7912b617621ebdc4ebd4897c7b71b432cdd6ebe", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333577, "uuid": "671ae4c3-98e7-4156-9773-799b40c6f66f", "value": "T139635C0037A8C925E5DD86B8BCB2550106B5C63B2113EA5E7CC450DB9BAFFC64A133EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333577, "uuid": "90b81043-4940-41ce-8247-153f4c17e9c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333577, "uuid": "92249b52-a5ce-4cb5-a6d1-1659a5ac85ee", "value": "1536:CZn6AVsIQ9HJfxQ7CqmB9x1bbsTxRJY8hp+asNNpqKmY7:CZn1Q95x/q8n1bbsT5Y8HKNWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666333577, "uuid": "2024d36f-6f1e-42c8-baca-633cf144eb0e", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666333577, "uuid": "c5dfe609-aaf0-465a-8700-2fb2339361aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333577, "uuid": "e5655948-1667-4652-913f-ca220eab9f52", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f329a4a5-517a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666382402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666382402, "uuid": "d8767cdf-cb69-4f38-801b-801f9e26ba04", "comment": "Malware payload", "value": "18abf9c67778857596b99ae476e5a447", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666382402, "uuid": "047c81e9-8d0e-4521-8bf7-115904ab5f41", "comment": "Malware payload", "value": "e52c50986b5b8e97e2d56ce34e94d69a15d9859c124152e88fb561d3407f3fa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666382402, "uuid": "b7affc7b-2f5d-406c-8293-f7cd5712a584", "comment": "Malware payload", "value": "f383de661fc750d88a5328781ecaee3e59c67519", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666382402, "uuid": "a1e1545e-52d4-4719-8dd9-50735187f677", "comment": "Malware payload", "value": "9a28c5b75dbe044367c145fc17934f7757806149b278f972a79b86acf0af1a6930cd099a6949b6c69b84ff68c24e2b18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666382402, "uuid": "f0e59025-6546-4593-bfa5-e0bbbd0920b3", "value": "T1C734E011B682C872C88344344874EAF462BBEC32C575998BB764377EAE702D1A77734E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666382402, "uuid": "fbd91f30-dd4d-4df2-99fc-7357e016c941", "value": "bc5a05e947eb61731a4e3024a4f4b617", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666382402, "uuid": "d27537f0-8190-4d4b-a23e-19983cb1af9f", "value": "3072:JXSP1L8lU4AzE5ZzHig4F4sQWB+/AZVVi4/dqFL4NES:tE1L8+4Azs83NB+/L4FkgES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666382402, "uuid": "2e0817c4-a7e5-4822-ba42-03efb7254997", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666382402, "uuid": "b948e993-c943-4642-b348-e443b4f5ae80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666382402, "uuid": "4630b10a-904c-4eae-9663-f537402cbc25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b0ad7c-5117-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666339502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339502, "uuid": "aedb8ea0-fb9e-438f-9d3a-e83e37db9cd6", "comment": "Malware payload (Formbook)", "value": "5ee85a11112d67592f777e8e7fffd8f3", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339502, "uuid": "6d591cf7-cda6-444d-a68b-64aa2cb9ff2e", "comment": "Malware payload (Formbook)", "value": "e60b46268b21873527cb17080d514cfc0f0168264ef4258f1d6b105bc083b847", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339502, "uuid": "d9346fee-3661-4422-9533-47f615daef60", "comment": "Malware payload (Formbook)", "value": "871f3953e3adf1d566b87feb39a8976286619a28", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339502, "uuid": "a731fc32-3930-4cc6-896c-ec3d58b9f65e", "comment": "Malware payload (Formbook)", "value": "b9a3d20c0e15a04b696e86e6404aedf74c3f2173bff576d23723baaab6561114ed64eb43fdc100267ee14e89088690ae", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339502, "uuid": "ed1dd599-95eb-4114-a899-ec521768ca54", "value": "T1B54412117250C9BBFD2659B14D2E837EAFABC40412F6EE4B93403D943C63781991EB76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339502, "uuid": "9c5323d7-73e1-4ea9-afef-a30a2cb63078", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339502, "uuid": "db3b517f-e0c5-4660-8a19-8f3309760279", "value": "6144:mbE/HUbLgJnaljvLVt8dVwF++Rs0F77v9Xwujhw:mb/hjjvd9/Nw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666339502, "uuid": "0d7bc866-b275-47ea-9c71-5da529f0224f", "value": 265448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666339502, "uuid": "da3e3324-35d1-4cdf-9a07-a7508f95c8d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339502, "uuid": "8eb5cc2c-f095-4118-8de6-3f4c8e062102", "value": "UPS 1Z6917FF0448696280\u5305\u88f9\u8ffd\u8e2a\u53f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53511363-5117-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1666339614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339614, "uuid": "5b741881-9a82-4e0d-a768-72f4294ebdac", "comment": "Malware payload (GuLoader)", "value": "b4072cd2dc3b7c62ea915c9fc34e72ab", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339614, "uuid": "7185cd1d-e64c-4ce3-bf43-c78acea37e72", "comment": "Malware payload (GuLoader)", "value": "e71bacf35b825290d37ac857569acae21c9b534048348926aa598c1ec970ebf3", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339614, "uuid": "5f93b1ec-90b1-43e7-8426-43cacf788c2e", "comment": "Malware payload (GuLoader)", "value": "3c2ec98a79f5bf7de69beece1fb88aaa2bffd812", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339614, "uuid": "eb7a73e8-13ad-4402-8f60-6f9fc6f5ea80", "comment": "Malware payload (GuLoader)", "value": "56de5ae1b385ce4b0e4ce0e019b7fe5373346dab0a406cde56bab6bb1594f619f903c85f49f6522e87276ee224396fa7", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339614, "uuid": "07d257d4-010f-4281-bf7b-437eb692fcf9", "value": "T1B7D4E119AD734F1E8ED823EFBC570E9B0E6C4259D218077A39C5259CB90A37D209F26D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339614, "uuid": "b09ce903-b098-4fac-a45f-67ce4152017f", "value": "12288:cqOPFUCm2tTKr2lTxkcq2EVYuUUzs6rPKYHDhOmu0JzQelDO7:/ONUDat3fNbUzzFNRumTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666339614, "uuid": "25789704-8f37-4f9b-be4d-7b6f3de6c783", "value": 647215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666339614, "uuid": "fb61d6c3-da6d-4c2c-a27d-dc68297737a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339614, "uuid": "a9274d3a-c11b-4335-bca2-e594db30f387", "value": "TOO TEE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6e5340-5119-11ed-9266-42010a9c0072", "comment": "Malware payload (njrat)", "timestamp": 1666340543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340543, "uuid": "4e1cf4b5-6b76-4f01-b0e0-141e206443c6", "comment": "Malware payload (njrat)", "value": "dca57c2f40eb7886d957c4362078a835", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340543, "uuid": "8a2c128b-9251-48c1-811d-0bc24d1f642b", "comment": "Malware payload (njrat)", "value": "e7451a6cb4d87006a8e3cae3fc7dd3ca757b6d2485c2b2c485e113ede607f1c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340543, "uuid": "6f97e5cf-af73-401a-a4c5-503521cffcb3", "comment": "Malware payload (njrat)", "value": "0adb96a312c3af89bb5ce5e78b16e76b42948baf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666340543, "uuid": "90b24209-19e7-4f42-a358-bf2c5b79f5ec", "comment": "Malware payload (njrat)", "value": "544b882393001f975b23af4e63f118f8b252976c20e68ba4ddaf07b9bf0bd283828fc187b598fd15507ae4768fa0a1d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340543, "uuid": "76149b4d-f896-4388-b086-80e80ca536d0", "value": "T1A6C1D716F3D95377CE7A47BAAC7753401278B7509D93CFADA8C4615FAD023020F62A64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340543, "uuid": "00566674-174e-4dc1-a8cb-cef6f8ef8136", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340543, "uuid": "6c1d3222-9211-44cb-9df2-8bd9810939af", "value": "96:ui0tKnX+JSOETj/uR+qJ3QeLz3v235zNt:8tKuclj/uRZge/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666340543, "uuid": "42e0a822-618d-4abb-9f02-933c3a9e7055", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666340543, "uuid": "804419c9-350a-4659-9446-d52b2c2f3a42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666340543, "uuid": "b3a9f15b-42df-47a1-8f32-465fda8f3900", "value": "PURCHASE ORDER_203974.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb2e55e-511f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343124, "uuid": "057825e4-72dc-4bd6-8870-1bba4b3e2379", "comment": "Malware payload", "value": "503c178db8b1028775412c5779df659f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343124, "uuid": "7e14b318-4a06-4ebb-acde-ccb4c67fd18c", "comment": "Malware payload", "value": "e7a6925f0fe03108b965a3cf9f2fe1204add376ecde68bafd872e9d828d762e9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343124, "uuid": "207894d3-f2dd-404d-8fa2-5ed3383d6e70", "comment": "Malware payload", "value": "37af82f8efc9aa53cd05234e5c509eaeb4e0d810", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343124, "uuid": "abf2f57f-507a-48d9-b18b-4a24ed233f17", "comment": "Malware payload", "value": "71e7ce755a13798714adb21be1b02f7fd3aaa2b020463871531420447bfd552f234135a45c6fe5c6a2f6d6cb4a6dba64", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343124, "uuid": "a5ef5cf6-0722-4845-9cb9-c3966143b813", "value": "T1FA85E183FB14A86EC4F783368A7606A695075C658743E3834995B33C2DB7DC05E9AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343124, "uuid": "bf204210-5bec-4639-9ad0-7c76ea2199f9", "value": "49152:R91Oi2VgpKBm9zpIqA2Q+12YPzGhCWo0QgC7+:j1Oz1mdpb+Erko0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343124, "uuid": "43134dc4-8a4f-41ce-85f0-28a845b7d55d", "value": 1829994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343124, "uuid": "946a23fc-216e-4c10-9bfe-170ccec50130", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343124, "uuid": "0fcbe561-312f-4b2d-98bc-d1ec7bfdea8c", "value": "e7a6925f0fe03108b965a3cf9f2fe1204add376ecde68bafd872e9d828d762e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b3c0fb1-516d-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1666376510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376510, "uuid": "6706f9cc-6e5a-48a0-a5f9-eb6f434e918b", "comment": "Malware payload (Mirai)", "value": "f4de747c087551938aed8c9ebdac9014", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376510, "uuid": "b4100bab-cb44-40a5-ad03-54ec86c2fa99", "comment": "Malware payload (Mirai)", "value": "e885fa64b5641b395d73d41518b3b2236cf794104d1e970568e40da0938232a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376510, "uuid": "0b747825-c319-4fda-a771-fe6c995b0456", "comment": "Malware payload (Mirai)", "value": "a8feb41b6d047aa0fa0255e7e2554aec2c6f4a38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666376510, "uuid": "2eefadce-6e9e-4e6b-bda6-ed31595c3345", "comment": "Malware payload (Mirai)", "value": "0d82257272c4cbacf7e44fc3623fc3d5d061463c970eadb679bacaf1461f61f5e0b5ac20aab55718c3cc28999d80792d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376510, "uuid": "d135e56f-c1fe-4f70-9344-7effcf5ee092", "value": "T1F573B309BFA50FB7EC9BCC374AA92712288D651A35A93F35BD34D418F25B21F15E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376510, "uuid": "e99408a3-28d3-4509-bc02-2bdfe604d7f3", "value": "1536:aHJtIFGq1QuT+uDEQhKvt191Yi8ZNFDGZ:aHJtIM0T+UEQPi8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666376510, "uuid": "8aa3a9aa-1e62-479f-b4df-34af15c48470", "value": 76904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666376510, "uuid": "63d8b2e1-c4ee-45ea-8911-e54b954f7109", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666376510, "uuid": "bd8d48c2-95bc-4d22-9ff1-d9d3f6e4f73c", "value": "f4de747c087551938aed8c9ebdac9014", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4fab03-5117-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1666339844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339844, "uuid": "e9cc468a-f0cb-41cc-a2dd-21ebb71f02e3", "comment": "Malware payload (Loki)", "value": "b0359a750bd028865ad4694d5b043c4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339844, "uuid": "6c13a7ef-b4b0-409a-9bc9-d572218c21a5", "comment": "Malware payload (Loki)", "value": "e92b0f0a2e7d876b2c46f0e46891bd2246d43f24e4e5b8870d56a440f60bae62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339844, "uuid": "9eae67ce-f588-47a4-abaf-4c274b281d7b", "comment": "Malware payload (Loki)", "value": "e5c3c2e66b920d20ce7db26ba80f13db4235abc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339844, "uuid": "08e04c01-17e9-47b3-ab90-6d2d3c44ab42", "comment": "Malware payload (Loki)", "value": "eb88073aebe089c5fbec71282dd6b13d7185d0421b0a42c836764adc8b2ab2d3983ca54e01f9b1594288144362fe9757", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339844, "uuid": "5c61235a-508a-4331-915b-d9071b0484af", "value": "T18A15D2BA2280255FD556B571CC83D8B367F7AD696236D1C370D30F6FBC480BB8A12296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339844, "uuid": "a788efc4-8c17-415a-9811-691f5c9d71b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339844, "uuid": "c25fd992-6ce6-442e-a7dd-c2849b40bdfe", "value": "12288:KPjVndifEuAVqcZvrp8b0N5ut/LBhcjXpdxmqBdo5j6mV3YwqCO0NO+olGV/81l:Q+cZWb0ut7cTdcj6mVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666339844, "uuid": "b9d0e373-ecc8-42fb-94a2-e58065f15c6c", "value": 923136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666339844, "uuid": "6fdc5663-8a18-432c-92c3-adf49ebada73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339844, "uuid": "fb456685-4bc2-4991-9daf-0b40e73de250", "value": "b0359a750bd028865ad4694d5b043c4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78e618e-5101-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666330306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666330306, "uuid": "87901301-dc64-4f1b-8038-76cc76475199", "comment": "Malware payload (Smoke Loader)", "value": "6e317ed0a411bdf0b07b884284e685bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666330306, "uuid": "750cd93d-b898-407d-aac1-3f5859a73dc2", "comment": "Malware payload (Smoke Loader)", "value": "eb140feed354d043930bebbc1175d26f6c82a017e339c1da938e63256193eeb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666330306, "uuid": "3edae1d6-02c7-4ae9-9c1f-717955f42d52", "comment": "Malware payload (Smoke Loader)", "value": "7ccfffc8a2bef1a53d135710120b870d1fec5f2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666330306, "uuid": "6d60b0bf-e29d-47d5-aca0-7b5ca24ddb5d", "comment": "Malware payload (Smoke Loader)", "value": "ed5499b0e4b063c62f6bdb529aa2187901db37b7a32b33a8d2c4f29837797c31ff48ca17adff0458fa4dbca0df062127", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666330306, "uuid": "e1001654-1e0e-4a4e-8e26-e085df1be464", "value": "T12614D01175B2CCB3C4B688348766DBE0767FA871267A8A873764132E2E703915B7634F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666330306, "uuid": "ee192296-8cda-477c-9aa7-2e81497f7e44", "value": "3e6038f4356f890c26b700ce3212574e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666330306, "uuid": "f44ba98f-970c-4556-b0cc-3ccfb5c950e0", "value": "3072:aXD07rLbq2k45VGz2UygyM0Mdq1eEohLm0K+3ob:6qrL2toGxHYIC0TYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666330306, "uuid": "fb64b194-c810-4fee-8943-b1dece32ae1a", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666330306, "uuid": "0c5ca1f8-feb6-4656-8e58-9668dc153b5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666330306, "uuid": "cc7c5d67-6c29-478f-aaf0-23371c886f7b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfc3db6-5184-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1666386339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666386339, "uuid": "5d22fd20-108d-4905-8535-dfb6fd715c2b", "comment": "Malware payload (DCRat)", "value": "035388362bd67081a71b41d75310d50a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666386339, "uuid": "b63d9464-82f6-4bb5-9afe-b13ce1a6f23d", "comment": "Malware payload (DCRat)", "value": "eb70df28d5b1a84129fe24f29d87d2ad73ff8869ebc725a87deb9f0fbff4b5ce", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666386339, "uuid": "c66e5570-97c6-48b2-a6b7-60306787ea59", "comment": "Malware payload (DCRat)", "value": "5e68aec9cdec49349cc4a6cf838e782c547cdd3f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666386339, "uuid": "61019315-4900-4611-b4f6-112c60b0f5a9", "comment": "Malware payload (DCRat)", "value": "f35ef6039c70f4765c1a68a3be66ba59e846cab796eec20d3a550a9fcd8d806fa229fdd04a4e7747e9c2ddd5ec947a94", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666386339, "uuid": "6a33245d-5876-4ed1-a5ae-8a1fa8378ac6", "value": "T191D5DF027E44CA01F0195633C2EF454887F4A9512AE6E31B7DBA336E59133AB7C4DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666386339, "uuid": "1007782b-558c-476f-9537-725e6dd385c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666386339, "uuid": "e13aa5dc-3344-40e6-a44f-483f6b607b6c", "value": "49152:ZqCsctL3DxiZWjUs1PnUxfRkj4RjZT8iA9zeADpewwwUqr8N:ZqpMLFQXsuxfRkjoS9zpdewwxrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666386339, "uuid": "3e374f8e-7a8d-4dd9-b5ed-0714178b9cd0", "value": 2897408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666386339, "uuid": "709b15c9-f76e-42b9-8019-df84a74ff58a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666386339, "uuid": "10853d5b-5b50-4c17-9831-a4b79c481c4b", "value": "035388362bd67081a71b41d75310d50a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6de06ff-515d-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1666369846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369846, "uuid": "6aee5543-087f-4c6e-8354-a7a6dd91014b", "comment": "Malware payload (RecordBreaker)", "value": "040a29b44bb2466225c69518dc95d59a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369846, "uuid": "1822f2f2-be00-4519-9658-5655fbb76779", "comment": "Malware payload (RecordBreaker)", "value": "ec15e6c1ab8771e787fd3fcd0b25e6f2c1a0a540717cfd5bf45991c03de1fa2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369846, "uuid": "332afd32-5aed-4ad0-ad81-bc6eff986ebf", "comment": "Malware payload (RecordBreaker)", "value": "42438a7da41dda9c5bd8ddf97c52eb9eae7d2481", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666369846, "uuid": "f8da2432-2ecb-418c-93e8-6ec817653cbb", "comment": "Malware payload (RecordBreaker)", "value": "df6cc26c820b437b32f8b2a6b3ce79619746af7ff31ed8db9487f7b07f37c94009921b05e81d28e911bdb6bbd91f2f68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369846, "uuid": "e2db54d6-016e-4543-adcf-df26f8954c10", "value": "T14143F88A15C6AC23C16244BC62CF7626CBDFFD03EA25E04F7B4617877BE069185193DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369846, "uuid": "5197fb75-4e09-4fbf-bc3c-35911ad4e98f", "value": "94482195a14b2f0ff3fd77f07609274d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369846, "uuid": "8ffa6623-b5f8-4d91-9ca7-afa24df7999e", "value": "768:8qOKi+7erib7i6DcJKUU1HTbqHymKYGkHrYb1sIz1Mi0MTGVq123VEcBehZVDBlR:jky1EMd1KEWexDDRcpdUooIdYfN8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666369846, "uuid": "149eb1e7-10f9-449f-8dc5-b1a1674110f7", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666369846, "uuid": "9b863751-8bbc-4ab1-a4ca-84dbf3b4c5ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666369846, "uuid": "64800a19-9a38-4f56-a603-8acb505eebbd", "value": "EC15E6C1AB8771E787FD3FCD0B25E6F2C1A0A540717CF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb103a26-5110-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1666336889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336889, "uuid": "142cee3c-d535-4ff5-ad1e-95617e7d0e28", "comment": "Malware payload (DCRat)", "value": "93b1b73283a7f2fc2ed2c03a7a6eb1cc", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336889, "uuid": "fa9d111b-f5cd-4619-9952-64a507290b90", "comment": "Malware payload (DCRat)", "value": "ece5d984948d86af69547410313ff98743d52586a649ac7d132900a27864432a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336889, "uuid": "1835884a-b865-4efc-a66b-865278aa069b", "comment": "Malware payload (DCRat)", "value": "46ea510204654f88c813b580af24860085f4bafc", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666336889, "uuid": "0e7f0ec8-a81e-4a7b-b7ba-49cb76411d2e", "comment": "Malware payload (DCRat)", "value": "5c2bbdc145ff49980aa5bab9f90cfbe043b63742e83dcfff9d5067fb189fe7dba7bc786064d69d2ab9ba16d2fe8602ba", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336889, "uuid": "67e64e24-ba68-40a3-baf9-dda120081477", "value": "T1BC657B017E40CA21F0181633C2EF454887B4AD526AA6E72F7AB9377D65123B37D1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336889, "uuid": "53f8f6c6-53cc-485e-b657-5fa1c215ec63", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336889, "uuid": "ad6919a3-e4e0-43fa-88d9-c668c1c620da", "value": "24576:u2G/nvxW3WieC1Ab5W7eGoXKQZc+J/E11cCdbVkTQD33:ubA3jOb5WTeZc+5CdbV8QDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666336889, "uuid": "211e9703-002e-4333-bb21-ec844f38de02", "value": 1487622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666336889, "uuid": "186d97a4-c720-45d7-9cf7-590f049a74f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666336889, "uuid": "81af3ffd-3c4a-4183-bcec-d5857ee69335", "value": "93b1b73283a7f2fc2ed2c03a7a6eb1cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0400e6-516a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666375327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666375327, "uuid": "44eabab2-7b9a-4e1d-be61-2cd8493a78b6", "comment": "Malware payload", "value": "8dd0a3db1fd1fc29b26e65d50f27b3ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666375327, "uuid": "b960dd00-2960-4bfd-8d57-d04947fceb28", "comment": "Malware payload", "value": "edcc696b6fce95520e5018fc8cf00041f813ed4ea4d4244c2215b9abd2265939", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666375327, "uuid": "0964f021-e9c4-4bf6-afbd-b9132d8dee35", "comment": "Malware payload", "value": "c650b1726af43a277efbf65134e826403621e114", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666375327, "uuid": "7129abcf-3036-4ec6-a00d-afb81d6dc4a9", "comment": "Malware payload", "value": "6872655fd94c17461a97bacc9cc8414248c8aa80a511cdb835c5b88020b32ede79733f7c56831561564a67c700a77765", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666375327, "uuid": "9c7e0e91-9aef-4848-95d9-1e4111b73bdb", "value": "T11A740111F992C872D48655304864EBA15ABBB9B625754F0F3F6977AE6F302C30A7330B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666375327, "uuid": "cffd3f14-d05d-4f41-8d76-0d4de63bb786", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666375327, "uuid": "d843c3d5-b4ed-43eb-8364-57a5ba2e5054", "value": "6144:5jELNvtQVLJAV/UgQZSEB80JoFLCs+xcVhDZD8dXOWzf1Xbo9m8yfNqXIn:5jExviVLJAVM15O0mFv+OV7cBhXquq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666375327, "uuid": "e0094df2-2c62-4470-8d85-6eac6b6a9337", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666375327, "uuid": "4bf53eb8-aaf1-4406-ab37-b66ad42d9093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666375327, "uuid": "f854d015-a0cc-44f1-bebd-2966791ca81c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231c715e-514f-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666363585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666363585, "uuid": "1043d4cf-0ae8-4e8f-bad3-f60573e2657b", "comment": "Malware payload (Smoke Loader)", "value": "3a9ce5523db8a26e556d8e12888036ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666363585, "uuid": "1ca26250-df2e-4379-90dc-961382c1011e", "comment": "Malware payload (Smoke Loader)", "value": "eea899d2674e15f70cc95dd8a2d5e3dc883b709b84e6bcd6d953a6e1d5bfb64f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666363585, "uuid": "ace45d1c-8d8d-4502-97d7-c7213afd60bb", "comment": "Malware payload (Smoke Loader)", "value": "c24294b2740557558f11518c1246f4dff4eff1e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666363585, "uuid": "66c74dce-877b-4b90-b0bc-b10e9ed49221", "comment": "Malware payload (Smoke Loader)", "value": "e5a515036686637c43370572c59cecce99c0b38071d0321499244426cf539f100d2745f02b59632dee32e834a420f968", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666363585, "uuid": "5a496d7a-e387-4911-8d5a-f73983003ee1", "value": "T1CF24E101B5D2D4B2C48214358874FBE41ABBEC321671D94737693B6E6F312D25BBA3CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666363585, "uuid": "a7da48a6-b718-4ffc-965b-e0c478318c31", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666363585, "uuid": "5414d2c7-9404-46e3-945e-187c62a52951", "value": "6144:DnJLO+0QotZlS6Txu9EEC6o/NewrI7id:DnJi+VorDT8eEC6MewE7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666363585, "uuid": "1e0ca88e-7d32-460d-a6a7-9b601ffd2611", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666363585, "uuid": "adbe7336-caae-4f8a-8895-616184a1c564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666363585, "uuid": "2f90e03f-bd56-4b24-ae62-20243777b588", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0cab1f4-5153-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666365567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365567, "uuid": "456de47b-1cb7-4487-8dc1-0ad4710a9b41", "comment": "Malware payload (AgentTesla)", "value": "a651928033ea1ac11f6bb91b3db81af7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365567, "uuid": "c7e8d01f-69d3-405f-8397-c9023516a163", "comment": "Malware payload (AgentTesla)", "value": "efe75dcafb9ef82bc672302cba2e38dbbe7b5b8526694a7de247b8f39b308a41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365567, "uuid": "9c6c456e-ddb1-40bc-852e-a088ec92a5ea", "comment": "Malware payload (AgentTesla)", "value": "7548884752eba5949da10a8847f55c7eba7f7bc0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666365567, "uuid": "43cb601b-6b98-4f71-94d2-a129126181b2", "comment": "Malware payload (AgentTesla)", "value": "868cf4d5633f6f4f0c2eb0a08f33ec6f242809aa53ad291af5184fe50e6a3dc65489f2f0a8f8dabe828eb1410bceffb3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365567, "uuid": "101cebc4-119a-4a68-888f-741dd20c09a0", "value": "T1D605CF7C3B441C83DD5E84B5A85D019186A1B82DB214E90F3ED2FC29C7EA6FD0E9A5DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365567, "uuid": "b2be61a8-77bf-4426-8e32-a6a571521435", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365567, "uuid": "f25c1098-a4db-41df-ace3-2cdf89a60bfb", "value": "12288:rbSPpwn4MCQo4EHM24E9HlVBMgHbxs5Bsq3eZwCSb0t0Xof7yADuLjNYErXWAB0r:6owJHt4CgLCToO4NPqg0Gw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666365567, "uuid": "e4165622-8bb8-4e77-b400-e64ec684ab59", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666365567, "uuid": "ddfecea0-04cd-4b01-ad37-d8679fd5c35b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666365567, "uuid": "29d0eae6-828e-4dc6-8cd6-ab6a8bcb327a", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca098063-511f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666343249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343249, "uuid": "8765b3ed-db0b-42c5-bc75-937db1c88b9b", "comment": "Malware payload", "value": "ac32ffaa379aed78dcc11ea74fbdfcfe", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343249, "uuid": "40b4570f-8966-45c2-a038-0fa89ac41fb1", "comment": "Malware payload", "value": "f1728125f37ca8738b19b418a3fe896e9bdcde5aed6559db3eea55f4e17602c4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343249, "uuid": "464f9027-20e3-4635-97ff-c98bba6feebc", "comment": "Malware payload", "value": "7555f5c5e70d3b33a35e9db9a6cb5554b38ad9f3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666343249, "uuid": "69456255-c980-4d05-b5a3-8bc2dd070cf6", "comment": "Malware payload", "value": "6425bd32bea238b7915dcef0f82e4c91551700884cffdebac00ce3e52b0e2e7181fbcf93dc694af562ea6c24c2e9399c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT C50", "colour": "#9016BE", "exportable": true, "hide_tag": false }, { "name": "APT-C-50", "colour": "#C3590F", "exportable": true, "hide_tag": false }, { "name": "Domestic Kitten", "colour": "#F65E39", "exportable": true, "hide_tag": false }, { "name": "FurBall", "colour": "#41E48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343249, "uuid": "7e8e01a4-5427-4f6f-85e5-1c88ce77309f", "value": "T1C5E522D3F32AFCB5D12BC93693760687B9244D818A50E32E325DF1A85FF7940C64CA99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343249, "uuid": "94805423-d021-4830-a1e3-ea75dcda4699", "value": "49152:RaM48Ab7zE93DIN03mSGjHGCPAWyQ05dqX6VszSkvQ+5NvCCYEkdw7lChD7:Rz8fHrofQAdqKV6SkowC2kayn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666343249, "uuid": "fda57203-1445-4710-8a45-7bc563e828ae", "value": 3310316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666343249, "uuid": "ceba5fcb-f3e7-495e-8c09-0ec25516d066", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666343249, "uuid": "cc5398ee-dc14-4498-9cb4-f0884edb4400", "value": "f1728125f37ca8738b19b418a3fe896e9bdcde5aed6559db3eea55f4e17602c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba823348-5139-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666354390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666354390, "uuid": "2212b3ad-2bc3-4a8e-970a-05e1e0c740bd", "comment": "Malware payload (Smoke Loader)", "value": "daed8129439edb464becc2a544b55f6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666354390, "uuid": "1dbe0d9f-5594-4147-8138-07936a4d31b8", "comment": "Malware payload (Smoke Loader)", "value": "f1f053c7dcc5cdd0d65a8420acdaa7f0d45d8b9406a098e3e2b622d498e7cf35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666354390, "uuid": "85c073c2-03b9-45cd-9b63-d8873ea61ebd", "comment": "Malware payload (Smoke Loader)", "value": "88364358057e7347e222dbcab143c11dda4c4647", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666354390, "uuid": "4bedae20-386e-4cf7-be6e-4fbca25ed457", "comment": "Malware payload (Smoke Loader)", "value": "9d0f4fe4b7e0d0b2a85e11a04e9d482fca979f6d7b0aca41354f4e7f472a5e2cf049b8d836c496679f315af3809862fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666354390, "uuid": "47def416-de92-4e66-a01e-b999eec2e66d", "value": "T16814E010BAC3D472CC8611354824CBE56ABEF83216745D4B376837BE6F712C25AB635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666354390, "uuid": "643fbb34-e63f-4997-81ed-85bca0f01ab4", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666354390, "uuid": "ea384128-ad16-4a86-8841-2d23e242a390", "value": "3072:/XS58LL3FQfz5vtOOi4fTxBo0MUhRURlVaoZGfT5:vq8LLFQfnOOxDMUhuVJZG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666354390, "uuid": "2a0d410a-3da1-4a88-9bdd-dede3b16dd6b", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666354390, "uuid": "69ccd254-e5a6-4fef-bcc1-5439e0afb648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666354390, "uuid": "a3570ff1-e732-4167-a69a-863cda33bc80", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2c755e-5114-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1666338426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338426, "uuid": "82afeb80-783f-4899-a6d6-86bc1bc27348", "comment": "Malware payload (Stop)", "value": "8ee2efd7996707befe2ca2bf4cdfc789", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338426, "uuid": "b3034db8-afa1-47ed-b288-7c066534385f", "comment": "Malware payload (Stop)", "value": "f22cb21254d0c99ea66a20feb10d96e069229ea848d461632c0c86b38799359e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338426, "uuid": "644c9940-fece-48aa-b334-854cb5d30ce7", "comment": "Malware payload (Stop)", "value": "176dfff1a8c12f0574b99292807c12ba11a1f04b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666338426, "uuid": "0abe22f9-dffb-4b9b-bcc6-8bde84633a45", "comment": "Malware payload (Stop)", "value": "259e7da44e684ebc670ea6fa79243086dbb0072d91fe147624a5138f3c1f715b26ec9e24dfcee67e495186950574d420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338426, "uuid": "189bd004-3389-4391-988e-d61f6d160184", "value": "T166F42225F083D835D06918744DA5DFEAAA7F29306627C92727D82F7D1E312D022B778E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338426, "uuid": "e980c63d-012a-4341-acd9-4d5738207e73", "value": "ee783376aeb5a6ccd1e2676f1a5f0e82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338426, "uuid": "737af2c8-449d-4b36-9ba4-60da862fb9b3", "value": "12288:/rqoqHZAyLP4U9ouyj3uI8G8gRf47iAwz98fXP7UMA5OcR5JpsgOuqNl6jGF:/tq5/oJj3uIi7hwzEPr4NrbPu2GF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666338426, "uuid": "4e9774b2-23b1-4754-8fe0-c0aa67b65ad7", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666338426, "uuid": "13b6b753-c953-4949-ab0a-4d2078592873", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666338426, "uuid": "c996ee1d-cc42-497a-a9ee-3f23f2e10726", "value": "8ee2efd7996707befe2ca2bf4cdfc789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee1c83f-517b-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1666382449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666382449, "uuid": "3108c588-ae89-4fbe-a9c2-abddc5872a11", "comment": "Malware payload (ArkeiStealer)", "value": "151da4f7f535575170747aec0f012a57", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666382449, "uuid": "316b64fb-1efd-462c-b69f-9afbd333bf80", "comment": "Malware payload (ArkeiStealer)", "value": "f2c2d735264db1268968b67726e749f5ee765e87c7af8c9f75ec6b5881bbd550", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666382449, "uuid": "6342866f-9b2c-48eb-8ee7-a96e2a9e5702", "comment": "Malware payload (ArkeiStealer)", "value": "f9663d0036e66aa68eb2a30b6b8c9acc582bf548", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666382449, "uuid": "60d02b30-0f28-466e-bb54-d122eac8af3d", "comment": "Malware payload (ArkeiStealer)", "value": "c79e37ef3a5b7e298ffb39758cff95f6f103d73bd9c6862d625624c4d98c1d92f3bd2109215f59720d5afc88a36c03c0", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666382449, "uuid": "8ddcd495-69cc-4869-b89c-0d59607332fe", "value": "T1E036AF01E7A1C038F9F712F94EBE61AD593CBE90172484DB63D42AED4A35AE0AD31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666382449, "uuid": "3a26cd1f-2702-4266-ba1d-f9fce5c646ba", "value": "19ffe6b5d2e90a03cc214c985ae1a0ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666382449, "uuid": "974109e1-6969-4309-9d35-94c6ab9eea7a", "value": "12288:a0Jou5QBtIc2sVY1SRnuRLxuoPsuo/fX4Pzzjbp1:a0JdLsqEQRpyX4Xjt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666382449, "uuid": "f1431907-8d38-4879-ba1a-1aac3d97433b", "value": 5214208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666382449, "uuid": "ea3e4a1d-6479-4ac3-8cd4-abdb8644f2e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666382449, "uuid": "8466b03b-c1d9-4853-9568-94b3c86cf005", "value": "151da4f7f535575170747aec0f012a57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd732759-513b-11ed-9266-42010a9c0072", "comment": "Malware payload (Ermac)", "timestamp": 1666355361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666355361, "uuid": "aae41041-a067-4c98-81fc-389bafaefa08", "comment": "Malware payload (Ermac)", "value": "16e991d73049f1ef5b8f5fa0c075ef05", "object_relation": "md5", "Tag": [ { "name": "android_ermac", "colour": "#DA1E11", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666355361, "uuid": "ae351b55-d106-4ebd-8718-bd63433c3a51", "comment": "Malware payload (Ermac)", "value": "f4ebdcef8643dbffe8de312cb47c1f94118e6481a4faf4166badfd98a0a9c5d3", "object_relation": "sha256", "Tag": [ { "name": "android_ermac", "colour": "#DA1E11", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666355361, "uuid": "bb539c25-2a74-490e-9938-e977a808a674", "comment": "Malware payload (Ermac)", "value": "79b5c686478c3db742666068d3835eb3409af32a", "object_relation": "sha1", "Tag": [ { "name": "android_ermac", "colour": "#DA1E11", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666355361, "uuid": "f5f739ab-8203-4377-b396-5834a1249b80", "comment": "Malware payload (Ermac)", "value": "e21cccc8602e5f5883b0a0311a8b96738fccb7d80710344eba680c01be8d3eec7f04708ab65d0bf1d6959ae49281728f", "object_relation": "sha3-384", "Tag": [ { "name": "android_ermac", "colour": "#DA1E11", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666355361, "uuid": "945e1a51-df25-4c85-af90-1eabbfabf6b7", "value": "T1EED5F141FFA5A49BD4F3CE3442A6C256410B9D95CA1BE34B0E51783C9E778C0AE4EED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666355361, "uuid": "8f646cb9-90ac-4920-863e-ebb13fded217", "value": "49152:Y/cThIEUoEPCM0FjUT8uD4f14CUnA6CKe8NbLDMR:YEFIdP9q9GTn9CctX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666355361, "uuid": "7aa49f20-cef2-4665-850f-48eb1024f9fb", "value": 2773389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666355361, "uuid": "1ca4e966-b09f-48e8-90f1-f44e7bbc85c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666355361, "uuid": "b4da920d-f2c3-4826-b8e0-9ea9e078b00b", "value": "paypal.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc033e0-5138-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666353774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353774, "uuid": "80028976-a601-4149-b3a9-8f1f9b2f70d9", "comment": "Malware payload", "value": "e3de6b7dc49d10f792039d91e1ff05f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353774, "uuid": "c8a44bdf-b87a-47a0-9dd9-7508a4eca73a", "comment": "Malware payload", "value": "f55ec01d2ba745b1d5b0c02f012a3a1d3b46f5a3a0e3d214ccee5504dbdef614", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353774, "uuid": "9ca46b12-73d8-4f34-9b43-73620223d7f9", "comment": "Malware payload", "value": "643af4819752f65b0ae7ed6ee90d07ea0b157eb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666353774, "uuid": "76c2957c-db36-4588-abc0-65df152660a9", "comment": "Malware payload", "value": "ff5e31c015417523d2c1ef4f25e16a8fca01b6c9a22f35c7ac84ac0410a1cc7127fbf070a93af3effed63ae9d59c47df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353774, "uuid": "ae0bff15-6d4f-4460-af23-85e172468f3f", "value": "T11A763317B1E35A76D3129CB246A22FE9B9F5C41D0DD48ABF3338690E1F3D80D5689B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353774, "uuid": "c70f17c3-b028-44be-9dd2-e59087038431", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353774, "uuid": "e51a839a-a155-45d3-ad4d-674a6dedda83", "value": "196608:91OemuiOeunyuXjHEiVK8lj2ISScSLM7QEqcOewwyvRiq:3ObFuyuXL5VK8UISjTiRwIR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666353774, "uuid": "f3fb447f-109f-472a-9b3a-e849ecf3c7fa", "value": 7601024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666353774, "uuid": "4848b6aa-5784-458a-9a1f-cedaf7a7912a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666353774, "uuid": "174367e7-aa2d-49a2-ae32-4a07c681ad1e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b83ce40-5157-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666366981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666366981, "uuid": "6ebbbc14-ce74-4c62-ae96-eb0bd1eacbc7", "comment": "Malware payload (RedLineStealer)", "value": "addac1bb4f178f28b597313f628be173", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666366981, "uuid": "07860af5-2865-4048-9d5a-b3d1bf8074c7", "comment": "Malware payload (RedLineStealer)", "value": "f5b5010846f8b9d120cafe1f08ecea43ed3db53cce2c4e4bf166c67dd15bb183", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666366981, "uuid": "ef8879ee-2d88-4199-a60e-763a41a18595", "comment": "Malware payload (RedLineStealer)", "value": "0745e58ce9f124dcb73764bd87fc46ca562ae2a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666366981, "uuid": "8486a1c3-8ecc-4ed7-8ec7-ccc3983d5184", "comment": "Malware payload (RedLineStealer)", "value": "039731fbe054fab5295c31394cc2570e4c1b318e8edb105370b00abf7037a9f9c2f80984c0a7a9a0ec28ad9df6c23773", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666366981, "uuid": "ddc326ce-9c5f-4c9b-b6eb-5932eff7b754", "value": "T135740111B9C3C8B2C9D685344426E7A109BBE47125760B5F3BA47BEE7E302D3197B31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666366981, "uuid": "ea2a3577-6845-4d59-8df3-0982ed831a7b", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666366981, "uuid": "9ea1d01b-d784-4e56-9b64-af3d7f3f4797", "value": "6144:bdsLh5DQbUkX6eOYkszHXQ63E4bH9c4iNciAOwkrH0COPog:bds95cbVsq33u4zOwkgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666366981, "uuid": "71d1945f-6321-492d-8d6d-698f717707d6", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666366981, "uuid": "1abfd08e-4d2a-41c5-83f0-791dde5b303c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666366981, "uuid": "ee9ac5b5-5115-4d7c-be39-3f1c161673de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b19253c-5147-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1666360162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666360162, "uuid": "dd8b65a7-f4bf-4810-abfd-90350cc71a24", "comment": "Malware payload (RemcosRAT)", "value": "a985919b15acbc5ddad3d441d90bf319", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666360162, "uuid": "93f2d4f1-3de5-4132-827c-81605a9509bd", "comment": "Malware payload (RemcosRAT)", "value": "f5faaf973c1d19ec62c271762f887d0a419e5d17ffc8a385e13728867aa1620a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666360162, "uuid": "8b197473-c9b8-4911-983a-dad830225638", "comment": "Malware payload (RemcosRAT)", "value": "afc7547d84a7e74469943bd915838f2f91f30bc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666360162, "uuid": "415eded8-78b1-495b-88dc-dfa0983e854d", "comment": "Malware payload (RemcosRAT)", "value": "58516fd35fcda1fdc73acb554243889f37b6a3943b34bb9cdef23b208d6c5ec84e640095e83010b1ba0c4f2a0f4297ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666360162, "uuid": "2415e6fc-8d7a-4bae-89c6-e48746e2dc6a", "value": "T1EE656ABA22D0229FD426B1758593EDB366F76D221116D1CB50C30F6FBC482BBDA12397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666360162, "uuid": "628da1a0-d88d-469e-9bb4-897c89985593", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666360162, "uuid": "88a93343-a962-45e7-9b7d-af683db79468", "value": "24576:/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxNusszOgpAho2:Ngpya1JPI9bgwB6lk2DmaPFdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666360162, "uuid": "c4aebfe9-dbc2-4eda-b36b-a640300f214f", "value": 1428480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666360162, "uuid": "09ccfe6e-b9be-4ce5-a6c7-cca234e857be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666360162, "uuid": "74a58856-fc7d-45b4-baf1-583ac4c7c331", "value": "Purchase Order PO # 808006408.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447d402a-512b-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1666348179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348179, "uuid": "b137d45e-2748-49eb-90ee-ceb88fd61d1b", "comment": "Malware payload (AgentTesla)", "value": "cdac45a2bff96024dde9e114083446bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348179, "uuid": "582d1a6a-9e65-4385-bce4-6ca33ccaf882", "comment": "Malware payload (AgentTesla)", "value": "f6f06166948a55fcb84416c7a3f410e36a086c4a86980d2571e0055a5e1ff9af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348179, "uuid": "32f7356d-c822-4ebe-b062-6d0e7d59ec96", "comment": "Malware payload (AgentTesla)", "value": "564eaa4ce5c43b1827cfc5ab5e18fc380a231833", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348179, "uuid": "26354c65-1e2b-43d1-b823-60fca92ac927", "comment": "Malware payload (AgentTesla)", "value": "534cace51eab0ec7d64f37a1718762e33bc33d2719be6e09eace36bd866edcfd7ddf3c1e0b0b157398314f4270b6acd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348179, "uuid": "bc0f9106-c32c-4243-a50e-87bdb8644640", "value": "T112053A2839EB421CF87A8BF99FE7B4CA49A7F6212129B4DE14AD43464533E44CCD3635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348179, "uuid": "53bbf0eb-6f27-4be4-bcf5-b8904b8f0218", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348179, "uuid": "377335f4-146e-4917-801d-fa3d3bec4535", "value": "12288:B94sG4DA7nzCQo4jM2Dr+geEVA4/GYUmQhrUH:B9NqeKr+pWZ/Qho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666348179, "uuid": "c5911130-5948-428a-9c1c-0cfb34668075", "value": 833024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666348179, "uuid": "58c126a2-5871-4315-a655-d5ba9d394e86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348179, "uuid": "b8af034d-5dc0-4b33-a538-7d8f9e5a3cdb", "value": "cdac45a2bff96024dde9e114083446bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2535c974-510a-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1666333953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333953, "uuid": "40966fa3-bb7e-4da5-8912-59b492819011", "comment": "Malware payload (AsyncRAT)", "value": "3717491f7b1a90aaa5f271ab14147a9b", "object_relation": "md5", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333953, "uuid": "787f97c4-f5d8-4b25-84b8-2a98baf312f2", "comment": "Malware payload (AsyncRAT)", "value": "f744c46e4c678d65d9682a0f42dc2b82277ea2d879eeb3d708fb70af2af40a94", "object_relation": "sha256", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333953, "uuid": "035fc15d-fa79-4380-95d3-323a8a91b322", "comment": "Malware payload (AsyncRAT)", "value": "bced873bf58c79d2787d8ea501e7888b260d36f6", "object_relation": "sha1", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333953, "uuid": "8feef2b9-f2da-4c16-aa61-dbf8f2f9c157", "comment": "Malware payload (AsyncRAT)", "value": "9f23ea344ce45eae89ed8a1d8c2080873976c7ca0142b79f72c4e9371ff1b363d58289af0edeccebfeec5bea4f985635", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333953, "uuid": "4593dcb6-24d4-45ae-ac69-3118b4334214", "value": "T1F5D22A066B54E377DBDC1BB8A86313010775C1A7A903EBCA6CA460F60A173DB27256DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333953, "uuid": "5926a408-db8f-4fa4-b017-13d3c0c2f8f4", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333953, "uuid": "eb17dd3e-b467-47b7-927b-f17e72db36d2", "value": "384:KyQLebQc3aImZ5mzk2yKajPdseXGLN0phDbuAyso4bNmLaNDNCsQKbQr1jIC8:/i/bbUyPMeBbI1AQ50C8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666333953, "uuid": "4f5b2329-cefd-4454-baf1-c6315defddea", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666333953, "uuid": "0f8ad0cf-1e76-44aa-88be-68b2b81bd9e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333953, "uuid": "e5e77150-f5ed-464f-8fbf-bf67f4e7820f", "value": "Logger.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de387e78-5142-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666358315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666358315, "uuid": "14ad7716-4c7f-4bd9-b9b2-c636ecd9726a", "comment": "Malware payload", "value": "3b0624e7f847e435a0067e2e0e95a258", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666358315, "uuid": "0b833503-3ce5-4282-803c-ba51902ab29a", "comment": "Malware payload", "value": "f942890c67287fc71ab2e6bfa826ed31a8338c54e1a767ff8d387780501ad80a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666358315, "uuid": "5a840a98-2b9f-4710-b60e-2c4a5f28cf80", "comment": "Malware payload", "value": "a812a9d27077675bb46f46b91a2195cbe5780a11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666358315, "uuid": "58f3f05d-80ea-42fa-ae31-e0815db2c457", "comment": "Malware payload", "value": "e3baaa476994db76b7d238fed16e3bed389372d767d7050abd72980c94d83d6fab32c89b7f05aa6410bf5b7e4f3e0d4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666358315, "uuid": "7b49c15f-3f42-4b5b-9644-86d1d8c8adb0", "value": "T1C5763320B6E3CCF5D71F6070C969B353A9B1E30D5A01C673EB1A081C1E559EAB173AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666358315, "uuid": "3e85d453-f685-4d28-8da1-267bc589381f", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666358315, "uuid": "f9efe14c-5b8c-4f52-83a2-0b49dbab31ba", "value": "196608:91OUM6pawX9eZmi2s0HzaXzK1tIUr3XTua9O:3OR6pawX9eh2swOG1tImXTZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666358315, "uuid": "dfdc0305-1a9f-452e-a600-59a9082bfd2b", "value": 7607061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666358315, "uuid": "0208c560-d249-4776-83dc-f94ee8274c73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666358315, "uuid": "28fb2fc3-3807-485f-ad67-33b43db3b55d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916f8a1f-515a-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1666368494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368494, "uuid": "93d0a32e-2fbe-43ac-8a41-ba8a194270c0", "comment": "Malware payload (Tofsee)", "value": "ddd43c47836f76b5f04db334d3d05eb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368494, "uuid": "99cbf071-cfab-4056-a986-a258c257c89e", "comment": "Malware payload (Tofsee)", "value": "f9544817c164e0f4bc555800223b7499ffff5f13c2cf2a4ea0a97139601d091a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368494, "uuid": "1a8c7be2-f76a-455f-890b-efe9a03619a0", "comment": "Malware payload (Tofsee)", "value": "53fa164e2fd56e045275bea16e361dbf43991192", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666368494, "uuid": "855663ff-856e-4e28-8aee-dc7bbd0dccfa", "comment": "Malware payload (Tofsee)", "value": "165ac54725665f2e9f5b3153a6f6fb822fcb45dcaa12b7c66c8d57e2940fcdfe52c883773e8cc7b3fc3608c226d7a2dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368494, "uuid": "e22434d7-cf93-4745-8ad7-a68eddbb21d4", "value": "T1C734F11177F2D472C44695318460DBE62AFAAC3312745D97F7583B6E2E303C29A7638B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368494, "uuid": "4bd24353-947a-481c-8237-bd649a604771", "value": "83aec8d33ff1d2ed6e490bde788f9850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368494, "uuid": "92b165c6-fca6-4bfe-8d3b-0e24564c610d", "value": "3072:jX1CcLz4WkQBO5rRLwTWapJmOAwFvF1AAk6ziC93y1M:bkcLzvkQBwLaLpVkyiCVCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666368494, "uuid": "2cbd55fe-0d0d-4594-95e4-5d12f657be12", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666368494, "uuid": "3bee2c4d-ee3e-4a4c-b2e3-62ffb2f04cd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666368494, "uuid": "68af505f-2b96-4a20-8840-227095c2f95f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1c6237-5116-11ed-9266-42010a9c0072", "comment": "Malware payload (DanaBot)", "timestamp": 1666339177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339177, "uuid": "42cd100c-1f5a-45a3-8a4b-f4979962f7b8", "comment": "Malware payload (DanaBot)", "value": "126ab2a3f29d4fcc19197b48551c0745", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339177, "uuid": "67980643-2859-4cd4-a3e5-e13e22580784", "comment": "Malware payload (DanaBot)", "value": "fae6ecff0005977007f1e38c6f9f574b5ead530a3fd4e006e985e1a324860c05", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339177, "uuid": "c423545d-f729-465a-8c4a-155d29d2816a", "comment": "Malware payload (DanaBot)", "value": "120d2b163bc0748db5f776edcadfd922396d4d12", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666339177, "uuid": "2b851de9-9d26-4d7e-a83e-ee814a4794e8", "comment": "Malware payload (DanaBot)", "value": "3a3d273e0499b8cebd701f0ae0f2968eaffb0464ed7d14df220f2a219f14bc38da64293ddddfa5695de4bca190001923", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339177, "uuid": "b6568361-e4e9-4f18-b6f3-a628e74c7a7e", "value": "T1625523E179D2F07DC041A130C427A6B4063B69B55BE5C6BB2BB19B9E4B711E193FC382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339177, "uuid": "9b6049a4-29ea-47c8-965a-df0c06b8916f", "value": "b6f22f12a4536f4994eafa4f96919e3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339177, "uuid": "f5a027f2-45aa-4814-81f8-95262d68ab88", "value": "24576:mGavEaSVt84fiORAFJq9d1FTOP/n1bdpM4t6NU05Hj05mF8hdQFD+lH:mFgtBqKFTOP/n1ZpM4t6209j5FvkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666339177, "uuid": "476f19ab-eb56-4f4d-bce0-c165e0e9f558", "value": 1307136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666339177, "uuid": "daaaa217-4a8c-436a-b737-233c80865019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666339177, "uuid": "1a48896d-214b-4264-9d49-daf6aab068d7", "value": "126ab2a3f29d4fcc19197b48551c0745.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86fda524-50e9-11ed-9266-42010a9c0072", "comment": "Malware payload (Chaos)", "timestamp": 1666319944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666319944, "uuid": "d5808017-6eb6-46f0-8573-ddab36a333bd", "comment": "Malware payload (Chaos)", "value": "5fdd033b614e18f7ebbfca2e7d6a1996", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666319944, "uuid": "0d5ca896-ea5f-4538-9cc4-19dff7041726", "comment": "Malware payload (Chaos)", "value": "fb69b4b5637a6b7aa40ba7ae56ed617d375f67984c3028a7607e1764fdda8490", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666319944, "uuid": "aca0e957-b946-4a57-863c-c7dd93eef924", "comment": "Malware payload (Chaos)", "value": "fa047c9a9e8dc5fa2f92ad34e02e309edfcd0b61", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666319944, "uuid": "4403115f-fb77-4302-b9bf-08f1513f12e8", "comment": "Malware payload (Chaos)", "value": "0faeec5c274635ff00f9a029c88729a51bb19c5f330f6564742c875817433e787f004e91cbe84e9b4f2d58afb4052a41", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666319944, "uuid": "544113e9-ef38-427e-8774-a9c4f9166b9a", "value": "T1439533728AA79057D401353E7BA89054D083921DE5B2959F12ABC44F007BBAFBF8DBC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666319944, "uuid": "4b1e44d5-af9b-4694-92fe-a82a9f4addf8", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666319944, "uuid": "380f462d-77de-4cad-a76e-16da8befeb0f", "value": "49152:3Dmghls3y1+XfWL6Vcp5/e2JtJA6O33q74dXV:Tmghls5Bq/nnA3q74d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666319944, "uuid": "e7fe2bc0-d388-4715-a526-21dd2d48747e", "value": 1889792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666319944, "uuid": "350ed6f4-c8d4-42d7-8d71-2628843a168a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666319944, "uuid": "cb0e8002-c9d6-4381-894f-1f9cf035dd63", "value": "as55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef06f79-5109-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1666333540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333540, "uuid": "1353c87a-4776-4334-9f97-c614b74af0f4", "comment": "Malware payload (AsyncRAT)", "value": "f5b410d28694d7ba6fdb53b750e66a7c", "object_relation": "md5", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333540, "uuid": "03b32678-7a30-479a-80b7-23ac9ece80c8", "comment": "Malware payload (AsyncRAT)", "value": "fc24986ae5fe88ea3822b9af685e948b6bb00029c8250ea65188cd65529e62cf", "object_relation": "sha256", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333540, "uuid": "4e040208-ddb6-41a4-aa20-adaa9d712187", "comment": "Malware payload (AsyncRAT)", "value": "5cc2749ce151f845449411c64dbacd2ecd5cf38c", "object_relation": "sha1", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666333540, "uuid": "58a86724-8863-43e3-8463-06b18c6b21b5", "comment": "Malware payload (AsyncRAT)", "value": "cfe9a709fa00c7817a6f450a743bc544e6b0ebfb454343e87fb8d83a64a6eb8b60fb85661506fc6c7283beb42d4447ad", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-183-175", "colour": "#AD046A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333540, "uuid": "055986c2-2c8b-40e8-a513-31b864b1f960", "value": "T1AC635C0037A8C925E5ED86B8BCB2550106B5D63B2113EA5E7CC450DB9B9FFC64A037EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333540, "uuid": "29d2ceb0-d956-4076-8ad8-f8db67ae1e30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333540, "uuid": "dfead877-e2eb-4b3b-b01c-d14dcd3e00b7", "value": "1536:CZn6AVsIQ9HJfxQ7CqmB9x1bbsTxRLwocxCx+asNNpqKmY7:CZn1Q95x/q8n1bbsTbwRaKNWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666333540, "uuid": "2c87f917-7ee9-48f6-9e12-4ec89440e387", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666333540, "uuid": "e88cd8a6-109c-4b8e-bee8-a6ca7e2adecf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666333540, "uuid": "46daab5b-bc28-4ec1-abf4-ed50ddb9bbde", "value": "Client(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f1fcd7-516b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666375835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666375835, "uuid": "17b0f75e-f904-4ccc-8637-82a22714b11e", "comment": "Malware payload", "value": "b2543ad64994345ea58b71c2a2ddca2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666375835, "uuid": "de7d71a6-db5b-4042-b840-8854343f84b7", "comment": "Malware payload", "value": "fe30b6b149d8a7e5da77faa6a6f36ce78132b682fde4f48fc77939de870bbabc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666375835, "uuid": "8065e650-669c-4092-860f-9e7083841f49", "comment": "Malware payload", "value": "5d34873512ddf30a6e113b4b3b456049479ded86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666375835, "uuid": "d071594b-3e08-4b72-a596-1a7596c2748c", "comment": "Malware payload", "value": "f1587f5f588d9842b4972a97ef06f9cb853ebb33324cac789dfc6ab8105b93d425ad05a31d08d9b7db5b2b1e22022aa0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666375835, "uuid": "6033c38a-a3f3-4d09-ba77-f91bdd525645", "value": "T14796CF1175C6C132D5BE02701E2DEB6A417E7E250F7098EB63D85B2E1EB28C25632F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666375835, "uuid": "5a2a0aa7-7041-4329-91d6-876e93ed1984", "value": "98304:xY/hZAaegRMInShnMFYCtLAme/dTTKvu1fwCdOECHcN5dYtuAHhXenUsuF1:sxShM8yWDdOECHYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666375835, "uuid": "242be56a-25f1-4a8b-8193-23fe2ae5669f", "value": 8744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666375835, "uuid": "fe5fd424-ef92-466a-9d1b-43a0af6d8faf", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666375835, "uuid": "8397f7e8-e06b-43ad-a680-ceffd0f1111e", "value": "ZoomSetup_40015382.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82b5dd1-512b-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666348427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348427, "uuid": "82a16b11-01eb-434e-b43b-924450cb31ae", "comment": "Malware payload (RedLineStealer)", "value": "d5a60452fa5ae76cc98c544f90af87f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348427, "uuid": "ae65d39e-b7bc-41f5-99ff-6d323d52eb27", "comment": "Malware payload (RedLineStealer)", "value": "fe579c4149f21ba757df2ee514080010a0a297fb7ee512290769134ab5f9e74d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348427, "uuid": "a549d282-7b9b-4d77-9b4a-3bd256e8dd6b", "comment": "Malware payload (RedLineStealer)", "value": "c97b81da4579796d67df6eef4fe386b00e2eb0c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666348427, "uuid": "21071e6e-0dac-434b-887f-beeb82c7645c", "comment": "Malware payload (RedLineStealer)", "value": "ec8143984660b3ddefb666ef10d5c143346de00f5653d780f9cc4d5b6251cbbc45268952027bef5e97b22c39acbcb165", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348427, "uuid": "783bff14-e1c3-44fd-9e2b-5fb801c6c77c", "value": "T19DC52B139A8B0D75DDD237B4A1CB633EA734ED30CA2A9B7FB608C43959532C56C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348427, "uuid": "c9739601-4a04-4b37-a96f-4c83637e0e9d", "value": "29677885c0fdc7680e2620d4335d1995", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348427, "uuid": "5a2d05d2-4968-49af-9e8c-e91581edafc4", "value": "49152:sMFDaGI4LP2w+bmWMKPqrAupxkzJDWqol3y:sM9av4LP2w+bbMVrAYkzJDWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666348427, "uuid": "5faa9f36-aa65-4a63-8f0c-3d4e611b383a", "value": 2732956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666348427, "uuid": "ff60d4ed-1d52-441b-bceb-d328579791f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666348427, "uuid": "fa46df20-392b-420c-b05b-34fffc75a19d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5753da6-511c-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666341899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341899, "uuid": "fcb300e8-d23b-4517-838f-ecccd922298c", "comment": "Malware payload (RedLineStealer)", "value": "d872d4ff8d65337e07d9b4c5cd7d04d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341899, "uuid": "00585b1a-1b23-48a0-8552-830ba6bd3772", "comment": "Malware payload (RedLineStealer)", "value": "fed556dd0726228d9e2021388efc33e5b1d6ab327e7062cc97c709ab7947d5a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341899, "uuid": "7ecfc628-1de3-43cc-8583-bf2acbd4fcf6", "comment": "Malware payload (RedLineStealer)", "value": "95a3095e7e530b72f0333334bb8653d010acc06f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666341899, "uuid": "363ee80f-df2f-4e98-8806-24e36acc2fdf", "comment": "Malware payload (RedLineStealer)", "value": "fdf4cac0b2bb9d00e437ed19ee3ad395aebc4da79c8eb758baeed743fa6b966f490a0b60dd48017220340cdae64c8c77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341899, "uuid": "4085d3de-f472-4f60-b338-e936debe83f2", "value": "T111C52B139A8B0D75DDD237B4A1CB633BA734ED30CA2A9B7FB608C43959532C56C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341899, "uuid": "19a10238-f884-4eec-8fb6-8ddf733a9659", "value": "29677885c0fdc7680e2620d4335d1995", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341899, "uuid": "ea9c3f67-7186-4cf7-847e-1763bbd9bbfe", "value": "24576:7I+rO0XWGlUHzo/OhjHG7sjYyY5jWXIOMPpwSedqpMHx+z02Z6mYaVehzkj3Lf14:8S1UHzo/OlHGKYz09kVehzkj3Ll30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666341899, "uuid": "d90a0039-ae6d-4940-9e4b-a7e07b91d1b8", "value": 2732956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666341899, "uuid": "c5e01d47-adb0-4cf1-b83e-daa78471bf0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666341899, "uuid": "044378f9-f19b-4807-bb5a-e17d95ace844", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1948d5dd-511e-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1666342523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666342523, "uuid": "b10c8702-dc93-493b-b170-d348b8ebe9ae", "comment": "Malware payload (Formbook)", "value": "23f22ab208306d5c6d9ad9e344c446c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666342523, "uuid": "be519d6c-b770-49e4-980f-42f0bff264fe", "comment": "Malware payload (Formbook)", "value": "fed743ba97ee8b48a3925816de1b2665d2a73bbf3bc75083fb9ade2855afc0ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666342523, "uuid": "e754646f-0d53-4f82-b68a-2cd5386b120b", "comment": "Malware payload (Formbook)", "value": "8f4ce81c820d9b39b5930bdb8178e1e8d728378e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666342523, "uuid": "ecf40976-09f1-4199-a04c-c7c8755c5842", "comment": "Malware payload (Formbook)", "value": "ef022322a44a0b079da5ae0447dbfc2be13164be2fbb1f33f6f2605742304e5a71461354eaa268319642b2d3d9f6c0ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666342523, "uuid": "08023454-04fb-40dd-ba42-fcbf8f52aa2a", "value": "T10A451201B6DE8471D0B219316935AB1E6D3B7D202EF4C51FE3E4596FDAF02916220BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666342523, "uuid": "be17cf76-a565-45d0-9759-a48e21cc3cd7", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666342523, "uuid": "556a12b0-d360-49d4-94e0-28c7c5cec46a", "value": "24576:gAOcZXQOQyB4o63Ia5tgKWPMgobTuj5HHeg/cbGOSMId:+HEfWdW8TO5HdYGOSMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666342523, "uuid": "783ec59d-3166-42b6-ba35-37e3d48414e0", "value": 1208033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666342523, "uuid": "3b942871-107b-4d40-afc4-56a9cece2768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666342523, "uuid": "2b13817f-cf00-4a72-817c-5af88ecbc5c3", "value": "23f22ab208306d5c6d9ad9e344c446c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c6dabb-5125-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1666345814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345814, "uuid": "67fce27e-bedb-4821-a415-d0f35f4c8b82", "comment": "Malware payload (Smoke Loader)", "value": "c7f2667fffde66538aa7a0e08f113088", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345814, "uuid": "904a1300-52ff-42e3-8ff9-bc9534f920c8", "comment": "Malware payload (Smoke Loader)", "value": "ff05510749361a5bf23518e4e537c481d2ba55cfcb9e286c92cba88f24057471", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345814, "uuid": "6893dd5d-959d-4e6c-95a7-f5ac353f57a5", "comment": "Malware payload (Smoke Loader)", "value": "d3c86847feab0e07714546ab910d77a2191fb9c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345814, "uuid": "701b08ba-6cd5-4b1d-8f66-83a4365f91a8", "comment": "Malware payload (Smoke Loader)", "value": "c6cbdc294bf60816943671093c55db953a7b50a235b85cdd6ee9ef2e289aec5e4be3c166151b916c38e665f9406a1980", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345814, "uuid": "fae3086a-1d80-4d68-be9e-4962f069e0fe", "value": "T17A24E01172A3C471C486943C4861CFBD6A7F7C3532B55AA737682B6E2E7079366B2383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345814, "uuid": "1eb885b1-5614-448f-bb59-84e2b188c5ed", "value": "965326d499ea63bde30a73f94c3886cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345814, "uuid": "d0f2e795-1cea-4db7-b3d6-1afea4d28c79", "value": "3072:hXSfPJL+W6W75ckANCv4exwAzxp9RaMhTRuusN0KZ7xWmj:F6PJLPLyNCvzyAGMB0usN0Q7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666345814, "uuid": "c47c0184-ff1d-49e6-a1af-684b2efc1476", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666345814, "uuid": "d76a518c-1514-4732-b572-1d982d6e1d02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345814, "uuid": "72133772-73ac-431e-912b-0489bdc32f6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2130702-5125-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1666345839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345839, "uuid": "1e0f039a-29ec-4425-9b85-11119acc1806", "comment": "Malware payload", "value": "f1a32863b2a86f89ca300958d8fd7e57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345839, "uuid": "94370083-6979-4f86-9041-c93f59d572ee", "comment": "Malware payload", "value": "ff4de84e3ba8b483f30856eb6cad39cebe7be1fdeb003b4503a25ba3057bbe7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345839, "uuid": "aa68e11e-13d6-4af5-ac41-0fcda8343ea6", "comment": "Malware payload", "value": "94eb5dab5bc1fcb056eb62cfacc137064b5327d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666345839, "uuid": "9003f3df-422d-43af-87f4-5ce7ce439943", "comment": "Malware payload", "value": "2786928a174b94aa31621e8c6e324ea346b6a7de88b34343a64d7f474aaaa69ece810d3597cd515f5716bb1842d1e625", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345839, "uuid": "97f52d64-c62f-4eb3-a445-ee114ddf238a", "value": "T14976332032D1D4B2E873043B8D793F7F65F8F6A8623E547B678A012CE77E6D69046642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345839, "uuid": "f8b035b5-9196-4d69-99a1-7e5db7ee9fe1", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345839, "uuid": "3ad25962-99a8-42e4-8540-ca3255bc6329", "value": "196608:91O9qFz6jr5Mo2n0FA0SPWLGyHyx20tktRB0f:3OMFelKRKGloW6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666345839, "uuid": "dd1345e4-6f2d-44b1-bbb7-ef4fea41e674", "value": 7631279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666345839, "uuid": "4ceab2e1-77a1-4510-908c-192cfafe1a12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666345839, "uuid": "ad8c3604-bfc7-425c-8e68-b5ff50f1b2f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792b86b8-510e-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1666335812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335812, "uuid": "87006dc1-fa9e-45fa-8447-a1badd7d19dd", "comment": "Malware payload (RedLineStealer)", "value": "030184b1ff85fc742dd584476ff97302", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335812, "uuid": "17c5c6fe-d169-4064-9e52-6654b1873580", "comment": "Malware payload (RedLineStealer)", "value": "ffc311faa60a3952e30c1e72997d8c58bd64b40ba5ebd710af68616b9e96ac7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335812, "uuid": "b832f5db-b8f5-4bf3-939b-719a0e003909", "comment": "Malware payload (RedLineStealer)", "value": "d188e59206825ad228fe0aa477a241db81b74cce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1666335812, "uuid": "92c3e21d-f65a-4aca-96ce-bb039a8bad75", "comment": "Malware payload (RedLineStealer)", "value": "d8b1e991c3b2c6f978728cc44b6468413607b1b6bddf8a7189ef431f7de893f56bec356bf35e1c2910bbad494159e553", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335812, "uuid": "eaad404b-7b6d-4f4a-b8e0-c1f7eabce716", "value": "T1D1C519135A8B0D75DDD23BB4A1CB633AA734ED30CA3A9F7BB608C43959532C56C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335812, "uuid": "8381f04e-4a29-4d7b-8578-0550ddd04ee8", "value": "a93cea5329220fb90674a1f0bde2cd0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335812, "uuid": "4b6ebcf5-c3fa-480b-81a7-75b75ea72409", "value": "24576:AstjyqmIpVYkYklkhQ3Mi2LbWdoelIfwjU2R8H+lhAiILgtBl3RuQ55313E:AstjyqmIBljLR6+lhAiIsBl3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1666335812, "uuid": "ca7964b9-0d83-49cd-9c62-eecc177d0a4f", "value": 2688620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1666335812, "uuid": "20535891-22f3-4dc7-9c20-5d38b7579b83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1666335812, "uuid": "849c569d-fdb4-4758-8380-e8acf4b498ca", "value": "030184b1ff85fc742dd584476ff97302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }