{ "Event": { "published": true, "date": "2023-02-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-02-28", "timestamp": 1677628981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "84a7c569-3b48-47ac-8f59-149692f8e7cf", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3f03bb-b78a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677603956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603956, "uuid": "363628db-6d4a-40bf-8a87-345b79572ff8", "comment": "Malware payload (AgentTesla)", "value": "c4e801f76e72711530fde1a1821249d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "smtp", "colour": "#E64C5D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603956, "uuid": "8f877afa-44b8-4c7d-9df1-4af0bf96a1cf", "comment": "Malware payload (AgentTesla)", "value": "01d4351ceb4044ccc2ccccccf882a67a8abe80eca77c2122589db093ede7d84d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "smtp", "colour": "#E64C5D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603956, "uuid": "54ad0aad-ae5f-4aef-ad32-418237d173e6", "comment": "Malware payload (AgentTesla)", "value": "34b7181a525ad5e139bfbbfa2083dbb4408ac69e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "smtp", "colour": "#E64C5D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603956, "uuid": "aced9ba1-a283-4dac-b56d-e60f490b33b4", "comment": "Malware payload (AgentTesla)", "value": "390902db75c72c905be72a6c4777955cea0bf0ffa56c41cf5799ce2fdb5f2c87c85a7e7aefd3a9333d0e7780bae23fed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "smtp", "colour": "#E64C5D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603956, "uuid": "6811bfee-08df-4e16-aaf5-6764fa6d19c4", "value": "T1CD9423F358308B94865D58A0D2C1E43185BFAD12C83449397E89E324EC856F6FB7E7A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603956, "uuid": "acf9544a-4907-460d-9a43-b68f41eeacc7", "value": "6144:hUFXOYie9i0meWdvkMvMq+duI3j0IeXNPpqCKIILYVW/TAseVOrK4lpVF/fjky4B:hURZjmecsFnQzhqXYM7AbRspEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677603956, "uuid": "1c7b0260-e175-4fca-b88b-cf231f3f8b24", "value": 430399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677603956, "uuid": "5c0349db-9317-4555-82c4-e90b8ae494e9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603956, "uuid": "8adea088-a163-433c-a548-068d1ba15a9a", "value": "Pro-forma Invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ec6692-b779-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677596615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596615, "uuid": "c8390668-dd18-4e35-81ce-dd8f17cc8bc2", "comment": "Malware payload (AgentTesla)", "value": "841df4aadcf2ba0ef0a1bfe3a421c7bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596615, "uuid": "5ed6dd1a-6318-49e5-999b-72bfae7a80fd", "comment": "Malware payload (AgentTesla)", "value": "02d64b9cbd5268cec49399d35962acaac4e4548b96b0775b315811bc0c23c7e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596615, "uuid": "2e4bfff9-9dcb-42a6-aa0a-a34803a6ac6c", "comment": "Malware payload (AgentTesla)", "value": "5b3d870d348f52908b8871f16ad8f6edfbac08c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596615, "uuid": "9d859639-00b1-4be8-8e95-228092b6e7f1", "comment": "Malware payload (AgentTesla)", "value": "ff898ae889dc10e5ae516e38b8f07831c350a7aac9d244e3dad12ac51f698b15b06c85a4dce4fefe837186cd9bda7f20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596615, "uuid": "998c6c66-5fd7-4931-9c6a-0760a0719658", "value": "T1E1C4AE06A194E306D7D5A1B2DB41D2780F136EAEE500610761F83FAFBFDC943915EE2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596615, "uuid": "385ff777-f317-46b3-97f8-3c13a963e648", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596615, "uuid": "51e01806-7423-495f-ab23-52b3d3a6c6e6", "value": "6144:WYa6Bv7p3QTwn5M11k+zsndP21nktxtlfzw/5kb1wmO4zhOVJeUsK73b1KYr0hgP:WYfzFQTwM16+sdenmS5kbiiUsKLb13F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677596615, "uuid": "44d8ef1c-d092-4e4a-be81-b98436449227", "value": 554277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677596615, "uuid": "366f4edc-0b69-42cc-a6e9-bd502b4207cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596615, "uuid": "5d6a8cca-aa37-4317-8d20-eda370a97409", "value": "Payment Copy 610975.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc02d852-b7a6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677616253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677616253, "uuid": "329474f6-b2fe-45d6-b5ed-9f556212feec", "comment": "Malware payload", "value": "e54e2c6aa8ca1d65d28e77805ac84d3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677616253, "uuid": "975142b3-fae6-4de3-93bd-4397679148c0", "comment": "Malware payload", "value": "0323277770dc3d499264c4dcac77e3f18164ae8d2409f1d503602b0c8b966ba6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677616253, "uuid": "49fda794-d929-432c-be13-957f5c58bb81", "comment": "Malware payload", "value": "349a5f421e23b35666a87c0bb062d30986c5b4d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677616253, "uuid": "334b45e3-d5e6-4d05-bf66-d77bddd5f7bf", "comment": "Malware payload", "value": "aec7594b6064b7df9f2bb274f44833562f66d8f3757e90e2623e9700563f55aac60864de260369f666aa759a45466f35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677616253, "uuid": "55ad0555-09f4-42b6-860a-e73ddbedc8fc", "value": "T12AE4BF027184ACDAE4535AB20CBFD62021696E9D5175CA0E3383BB2B65F3712316FF5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677616253, "uuid": "d54b339d-e5cd-4b86-8612-ddf24ffdcd16", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677616253, "uuid": "bafa9955-2c97-45a4-aefd-519accbae855", "value": "12288:DYnRR93Y9cVKLXSeXguItFNUnaFFtbvAd9GrD1LWUrwVHU:DYnRRu9cVKjXXghb2nOvDAd9dYw1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677616253, "uuid": "a68be3c9-bf7e-48d3-addd-0961f98f2da7", "value": 668417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677616253, "uuid": "829fb2fe-4f36-4a05-ac5c-0d45f0580799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677616253, "uuid": "e948bdd3-cc3d-479e-9828-4d671c607392", "value": "dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48271f7-b78b-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677604724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677604724, "uuid": "e7bd8b2b-8e1d-4967-847a-f50b4c03c8e5", "comment": "Malware payload (SnakeKeylogger)", "value": "67b8e421490827c550e75c589800dd31", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677604724, "uuid": "64076ab6-4351-4d99-8938-f0126ff6f096", "comment": "Malware payload (SnakeKeylogger)", "value": "037a5b2be8369b943d050153233908211ac9bf420a9c79bab8a910111bd00df7", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677604724, "uuid": "498c2362-7fb4-4d1c-9c50-d241bd5f4e4f", "comment": "Malware payload (SnakeKeylogger)", "value": "f38f2ecfd172ebb77790b98dfe807b48863fc2b5", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677604724, "uuid": "3dcf1cda-8703-4aa5-94b5-ed6428f8f470", "comment": "Malware payload (SnakeKeylogger)", "value": "d60c6730960eaf0e56654141415382ce0dadd92a6cf82700f7aa00bb3e80e0ee0771c75e7c61b36f89adf2b413d8c82d", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677604724, "uuid": "b18d2436-009a-43eb-9002-3a3f15e19eb7", "value": "T1555423FA7907011EA5EE31D44FD316064386E094CC235D2652F98F38A456EADA34ADFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677604724, "uuid": "2f4427ca-8d8c-48f1-8153-b9cd2e673bb5", "value": "6144:x/2lF2b0keYMSX1dMxASpy6xLfkyGC1rEwZzF2uwyIJS5:x/+OHLXHMPpy2LfIC1JphkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677604724, "uuid": "0c670405-21d2-4fe2-a250-5f1c1f53dadf", "value": 283343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677604724, "uuid": "b85fa197-7014-4eea-8d9a-f30b60b91cfc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677604724, "uuid": "0275491d-bb45-4639-abfe-d3b8e53b432d", "value": "hesaphareketi-01.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aec8dff-b740-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677572308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572308, "uuid": "b62e74ef-ccb8-4347-a77c-a14ef26dcffb", "comment": "Malware payload (GuLoader)", "value": "e2e83d8f022fb290a3e79faa35e00e32", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572308, "uuid": "d9566324-1661-4989-8861-f6d6a2e644fe", "comment": "Malware payload (GuLoader)", "value": "04380b758527c5d940fa993e1b4e76ad7d4133f789721f2373c1fcbbdaeaf1a5", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572308, "uuid": "58a6a741-6b36-4747-a9ac-f9e3f0b6814e", "comment": "Malware payload (GuLoader)", "value": "79382dd27293882cca374cc8f7a787938f1b0952", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572308, "uuid": "12f0a2bf-f1f0-4990-9b99-f115d2493d2b", "comment": "Malware payload (GuLoader)", "value": "1c75d5aebaa03ac4cf86a91bbdd46fda1e8c758928a7160264943ac8a3813f4f9938bd696ca3810897101007ece8e70a", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572308, "uuid": "6feafba5-261f-4cb3-8c4d-639447086fee", "value": "T1B04522400760D8B7D9220FB209B6AAB0CAF6639745E9574B336C8B58FF5BFC05C0925B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572308, "uuid": "dc072f6f-6aa3-41ea-92ed-8cef59994efa", "value": "12288:2i06hEUyDOiE4cnblqcRhNxTAoi+079k60HJ+LshL:2i0o4dcbRFLMkHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572308, "uuid": "5a3a334d-2013-42ef-8094-8b9e0f7fa933", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572308, "uuid": "a0c14ab1-5214-4e60-a1e9-62ec8bef1af3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572308, "uuid": "3ca33483-3a44-4491-b540-5c8090e13f61", "value": "IDOM-Related Power-Plant-Services-Brochure-Rev.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6ec8f7-b76f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1677592661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592661, "uuid": "c54d5fdc-b737-4ab4-8db8-0f63d62b12e6", "comment": "Malware payload (RemcosRAT)", "value": "b52e133b4b57aff9a38285cda2a33def", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592661, "uuid": "99fea176-1914-43f1-aaa8-cef7f4087e23", "comment": "Malware payload (RemcosRAT)", "value": "07050af33c4d45af03caa34bbf61a832ec4cfb84535aaae85097176e0defcf11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592661, "uuid": "16108218-2a89-4f91-91c2-e8a0f91ab85f", "comment": "Malware payload (RemcosRAT)", "value": "51a4b91f72e1cd44b26962650eb4ce1077d8ca7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592661, "uuid": "b4df7909-510e-4bcf-9ab0-e4a1df5c4189", "comment": "Malware payload (RemcosRAT)", "value": "4d33908ab2d4237abaa41423a419218714a2291bb62717ea64485623f3b9d95c67870e09448ac2cb0024f810ad164e48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592661, "uuid": "8d08ac34-250f-45a3-a8f2-46915c315b2b", "value": "T1BD75BE4C63708C73E9DB01B2448522CC4EB4F5CB6516F35A5BA73742AA8ABFBB58D143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592661, "uuid": "457837bc-be2d-4aa1-9c5b-d6c242bc3b77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592661, "uuid": "6c78395f-c9cf-41e2-a9fb-13467207433f", "value": "24576:USlD7SzYNJdfgWLHZL1T/SNzMPTiQb2EUWExbCA6/+otqg7:jl3SzYTdxLN1TuzMP7biha+36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677592661, "uuid": "a77dda5e-ded2-432d-94ff-ca523f7b7739", "value": 1614848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677592661, "uuid": "15192309-4881-49b0-8a5b-e9e10272fae9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592661, "uuid": "e70400b8-9d5b-445d-b3e0-c961ee754902", "value": "TNT Original Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6cdaba-b755-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677581355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581355, "uuid": "b5e08ccc-51de-499c-9e9e-9ab0761e1009", "comment": "Malware payload (Mirai)", "value": "0c775619418e03e1c8d1aa08c8d01599", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581355, "uuid": "060e4aa5-10ce-48d6-8cd3-11b01937f286", "comment": "Malware payload (Mirai)", "value": "0792c284bff472eeff1a70fd4db6b9f27cb40e1d3485c1dbe918f52ffcea6179", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581355, "uuid": "b1e06f8e-d98a-4bea-9ef1-b9b098ea38c8", "comment": "Malware payload (Mirai)", "value": "190b9492ce73af31c31b718b324b7c8814b3a9d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581355, "uuid": "58f9545a-b6a6-467b-aa05-07e6c29a5047", "comment": "Malware payload (Mirai)", "value": "fea6a5de38bb8e62e1d55ce5be2ba8e08569aa05570d1e2363c0f1bdc8c7f2480a310fe2feb7b9eef1fc44ee0d4a2533", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581355, "uuid": "b81cf924-a240-4d96-9fbb-4bf4c20d8b1e", "value": "T10523BAC1DEE3BCB5D7C5FAF8E9D6E26019E34414A7BB8646A0DD4D61C43FA84220A35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581355, "uuid": "8e30c892-747f-46b5-9193-f9e2fefdddf5", "value": "768:N8eTKOeLPKKdIvin4HBgdsevonP6nmVZ9P4PZLoP4FC7:1OL9qIsegnfVZeZLoPs0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677581355, "uuid": "4d668cb7-3f78-4b7a-8ec9-fceca83cc582", "value": 49853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677581355, "uuid": "79068acd-a956-403a-b423-8a2a2c2edc45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581355, "uuid": "501b27f7-50d9-4ffd-b819-d59099ba902d", "value": "0c775619418e03e1c8d1aa08c8d01599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6daf68-b751-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677579694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579694, "uuid": "b56fbe41-425e-4c4d-8f10-f4f1109f4a46", "comment": "Malware payload (RedLineStealer)", "value": "383e5cc9d36d29187dae134ad8377dba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579694, "uuid": "c8535a8d-f8f0-41cc-9d3e-1fb7b4ed5635", "comment": "Malware payload (RedLineStealer)", "value": "07ef3c17f83a7edd9e2c820c10d1b24bb21804a734a1d6e6de9d9bcf1e9426e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579694, "uuid": "0e28e032-967c-433e-9e01-7e6bcdc6bd10", "comment": "Malware payload (RedLineStealer)", "value": "145020db6ac2c92fb94687c5b0308a04d9d37bb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579694, "uuid": "9bc17631-84f3-4bd9-b121-ac7bcc0a64db", "comment": "Malware payload (RedLineStealer)", "value": "84600985b45cfd9348582636859f4aaaaa960c18efeb4843aff4a2e76fd3786e49ff65435757b073a5409b850d1c8866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579694, "uuid": "a865ca37-6238-46b6-8fb5-efe802437c78", "value": "T18765022DE3B24447FA6B1D393930419B7E07DDA86EC592D168B72B6E04D22D3ED80ED1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579694, "uuid": "3cf4c8d7-4a97-4564-a3e9-29e5b8b923e6", "value": "d278c950c7b592dd5a69754238119976", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579694, "uuid": "5bd282ca-5d66-4a8f-b8cb-92f211599096", "value": "24576:+2TPePtTRdhmxHGwhv1l5pOugf8BbX0llM2Dd5HhoLNmTqFnMPbSJgzynlMmfFqs:+4SRRneGYhgm+DKsWUslMaqvObJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677579694, "uuid": "b0acfd8c-26eb-482a-8fc8-6b41b618ddd2", "value": 1444776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677579694, "uuid": "7e21f0be-5e2f-4bd7-ad09-08178e18f726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579694, "uuid": "4883108f-5b31-4df3-a1c7-949241504b40", "value": "383e5cc9d36d29187dae134ad8377dba.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d3022a-b73f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677571850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571850, "uuid": "1d652bee-f397-4848-af93-0799164621f7", "comment": "Malware payload (SnakeKeylogger)", "value": "702ab5daa0c23eb63bf81c2581f36c76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571850, "uuid": "559dec05-c674-4bee-a313-db7bcb725b17", "comment": "Malware payload (SnakeKeylogger)", "value": "084376001d1f1b28426221b2b3647af27021f69eec9c65b383f2ad67307276da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571850, "uuid": "a92ace3a-b4cb-43ca-b776-b86e22bd912b", "comment": "Malware payload (SnakeKeylogger)", "value": "74f529b16537b683fceb6b168ca68347bc79cc8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571850, "uuid": "0a929c77-a466-4398-876d-4511c79a1f76", "comment": "Malware payload (SnakeKeylogger)", "value": "69c04234d22104469f849523cd5b2c9fa617c918e30657f8bd847b15a6822d201a81f9c10da1be66aba766dcd25c1435", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571850, "uuid": "99eac5b1-644c-4c25-adff-89a3b04d7d00", "value": "T188D3191D2BF89900E1FF9E7705B15121C779BC42192ACD0D1AD2F5192A7DAA0CE1BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571850, "uuid": "0fe3765e-71d8-42d2-a917-e4292d7d9710", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571850, "uuid": "b65787d0-fcdd-4395-aab9-4239da355a9a", "value": "1536:bKnk2VarNzLzzyuiQdnPPJF+vBUFrlYY86ky8gSQqBww5VCMFsF7sLggrOb/UGqS:bKnk3UInPX86V4Xyb8FC8KMwBjOfFbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677571850, "uuid": "3f717fa8-4389-4f73-accc-f17bc493a922", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677571850, "uuid": "22776df9-d41e-4b62-be1c-d29c5ac7049f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571850, "uuid": "2a2fbc1d-b097-4c1a-8113-30ac1e3973b2", "value": "702ab5daa0c23eb63bf81c2581f36c76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c551dff3-b7b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677621825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621825, "uuid": "461bc4bb-54f5-4c9e-aeb9-12aeee42d251", "comment": "Malware payload (DCRat)", "value": "aca219047febfd72465798740d8b65cc", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621825, "uuid": "581c2b05-3a6d-4af9-898f-a431f203c19f", "comment": "Malware payload (DCRat)", "value": "08d9302a7ffe2f438b96a60ae35a2279d12081607cc6f0997fcb745814d23cf7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621825, "uuid": "bc6029bf-9676-4648-865b-b49fad5b8403", "comment": "Malware payload (DCRat)", "value": "a2011cf275e84a7ffd1381db95baa22fbb76ab00", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621825, "uuid": "ed51996f-baa8-44d8-b299-5e74fe959b8d", "comment": "Malware payload (DCRat)", "value": "338b00a34e95b23588c03a96fb21cce31bf1bbc8d06f97a8f7e8a2d8f26f8d806167d367d3ced222686f28f29ce9f9c4", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621825, "uuid": "1b42d571-ddae-4057-a005-4483c87b461c", "value": "T19B758C017E84CA12F0181633C6FF490847B4AD516AB6E72B7EB9376D55223A37D0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621825, "uuid": "dbd01ac8-c3db-4afb-8e36-dda33f191955", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621825, "uuid": "e6d0dcf3-5fde-4974-9a3d-314e9a3a394c", "value": "24576:U2G/nvxW3Ww0t7IiQbOchKTektOHVjm6ccwVATVjNPny6k5CUUviWZpRv9:UbA307PQbOkKTtOH1qspNPyvClvBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677621825, "uuid": "27c3753f-8e6c-44e6-bd4c-0418e9e09f9f", "value": 1661039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677621825, "uuid": "e31ef4f6-d27d-468e-88bf-301cde1c93cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621825, "uuid": "8b753eb6-f43a-4464-8542-266306a20022", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5cbf31d-b77a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677597291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677597291, "uuid": "76af7a39-0a5a-4f57-bc4f-e00017d81bd8", "comment": "Malware payload (AgentTesla)", "value": "8062b6300d7ec2cdea0336ad12718778", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677597291, "uuid": "1b034ca6-3ec5-453e-95fb-463335af514f", "comment": "Malware payload (AgentTesla)", "value": "099a804ef19073e984db05daa8d19a133452d056079f789fc7677e8c39141a99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677597291, "uuid": "f18f4418-6d67-4661-9a50-7c849c73ab7b", "comment": "Malware payload (AgentTesla)", "value": "ac8311130da0428f87e1ce9989f80774970481ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677597291, "uuid": "dacecfbc-4d48-42db-a963-c7cdbfd2f1b0", "comment": "Malware payload (AgentTesla)", "value": "2c3dfaa197626d48285fc5710cc9735870121b488b5b40704906615c37e7cda373ac4bbd4928a77b193119597ac2976c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677597291, "uuid": "8fc643a1-fdb5-450c-8f5f-209de211187c", "value": "T168B4234D2990EC0E6E0EE4BC363C54B24DB2B7689513ABA7A181D3C53DF934E2DC9947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677597291, "uuid": "c19ff728-a827-4103-93d9-c374ae3405f5", "value": "12288:lCBOKWJlHDDmCv5Mozh1ZUtkdpUOq1eqDmlEM2RwqQI:lCBlcN3lzhEEW1mgQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677597291, "uuid": "9e418941-28c6-483f-a8a0-3f922638dfb7", "value": 541711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677597291, "uuid": "4ff92214-66a8-4f33-bf04-1824db563a18", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677597291, "uuid": "75f6f78d-caa7-42f9-837e-10fd7655f24d", "value": "SEAWAY BILL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226ccfe1-b739-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1677569153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569153, "uuid": "593174d7-2812-4ad0-bf5f-ffb49f68886e", "comment": "Malware payload (RemcosRAT)", "value": "9274669a5d34fb6580ccdd199237f12d", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569153, "uuid": "ee78380b-14c4-4f5c-8342-4c2ba95d509d", "comment": "Malware payload (RemcosRAT)", "value": "09e041e2fc491332c957ab6f79721e835ab1fa73e7a37b252ae057c23a4e000c", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569153, "uuid": "a097df84-39dc-4651-b4bb-6763f247abdc", "comment": "Malware payload (RemcosRAT)", "value": "feec88fcafae7689299012da9f2e6ca346a757c0", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569153, "uuid": "86aca32f-7c65-4872-996c-270cb8c2ddbd", "comment": "Malware payload (RemcosRAT)", "value": "ddc15cf2eeb3d66518a56abc94f8909fbbf8642d0d2f8f98cca6a710941648a48413a1d98984cbc709cc8dbdefd07945", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569153, "uuid": "cf831db9-62f2-4eb8-80db-ecc09948a252", "value": "T17123F20A457BE6603251AB29817A9207290EC6BAB3F1CFFE1711D5A245D7D90FA0F9F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569153, "uuid": "4dceae24-f051-438f-9f7f-e33e0cd0ead8", "value": "1536:0UvdvdTDBQRSKzZL/IolRVRJdY1DUMK+0uoiAR:BZNUlQozV5yDUHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677569153, "uuid": "e8e1191a-5625-422a-bc92-534c6f9e27b3", "value": 49193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677569153, "uuid": "10492592-b8d9-4d54-a543-d9f6686550b4", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569153, "uuid": "5acb5992-e7b2-4678-9ad7-0725cef002cc", "value": "Confirmation(PymtNo117728).lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47072069-b752-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677579952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579952, "uuid": "7c84461e-20bf-4229-9f46-8b1c238a5e56", "comment": "Malware payload (AgentTesla)", "value": "a611a2c5484e8adaf3ca49e2e9278e7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579952, "uuid": "5dcb6bcb-d196-48da-b75b-4ffb38766496", "comment": "Malware payload (AgentTesla)", "value": "09fb849e8e9e88b102e2935c7e7fac8fa1fe4c71e464e397bbad798a16e94c18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579952, "uuid": "54114781-86dc-4764-9e83-816bb613665f", "comment": "Malware payload (AgentTesla)", "value": "137d454ba92c85fa0d2a27320d71f9c1d1f28e97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579952, "uuid": "e7328d56-629e-4d23-b663-dd40db87f639", "comment": "Malware payload (AgentTesla)", "value": "07869bd74015a17a5a8691ca33c28433d10d9ac14e20a4b46c079efa6ab122be5ea8d06208edabdb9fba08683f3eb16c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579952, "uuid": "cfe5abf8-3161-4358-857f-9cf5a8989306", "value": "T1B8641217FBA5E64FD4690332287557595BF8A72162B8920B3388BB387C36521CF0E772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579952, "uuid": "1295e9ac-d918-40c5-b9d4-d51162b370d6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579952, "uuid": "ecbcba83-db54-4368-9756-6758eb5c6115", "value": "6144:/Ya6PHN/vNPjkb7B7cFcDjCGg3ZfdsRD++ZYZtZj+Cr4JKzd3e:/YdHN/hi+IjCtJfdeD+AYZtZddO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677579952, "uuid": "bb087039-955f-434c-9239-84487973c72d", "value": 334496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677579952, "uuid": "ab96c84f-38ad-4775-8df9-2e8d1d53a7e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579952, "uuid": "cc39fe87-6d54-4dab-b353-3fbdb8aa8839", "value": "Shipping Documents 7639081.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3bc0de-b76c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677591319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677591319, "uuid": "0b5aecab-c0f8-4fb7-a577-9fe3049a4853", "comment": "Malware payload (AgentTesla)", "value": "9e51e1ce0b08d52e9137766a506c9ab6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677591319, "uuid": "df5cc08e-3152-4e35-b37a-d1a50d5858d7", "comment": "Malware payload (AgentTesla)", "value": "0b544138e67ce8812ba90dfa705d39e9f4126eec57aeb7e01e89f776cf6389eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677591319, "uuid": "71fb6f5a-df0a-4250-9df0-83f9afd580c3", "comment": "Malware payload (AgentTesla)", "value": "bd541bef842c9eae6b95832a66ebc3a64a96127c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677591319, "uuid": "178b9550-8f64-41af-9c85-596eb23f2390", "comment": "Malware payload (AgentTesla)", "value": "4618261af39ed1bc0b551bfab90518248fe8c9ca885ec07e3fdf8529b734499f1ab9e5c870bc42828407eebc820ea6df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677591319, "uuid": "a702b8f3-2b9f-4696-b464-838a23c392b5", "value": "T1606423693394D8F7E9E267321E34A76EBFFED9104465EE0BA7A0496CBC21510B70E314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677591319, "uuid": "d6280dcc-01d5-4f38-b26f-446921266ec0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677591319, "uuid": "8fe02044-cf62-464b-ad5d-83280910cdf1", "value": "6144:DYa6vttoddybjf9EdeDXvQ5BB9U5aLtBNI4PIjqTIHwiSqipJWfiwB4erHJ3ed:DYtvk4buAXYBBhLNOqTIHuQJ4et3ed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677591319, "uuid": "5030161e-2e4f-4a61-be69-91fc9a8cb172", "value": 332651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677591319, "uuid": "82174c32-6cf0-4ed8-9b73-f67499495f4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677591319, "uuid": "5bf7bb6c-84a2-4771-831a-7802d73174aa", "value": "Shipment_notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9a2c89-b741-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1677572638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572638, "uuid": "14e76d93-751f-4850-9c43-0736682a3d19", "comment": "Malware payload (Socelars)", "value": "fce50d42c32ea7de3d5da455cd2ead3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572638, "uuid": "3a4fcded-08b6-4558-a405-59f5fbecb035", "comment": "Malware payload (Socelars)", "value": "0b70ee102482780a5039700c0edfeb2d483b3f142bbf8ee23a5c364d626da672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572638, "uuid": "347232a5-e1d3-48fc-b53c-cb7a7c364767", "comment": "Malware payload (Socelars)", "value": "7fcbe29cf60fb2f9ba1380a33747c3d6665316ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572638, "uuid": "b245d718-73c0-4e62-8724-e3208b0ae4b3", "comment": "Malware payload (Socelars)", "value": "1da90140ebe5fd0d6d7e948f71092c1d2d757f44e5969222ac4c3523c4a47ba58a808d98f13c4d01e226ef2198e07dba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572638, "uuid": "8604ba7a-1da0-42ad-a131-b4c32aa1ae21", "value": "T1BD658D21F7C26032E8E310B745FF56BE9D3C6A114708A4D7D3C82D999B614E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572638, "uuid": "a265cc89-4428-4c99-b6fe-e164bf081bbd", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572638, "uuid": "2726caad-4c83-403c-abaa-86f61fde9be0", "value": "24576:tGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRTP5h/Sm:wpEUIvU0N9jkpjweXt77b5B7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572638, "uuid": "aada8bae-0723-4c0d-9025-2e86e2e2dc75", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572638, "uuid": "710dfb3e-5351-4aef-a7fb-4a94fac6c7fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572638, "uuid": "b7b53040-821e-49de-867a-700c99069efe", "value": "fce50d42c32ea7de3d5da455cd2ead3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71dcfb27-b740-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1677572293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572293, "uuid": "b4ef2752-3de5-449b-814d-820c045deb2b", "comment": "Malware payload (GCleaner)", "value": "fc9d6c44a166ea2f7f93de619b904481", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572293, "uuid": "19d6d67d-8978-4951-8c0a-a40649991ea5", "comment": "Malware payload (GCleaner)", "value": "0bae28922ad0fc2e5d92b6bf45fd23efb20c2639fafef7bcb0e12b642e2a9f5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572293, "uuid": "9257189f-4161-4968-b4b2-dcda23d727d8", "comment": "Malware payload (GCleaner)", "value": "e47a116cf55e7f3dbb141f0dc4b6c75875fec38a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572293, "uuid": "8f609a12-e51c-4730-90dc-823d504b18c1", "comment": "Malware payload (GCleaner)", "value": "ddff33193c9f79f757a4d9d3aa6135691c4f714caaa17866b0ae8cbd9543010aa72be8177615d821c094ca66f5d0a565", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572293, "uuid": "ce359770-9be2-4388-85df-fbd319cfee29", "value": "T13E54E11272E1AC71F51E1A36896AC6F4693EFD228E29665B33383F6F0D70190C5F2752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572293, "uuid": "d6bfdc60-f03a-4161-a388-6ba2eda39a4c", "value": "7f54b7f04db8fcc4bbf55d4720df1540", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572293, "uuid": "a65c50e5-d937-433b-8d63-165b0a5476f3", "value": "6144:QgnrhUFa2TGI5Z6p+F8duWDHoGjiXECnrSenXJ0v:Qgnr/2TGI5Z6pjEWSBneen5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572293, "uuid": "1c786863-d574-45f4-ab19-8cc4491f6c54", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572293, "uuid": "fe0334d6-7ada-4f1a-ad7e-1daaf881ee5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572293, "uuid": "d0cc39bb-ab26-4e5f-bc16-562b7d109c22", "value": "fc9d6c44a166ea2f7f93de619b904481.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1084c16c-b781-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677600047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600047, "uuid": "c5eea011-49b3-4035-b6d4-77436763f59f", "comment": "Malware payload (RedLineStealer)", "value": "cf584a07a24c484d118b5ab8824adeac", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600047, "uuid": "c4c76d7b-aaeb-4387-b19c-f9311c380a8e", "comment": "Malware payload (RedLineStealer)", "value": "0bf8d1b56d9ee5eae096286c987f3433ee9e1141afdd45581c0b644316e2fdb2", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600047, "uuid": "d9d72afd-b698-46c1-865a-995e4633d31c", "comment": "Malware payload (RedLineStealer)", "value": "555db10f57d3f85fcc51d948aedab3312e6acade", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600047, "uuid": "0be4fca7-75fa-47e7-b705-fedfc24ae552", "comment": "Malware payload (RedLineStealer)", "value": "c690794f0d0a6e518fe7ca5fbc844f558863fca1b60232e9d83508efe7607a51052da2c4e169c72b47d93b55f09204e7", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600047, "uuid": "0cc27075-fbeb-4f5e-a438-c018747d60f5", "value": "T1C6F4832F58CA91E1D5C0C832F3FA80FD15F54A7F1999A3B705A403E8EF5222A72525E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600047, "uuid": "d31c5a50-5a74-48ec-9035-460393e84420", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600047, "uuid": "50e499d1-e97a-4293-b28c-d9fad94aaa36", "value": "12288:lUO9ksbhGltJIaejajQQ9NsmwQ7h1QhVi0RUz:lUvWQ1yi0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677600047, "uuid": "240e0dcb-6f26-4bce-ac27-6ad8ba8dba9c", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677600047, "uuid": "a3e6adba-4700-4568-b6d5-655d49f18eef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600047, "uuid": "7eba64e6-9422-48fe-a0c4-b8723a8a433a", "value": "cf584a07a24c484d118b5ab8824adeac.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a944219e-b725-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677560789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677560789, "uuid": "d8718b7a-6eeb-48ff-8884-c37c4d82d109", "comment": "Malware payload (RedLineStealer)", "value": "70c0222b8e6d6e976d67d291defff98e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677560789, "uuid": "e56ce0db-3a4a-4297-95a1-c3b100f707b8", "comment": "Malware payload (RedLineStealer)", "value": "0cf4ff5c4d14971d722eaa70fc07063a606066b5e5cd6bc53874b818b854646b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677560789, "uuid": "eb0d234c-4523-4efc-8bbb-ffc4737bcc6f", "comment": "Malware payload (RedLineStealer)", "value": "fee2822974aeb85de7f2898ac2e73d1117921992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677560789, "uuid": "6d6e378b-9256-49a2-b607-7d3570d7df09", "comment": "Malware payload (RedLineStealer)", "value": "99966c60248cc8948b2641a10f98e57f75cde202ca0c47d39359405abc13053ea760cfb42fe160fe3fbd2b33cd5512d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677560789, "uuid": "1dc3a5b4-76f0-435e-bd0f-90e954ea9002", "value": "T14FC40247E7E84062E9B45B3009F602D30A397D60AB75479B138F6C1E5DB3660B632B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677560789, "uuid": "f9668c4a-c226-4e95-9dfe-33fc284a447a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677560789, "uuid": "354bfb82-61cf-4165-b868-8e13777023b8", "value": "12288:wMrey9093whxJe+x7NEXah/k7e0ZLJ2bHI3Qzrem5A+2o9:+ys3whxJdJN+a9kj0sIam6rG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677560789, "uuid": "f7acba2e-6265-43c9-b942-daecbf2cea80", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677560789, "uuid": "4d061e53-eb18-4ae6-9b66-5cd2a524977f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677560789, "uuid": "4a1dc719-a28c-48c9-ba01-dcbf4e3b78a2", "value": "70c0222b8e6d6e976d67d291defff98e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5d6750-b781-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677600334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600334, "uuid": "6d06ad42-2819-4c6e-85d9-bbe4b4161c2b", "comment": "Malware payload (SnakeKeylogger)", "value": "0f88f27091d2b25759f51f99ebe6beb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600334, "uuid": "69a4c1aa-794c-45e7-8829-b4bec8cc1bfc", "comment": "Malware payload (SnakeKeylogger)", "value": "0e7bd6f8296063a72918c9ebb5a7270a8ac73edf60831a963715cee2a267a793", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600334, "uuid": "dfb270c2-44a7-4b88-bbaf-d82032792c46", "comment": "Malware payload (SnakeKeylogger)", "value": "af6dd7f82f5b1de6e533ee44323747c0e998ce82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600334, "uuid": "61df9e4b-b86f-4caa-acf7-6d50118aca54", "comment": "Malware payload (SnakeKeylogger)", "value": "135edff16269263cd9e208969d18ac89ac5568a6f63feb38e23fb5b2650e21bee2b813befde2b0d4b0111897d4b6652a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600334, "uuid": "49a30412-dc2d-46b7-b18e-e2a163f5a398", "value": "T16054131333E5C1D2D8E393324FBA2AA1FEE6940154647B37FF549B643C61541EA2E3A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600334, "uuid": "251b0d31-9bee-42dc-bdc5-a57166dde458", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600334, "uuid": "f484560e-8d55-48cb-acbf-af718731ae0f", "value": "6144:/Ya6q+A5R25huUdJDvtS72xOQM7303YHdnU/XyKSgIgktRKxk:/YEX54sUXw7/03Y2v9NIx8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677600334, "uuid": "07226385-6c22-43f4-ab1d-bbdf4e49afb4", "value": 294163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677600334, "uuid": "1f5316f1-7792-4637-9a74-861ce191f115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600334, "uuid": "6adec1e9-b194-4600-b12d-bcd02cd61879", "value": "The New Trade Festival in March.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10699eac-b741-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677572559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572559, "uuid": "7c3a0fd3-6249-42cd-bb19-b459401c6ebb", "comment": "Malware payload (Formbook)", "value": "3d7b32fce8e6eacdb430cdb33bbbca27", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572559, "uuid": "6cfb41cb-0360-402f-9f55-012d11ea6023", "comment": "Malware payload (Formbook)", "value": "0e83b40d751f735b6088f7c998ed7dd3321527adecf03ad156d91120adccd9eb", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572559, "uuid": "9c6159a1-d7b0-45c9-b65e-034a7bbddc2a", "comment": "Malware payload (Formbook)", "value": "4e440184ca3aa5b5eca1e238af95a98440b4dde3", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572559, "uuid": "b130e298-52fb-4cc3-acd7-ff2b7fd0984f", "comment": "Malware payload (Formbook)", "value": "0023593b47528de4af48278bb08e1d383a811e6b6a3e7fc9d3435c66c108e1ee45e6f33b363b5792e8714c21e4bdb98e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572559, "uuid": "e7f986a6-3853-4112-af57-3d83cd98e0de", "value": "T17FF45BE1D68488E9FC694B76A8339C3614677D7EB9B4A41D661EB6322B732C30077C07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572559, "uuid": "997f7392-0906-4769-aa92-90e91a1cceaa", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572559, "uuid": "ca2cc931-a7c7-46b8-9715-3aedc93acb3f", "value": "12288:4YGGr4VVVVVVVVVVVVVVVVVVVVVVVVVVVVVH+WMOMIl6YuO7XsI5DZOudbCTEoS/:4Ye+WM7YZsutoRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572559, "uuid": "6dde1cb7-f722-435f-9053-f651b9eb7686", "value": 739374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572559, "uuid": "6d5bcd5d-b695-4d9d-b09b-6d122024fb23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572559, "uuid": "8283d058-c6e8-43e8-852e-18b4e17a7814", "value": "DHL Shipment Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4049646-b74c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1677577638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677577638, "uuid": "f8e3d55b-709b-4485-92c8-1fa9c0e02658", "comment": "Malware payload (Adware.Neoreklami)", "value": "ffb11d26beaa0cb59352e10de287ea19", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677577638, "uuid": "1df02ac1-0eec-44cd-8861-b3f8a92611a3", "comment": "Malware payload (Adware.Neoreklami)", "value": "102526f614dc0c400094a37154b9b7f9c9c1fc2c4bf91d637526d6fdbf525e4f", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677577638, "uuid": "9cf4f338-62ef-49b8-8709-2a4bae82adb4", "comment": "Malware payload (Adware.Neoreklami)", "value": "bed37eee47928d008a7f9b2a977c5070e2c44562", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677577638, "uuid": "2a24b0cc-070c-4caf-9590-fcee9c958999", "comment": "Malware payload (Adware.Neoreklami)", "value": "69058e20a4c1d0c0c55ea62dd6f8c4958e46b6f4b20148ea0a4a0da051eb2667160254fa2e8c3bc4d8a0e157a69072f4", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677577638, "uuid": "2e5c4d51-93c9-4699-a3de-637f3089f981", "value": "T1B77633213BA7CEFBE556593E05E86FC0D6A7CE614943E2A3438DA43CBE2D124C15938D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677577638, "uuid": "62951e33-7a82-4179-a708-3b5ec7dec1d6", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677577638, "uuid": "a90c6ba4-fd4f-436c-9f5e-ec3612910840", "value": "196608:91O9dswziLab/xpOQSOhZO/4zGQJqFxlZJgqs6:3ObsIiLaTrBY/OG7FvgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677577638, "uuid": "6de0acc1-11be-4bba-8c80-14c10fe81e88", "value": 7585563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677577638, "uuid": "79ad5331-fc53-43d9-9be1-151aad93a2f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677577638, "uuid": "f845a84f-40b0-4c92-b81d-8fa32b9a68a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7ad4c1-b755-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677581409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581409, "uuid": "97eea7cf-aecb-48b3-9e49-074f017ee3d5", "comment": "Malware payload (Mirai)", "value": "3bc16fcb6051b1f60a6c99ee5f0a3bc0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581409, "uuid": "519ae459-d2a6-41b3-81af-8d890b4bf321", "comment": "Malware payload (Mirai)", "value": "10416b297500fda7276dfbaf97b656ea990120490620da844a4bcb9e9cda18d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581409, "uuid": "f53c4fae-0c9a-4e1a-b988-322ce120ef75", "comment": "Malware payload (Mirai)", "value": "bd93ea7827f3d5f271f4348e9355b04bab710ed6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581409, "uuid": "42752ebc-19ad-465f-b5f1-78d2bce805cc", "comment": "Malware payload (Mirai)", "value": "5cb147d53b71b6aa18be716d52b34a6059767daf32fa48e1ed814d00b67735d10b5ff0b0ac8f48995211e5cc3e6092c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581409, "uuid": "1ab3b12e-b9c3-4599-9085-4f972d685335", "value": "T16933B6C58EB63D3AC2CAFBF5E5E3D200A5F71640A7A5424D7CDA0D51C92DB80246D3AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581409, "uuid": "7b134a18-52f6-4e55-964d-b8aab2f6ce2a", "value": "384:2sFTIWXQJMIerbn47MpVzEaVSm/8YcVLYjLRN2xXiK/AmgDNdCwlxpNlpRX9bLJj:/ewHLnjmAAYxfRtbFLRItF0WHl3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677581409, "uuid": "664a68ea-03bb-4808-8e86-963fe487174f", "value": 53186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677581409, "uuid": "5a96090a-ea3b-418c-a908-06bb6ca11893", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581409, "uuid": "b42b6aa0-7c46-4797-afef-166dde15dd53", "value": "3bc16fcb6051b1f60a6c99ee5f0a3bc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c1eb2b4-b776-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677595396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677595396, "uuid": "543024f4-6311-4d29-99f8-2ba430e8828d", "comment": "Malware payload (AgentTesla)", "value": "cdc25850d059660c60a5e6445c05c9b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677595396, "uuid": "b49ad452-b65f-46cb-bc69-b8c992b67935", "comment": "Malware payload (AgentTesla)", "value": "11a62d73904b8e0635d5982b3f69c9202099353d28621e665e63486e7f14c4f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677595396, "uuid": "c37a00b7-4664-41e6-875e-f042223cc41f", "comment": "Malware payload (AgentTesla)", "value": "0c3eac6cf66a46eb23acf715a1397f2627f894ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677595396, "uuid": "4d557e29-30ed-41a1-88d3-7ad5d35e93dd", "comment": "Malware payload (AgentTesla)", "value": "b3ef0ecad322cbbbe571dc1759a6bff7c18c373c04f5441e02fc7e8a171b323af22fce5cce6c61d96015124cf732500a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677595396, "uuid": "4410938c-2f6f-40ce-a2d6-231630c83b37", "value": "T1BF257E60CA1517291D1F1B9EECC14D51897DA82C422B8E39FEEA23AE610355CE3FF719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677595396, "uuid": "cf78fa2b-9dec-4228-b294-24d46ea58b25", "value": "24576:Jamo1D4oLGWnvUXAPZx/09aYpA98hsmt+h2:EM2Gqx/0ftsmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677595396, "uuid": "283253d0-922b-4b1e-b466-32d376212854", "value": 1011615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677595396, "uuid": "70cf4439-b634-428c-925e-c89dacaa197b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677595396, "uuid": "81126ca5-554e-4c85-a6f2-5ec4aaf8bffb", "value": "Signed Invoices.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a62faae-b6fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677543397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543397, "uuid": "84c1099e-d031-4760-a6b3-db40d6a864c8", "comment": "Malware payload (Mirai)", "value": "45df33628673644da3da392447965fe3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543397, "uuid": "e8a7bfd2-f149-474e-9ec9-67cd11dc8f20", "comment": "Malware payload (Mirai)", "value": "1311dcf7f16d59f76e8f218a22efc8601b029762459fbf28371f265360df440e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543397, "uuid": "59987650-1abf-4f90-a79a-400ea8e420a2", "comment": "Malware payload (Mirai)", "value": "abff32297006fc6b2d227b492ac737eb79603df7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543397, "uuid": "a0b60ce3-1f53-4299-8494-6a2c731d1d93", "comment": "Malware payload (Mirai)", "value": "e2f1c987013c2fc9548088004872ee82f9b0a0620f768d75f74f1569dcca22f4a94ce17483ca428a5ffd40194a5800d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543397, "uuid": "8141d00a-b4de-45e9-a768-6cfb0a6105f3", "value": "T12BC32B46EA408B13C5D617B7FAAF41453322DB5493DB730689285FF43F87A9E0E27A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543397, "uuid": "98ade18d-df5a-454b-9ec8-44929836f166", "value": "3072:K8PXmy9MphJXM93N30yDShgFKeqBp+nbHM/9trM/:pPXmy9Mub0yDShg4eU+nzM/9trM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677543397, "uuid": "32204cd8-2710-4db3-b95a-c2d1574825c6", "value": 128047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677543397, "uuid": "bd5d293c-05f3-48d1-8b40-1ea7faebd5fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543397, "uuid": "29569b12-7bd7-4e32-a227-e56235ec998b", "value": "45df33628673644da3da392447965fe3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9984b0-b779-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677596737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596737, "uuid": "e4602049-7ee6-4de3-ba0a-c8343895a086", "comment": "Malware payload (Mirai)", "value": "f7a027f1b407888ebb5fb264bffa6588", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596737, "uuid": "9e3b8bbb-11fa-41f7-9c7c-143fb25874f0", "comment": "Malware payload (Mirai)", "value": "131c60ad267ea504c7fff6977e68bb624dd0a19eb49d1fff40f9b9e55c105ac1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596737, "uuid": "15658961-b550-43ec-b1d7-51a3d1a1a135", "comment": "Malware payload (Mirai)", "value": "f58c6f363b568428108adf846ed903e03ac3d6e1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596737, "uuid": "e3f3233c-3198-42c2-ac98-d83a0d0bdb24", "comment": "Malware payload (Mirai)", "value": "2c4123ed910d6048c7d8e9bfd7ce8a98c3d24cb2d8029043deb36f7f83651ac54406165f49424b7b25638b7d62050e3d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596737, "uuid": "5769df8f-7733-45af-88ea-585bee600281", "value": "T1C321B19AA7D36E27CC540277DC9F5710F362AE95869EF513F32216190C7F21A1F31186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596737, "uuid": "69703b34-9b9d-4c55-bc6c-fbd84375bc1e", "value": "24:JColMlgP9qD0at6EocGwrrUlFSy4PzLCkIddx2HuGIpMNfc7:JColMOFqDPtFrrkFSy4PzLmGIKNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677596737, "uuid": "6dab6683-f5a2-4fc0-8231-3b723cfb61e4", "value": 1156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677596737, "uuid": "6009b83b-cf5d-42b3-97d5-086ddea38550", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596737, "uuid": "258c79ad-ce6c-4d97-b323-14db7ec4dde4", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c43ead-b7b3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677621819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621819, "uuid": "bf06e816-506a-41cc-9e47-9d47897ec405", "comment": "Malware payload", "value": "0aab3c9326a82d57e9525898133af1e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621819, "uuid": "3abf8cac-ee0a-46fc-a5b4-f2bd7bc447a8", "comment": "Malware payload", "value": "134aa826ca5a941a1bf9db22b94b2c765c5c014a4819eaa354bdac50a67b967a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621819, "uuid": "a9626634-6d99-4052-b35f-c50889865dd8", "comment": "Malware payload", "value": "de47958d6a3273e936e8bd22745223c9984339e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621819, "uuid": "e51fdb08-cb6f-41e7-9641-ca1345cd27cd", "comment": "Malware payload", "value": "c122523dfe554a21d8ad5bfdd093aaea1591df1c05328bb8f58d3e6c910207d6d080ea716c8c0d9a1034803224714c10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621819, "uuid": "b352d600-9c8e-4f3e-9f1b-e3b0b0616b85", "value": "T1740523BE7C40AD9AE0554F34BCA0E332861C8D3D5C18D89B5B8EED977774792CD8A218", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621819, "uuid": "b61a939f-b31b-4a38-a9d2-1cc4fe72cde3", "value": "d568c4866e96ad0f3e66ac4d689fb8e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621819, "uuid": "fdbd718c-113c-4699-84dd-b1dc4d16cfe2", "value": "24576:SFKuNIdnwzifO5IBvZFkr4TgpNrAOTILPX:UoKifO5KhFougPrACILf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677621819, "uuid": "f7e85502-04a3-4fa8-9094-a95ee519ad55", "value": 813736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677621819, "uuid": "2c636a5a-afeb-442e-b539-3029afbe5822", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621819, "uuid": "f84472c2-b083-4458-be0f-ae01e52337ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355226e0-b752-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1677579922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579922, "uuid": "77686d6c-506f-4be4-b1da-24835a5a9e8b", "comment": "Malware payload (RemcosRAT)", "value": "5540d0e063b8778bfe7a44ee77a95bb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579922, "uuid": "73b596eb-3e05-415b-838d-372c5fdc5503", "comment": "Malware payload (RemcosRAT)", "value": "153f00cfcabb3fc9bf6ca01da20de1702cae1957d4b0fb998db99ad502896f76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579922, "uuid": "0ed60484-327e-49cf-8592-cee80a35e9ce", "comment": "Malware payload (RemcosRAT)", "value": "7dd4bd1ccc0c4aab197cb78368c749234a6857e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579922, "uuid": "da11abe6-c2db-4017-b614-b5a7f2b616b2", "comment": "Malware payload (RemcosRAT)", "value": "6120befeb738ccb9c00fedb62dfd409c878fdad271130dc7305a2611b1a410e8ddf5dc47ecd6baa794703e0d0ebf1115", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579922, "uuid": "ca9b68d1-e9b8-40a3-bcd0-7f6da8afb732", "value": "T1C4057CAA75E2E179CA84C23099113C3043F30D95D93DEB05A8CEF9E89639FF59F56206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579922, "uuid": "2c4f7980-fa1c-4c89-bb42-a1ca0fb7358c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579922, "uuid": "efbd48c8-20f2-45da-9634-32659054822d", "value": "12288:PklhUh4txi/Xg2VbQIweSp3iLeIbxxlRLDqvIqCjwldEfTX:P1JChhp3mhxRnqNCMlur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677579922, "uuid": "0d608518-74ea-4113-9d47-655244021ad8", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677579922, "uuid": "f5bd2711-c0e3-4d51-be42-fcf24988add5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579922, "uuid": "b9929041-6ec5-4600-981b-e063c06c4160", "value": "P.O-2023022810430524IT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18913b1-b740-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677572400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572400, "uuid": "be7a8d97-d535-4ba5-a63f-485ed32fbd9e", "comment": "Malware payload (Formbook)", "value": "ecf63933f952c0681497cb895e703041", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572400, "uuid": "05bb30cf-b5bc-4355-9a0b-06dd00829564", "comment": "Malware payload (Formbook)", "value": "154ad3c86d2a3c4dc332a7a130ef5c437735530d8c511aa85a1bb13dbc6fc45d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572400, "uuid": "92e6bcd0-f8e3-4c57-ba2c-4085845be7d8", "comment": "Malware payload (Formbook)", "value": "73181418d4aaaa319a37b8dbc8a53daf33bef566", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572400, "uuid": "ca9dbcbf-fcab-4293-9c25-c73966f9745c", "comment": "Malware payload (Formbook)", "value": "e03aa8778c8ba99d82e61481a1ccf2f00e216b6785bb739dd0fba0a187749fe939c92403882abea001532e2a4f9f61ff", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572400, "uuid": "c56f9799-607e-4de7-a1e4-39635d241fc2", "value": "T1CB85BFB876047DE6266F576BDA96ACDC13B627239ACBA4CC806477C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572400, "uuid": "effb2032-6e86-41df-abce-789abb488d01", "value": "24576:h5hMQt9Qeqrxr/C94xx7+AQP32FrlXl1n+8iNH364xctdPdqDm+QujWrcVTxsYhB:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572400, "uuid": "977a501c-f957-4193-8296-90011ddde29b", "value": 1832550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572400, "uuid": "e8a0eb05-b556-4fad-9451-783495371163", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572400, "uuid": "62d3aeb8-e514-4f3c-bd55-e4f07ffb08b3", "value": "SKMB 2023002.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f05806a-b739-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677569174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569174, "uuid": "967d7851-67b7-4f1b-be48-3ecd9f472924", "comment": "Malware payload", "value": "3060f834b50441a6ebb3f6b53dc3fc83", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569174, "uuid": "a53f9077-6d06-4b03-a3af-ac4cea87667b", "comment": "Malware payload", "value": "159642e35052c735a006e0eda8be64f2a333d4fa4e55964baad98cbd71111ddc", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569174, "uuid": "ad370250-580d-4300-a023-b7418bf27b02", "comment": "Malware payload", "value": "ebf63d74e9c4e4bff97161404a85599a116e2fca", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569174, "uuid": "1abe5891-279d-404b-9c3f-41f4c3bf9182", "comment": "Malware payload", "value": "5c2a69d446d88e17ec2fe7cafbc4087930c64f5691781e0543b9c30b3c6ae913895cffc789ee0a63c15481c8bc7e4a70", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569174, "uuid": "dcc76a65-88f4-4ded-b392-97879a75dcf0", "value": "T140814CF702219418813E76C9E91FEED0CDCE73EF018F9A56B3E469269349254768C1E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569174, "uuid": "d916062b-27e3-4e2a-ab98-46998dbbf867", "value": "96:VLyOULDTW6jT6aU3HZsqQhWKQ1iTPVpaAut4iHPeNNteMzcz:VVoDRUXFXfoNpaD4iHPmzcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677569174, "uuid": "363a5dcb-3f07-4adb-aab4-1cf039482b7d", "value": 4022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677569174, "uuid": "68422dcd-6b7d-4f84-bef1-eeaf30bb40e5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569174, "uuid": "0cff148b-4b33-4927-a73e-8535027cb6da", "value": "New PI 206891711.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff49aad-b7c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677627400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677627400, "uuid": "f9d76dfb-bce5-4aa3-abc9-a5031685ddc7", "comment": "Malware payload", "value": "73ba0a661987544602661c5929f997d2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-5827", "colour": "#970B40", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677627400, "uuid": "6381bf49-5b46-419e-a9d2-a1246678aeb7", "comment": "Malware payload", "value": "15c6af185e7f3dd9a9fde1a3d418b5f9a82b1fda13d9f7989cf9747ecfb65003", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-5827", "colour": "#970B40", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677627400, "uuid": "14ce14cd-1c54-4fd7-bdb6-c68b8f68ddcb", "comment": "Malware payload", "value": "f1d3757a28eaa14b009a724983c6038195c74b48", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-5827", "colour": "#970B40", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677627400, "uuid": "e3c1966d-83a3-4615-90b4-263701bbea67", "comment": "Malware payload", "value": "58039675e37c49e0ac0e748095725c13ce57f09ee696362737f14f3e5cb4ed4273f977d4246550bc20e3110b0cdbad29", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-5827", "colour": "#970B40", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677627400, "uuid": "0c02040f-a7be-4e86-8210-6f013471d3df", "value": "T1BAB3128185196DC9F6DBAAB4B7E6B7DCC2284143C2DCA5C2F7ECA415A38253D43D28E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677627400, "uuid": "598899c3-8671-4066-abeb-4a0c29309ece", "value": "3072:yAP5atqnEA0UqTcNRRoYm6Q6Vd6Ig5F1/98CdyiJ:1hbEAvqTeRRov6KDryA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677627400, "uuid": "613137d1-922e-4b03-a6ed-11ee87bbafa3", "value": 112273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677627400, "uuid": "9048324d-967e-4940-884d-6283416b378b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677627400, "uuid": "02cd770a-7368-48a5-a52b-c08df1b2bccd", "value": "Contract_02_28_Scan#318.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558a286c-b782-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677600592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600592, "uuid": "6e17a91c-6dac-4566-b12e-03bed3a34d02", "comment": "Malware payload (GuLoader)", "value": "2cb34765902cc15b3d374cd431957c6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600592, "uuid": "edc36781-c122-481b-916c-9fd57333cb05", "comment": "Malware payload (GuLoader)", "value": "1642e302ea7d964301d5d1c2e4219be810a696d883aa732d4b4a55a10055a562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600592, "uuid": "deaa2efc-4803-456e-86f9-ed636d7ab747", "comment": "Malware payload (GuLoader)", "value": "8b8ed93b84f5af4628945e22cea47ebbeb84a72d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600592, "uuid": "8b336013-ee1e-446f-aad4-52e0643b56d6", "comment": "Malware payload (GuLoader)", "value": "5b92fa191f2e452d29b9c1fbaea1a8f156f79e6ae1c80a6ee50200a24066e4bcea7e50f51ddc7b3586be7a4ba58a837d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600592, "uuid": "41c1a952-1d91-4b2c-9994-433ed6ee6d5c", "value": "T10155331A46E0D9E7E049A174C4B6B6F8EEA1DE03CA909BC3BE407F987EB345157C4391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600592, "uuid": "f3be7fb9-8cfe-4134-9341-416b31dee452", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600592, "uuid": "b55a2971-c9d4-4781-8615-ad96dac1d232", "value": "24576:ls7xSc7hri6vURy3jHwX5AwP2E1OdfGmf2LxBxnusgbjIh/:Mxbhi6sRy3jHCAwP2E1AGRxBxqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677600592, "uuid": "3bdefc59-7f28-44f7-8032-edc44008f2ca", "value": 1378992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677600592, "uuid": "c7124e88-b284-4d79-84c0-63929dd3766d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600592, "uuid": "314dff08-a1e9-4fdc-8788-41f8aca36c9b", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "395a217b-b6fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677543422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543422, "uuid": "2cec0b86-a55f-4b24-a139-56a58d0cecdc", "comment": "Malware payload (Mirai)", "value": "fe45ff08a7e1ac8dd2377af080408874", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543422, "uuid": "ef1f9c25-5f17-4598-95e9-577c2dc1f8ef", "comment": "Malware payload (Mirai)", "value": "1650c8e5fc4b68444336f4d33ef943cd4e83b0c0ee1af9bdf440a4e80c480b44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543422, "uuid": "dd0b1c09-6115-4025-9837-08e642a7b640", "comment": "Malware payload (Mirai)", "value": "768b1869a84eb500b83d76f5136810beb6a0047e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543422, "uuid": "9645ee5d-2fd2-4a97-afb5-9feba74ea378", "comment": "Malware payload (Mirai)", "value": "109d845f36320b0ab30a6a7fb160463aa146d4c4fbe5b5e1ab9ef603bc4da3d0b4ccd08b0b77c740c798c448032c8133", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543422, "uuid": "892c7ec9-d7f6-4a32-94f7-4dbfee37a757", "value": "T15E333A0272280907E4675EB0353F1BE093BEF99021F4F688690FDB5A8276E771586F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543422, "uuid": "4ce80ea5-c515-47e0-ae84-452678af0bfd", "value": "768:JYqJ0K3+Rxf/uqxmDlDa0UbHrzid5+p7z+Euv/T:1J3OiqoRDHAriEp7z+Xvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677543422, "uuid": "05055f5a-dde8-4efd-b399-b0e92754b261", "value": 51096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677543422, "uuid": "52f9a348-efb5-4ffc-a5fc-2c86f5f0c31f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543422, "uuid": "7b0d4b1e-e086-4cd0-916d-a46a834bb695", "value": "fe45ff08a7e1ac8dd2377af080408874", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b18505a-b774-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677594562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594562, "uuid": "0841b540-3e6d-42b7-9e06-8b50f4e8e060", "comment": "Malware payload", "value": "52f43f65936b528349c16e7054072c1e", "object_relation": "md5", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594562, "uuid": "e4486cb9-0e6c-4565-96d0-c951ee53ef54", "comment": "Malware payload", "value": "1713afb7ab14438e57b0e79bc8d3bae60cc68363acaaace0db90adcc17204cf4", "object_relation": "sha256", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594562, "uuid": "a93a6ece-b743-4022-a652-bcd210ac29ee", "comment": "Malware payload", "value": "9988062fd195a6020e0403f3e3e66556b2047ba2", "object_relation": "sha1", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594562, "uuid": "208177da-9336-4d13-9a22-2bba04f0888c", "comment": "Malware payload", "value": "47735226b06bf929957de68e512e342f666dd461f284bf5cb2aa4ceb97981de5bd89e2cd674305c3e6bb5d5606855916", "object_relation": "sha3-384", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677594562, "uuid": "6bdae4f3-dc40-4fa8-8706-2d47c384e8c4", "value": "T1A9F4AEA8A75805BAD967537E8802C691C6317831431312DFB3E89A7F7B439D8633DF29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677594562, "uuid": "0ef838ed-b570-4982-a71a-d0c6c95c9320", "value": "12288:Glk/KxE6ZaHBIgnoIf4YH5OHyhtF31BhkWvSqY4zvmjOwJITEXaN:Gluq2oSPZtnPk0hmOhTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677594562, "uuid": "941cf949-8bcf-4332-8c94-7d631e4123d2", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677594562, "uuid": "090d2528-0737-4c59-9925-3cfc5ec2c40c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677594562, "uuid": "c5b08df5-002a-4eb5-b4f2-0ea83c59eba6", "value": "concaveness.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b66d71d-b745-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677574295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574295, "uuid": "acea82e4-1ee4-4e73-b961-6cc37d6c92b6", "comment": "Malware payload", "value": "ead9e508ccf7794da7f23f1c55206ea0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574295, "uuid": "3b6e2446-e7f4-4a4c-9898-ab1168ec3084", "comment": "Malware payload", "value": "182bcfaaf9e59ac55d1419907c6a45510207378c3eef5b8c023c1bf0d426cc29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574295, "uuid": "5ccc77d2-0d25-4a38-9294-72d89ae296e7", "comment": "Malware payload", "value": "f342ea3465f4440b4a595f6e67317a0c9835be70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574295, "uuid": "cb6827cd-fc4e-4c25-aad3-14a51c5d65b3", "comment": "Malware payload", "value": "f867d0a3712a79adc7f7d3f35e5c3903468063aeffe1c1d1c1df582fbe348e61fbb679e819423e4f779fb467a504bd31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574295, "uuid": "5fd6d451-2438-4558-8ac5-e338c1585b4f", "value": "T18136334131E4C4B6E0967E728A91399702F2BB561B104BEBB6641D03AE907CCF67F61E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574295, "uuid": "9aa47746-04dc-4b97-951e-abcf44ef2ad8", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574295, "uuid": "a6d22ba8-0c76-46ac-a46c-bbbce4d6899b", "value": "98304:j65fKdNl5z/HYSzawdp0X3Jtq8VqiLIOmdMS3s1zpczbpxixBqTgv0W:j6RKdNXz/HXzjUZIuG3s1zpcXpxixBOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677574295, "uuid": "87d054c6-ce5b-4077-a765-f0cf3833fbc4", "value": 5153812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677574295, "uuid": "2a1c04b8-8ec8-47c1-8618-c9d85e8f4426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574295, "uuid": "b046d311-17d5-4897-b4fd-6ecc9b0e10bd", "value": "ead9e508ccf7794da7f23f1c55206ea0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb1374d-b736-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677567887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677567887, "uuid": "4982695f-a6c5-41ca-8e74-eb87ffd98b7b", "comment": "Malware payload (RecordBreaker)", "value": "f7678acac8edd162ae96ec05614412b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677567887, "uuid": "8b0407db-e67b-4eb6-b0f5-2a6585a0b140", "comment": "Malware payload (RecordBreaker)", "value": "189dffa6765935edda9032287b209ac61b5058e4163320e15c7cd2d20d8da5cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677567887, "uuid": "1c2419e5-597d-4e32-9511-3058b9cd5b8e", "comment": "Malware payload (RecordBreaker)", "value": "24f9b64e42b1943a9b6223c13bfee7c880dd96e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677567887, "uuid": "7070d30d-782c-480c-ad07-40b4cb9b1b8e", "comment": "Malware payload (RecordBreaker)", "value": "01bcff73457619a2eb8b028899f1fec81b3947d9ea97ea2bf153217f0ffb6e77e72a4daec1a68ad95d3547c7c2f3c744", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677567887, "uuid": "482bc260-ff8b-4a53-bd0a-2397eb5a31b8", "value": "T13CF59D12EA809035F4A301F697BE1A7A5E7CBF31231054D3D3C8689C9B654E1BB36B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677567887, "uuid": "19aa826f-8660-454c-a5f8-eed570f1b123", "value": "ff6db230b8655004abd62c30d0163534", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677567887, "uuid": "167f1838-663c-4893-a9dd-b33bf96fdbaa", "value": "98304:BhdvvtSdd0zlR0AxzQi5C6//u+TDIPGjiIKwLDrG9kP7P7CbM5zD6sILTjblMS0u:u6//pqGjLKEUgi4osI3jhMSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677567887, "uuid": "51bf56a2-a3ee-4a23-a3e0-3628f4858c04", "value": 3640832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677567887, "uuid": "b9d028b2-c9c5-43d7-961e-62c76ae80bea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677567887, "uuid": "3647d0fe-01a9-40b9-beb9-d0781705d64e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868422fb-b759-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677583065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677583065, "uuid": "de765a07-ac18-41eb-a059-a298f698d95d", "comment": "Malware payload", "value": "1476e51a0b94bef80e9ad6d3472142dd", "object_relation": "md5", "Tag": [ { "name": "1677576236", "colour": "#542660", "exportable": true, "hide_tag": false }, { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677583065, "uuid": "bf6e8021-37dc-4503-9d83-265519537a3d", "comment": "Malware payload", "value": "18dce3f481464289d20055c3d7af7b703d54fd850084ed4c71d4124a79aa1fba", "object_relation": "sha256", "Tag": [ { "name": "1677576236", "colour": "#542660", "exportable": true, "hide_tag": false }, { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677583065, "uuid": "dc0f3e64-db7b-4f2f-bde3-1e547dd5f7f6", "comment": "Malware payload", "value": "770128a6b7f2bdab7a3bbabbc73fc71fe2663be3", "object_relation": "sha1", "Tag": [ { "name": "1677576236", "colour": "#542660", "exportable": true, "hide_tag": false }, { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677583065, "uuid": "7855f7ce-2158-4413-ac39-933308bb1ecc", "comment": "Malware payload", "value": "5d9a30d0b7a720b4b42bae909d8da7bc14a03b7c6e29149ba9a6f27f893e85cd00c18c5325e4d0d2aedcee37775b8c49", "object_relation": "sha3-384", "Tag": [ { "name": "1677576236", "colour": "#542660", "exportable": true, "hide_tag": false }, { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677583065, "uuid": "c44df304-1a3d-44c7-abf3-c614fbbbe5a8", "value": "T1C8E41254DFD8EDE80C1F329F7A75E1A0E66D0D4485C49A74E38DA42B620FC985BE8E31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677583065, "uuid": "3f3bee9a-836b-4f8b-a25c-28ac2e61a8c2", "value": "12288:SEtveoqfT2QDKwtvKIvCSJh0LzopkSYuR02/FFWCXif2G9ttUFJ:NtvehbTKwtvKIThQzodYu62WCw2G9jWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677583065, "uuid": "51bdbb3e-888d-4c84-b685-e70bfe25e375", "value": 677485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677583065, "uuid": "3da636f8-af49-4c19-a4c1-30d89dd17dba", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677583065, "uuid": "598ae0ce-4513-42bf-b994-2898a9e6ee2b", "value": "BorisUX.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01394b5a-b745-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677574251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574251, "uuid": "3f32bcf5-3ab3-4c0b-972d-e98b62df9aca", "comment": "Malware payload (AgentTesla)", "value": "39376f45f320edad9ba50c4e1049c365", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574251, "uuid": "56040f02-21a5-4b19-851f-61d6a2168b42", "comment": "Malware payload (AgentTesla)", "value": "19146932c4a283f9e7580b7c6c729f81e1e3c7ad6012556f0b7059d8c4af559e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574251, "uuid": "e00c93b2-6c6a-4d59-b1e6-511dce193008", "comment": "Malware payload (AgentTesla)", "value": "e0698397903229e24682dc8dfb3402423b9c4651", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574251, "uuid": "10681c8a-35f1-4591-b666-d50cf4432fb8", "comment": "Malware payload (AgentTesla)", "value": "220f7662e95cb402530e787a30e4a24a9214ef3d0ad17fe079439b8849aef4d6c081d4fee0b99faf072b7b9158e242ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574251, "uuid": "4a9fd160-4ed4-4174-ba40-9e55b7514521", "value": "T13A45AE4853B34472FBDB11A51865229C4EB872CB3585F22A5F773751A922AFFB29F003", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574251, "uuid": "4b372a69-4138-477d-91c2-17c3f4989c9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574251, "uuid": "18513b8b-db92-4adb-9ed7-62554f4321da", "value": "24576:3agmebuCA6/+o1cUyKsF51Dpf4SkNlgL6uweRjx/6qW:qgmebua+eHrWbF+NlId1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677574251, "uuid": "ef8735b9-6c65-4d4b-9bfc-abbc496df1b9", "value": 1197568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677574251, "uuid": "6496e78b-0eac-493e-8401-9442d4fcc296", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574251, "uuid": "8048c833-c6b1-448e-8a8a-7810d7ae1e6b", "value": "39376f45f320edad9ba50c4e1049c365.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98d859c-b76c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677591418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677591418, "uuid": "2c4ec906-fd0b-412b-8403-0f6d37c867f5", "comment": "Malware payload (GuLoader)", "value": "bc6228b589ff7c76685003933f0e9693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677591418, "uuid": "a4f57d12-7088-4015-9546-8caa7f6ae21a", "comment": "Malware payload (GuLoader)", "value": "1bbffa3f8bd9d8adeb17700d77f607e48fbf88375a8ea5c8f119c63933204fc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677591418, "uuid": "741b742b-2ef9-4df2-8805-1ec8c859d8d6", "comment": "Malware payload (GuLoader)", "value": "3a1ca66c347c78ac1d5b6f7ec98c37ab4561392b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677591418, "uuid": "7373505e-b38c-474a-9ca9-e65d7ef247fa", "comment": "Malware payload (GuLoader)", "value": "04cd66ab6935db5b5cfe9af1c289020c5c82bf6af4df588a7575cdcbdb0068aff01aae7f4a6020defdf73cea46d45317", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677591418, "uuid": "3bd3ec15-dbe6-494e-882b-dce254a748a3", "value": "T1E894237059D8C30BD1B91F316E3615271AB0A62532B2638B0B31EA9C7F72701DA5FB5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677591418, "uuid": "43f09c7d-1be6-47af-826d-bda2bfee1e0a", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677591418, "uuid": "198db573-70c6-4fda-a35b-3d1c92273de3", "value": "12288:HiopATnYCAwgxbxcIZNQuzUDukt0UGSzWG+:HioqnYCAw0iI1UOu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677591418, "uuid": "ce1d3c6d-aafe-47b8-97a7-7ac4ceb5a8a2", "value": 419904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677591418, "uuid": "12e2c85b-a46f-4fbd-87fa-050f03726fc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677591418, "uuid": "ee75d92e-6300-4425-b02f-5e196d0462c6", "value": "rpayment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a18ef67-b761-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677586292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677586292, "uuid": "6f75fe8d-3e8f-4d70-8b04-8a588331e7dd", "comment": "Malware payload (RedLineStealer)", "value": "afda14bb01d49f990c630fb905ad10f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677586292, "uuid": "2c7edfac-013a-4e85-8d41-ebae0b20309b", "comment": "Malware payload (RedLineStealer)", "value": "1cc7c37baa9861920ab2fc557e126a9f4ec10ff5ee23578c9f0857c4e7108a87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677586292, "uuid": "97bfd5be-7e0a-4df1-a4e6-22fcbcfcd608", "comment": "Malware payload (RedLineStealer)", "value": "26e373fec80fe8a05292bd47151d6d80b732eda0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677586292, "uuid": "d15da818-73cb-44ca-bf6d-df5495e11ce7", "comment": "Malware payload (RedLineStealer)", "value": "d893e1b68f33b9e4d9a469e06b9af7f5238d94d14376f01b0aaa246d341ec8f232d95b032db305669f773b94b36839cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677586292, "uuid": "23c4de0d-3e37-4cea-9904-501659706527", "value": "T1A4A35D3067AC9F19EAFD1B74B4B2012043F0E48A9091FB4B4DC154E61FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677586292, "uuid": "52132ec2-2ba2-4d0b-b26c-218444e76989", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677586292, "uuid": "5637aa5e-0300-49b5-b266-5042fe9da8d0", "value": "1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed23tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677586292, "uuid": "5f914f44-596c-4f25-a68b-8e49c86758a6", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677586292, "uuid": "8fac833e-bb68-461e-9580-3bc7449b5921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677586292, "uuid": "b449253b-39c0-4faa-811d-4c6678b6289a", "value": "afda14bb01d49f990c630fb905ad10f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef5c33d-b745-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677574274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574274, "uuid": "7538a374-dbf2-4044-9064-cd6cd76eff1e", "comment": "Malware payload", "value": "9aab9fdff511541185f93b1f77262404", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574274, "uuid": "30a125d3-e316-4efc-a0fd-2786ce7024c2", "comment": "Malware payload", "value": "1e6f8e700eb6d957ea15ef1098ce6b2b292d32223193a54ff5c5a8df855074c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574274, "uuid": "7eb0a1e3-daf0-4319-91b1-aac8409bf38f", "comment": "Malware payload", "value": "f4a99f77cf50f5f29f9226cbc05e03db3f92e32f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574274, "uuid": "de62af9b-b16d-4a21-8ffb-1eea60ddd8cf", "comment": "Malware payload", "value": "8197a94469c91d02b90955d09787b17c4780e8a24cbf2e52527bcfce495f283186d2eb40945d40f4837f758a3886540b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574274, "uuid": "82edcd47-32ef-4dcf-b85b-2f7bef1fd91d", "value": "T18B25234759DB75FAF02A9AB10C78D1190C27BE2AA83D101635EC5E1C4FB3951B219FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574274, "uuid": "7dbbf7bc-8df1-4263-9c29-eca8851625db", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574274, "uuid": "76380fda-be2e-4a0e-b47f-4170f91e7a31", "value": "24576:pQisB9ZCc/BZYSmImYo3OqFJp5AUP0e3DDu/5Ssf+i0fdk:p98H1ZdmLYopFBhTi/5bhwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677574274, "uuid": "e4fdf202-280d-44f5-a74f-f2132c220ce3", "value": 1011780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677574274, "uuid": "b1d984b6-3f30-4697-a492-997345c48fb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574274, "uuid": "dbde82ee-cbb6-4827-8040-8a97b0823a87", "value": "9aab9fdff511541185f93b1f77262404.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90992bb1-b771-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677593390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593390, "uuid": "af7ba7ec-31bc-47ba-b1c4-06376da7a4f3", "comment": "Malware payload (RedLineStealer)", "value": "7f0770f086e4e9e61f6fea4e5d333a2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593390, "uuid": "f3e73939-a150-4d86-9d7a-0cf0fb5736db", "comment": "Malware payload (RedLineStealer)", "value": "1e8b65ae36a80d46ecf67ef4842ab9024466be83cb800fc55cabcc3d1fc51515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593390, "uuid": "72b2d86c-159c-4640-a870-9626b5fbdb31", "comment": "Malware payload (RedLineStealer)", "value": "d4d6523f5bbb82ca92beef7d2b05662994dc3ead", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593390, "uuid": "3a195188-7129-4269-be28-c8f26ff6e752", "comment": "Malware payload (RedLineStealer)", "value": "d57d1da460390d41334d944b0a5015245f81da39132b1771d1fd47510d6108698565bd1608c9ccb81fe85f474e611735", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593390, "uuid": "6e51d65e-70f6-4e3b-8f35-c65d92ff87a8", "value": "T15EC40247A3EC9032E8B56B7118F703D30A32BDA05B7496A7134E6C5B19B3A70B275367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593390, "uuid": "ce03b05d-8cd0-45f0-9add-adb99580d1af", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593390, "uuid": "4ad42ad9-f14e-4036-a139-44b3999e5bb5", "value": "12288:SMrZy90khFzGomLYZe5RlnYFujxhjCZxhuLIEhYSRR4E:7yJFzGoDAKujTjox01Y4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677593390, "uuid": "c7841458-3f75-492e-9e29-c628068c4730", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677593390, "uuid": "d9cd3508-d256-4d66-82e7-110eb88fa34c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593390, "uuid": "d1befc6a-c6c0-4590-83d1-f412130de5ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351652ec-b706-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677547280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677547280, "uuid": "0bd92ae3-21f4-4232-a837-3b614858391a", "comment": "Malware payload (RedLineStealer)", "value": "e04161d3230e35fb2585d6e71b59f4c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677547280, "uuid": "51430263-709e-4047-8517-74659f4a7ba6", "comment": "Malware payload (RedLineStealer)", "value": "1ea0b3b68757f846a0523d541cb6ee319495ce52d2655d59ae204c0357ad36f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677547280, "uuid": "327388ea-9dae-42ff-b180-a579b5e0b406", "comment": "Malware payload (RedLineStealer)", "value": "7cc71e56ce7954f0fd2aa64b988d1309def60d26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677547280, "uuid": "40b3ab32-38ed-487f-8103-6f1e0aa9c42b", "comment": "Malware payload (RedLineStealer)", "value": "ebac1a867cac3191622edf563414fadc4bc5f4bc23c43134392535790379bd4ddbabe510d494ce1249e711f08a86a32f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677547280, "uuid": "4627076e-74f8-4030-8ab0-7ff6c96fad17", "value": "T1BC452303EADD9076D6A04BB014F703D32A39BE909B78C36B635D5D061CB39E462327B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677547280, "uuid": "fdd98cba-b846-4d2d-b164-124439ec0007", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677547280, "uuid": "d3f9ce3e-c587-473c-b967-90b28e5a0b8e", "value": "24576:9ynUMvOIt/Miqyz4K2ajRDqmNI/nWSQZ49S6q:YnKi98KJqvTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677547280, "uuid": "a5e03a1e-44ab-4809-97ad-9fdf2effdf20", "value": 1213440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677547280, "uuid": "f48498d2-f30e-491b-9f66-3f2520ed4381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677547280, "uuid": "db07ccec-c9b8-4415-a8f0-cf8a9550e4d7", "value": "e04161d3230e35fb2585d6e71b59f4c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f897fffe-b799-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677610744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610744, "uuid": "5717e112-b8ae-4258-ad26-9f04acb584a6", "comment": "Malware payload (Formbook)", "value": "b59c09a06763d8b0a7d46e37857e6476", "object_relation": "md5", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610744, "uuid": "67f4c2f4-1e1a-43a1-90f3-ea29fbff50c1", "comment": "Malware payload (Formbook)", "value": "2016dcdb738fdd4dbcc09bad9e63604259b3b43ff2df2c9a5fc8d26d0cf6ca4c", "object_relation": "sha256", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610744, "uuid": "397e8acc-3539-49e4-bbfe-6851758267b6", "comment": "Malware payload (Formbook)", "value": "456fa1ddfb59cf3cb722a881bdb351ac7f388d7d", "object_relation": "sha1", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610744, "uuid": "71c848cb-427c-4629-83d1-bb16864cb4db", "comment": "Malware payload (Formbook)", "value": "c3ede54a1a7539b70174bb49a64b4f0a3550f1b95011fcf1d2c1538dd706dbe9a9c9a47dc5a42f3ecabdbc59553342ff", "object_relation": "sha3-384", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610744, "uuid": "29c8439e-f9fa-4e72-9ef6-02666e81d60a", "value": "T117659D8C337068BFE8DB45B10854198C5EB0B4DB6606F2575B233786AE8D9FBBA0D153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610744, "uuid": "3ba0d785-f3cd-4908-80ab-6870436986ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610744, "uuid": "519030b9-79a3-450c-a596-8a270855fad6", "value": "24576:x/+D7qye0uCAC7kIvS9lIffJbgB3mLc/l8x+Wlf7Uj/+o9x/6qW/T7:x/+3qye0uTIvSIffJbumo/l8xTJO+W1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677610744, "uuid": "e352c7a0-52e3-4b85-91ac-ed4d62afa5bc", "value": 1416192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677610744, "uuid": "bf584336-3443-44c4-8906-1b1e6f43377d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610744, "uuid": "3e163d10-a784-4a21-b752-0d2afa33533b", "value": "Bbva Aviso de pago MT103 Swift Ref 1009680458280223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e5114d8-b799-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677610432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610432, "uuid": "2c1dd67c-0058-4518-a87b-afe8250af0a0", "comment": "Malware payload", "value": "ccc51553f7447ee669f65bec31357489", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610432, "uuid": "d8225a6e-b514-4cbc-aaba-bde643b4eb1c", "comment": "Malware payload", "value": "20f5a703cb6808f1252f314022d1e3225776fb85316e24942a91db97fc3dfeac", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610432, "uuid": "750e8712-7bda-4191-adac-175241d6092d", "comment": "Malware payload", "value": "4e84efc26c3fb4adf204eb9e4a9a15546bfa3806", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610432, "uuid": "ac8a790d-2c66-49c5-95d5-f3bef1fe4dc2", "comment": "Malware payload", "value": "483592c998a17dc47a5c4ddc1415b79df03f74b131541cd42d578b60f271dd391b1cf05eb9781041c6f81451fdc33a69", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610432, "uuid": "84e25882-3334-4a3f-9704-e53eed0e10b0", "value": "T1F9236C46A7C19F07D96E713416EBC34C663CBD09CE62D24FB4BA372D2C712E8A691A14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610432, "uuid": "d3d46cf2-c9b5-46ea-9d7a-be40677d7afb", "value": "768:0+QG59jcs4l6Gaa4ucTmxw+tDTSDaxz99:0+QG5Gsoaa43TmxrtPSDa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677610432, "uuid": "8d5593cf-7807-4cee-a217-890b0fe8d28d", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677610432, "uuid": "ba358720-8824-4ca5-8de0-8be9e11054bb", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610432, "uuid": "8e478158-ae6a-491c-95f0-a9dd66c0a68a", "value": "2023 Easter Egg Hunt Sponsorship flyer.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a57291-b70b-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1677549638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677549638, "uuid": "95048f70-cfd7-4e11-a67c-c0384f5577ab", "comment": "Malware payload (TeamBot)", "value": "62bc933274068f728bae1e1c2c0379fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677549638, "uuid": "0f434454-9097-4d49-b0d5-afce78fadc6e", "comment": "Malware payload (TeamBot)", "value": "20f89104c6c27e855017d20081c0495dde2fd2230f3f52fc9974bc8fc882130f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677549638, "uuid": "1bb38cba-19fa-4d48-8f72-d28b4d0363d8", "comment": "Malware payload (TeamBot)", "value": "8727cbd9cb8ee676b5d1b7524bc805789641e331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677549638, "uuid": "a83ed54b-184c-4d7d-84a5-529c2c7fa5eb", "comment": "Malware payload (TeamBot)", "value": "1cf38ecb5a919815eee17ef95032a35cd1668bd1b66c60dfaa62701be4de974a0e6581616d0388f865072147cb288ecc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677549638, "uuid": "e65a6f70-478b-4a22-8b55-13d633f5474c", "value": "T1A414AF827290AC71D1321A319D29E2F46B6EFC514A796AEB7F582F2F0D74190C573B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677549638, "uuid": "b9722816-7f8c-49fa-88bd-620f1e881116", "value": "42540a9ca466c55bb4a1cb282423a3c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677549638, "uuid": "df57dab9-b577-4ee8-aef2-39ac02be60fa", "value": "3072:sq0XisQy6hRyEHvVTmb88+VBZCTzSe1CVR7UTm+cjGUw9eogY2fITZ:T0S1rjHdTmbwWzSe1CVlUTFcjogY2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677549638, "uuid": "ff218542-2ec8-47b5-b4bf-d57eeadfd4e4", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677549638, "uuid": "96ff6201-097c-4d0e-8ecf-de3b354458a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677549638, "uuid": "748f1b8b-e5f2-4d32-9969-0a27ce4b9a5a", "value": "62bc933274068f728bae1e1c2c0379fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0acb605d-b76f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677592306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592306, "uuid": "cb28f0f3-ddd1-47f3-9b14-46c8059953e7", "comment": "Malware payload (Formbook)", "value": "d4d1bb1618993de77885cd13c7f592d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592306, "uuid": "d1549a9c-6705-4c38-9e39-f680e282b36c", "comment": "Malware payload (Formbook)", "value": "213002db79b1a5e11521190f9f11fcdda96e24ab0f382fff8b9f6347c618631d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592306, "uuid": "1b39cab6-d038-43a3-86da-525c53079c04", "comment": "Malware payload (Formbook)", "value": "82fe58fe0fb90f17602d1d3327272a8ca6077d9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592306, "uuid": "1f74d9bb-204e-4061-9deb-4002aed5bfa9", "comment": "Malware payload (Formbook)", "value": "061c88864e282dd315825aee81c4052878ad91ab7b575ea936d7741020445a56777df89ae05a6d751a0955ba100b0709", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592306, "uuid": "5ce8a004-9aa4-4d10-9d66-814141388daf", "value": "T10864126121A8C9E3D69293303DB867791BF5EE2318399D4F57D42E0D7C603426A2F7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592306, "uuid": "eae6fe19-815d-4f22-930b-579ec506cbe9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592306, "uuid": "6adf168d-def1-4f2f-b44d-5c17540fa893", "value": "6144:/Ya6Gez0uNEpyOc4FpwBENLZVO3kBhMBFyaU/OuN+aQP:/YYe4uWcOcowWNLW3o6BRyOuQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677592306, "uuid": "23772d6f-02ea-4c71-9e9e-a1b550411722", "value": 306856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677592306, "uuid": "330ed276-ca63-4f5c-8159-330cdb8a2bff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592306, "uuid": "435ed037-db24-4339-bcb0-f20efea57ffb", "value": "RFQ WD-PO-23-6894 - Petrofac Instructions at KSB_PMY-GEN-S-0000.1_Rev.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "258d7594-b793-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677607813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677607813, "uuid": "f2bd6c01-2159-4f5b-8f14-fb7829b3d634", "comment": "Malware payload (SnakeKeylogger)", "value": "8df093014fefeed6f3b14ced1cd29a2c", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677607813, "uuid": "dee4b7b5-6af5-44cd-b06b-0e564fe5a80c", "comment": "Malware payload (SnakeKeylogger)", "value": "22cb6b485a1aae5183f4176cda0ac373f33f703c6aefd04ac1adc44f851decc6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677607813, "uuid": "9feb1198-39c2-4c1b-a66b-6e7b167d87a1", "comment": "Malware payload (SnakeKeylogger)", "value": "b0a57437ce64fd82992d7cf84ca7d66c15fd7c8d", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677607813, "uuid": "d373c3eb-b540-481d-ab2b-a2d35f0ad09d", "comment": "Malware payload (SnakeKeylogger)", "value": "7096b831a58132daadad408ec0aae823b887d3f3d61ebf8bc3ceea9c10d4b9a2d6791f0ee841e24d3ee9ead910886052", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677607813, "uuid": "aa2c90ba-928b-4d9f-8423-3bbf8f8e6639", "value": "T10415337DC93AC561926ACECABC5CE0ECFB17D2574E09B463A0D93B5096D7B0FA260D10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677607813, "uuid": "e23de505-bde6-4253-8495-1fe13f232efc", "value": "24576:RRSiiJB3yeEgtPaxaXbqVfdcu2ilgjY6dDdt8Eov:RnirooZYdct1dptdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677607813, "uuid": "4363f663-c324-4c10-98e9-8c7dee38afb3", "value": 899480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677607813, "uuid": "40bc20ee-bcd8-49c5-aef1-40e3a2628676", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677607813, "uuid": "8f03e499-8fec-43a9-a61c-48f4160b5f3a", "value": "SIEMENS Energy -PO- 216238068.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63145496-b779-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677596749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596749, "uuid": "829e9401-7108-4c52-96b0-36f99aceb48b", "comment": "Malware payload (Mirai)", "value": "a363b9f91341c605fb11681e2d7172c6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596749, "uuid": "c3e9ad24-ac80-474e-b5fa-8cbee48a1f8f", "comment": "Malware payload (Mirai)", "value": "24f2241568b9f5e2493eba4262143f6542690d78fea924acae346e3449b5440f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596749, "uuid": "e0477261-1691-4894-90a9-c60b349d555e", "comment": "Malware payload (Mirai)", "value": "767befb247cf6ae8ff82763d5e926ce8ea3ea38f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596749, "uuid": "18d0a784-0fe9-4b6c-9240-aa01e4f49e79", "comment": "Malware payload (Mirai)", "value": "6b0311c08b469fb430660abd198916800243c2ce825c33f4f66cf165890165588d3fb0188cb62c5ec5b788d09fc75a74", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596749, "uuid": "a9807080-f672-4615-8658-8ca467adb5b3", "value": "T17441AC8E1F714EF8F559D93C87374B3567AB925843D04249E2ACD6006EC430D49AEBE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596749, "uuid": "03ffb98d-108e-44e2-8760-d48326c15889", "value": "24:3u4dsgph8AmsiRD8AmyT/z2Hz7llPSqtWB4u37I8pagDdz3N9l5zBkEp7ilAGnEf:exgpEuQ2Hzx01EgD/9LuEp8nn2kqxMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677596749, "uuid": "f8af8bb9-dc95-4cd4-8722-49e7f9db5abf", "value": 1984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677596749, "uuid": "deef1483-8606-49d2-a0b3-78d702b1baa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596749, "uuid": "d88571a4-2065-47dd-ac56-b61a402a25ce", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8188d30a-b787-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677602814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677602814, "uuid": "09095891-727d-404c-a379-0a383124e915", "comment": "Malware payload (RedLineStealer)", "value": "8f8da0ca32368ec60c05bfbc287ad9e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677602814, "uuid": "f9a565a6-27a6-47ab-af66-62ab81539ae7", "comment": "Malware payload (RedLineStealer)", "value": "25fcafb8d9cc2339d14042b0e8291c023470902850261eef1349204ed38815e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677602814, "uuid": "2edc56fb-9f97-4e10-95c4-3c8055c863c3", "comment": "Malware payload (RedLineStealer)", "value": "dc59b943b54781501c5675d4fff50c520fe8de9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677602814, "uuid": "4bd49975-2875-48d8-9e53-89bd5e9ffa5a", "comment": "Malware payload (RedLineStealer)", "value": "326064d3e11936b464dd9cbbaf1397bb342afd31d0fe9a118b1d31884344c6a7abd63c4b65ea46f090f8f3b61bbcbb0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677602814, "uuid": "eaedc16d-618d-4e50-84d3-749d9b287ccb", "value": "T1E484F11D7A80C032F84742795825D7E96E3AFCB29659C45B33182B2F2D703D26EBE356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677602814, "uuid": "7e093f85-9bad-47ea-8d08-a78d67d93b2c", "value": "3a84ad57cd6d9aa470f58e07991568db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677602814, "uuid": "dc04b72c-2da3-4117-be66-926264fb7099", "value": "6144:keL2JrJDP3e9Ekfemp92ZXQrTukrwDocqJblTOX52:zqJ1P3ePfemOQuI2ocebdS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677602814, "uuid": "1e8a6b4e-1e1f-4f28-82c3-d6c3af6965b0", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677602814, "uuid": "5dd8144b-0724-43e1-beda-7437becb44c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677602814, "uuid": "3975a919-6739-46e5-9969-a1d6e4907b04", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9c49a8-b762-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677586946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677586946, "uuid": "4043012b-bdfd-4b11-9e97-574b02c5d16d", "comment": "Malware payload (SnakeKeylogger)", "value": "5c7a1919494dcc3865220a78953d39f4", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677586946, "uuid": "99da6701-4034-4df3-b1bd-f89b32c3e326", "comment": "Malware payload (SnakeKeylogger)", "value": "2617891c554493f5fc5a8a16e0907de04e2cfb44227e6c4c4f3f8c27234f94d0", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677586946, "uuid": "48c59c81-4034-4331-9dc7-903ef6e7296c", "comment": "Malware payload (SnakeKeylogger)", "value": "43ba70d506d2560d42f1f0b0bec9e6f501fb5f37", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677586946, "uuid": "3824e1b9-c3bc-4d67-b558-9fe801031874", "comment": "Malware payload (SnakeKeylogger)", "value": "2bc08ff54e3ef2e589b904544bb943fc6e8fab584f955a1de03804ca9c68e71cfb1bf4883947fff1dcc43a0c7603c5f3", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677586946, "uuid": "d72ca0eb-c0f2-4b56-8de7-f8ff1fa3c4b4", "value": "T1670533A652E7B647E200D532B2BB7C8D60E2DED3DC1D8050DF46C3BBAA5E31534199AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677586946, "uuid": "120f56f7-0f79-49ea-8773-39e9230faffe", "value": "12288:6r5Xas8qo4Hq01NiC5c9Sc89KIVRI7KNgTDK/YmulBl7YTeUDt3FPY3o7r7Ky+o1:6r5lbor9S7UmRTN6et4kTlHQ3o7J+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677586946, "uuid": "11468d9c-e5b0-4f07-abba-b4dbd5f95f0b", "value": 817525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677586946, "uuid": "ea034492-8bb9-4073-adb1-5d25fcc82c95", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677586946, "uuid": "bc0126ac-dc66-4d39-a3bd-1294c1f3d91a", "value": "Payment Advice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463ed4b9-b716-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677554181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677554181, "uuid": "b7a57ec1-e708-4bc5-a7aa-0dfe090521ae", "comment": "Malware payload (RedLineStealer)", "value": "4f4fcb68b93908e312022ca52165cbfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677554181, "uuid": "cfec05a9-e550-41e2-8fe3-5b6547a7958b", "comment": "Malware payload (RedLineStealer)", "value": "26487aa280dded6426648baf624cce4ea68c3a540c13cbb750f65df2008f723b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677554181, "uuid": "9efdc41d-ddf3-4b8b-920d-4e23c0e831dc", "comment": "Malware payload (RedLineStealer)", "value": "0513851fdf8b6255e0fb1a47545fcc78f2c1aeca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677554181, "uuid": "6d4e4fff-8439-47f3-9217-a8b6d704be3d", "comment": "Malware payload (RedLineStealer)", "value": "23205706e1101088b67c840c43a6f43988756d8f6bdeaf60d1d0b37423882358d03fac83486da9c489b57cd71c0a698d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677554181, "uuid": "770a7319-1f0d-462a-96f5-6d5fc323a200", "value": "T1A9452307F6E90266E43593704CFA42C3293ABD42462457AB32DE6D592CB31E5F53836F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677554181, "uuid": "072417aa-aa6e-4380-96d8-a5a0b8f71106", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677554181, "uuid": "dfcd67bb-15cb-4e73-9a3e-1dd562a7880e", "value": "24576:nyfdiKc3e+WFKvbfP1KSPV59fHe5eY86YvqCb1zhRRiF1p/Xh:yFnBvFKP1T1Y7qqQ1XRi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677554181, "uuid": "81527f5a-e1fb-4c49-b691-ae460b0c43ae", "value": 1226752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677554181, "uuid": "4aba1777-109d-4482-b2b1-38c52e95d744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677554181, "uuid": "71f8b8e7-c891-4af8-85c3-54fc6d573d85", "value": "4f4fcb68b93908e312022ca52165cbfc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86cd5e75-b755-11ed-88f6-42010a9c006e", "comment": "Malware payload (YoungLotus)", "timestamp": 1677581348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581348, "uuid": "ce9005fd-ce83-45bf-ac3e-8deffc56c5e1", "comment": "Malware payload (YoungLotus)", "value": "130ad560a5012b0e6152f3d260d273bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581348, "uuid": "de8e9ebc-d5bd-4ed9-8c68-7ffb4e209e3c", "comment": "Malware payload (YoungLotus)", "value": "277e859fd349215a85766ae30af74bdf7583830a9cc2f5befd072bca99b7450e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581348, "uuid": "d97abee0-1788-45f4-a8b0-d8044f5649d9", "comment": "Malware payload (YoungLotus)", "value": "50a65ea8ad0c28d76070b6c8b37321a20c27d018", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581348, "uuid": "fb91c4f7-b281-406a-93fc-3992781d3fe1", "comment": "Malware payload (YoungLotus)", "value": "c5fdec2a1ba845ad6a926e43bfde5c00f72c4288314b039e1e03992809ea951369b3ea77a2bf0c11abbf6d9385465561", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581348, "uuid": "7f603ec0-7076-4589-9e55-3eae3612d5f8", "value": "T1F3F20A01E6C1D46EE0A300B1567697FAE97ABEF212087213B3D85DA50AF56A5FF1120F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581348, "uuid": "4ba775e1-a539-4247-bc09-85a9ffe2e73c", "value": "50f2914c55696a01c19cbfb70bca752f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581348, "uuid": "38f0787e-e8e6-404a-a8b4-c6e59829a7ba", "value": "768:sX0mvrQFZiRigW3BeBPkgkqMptgYToDWzbUDs:sXBrCGigWxaOmiHks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677581348, "uuid": "e4206c5b-6ed5-4b90-b621-a2db5b167fa4", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677581348, "uuid": "de191d27-5c5c-43d5-8bcd-faa47f52c296", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581348, "uuid": "77fdc3b1-d14d-4f29-a2e0-d855eb5751c5", "value": "130ad560a5012b0e6152f3d260d273bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c494284d-b725-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1677560835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677560835, "uuid": "e94d1317-84f6-4326-8535-bd550d1e7b2d", "comment": "Malware payload (AveMariaRAT)", "value": "930aa1820fa08d9e2a36b6eb6d24749a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677560835, "uuid": "4d5ea8ce-72f3-4ca1-948b-6ac5db5b958c", "comment": "Malware payload (AveMariaRAT)", "value": "27ad4236669f741a8cb23e2d31854b075244f61bcccbb4b0ab55ee63a708ba45", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677560835, "uuid": "6b8d1011-82be-4b0c-ac9c-57ce28d1d311", "comment": "Malware payload (AveMariaRAT)", "value": "9c448f1e95610373caa3b9dc61bb6251c7925f92", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677560835, "uuid": "5d353a36-f882-43e5-bf92-53dad8d1c3e7", "comment": "Malware payload (AveMariaRAT)", "value": "e1475aaf490df0d2a28128590a7562a5630f3ccae2d5d33be2aaebe0b6b79cee528d3702ffbafdb6ad3a9defb500c42f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677560835, "uuid": "69e920d6-5d05-42a4-99af-415f1b25d7fa", "value": "T1B535AD57B6F09837F99E417C013852CE4A38AA13790EF2261F3B38449DA6DFBB6C8551", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677560835, "uuid": "1171957e-27a9-493e-8ee9-96484b5e71c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677560835, "uuid": "f2628bb2-3510-4b64-8bd7-2ffc98283f38", "value": "24576:N2VL5gh7mViJUXxJfoQQMcOOOTPkBpCtcuVfJYOW:IVL5gQVUUXLQomOyKJYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677560835, "uuid": "85d6f543-3435-4e2c-b44b-8de1992c93f1", "value": 1095168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677560835, "uuid": "5cef6c7d-9e06-4549-8a89-ed97bd84e646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677560835, "uuid": "1bcba19a-f48e-46a4-8a88-b31bd528206c", "value": "930aa1820fa08d9e2a36b6eb6d24749a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5ccb1f-b725-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677560791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677560791, "uuid": "e32a1e98-b851-44ed-964c-9f5d6dac25cd", "comment": "Malware payload (Amadey)", "value": "bfeb499cfc4e6a89d1c612333f067d31", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677560791, "uuid": "24e10677-f953-41fb-a0b3-a8a5eb2b41e8", "comment": "Malware payload (Amadey)", "value": "282753377f4d6122f4b69a190e5d36f23a3d6ef6cc05ddd56fa6d2a1ea1003d5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677560791, "uuid": "00514128-5bc2-42de-ac82-69cb60988e5e", "comment": "Malware payload (Amadey)", "value": "b511c4ba5d40c4456c06381720e24df1915b2c4f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677560791, "uuid": "f8871b12-dd30-4266-b2be-ec67aa1d4aee", "comment": "Malware payload (Amadey)", "value": "e055f4a94cb00ea5b62899fc6dff17ae3d4ce6363c23795c2466f9384d9113585029c1e90153516b7162643f4b1f496d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677560791, "uuid": "fb8ce4d6-dac6-40d4-bc8f-9e74e95079df", "value": "T1D655230BF7E85136D56167303EF6A2D3063AFD235A7003A2219B9D742C718746A36B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677560791, "uuid": "bf4d1025-658d-4a8f-879f-c204da0723a2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677560791, "uuid": "da0b3a8f-39ff-4fe6-b77b-9da08d867aa2", "value": "24576:WyiHCOGofyjFPJZnnUHJSw2M/3UyO/ModsNpBMcAUlwPvrDgVFuqC:liHTGoi/UpSvcUyQModsMlUK7qu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677560791, "uuid": "a4ddeff4-55d2-4abd-94d2-0093c7af364c", "value": 1344000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677560791, "uuid": "28bfb011-fa5e-444d-bbf4-06ad9d2ef963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677560791, "uuid": "d958c117-c36f-4351-8049-bc96eddaf36a", "value": "bfeb499cfc4e6a89d1c612333f067d31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08219515-b782-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677600462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600462, "uuid": "ead2db6a-c0bd-48da-b3b3-68b30c37f7cd", "comment": "Malware payload", "value": "3ed3816f22e70602f3824d3eaa2ce840", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600462, "uuid": "b6fa73b1-700e-43a6-ba13-2c4cbcb7f78c", "comment": "Malware payload", "value": "28fb377c16f619b55977901131fb1ba31afb440e1351442621c6ae45d9cd41ce", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600462, "uuid": "d3accc6d-0ed1-4d40-9381-36e7dfd47b9b", "comment": "Malware payload", "value": "6d491e9f28caa4bb71c4b859c55b2e11ab0ad2fd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600462, "uuid": "530b31de-a959-4eb6-b7a3-5e2801833766", "comment": "Malware payload", "value": "b603545a81856067948fb9671efdc27137db8defc67be66ded53f0d6aa1806689db0e53a1a475af912b38c04cea27f5e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600462, "uuid": "f3401e1b-3c38-4b34-91a7-902dd09ca737", "value": "T120251215F7919A3BE8125434A04A6097801D6C36BB41D60F36C6B71F6732BB34FBBE89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600462, "uuid": "2e46bece-2ae3-45ad-97ef-8c9e14eacf89", "value": "24576:s6NOpmetFeuLFRTy66NLpmJKmSp54t5Q0jWqx+Hxw3N7oVFN28:tSf5gfBmRhy4BNqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677600462, "uuid": "cbc0c1dc-f75d-4c83-b9d2-693279138de4", "value": 1037824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677600462, "uuid": "ae820d53-d4cb-4433-bd1f-920d191724e5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600462, "uuid": "b118f8f0-61ef-4ce9-a849-4316a9cdcdb4", "value": "Swift.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a276b073-b771-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677593420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593420, "uuid": "53a66239-82aa-478f-b2fd-966a55b3ab59", "comment": "Malware payload", "value": "d6dda8bf232bde5e12e321d874a95a68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593420, "uuid": "6cac6aea-940c-4474-9ee3-92bb6297fcd6", "comment": "Malware payload", "value": "2b43b430b0db620897da677dfadf603c65a6afac2320e254fe758b0fe3affbff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593420, "uuid": "09504768-baf6-4df6-ae5e-f4d20227c503", "comment": "Malware payload", "value": "5f17e2c7c120360ee7678e39fd3bff440046ec38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593420, "uuid": "c397c377-6a02-4605-901e-cf21f265a8c4", "comment": "Malware payload", "value": "2b40b075c06b44e984e3300622f424158af80bf6cefd1686b3d9dcf3b9dfcffe3aa64b6a832e413518177ce1a9dcdd08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593420, "uuid": "31c75534-abaa-4f03-8113-fd6ec63cad56", "value": "T14ED58C32BB049132F5D211F1981D1B6F898C953403B940D7E2D67AD929E0FE36B36BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593420, "uuid": "485717ed-ca4c-4d7d-ad7f-9ae31b7b4787", "value": "4825ef56a06f7fb58d67dc608871939b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593420, "uuid": "7013bcbd-1559-41e1-b019-47c8f9bced31", "value": "49152:1JAKgmq4Kttm3O1tF5f80am1Vb37nfPv03Gew5NG+Idlaq:3AKdqnpk0am1Vb37nXsnwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677593420, "uuid": "42bd0c31-b9b1-4354-93e0-3096b08eeb40", "value": 2820608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677593420, "uuid": "40d5f550-cc63-4724-bb71-13c22f9c3818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593420, "uuid": "670b2425-754e-457a-93a5-68cb5491cfec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fa6f35-b741-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677572676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572676, "uuid": "1cc2b0f9-3717-4878-a0f3-782e84c85200", "comment": "Malware payload (AgentTesla)", "value": "a3cce580df7e5656d3a465667df689d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572676, "uuid": "e2f01339-f400-4ef7-919e-5561117b0adb", "comment": "Malware payload (AgentTesla)", "value": "2bd4067e2b27ccac8838c5afd0d2a95f526b4fda0a3e3b448f78d39d960f0e1b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572676, "uuid": "37439799-98ff-452a-8ba8-2fb0dd831dd6", "comment": "Malware payload (AgentTesla)", "value": "a5ee5a47a59cc97c21798bc7dd31746918866c32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572676, "uuid": "b662cdc3-3b32-4545-aec4-de9552537c25", "comment": "Malware payload (AgentTesla)", "value": "6af3acd413fd944b0df1f48bc8a8ce0d713a29dd114f47f108119a6874ea4f30830171504da1164b6e02fd6139ae7ffa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572676, "uuid": "7811bd6d-e565-44c9-a3ad-476f613f2fda", "value": "T185357B8072F9D211EDCF329D091C568E7E79A107A152F22ADA7736C2530BBF776D8482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572676, "uuid": "fab603ea-e7ee-4428-9ec5-af5621168c00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572676, "uuid": "5fd68f60-96cc-4ac9-8494-17f81a00738c", "value": "24576:WBFy+jFy+hA5hBFBRFI9rYbNRFrpckgM:SFrjFrhm+yNHr1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572676, "uuid": "5b3f5a12-7109-44f7-8484-f6ada396a761", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572676, "uuid": "c47a1667-ad25-44e9-b679-bbfa560c1610", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572676, "uuid": "5943f08f-d154-4836-a7dc-45e6dd502e9f", "value": "a3cce580df7e5656d3a465667df689d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a843decc-b755-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677581404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581404, "uuid": "9b53e512-15c6-4c7b-a821-8ce925038e25", "comment": "Malware payload (Mirai)", "value": "b04e4655cb0127fcbb54db9a890c8559", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581404, "uuid": "ce294c64-71cc-4303-a694-e9953e2ecd69", "comment": "Malware payload (Mirai)", "value": "2c714ecac18e244f7c993da9fc06154090e3ce18221dd07d0caa36c30be64e1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581404, "uuid": "e17c8625-56a0-454c-8679-47d68b5fde52", "comment": "Malware payload (Mirai)", "value": "36225590ed1d6f5510a8c542fea47d3c50e70888", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581404, "uuid": "b43ced22-c40f-4477-8ce8-cb1cd8effabe", "comment": "Malware payload (Mirai)", "value": "5a2725a24c0468a9cb8c9ebdfcc930724d9d8aa173ae4689736effa00af76b802023b1aca013e94e170af35631ca26ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581404, "uuid": "b9ba76ed-cfe6-4701-83fe-1509981fd693", "value": "T10F4376C5AD52BD3EC3C2FBF7EE9BD24832E68644E396234291DD0AA0D56FC89194534C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581404, "uuid": "5c9af0ca-faa2-46d2-b2c6-cc7c0a7559e2", "value": "768:JEixJmX20TSPz8AaW5v8jOUxNHX7wCVy/zmJHUhG1jew/BU1sgKLfSs6lz5OjExZ:e4kD2j56xizpwR8IdFfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677581404, "uuid": "69c622ef-19c1-43fd-b14f-dd2272ea8052", "value": 57106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677581404, "uuid": "b53d1892-9aa8-486d-a9d5-048c7e8f8783", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581404, "uuid": "890d7b35-c61b-4d83-b6ce-87324f7aeb54", "value": "b04e4655cb0127fcbb54db9a890c8559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f793c0f2-b764-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677587979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587979, "uuid": "e25d3c70-a2da-4eee-82a6-029a6963d2d3", "comment": "Malware payload (AgentTesla)", "value": "80484570239ecc0ae45e4f057212543e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587979, "uuid": "993973a6-5962-4a7a-bbad-01fadf9862ce", "comment": "Malware payload (AgentTesla)", "value": "2c9702d9867875e0886e52ee656385ce638a879a9deb55ce4ed52f3d6335e849", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587979, "uuid": "558bc6bf-697e-4842-8911-da57f0efa30b", "comment": "Malware payload (AgentTesla)", "value": "67f5d494e4e2432852dff456e53afb2244a0c809", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587979, "uuid": "80a4c131-9912-466b-97b9-8233d03bdbe8", "comment": "Malware payload (AgentTesla)", "value": "e52b177728fac2d0db85e7e5847ca8f98986af4d3e133f7f1d9dd73849c7942bfbd735ba0bc3f63bd6df5889c94ca278", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587979, "uuid": "d01e4c3e-e07a-4349-9861-3943268f5699", "value": "T13E6412656AFCD85FC25204B35EBC11866FB5822D84D84B0B27D05B2EBE216A2CF1F375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587979, "uuid": "e58e7baa-2b8b-438a-82e6-1fc24e687c68", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587979, "uuid": "3c15d5d0-d664-44e6-bdda-a13376f200b9", "value": "6144:PYa6XEZNRtBwtM5WO6I945sqkr93m/vcPsa945u4LZVZM1jV/w34:PYNEZNyI6swkJ8vaG5uyZVZMg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677587979, "uuid": "35429394-f5a5-4999-9c66-c4a2ec701da4", "value": 325334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677587979, "uuid": "a0524b48-459a-4911-8c5a-b1060f2e0cce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587979, "uuid": "4d18bff3-f9d0-4ab3-b8a7-049dcde480cb", "value": "Shipping_notification28022023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc469fb8-b740-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677572445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572445, "uuid": "73ae3b4d-e2c1-481d-afb1-8d5c9c4083bb", "comment": "Malware payload (Loki)", "value": "969c65960dbb1b4f41e99032606779ad", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572445, "uuid": "ff3d7666-777e-4b0c-acb4-b19f40f4591d", "comment": "Malware payload (Loki)", "value": "2c9c0ca1eedd12362fc910301256eeaa607b57d4804a8469064009419b6661b2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572445, "uuid": "312c4e74-5360-46e1-a3a5-11e623947cd7", "comment": "Malware payload (Loki)", "value": "f4d8fcd1cfcdac33c324fd0d5717337baf3ab424", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572445, "uuid": "9cac88a2-9131-430a-9045-8f058914ad43", "comment": "Malware payload (Loki)", "value": "935d6ae8328ba9e7517b4cbeb8f85907f333f87cf2836c8f3736cde3d0614396cedca408f280e7fbbf9debcb8629424d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572445, "uuid": "e1bacff9-b84d-445e-97c0-16c8a74dfd16", "value": "T13C050229E7119C3BE4135434A44660A3622C6C7B5B44EA4F32C6771F5732BF64FBAE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572445, "uuid": "1db2fc23-e93c-4111-adf4-171f59ae7cf0", "value": "12288:fHrTmj0X8TlPYXFHTFeSkGhx5ydWjTmCvSrxS1sH6AhgPf3tN4MD9n+ntA/zlKVp:PmIkB4pFeqMdWPmZrk1sHKPt1+tEzag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572445, "uuid": "e84fe031-c0c0-4214-9b26-0ebeec09b97b", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572445, "uuid": "45257fd7-e205-4027-8bf2-744f42a767a4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572445, "uuid": "7e4f3716-c088-49aa-ac8d-b0691e8ed7f6", "value": "RFQ 2802.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb44121-b741-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1677572611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572611, "uuid": "08ef36a8-fa61-4057-b248-b670fb2a8ab8", "comment": "Malware payload (RemcosRAT)", "value": "d5bf80e1057932bc52398f77ab73c128", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572611, "uuid": "219485db-10f1-432f-ad0f-b7bcc487b93a", "comment": "Malware payload (RemcosRAT)", "value": "2e54805500f84c40a89e8ca4abba33324ac47f8715f8bbfba394228eb3cf128a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572611, "uuid": "93776329-214d-45e7-9146-36d3b33f9968", "comment": "Malware payload (RemcosRAT)", "value": "f64bb89243f6d29017a51d2ff2db8e080035ef2d", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572611, "uuid": "121bc5d9-9db0-42a9-aac3-864c862c9904", "comment": "Malware payload (RemcosRAT)", "value": "4c0db7cb875fdc483c66674189f8878bf63c5f45f1433ced4f638bc7870ae61c0fd4185533c26021ec9db5133b318a0e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572611, "uuid": "812f1e05-02a6-4b49-9b63-275b987338f0", "value": "T194D3195599FDEF05C45A1DAEFA834C8BF392CD510703406B1CB34F8A25DA238AA376D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572611, "uuid": "91b56d34-fc8c-42d0-8833-46db6af45b77", "value": "3072:V3gaz9ZIX69tFizYxPLEAMTGm5QgqpQZyij9s7MS8aj:V3/9ZIX6rF0Yx72v5QmZvjvaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572611, "uuid": "72a7b1d2-abc3-4006-a6d2-c15e0d9fc5cb", "value": 130459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572611, "uuid": "3bf6ff91-9aa7-4aaf-9c5f-7a1dcdb3e6e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572611, "uuid": "ee0c5eec-6ba6-4c51-badc-d281ade177af", "value": "Confirmation(PymtNo117728).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2741992f-b774-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677594502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594502, "uuid": "cf4659e6-24c7-4ea5-9cad-f5664b3a9f42", "comment": "Malware payload (AgentTesla)", "value": "2f84568242e6fda6ea1b2b0a581b000e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594502, "uuid": "9f12d1cc-9639-4f2c-b905-64db1729a470", "comment": "Malware payload (AgentTesla)", "value": "2f64531d71dd54c1e57e33a70a8b019bfb7997a2552f1b4ec63ce80bc6b07fff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594502, "uuid": "dd9abf39-0c6a-4ea2-b697-e925e8d29c15", "comment": "Malware payload (AgentTesla)", "value": "5b96fb8fd4d682897c8657ccb8fa1bb0f0a0c3c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594502, "uuid": "c2617ab6-3d89-4f64-bbda-0f2ba29a2436", "comment": "Malware payload (AgentTesla)", "value": "4519a08e0499c89351469a68c15804d9f8746c7dbf3f08d4ea8723b5f92dabd2580a73780342378befa85b6f2aef6028", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677594502, "uuid": "8fcc5620-061b-4476-89dc-468694f8ad52", "value": "T161641215AEF2C457D4F265321A7B1F64BBE148232C54AB4F17116A8C392BB52EF0E393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677594502, "uuid": "554ea36f-00c5-461b-8ded-b14bd53345d6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677594502, "uuid": "0d76b8c3-beed-49dc-8d9f-adcfed61ff7b", "value": "6144:/Ya6eiv2L9gsAOdUddh5w+9jKm6IDN65PBIKmu8qdcQ6mUaB7betsIvi91:/YIivnO6dr+NB6+Vn6/a55F3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677594502, "uuid": "630dc505-2944-4ad2-b053-208298c7dd6d", "value": 332285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677594502, "uuid": "519ef8b7-80fb-4327-a9b5-b6c3efb7f67c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677594502, "uuid": "562fc86c-8fa6-4d44-a71e-50fd55dbcfde", "value": "SO# A56DX04471 JOB#SZYC23021891.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d385d82-b740-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677572205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572205, "uuid": "eb9241a0-138b-4bad-9538-1803a0c2dfdc", "comment": "Malware payload", "value": "81f8723dd6d260acb85117b3e918ed0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572205, "uuid": "f27e11d8-6b56-46ca-b2d0-79479b312adb", "comment": "Malware payload", "value": "2ffc1db9223a826b83103a3d50ae9228ae1982551bb1eb8c14bc6788f85e53e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572205, "uuid": "7a0bba44-6fd6-40bb-9eb4-b1548ccc0c1c", "comment": "Malware payload", "value": "e120ddc2004afca6440877da78375e6b0265be68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572205, "uuid": "236369e7-b06d-487e-84df-238e7d759029", "comment": "Malware payload", "value": "4fb0e969491afdbdb0b62c2b3c634590ed7673a09b3025534a523918c7fd60aace554a6ab422eddea2cb26968396f336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572205, "uuid": "4d801982-bbf4-4321-a4f0-60510bc5a329", "value": "T1C002C853E6AD68A1FB66A2B30589B775CCADB83232540773C78FC1018D75882EC06DBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572205, "uuid": "9fe80317-6ea2-414f-a2e5-2159cf9e39e1", "value": "96:PN3Mr2aMGCaKsZjyJxhavmVrqKQ9aeHfwOrjgCh3CPpId+zaa7UZowNi67c3gZdS:PVMyaWLCeIMsz6IOR7UjNLcwZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572205, "uuid": "4742feae-7c76-429e-a4e3-80b904b7b0c7", "value": 8997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572205, "uuid": "6d0109a5-4eb5-4bf1-ac95-373a15ab16e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572205, "uuid": "60ad7864-129f-4c6e-9761-a9beee9810db", "value": "81f8723dd6d260acb85117b3e918ed0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86256e06-b77d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677598526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677598526, "uuid": "eb5d9314-5e1c-4e52-a0c8-36016707e4f1", "comment": "Malware payload (Mirai)", "value": "972f0fa8ef31290c8971dd4d8a8c27b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677598526, "uuid": "e5738a56-e02e-4611-bdda-f9d2ad38ded8", "comment": "Malware payload (Mirai)", "value": "3293fd41bab88bc6cea1a9e2d71d662bec25348cf2bbd85f44fe1fb25593079d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677598526, "uuid": "bacf2b0f-6164-4f17-87f7-56b6b285427d", "comment": "Malware payload (Mirai)", "value": "985192820d0a0a98e53b6878cac116b53a8e237a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677598526, "uuid": "027e3871-0884-4293-976b-83871ddd8619", "comment": "Malware payload (Mirai)", "value": "70565be40f1d3e3375d6f3dc17e1d583aa166bf26de15d27cf4376718e74e2c83310199f75b14ee2078d13dc07026d1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677598526, "uuid": "928fe230-e71a-444c-a029-6f0312262350", "value": "T1CB21F100F21D4413E6D13EB433371B519BBA8F13161865049BDFE3A9D8B8C20599D49D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677598526, "uuid": "167309a8-20af-4aa3-86a2-5396448488b9", "value": "24:3dc0pWS9nSWZ6S4/KSwISBd6oTKP5tAFlmhqzktqJAvy58aaTo0YW95y65Z:NWgZVbXGACoz2qKvy58lV4GZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677598526, "uuid": "fd8e74da-1ad6-489e-aafb-7bdbe25fc304", "value": 1396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677598526, "uuid": "f505f85c-94e6-41ff-8210-437dd804b49c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677598526, "uuid": "562e1f64-b0de-4065-9cd9-d80afd42233d", "value": "972f0fa8ef31290c8971dd4d8a8c27b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980ac73b-b77d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677598556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677598556, "uuid": "021c1c20-9916-4d10-951c-21aa25070981", "comment": "Malware payload (Mirai)", "value": "bd8fa45ec488667c6dd5114471b0563f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677598556, "uuid": "f88d47d0-f178-42f0-863e-eb0ade68f3a7", "comment": "Malware payload (Mirai)", "value": "32b359c17aa5ebb6709f1573a3fe1071a3f974fcf7ca647d1c08499050f9f634", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677598556, "uuid": "9294f244-e166-4d95-b2a3-e5bf7dc132b0", "comment": "Malware payload (Mirai)", "value": "9d3c95b0068b8b0869c33e9c2aa7a028260f2c2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677598556, "uuid": "45296f0d-7947-4229-a6d3-05f1fa6abe25", "comment": "Malware payload (Mirai)", "value": "c9ca72384d577ed3210b1a875f1364c12c4b3bb22b3539279512b706c01cccf8e85d7a5307e11d48537139999825a07c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677598556, "uuid": "2c4e130c-beee-4b4d-9345-9d4653c4e230", "value": "T1CB213257E1C49D55CF2AD73C5A714681BB46D528C14FE3CF0E0866FE191F28C66900D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677598556, "uuid": "777c08c2-eb96-4425-98fd-8e71c65b06e7", "value": "24:wCQYdGtSnUpzzbBWpzmKyeKD5gDrm7vGVikC7m17o7FcNfE7:wCQYdxnUpzzbBWpzmK2ODrm7vGVi772u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677598556, "uuid": "63ba99cf-1c78-441e-af51-2e4964b14ca8", "value": 1188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677598556, "uuid": "70f6242b-34fb-4a09-8105-76748888625d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677598556, "uuid": "3e55134f-92c6-4f02-9b76-c33aa0687a76", "value": "bd8fa45ec488667c6dd5114471b0563f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e11db4-b73d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677571058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571058, "uuid": "87114a95-fb0a-40f5-b4d5-50dcb692e3b4", "comment": "Malware payload (Mirai)", "value": "02a22388f121314f2d9330a29311173f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571058, "uuid": "ed93aec6-5840-4753-b7fd-ea2ad9f21c08", "comment": "Malware payload (Mirai)", "value": "33e95c11e7bd3d4d500277c7da05a6334f04e72bae5f2e27cd82e2e9732ac692", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571058, "uuid": "c86886c3-38e3-40f1-bd6c-a1849c4ae7bd", "comment": "Malware payload (Mirai)", "value": "e4fa11da4b6bcac2f238d90860093547c7ae46eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571058, "uuid": "0486958c-399d-4ae1-bf90-e641a2993dae", "comment": "Malware payload (Mirai)", "value": "5d2608a62a46819d636021de40eddd10c36f0a78c8098e2509f18b91fd5a6674d4334ec1d183dfdfa1820bee84e2f708", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571058, "uuid": "5ed5c2fb-a116-4f8e-9d1c-49e4c326ca74", "value": "T1F7B2D07A50AE5830EDA0D5B1DA22C29367034FB1C0FF366294C486715AFB90ED5FA7C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571058, "uuid": "523ff134-b4e4-4389-9197-7bfde0c18111", "value": "768:pjP+OXGgJ3CNza+VkZlCaDrVF/Ms3Uoz8:EOXQmXCCvRz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677571058, "uuid": "afc03b1a-f83e-4b99-93e5-46e3f8a07d50", "value": 25264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677571058, "uuid": "bd21b63e-b67b-4e8f-8759-1ee60b6abb26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571058, "uuid": "1d5569ec-7d29-44e6-ab43-369724380829", "value": "02a22388f121314f2d9330a29311173f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd0d215-b77a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677597330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677597330, "uuid": "c5426061-0d6b-468c-948c-d95964708126", "comment": "Malware payload", "value": "79b7237476524b5b3ba994dddb148333", "object_relation": "md5", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677597330, "uuid": "d39f746d-1aab-4ed0-adda-f44a03c6ddbb", "comment": "Malware payload", "value": "3434b023e3b29fccbc093730fc62164622a48d303fd715f5ce88293be43d0061", "object_relation": "sha256", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677597330, "uuid": "8ac25ad4-6360-4f81-90ab-28599dd1ff41", "comment": "Malware payload", "value": "942cecd35ee50f0ba8a2012dc5b3b93f96d263e9", "object_relation": "sha1", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677597330, "uuid": "755b5991-0f16-4cbc-a6e5-0ea11094ebdf", "comment": "Malware payload", "value": "1b71cfa4d03ff6db1743f27ddcd2c6db69009c7fd5ae7e88a8546c79d9442576c0cd612278b75c2b8bb114ab2b47c763", "object_relation": "sha3-384", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677597330, "uuid": "df675fa2-b231-430a-9418-a387ebc88bc5", "value": "T184012040D582443141F47DB979086F92BA1BE0464701DE1BF6A9B3D4E7AE0A9137C57D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677597330, "uuid": "16370ef8-3eca-4686-ab79-b7cccf9b48b8", "value": "12:cG2j6ZD6rwidF6ZFxQXiPVM2mF1tFX+yidFetFJRr1WXrLM9FArgBkVc:cLj2D6rHf2YXiNMZ1diHeJh9FPYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677597330, "uuid": "d6b58854-6328-49fc-8612-575a1a26c2bc", "value": 732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677597330, "uuid": "64b4021e-d9d9-4cd4-8a5f-1407826cf346", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677597330, "uuid": "f5c54f4c-de88-4704-bfdf-ffe9e285c841", "value": "pigsney.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e05f2fd-b741-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677572635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572635, "uuid": "a74c534f-fb7a-4ac5-b9ce-35bc06739209", "comment": "Malware payload (AgentTesla)", "value": "931ac483296340161009ee7f9c70ce44", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572635, "uuid": "c7bc0ab0-b2fa-4e38-a247-f569e793a845", "comment": "Malware payload (AgentTesla)", "value": "35e7b2604df05669b524424447654751c94c6cd5d7d4aec950bdefc4e377fdcd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572635, "uuid": "c6be8e33-eac1-4ef9-b6f8-e599c3496f18", "comment": "Malware payload (AgentTesla)", "value": "51e10fc1c8f9df12e5337f8eea1c6beb5adede3f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572635, "uuid": "1c7f939f-a85b-4480-8e37-35777911ec32", "comment": "Malware payload (AgentTesla)", "value": "5addb32cfcaabc2666210ad45c0d75c20b66cd49d58ff0bf293473c77f95a9bc8c94e7e89eaad0ea5e5b824ce5562208", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572635, "uuid": "892acb16-adec-4a56-96d8-42ba02dd22ba", "value": "T16C45BE4853B344B2FBEB11A51875228C0EB972CB3585F21B4F673751A522AFFB29F502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572635, "uuid": "f8ca35e1-09b7-4c0e-aaa7-7493b770e5de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572635, "uuid": "d8373e0f-6e20-49fa-850e-3c147f97a6b9", "value": "24576:3AgmefIleq4RWn5lO9XJVLFQjqxt5ArCA6/+o9x/6qW:QgmefgS4riala+W1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572635, "uuid": "326dbcdd-933f-4c6e-978d-dc28cf368b25", "value": 1206272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572635, "uuid": "015a6ba0-ded7-48e2-b7f4-0692d9a3125d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572635, "uuid": "83981488-b930-4b27-b0c6-087835272214", "value": "FedEx Express_AWB# 1022351516763.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bfaa7f5-b745-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677574323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574323, "uuid": "a1c89ffb-fd3c-4843-bf9c-270f7cb537ec", "comment": "Malware payload (AgentTesla)", "value": "0134cd12ded1d1d3989d499005e20aa3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574323, "uuid": "3d0f0cb2-97da-43ab-8b92-98435349add4", "comment": "Malware payload (AgentTesla)", "value": "363294418c47b12daa154b5fb57a760f647c8d075ac95e9fc8748e50c4796fae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574323, "uuid": "bf1a31c5-1055-464c-a3b4-de6330b7e9ec", "comment": "Malware payload (AgentTesla)", "value": "ff9ae1c9df06d7331e3940f12ae9fefbaeff83f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574323, "uuid": "c3f6e098-4bdb-49dd-ad57-b07dd54163f6", "comment": "Malware payload (AgentTesla)", "value": "3f319ab93d850a279c54aad48e391932d1ac66d7a4129fa487df00b4a835cc0fb03be38be412f54a1edea1bed12f1d7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574323, "uuid": "d93fcb13-e75d-491b-baaf-a91ee6c2349e", "value": "T1E8357C8072F8D215EDDF72AD091C418E7E79A107A152F22A9B7736C1630BBF776C8582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574323, "uuid": "4272ae36-b231-495f-a3db-117481b85930", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574323, "uuid": "a4d4f974-ce93-4959-9833-7083c734d3cd", "value": "24576:lGFy+jFy+HEEx4oPyQTi/yGCdM3mCx9N99dA:gFrjFrHExoQyGCKWI9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677574323, "uuid": "bc9f9b92-662f-481e-9dea-a32c1e1cf142", "value": 1092096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677574323, "uuid": "fcfee2cb-f738-4ed0-b32c-af9652425f37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574323, "uuid": "9cfe97d4-f33b-4927-80a0-bce9d6a9b48f", "value": "0134cd12ded1d1d3989d499005e20aa3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ba9ea6-b741-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677572623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572623, "uuid": "05ec0af6-b552-488d-a3b3-bffddaddd8aa", "comment": "Malware payload (AgentTesla)", "value": "6a00ac2de6900e9e4ed4d3f7786531c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572623, "uuid": "af744279-7ae8-48cb-b39c-d2d462f50643", "comment": "Malware payload (AgentTesla)", "value": "3672a8eb0dd83a097ffd82461ba28956fba31e179c80f3744bcdbd52a5b77121", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572623, "uuid": "2ca4d025-7a7c-4196-aca3-4f0358182622", "comment": "Malware payload (AgentTesla)", "value": "9316c175d02b30c572727ff6b1721dbd9873715b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572623, "uuid": "23c3b589-f45b-491c-a298-3060835bb2fa", "comment": "Malware payload (AgentTesla)", "value": "2443d2fc2078e679e5863860fe90c7d6b3a1bcf9c402b8c391affecbcf8dec321e8231dd597610c8d34e71a6ef720668", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572623, "uuid": "a51020f6-51ad-4f78-97c5-d940ad4fb813", "value": "T11BB4BE81329448B1CC7AD733A736E1138E1E6FE46BE0C51E16C27B9A3776689D5CB306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572623, "uuid": "e8fc4cf7-c0b6-4ef8-b114-23d1b57387b7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572623, "uuid": "dbf81350-fc53-4ad9-b4ff-4c9ffe042da8", "value": "6144:IYa6hQx8ayrbor/tTJMJWQ5AQNqFhomFh3CfYXVcJIUV9hUTRUWwJ51BRa:IY0xPgUr//MYBQ0m4C4nQnEOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572623, "uuid": "59ab97c4-acb8-4c71-9768-62801982922a", "value": 513961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572623, "uuid": "e64ef4b3-fc6b-4dd7-b06b-9c860f55fa29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572623, "uuid": "adcc10f6-0ca2-4a9c-bb60-d9a389904279", "value": "e-dekont20230228_061814_000076.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13089fe1-b789-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677603487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603487, "uuid": "63c7d4f7-49da-47d5-818f-7582c038d38b", "comment": "Malware payload (AgentTesla)", "value": "7513d92dd73d9db3285bed20b2ea8bda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603487, "uuid": "fe418f6e-a63f-460b-98b3-b4c63ae3e824", "comment": "Malware payload (AgentTesla)", "value": "3736a32db47acc255fcf48ecbc756e24eecd93fe5d5b3267d5c4c1eca68430b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603487, "uuid": "287aa63f-6336-437a-8a75-faaa7bb9aa37", "comment": "Malware payload (AgentTesla)", "value": "8039c0a3b570da6b29c3ca0bc9d5803bf46e7bc9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603487, "uuid": "4fd26cb5-6618-437c-bc93-a0127a17180e", "comment": "Malware payload (AgentTesla)", "value": "f62d3ee45ba701bf43ee1455a8787bf26fcb53bebd277745b3b308c4495dee959befde25acbb2158bcd5c72fbea13725", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603487, "uuid": "46f07534-d60e-4dea-a5e8-7921d94c1fde", "value": "T13E6412BDB688D32BE5F109754C995360AEF2F2562829130F3FA09A5DBD27141C92F723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603487, "uuid": "a705fed2-8bc0-4617-888a-fa576d978e11", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603487, "uuid": "04bd8e94-597b-4128-84e9-23f138ccd5cb", "value": "6144:vYa6kNxUn+H2kUSEs82wsFfE+9YwuqEeR/1ABwEVN5NCQcFUsFt7:vY6NQs8A1v9YwfNV1ABwEf5NCQcFUCt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677603487, "uuid": "f1fa78c2-601e-447d-be55-3e51f04e2594", "value": 332329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677603487, "uuid": "e754bb0b-2a8b-4b19-8bd6-1e0cca23a1f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603487, "uuid": "3cc40f2b-5248-445d-9bae-d1162748451e", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58af88c3-b768-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677589431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677589431, "uuid": "19b25567-bb98-48df-9e62-1e570dc17f5f", "comment": "Malware payload", "value": "af1c7fc23a1ee4e4e10f3130385e476e", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677589431, "uuid": "9c6a6e36-eec1-4d31-96b2-176403f83d5f", "comment": "Malware payload", "value": "3890bd148df99e8ce03ad1c19391350e5a19e54bf43cd4d931582a6b3a8861a0", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677589431, "uuid": "3b8799d3-1cda-42cf-bc9c-2b672cb5de46", "comment": "Malware payload", "value": "5b65f3a848c83e9990652e94593b0b9db7fea3d0", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677589431, "uuid": "7ffd03d5-3d91-442f-badf-7f0725a588ee", "comment": "Malware payload", "value": "1fad11d3bb73a5d74b92e591b56e9ce57c0cc38a91f0acb8310450c8d73a04908acb432a312043ae91415bdfb3dc82bf", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677589431, "uuid": "baa20424-ab3c-429a-8ca0-cc138cf78902", "value": "T10D62D1F65B4252A45A9283766E0E82B8A54CEC20CFDF047976ED13015F9CF472108BF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677589431, "uuid": "a2405ca4-4a62-42ae-af79-2ab6fde99a11", "value": "384:58Ggxt+yaRUE7E2cVdFfm7a6TXJioQ/yB0WdzhHeklJc5:58GgxtjaRFY2uzgfTXJioymHeklJc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677589431, "uuid": "6d8805d7-901f-49ea-8938-1d9bcd83bad1", "value": 15586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677589431, "uuid": "5bbb9e67-f148-4eac-a69f-981a8cf13f7c", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677589431, "uuid": "ab30df71-5aec-4477-a86a-7be37e3c414d", "value": "b46b6f20-d405-43a3-a01a-08db197f9be5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f4a676-b771-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677593402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593402, "uuid": "b3603d32-3664-4ed6-bd85-b26b759997c4", "comment": "Malware payload (Rhadamanthys)", "value": "69a9d3bf89e9bf6005414c89e10dfa69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593402, "uuid": "48deadc7-8bb9-44a7-b35c-3d654b5591ad", "comment": "Malware payload (Rhadamanthys)", "value": "391e28f2d1bbc994cf51c7121684279dafab391e3abd3043d633f29d226a0905", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593402, "uuid": "ee93e57b-fe2e-44d2-85cb-c22724111593", "comment": "Malware payload (Rhadamanthys)", "value": "855bfda36928142b4a8796498d8e3c919f197f1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593402, "uuid": "604bf42a-8245-4fa9-80e9-9cedbeed4ba2", "comment": "Malware payload (Rhadamanthys)", "value": "cf87afa8c85f5403d057ebb49633f6f7c394c6084750326ce7db3594e104153e6b3e2a76192f089bfdbf62b6352c8e07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593402, "uuid": "446a57b0-2b28-43df-9167-b961db7f735f", "value": "T14D64F111B991C477C847C1B08868D6E82E7ABCE2DA9C895B33587B7F3C302E15B76325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593402, "uuid": "93e50ab7-f379-4292-b6ea-50afa0052e6e", "value": "2ff441a58ff638ca2d2b64ce6ffa9559", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593402, "uuid": "55e18978-65a3-4f40-8f34-97b8c77d4812", "value": "3072:YvSLFsZYgBQ9lAczvGO7ArTpe1U/Yc+RflMYoGhVxXbP0jGZvw368P73tfkC:HLLgB92G3MhflMGhXXbPIPKgf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677593402, "uuid": "da0a6402-be9d-4357-bfde-ff15441aaeac", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677593402, "uuid": "d4d9cd3a-7d67-44ec-98f8-1c6054f0d3ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593402, "uuid": "6ad8f9d4-cf9a-418d-90d0-288840981a9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85f85fa-b709-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677548789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677548789, "uuid": "14897a83-5f69-456a-8976-e267a141358e", "comment": "Malware payload (RecordBreaker)", "value": "b62edd6191ce9af0835f2b18f7a3c675", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677548789, "uuid": "3c85bbcf-6eb5-40f2-a7f0-59d8482b1fa7", "comment": "Malware payload (RecordBreaker)", "value": "39429ddce866fb8657c3fe04c9ec8a2eef27b73680835e4abcec6d3afb63f66e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677548789, "uuid": "31e79c43-8721-4d8c-b75c-df4d64cac99e", "comment": "Malware payload (RecordBreaker)", "value": "cb759ec7383043c1cb400b9da21c78a61b257d7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677548789, "uuid": "dbff9ac4-e463-4653-a229-6416a1eb0226", "comment": "Malware payload (RecordBreaker)", "value": "9265e6db515ede7ef056bd40def5d79520ab64e5575aeae801f4f64bd3cfc70f65c5e9a557124a9157d37ad8fa977bd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677548789, "uuid": "2b8f3f42-934b-4879-b56d-86ee24c944ac", "value": "T14BE6335236F20015D8AB4CBD6037B9DC72BE9E265A84E83C11E53DCCE534EAFB44625B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677548789, "uuid": "45feada8-64f2-49d4-a9da-a0302c80a56b", "value": "1c6788ab459e74ff34b16016192dcb11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677548789, "uuid": "32991f60-d2f4-4a16-8054-2d14960955b6", "value": "393216:34NMI19b6BNmLE/0d5Xe8GqvS2cNI+0eaVQdJjeK:oNnb6nm5T5GOjcNI+UVQdJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677548789, "uuid": "96d41bf6-49bc-4232-8089-fa7fcf8fbe83", "value": 14494720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677548789, "uuid": "ba58fee9-dafd-4815-b789-b5e267c178e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677548789, "uuid": "139c7da1-6c0d-4929-b0cc-1f19b53fa643", "value": "Setup_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3775688d-b70d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677550291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677550291, "uuid": "45566c97-bc7a-4417-97ca-9d31d5045837", "comment": "Malware payload (RedLineStealer)", "value": "b8d71c4aefb039e77386a867790f5974", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677550291, "uuid": "9c7d4454-d3d1-44de-8aa5-43de1defad2f", "comment": "Malware payload (RedLineStealer)", "value": "398f98cfa7c965d5e7b8c75a1f7ba3e34480d7805c08bcd472ffed2d25de1bca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677550291, "uuid": "7f984cf3-67f7-4287-b9fd-116bde7b494f", "comment": "Malware payload (RedLineStealer)", "value": "20617e5ff48edcbb82556b92aa818df1e98823ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677550291, "uuid": "84e4f313-fed8-415b-b9e5-a7a23eba03ce", "comment": "Malware payload (RedLineStealer)", "value": "7730853003442a0f0790d8723dad6e50616b944a299447e5e94fe66ba164439be674298888bea0ba92d86348603cd46e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677550291, "uuid": "2b3c707d-9d20-4e7a-a0c3-baef3cfdac7c", "value": "T147552387B7E889A2F97493305DF607C31A25BD703A348297334DE96E09336B4963176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677550291, "uuid": "597f91d9-5b6d-40d1-bdea-fa8c125d3ab7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677550291, "uuid": "2d24e9d5-e912-468a-98b9-922a22c39035", "value": "24576:dyC0OXYoNDHXgDO1nFy9LKcCqOskTkWWl06eiaV7mLc+i1ioeGPfT+bh9r:4YXYoNjXgDO1nuLKrqD7WEeD7f/L+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677550291, "uuid": "0566aea4-2e1f-4a95-93e3-c494393421bd", "value": 1363456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677550291, "uuid": "116fb649-de44-4eac-b4f2-f490e6f444d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677550291, "uuid": "a136d0c7-4949-4cf1-ba54-c72bfa9a5c0d", "value": "b8d71c4aefb039e77386a867790f5974.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac322b38-b751-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1677579692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579692, "uuid": "9397f482-b046-4e2c-a310-a9172eb0024a", "comment": "Malware payload (RemcosRAT)", "value": "f459f4c435c0abc3c8617ffe554e5b46", "object_relation": "md5", "Tag": [ { "name": "agoziem", "colour": "#985FBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ezeife-kozow-com", "colour": "#80D626", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579692, "uuid": "f3348a63-03cc-49f5-81a8-721590dc3727", "comment": "Malware payload (RemcosRAT)", "value": "3af3cffefa2df2c079f2901470005de5c361357e1072fd234226d72ea2214d45", "object_relation": "sha256", "Tag": [ { "name": "agoziem", "colour": "#985FBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ezeife-kozow-com", "colour": "#80D626", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579692, "uuid": "e53195a3-e974-4fd0-abb6-214eaa58f2bf", "comment": "Malware payload (RemcosRAT)", "value": "e93d035390405dfe32b4972392a3bd52c01d6cc1", "object_relation": "sha1", "Tag": [ { "name": "agoziem", "colour": "#985FBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ezeife-kozow-com", "colour": "#80D626", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579692, "uuid": "a5641513-6672-4b71-87b1-6b4071fb1e02", "comment": "Malware payload (RemcosRAT)", "value": "953a6e021e26ce872bcfcd7bdd5937fc4f5c88f06cc01f2fcd5ad1a50e12a976c5aa7d242689b1175677f38d81f2b5e6", "object_relation": "sha3-384", "Tag": [ { "name": "agoziem", "colour": "#985FBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ezeife-kozow-com", "colour": "#80D626", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579692, "uuid": "1ab53669-86c6-409e-bc64-c9b2e11d1f96", "value": "T18FA4AE01BAC2C072D57524340D2AF735DABCBC212925597BB3EA1D5BFE70190A72A7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579692, "uuid": "fe147e47-fd00-4424-aec6-b10d08dc2b64", "value": "b1c8f7572a6db205362528e88fd3ff32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579692, "uuid": "5ec51691-0b69-4b16-a887-551c15056706", "value": "12288:3jdAK8wxqkXuxOqLXO3X2orpbKs/Zg6BRq:xA3wxqkXuxOq+rpbRZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677579692, "uuid": "38e197d3-aee2-42a8-98da-672724cd07d7", "value": 486400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677579692, "uuid": "941a8397-94a3-459d-886e-77431961daae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579692, "uuid": "df3c46f4-f434-49a3-a36c-967ff3a2b4f6", "value": "remcos.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6095d93d-b74b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1677576988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677576988, "uuid": "a785a9b7-8431-4663-a4cb-17b13ce8f571", "comment": "Malware payload (GCleaner)", "value": "ce3f045a118a5843bb5bbb040cb70820", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677576988, "uuid": "dde57a7e-639e-4e41-8d31-0a01e3d1428e", "comment": "Malware payload (GCleaner)", "value": "3c06389cbfe7ebc70b30e233cc304a59605fca85df724eb80f484ec41dcd0a6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677576988, "uuid": "93628657-fe2f-48c2-9c6d-3394ab7cfe98", "comment": "Malware payload (GCleaner)", "value": "48396ff8078c38958bf91187bc0a41177fc552b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677576988, "uuid": "9ae45c31-0a5b-4f44-b26d-7c71fb0629d3", "comment": "Malware payload (GCleaner)", "value": "16065e1a197aff135e2a5148495d192f2160b69161948aaced1e9f1f463d27d2afad084315a0b1fc92050c1048dfc9db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677576988, "uuid": "bb4d0d24-7f15-45ad-960e-ee58d12ecfad", "value": "T1D0C5334B96D848B9F572AE753AD6EE0B4CF375231E3C9024F78F4F9A4A5CC818648B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677576988, "uuid": "796de673-35de-4b2d-a8ce-6020ae74c8f4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677576988, "uuid": "9f3052a4-a58c-43d2-8823-425d57ac82fe", "value": "49152:AGaDopFygNppLPFUQDXC0tuAZd1euN/Ii3Ip7COjuWvDHIDIiyPCjuVOMwxPFOKz:dio/zpLuSS0YmAIU7/1DHIkiyPCjW3cx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677576988, "uuid": "8cb641e3-f681-45ca-9307-2bf9d267bf00", "value": 2644657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677576988, "uuid": "f8dfa22a-1d46-4871-8f73-f1a29ed2d7e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677576988, "uuid": "c5434f99-19dd-4e31-9812-401f65398fc7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69300c7b-b6fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677542643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677542643, "uuid": "f1624044-9281-4464-9106-23c801114bda", "comment": "Malware payload (Mirai)", "value": "bab3af0510bb7fd39d42733dacb68b2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677542643, "uuid": "9f0229c1-6695-4284-8cd4-79f7197f2d95", "comment": "Malware payload (Mirai)", "value": "3d7ea4953c9c2c0fad636273a3c731538fed4381c9fc45ed63b483f73632aa68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677542643, "uuid": "23bb243a-2e28-4581-ac40-1840ecd8258e", "comment": "Malware payload (Mirai)", "value": "737a4669ad621bbdc8c402d8e84d435aea886d9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677542643, "uuid": "39b1fb57-a5c4-45a2-bf8d-916ac408dc02", "comment": "Malware payload (Mirai)", "value": "e0a07976c2c0d1638ce8987fedcebc9554dcdcdb2e1b0180a8e6b29718d74c68db325908ff5d5dd2cdef9478200b2805", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677542643, "uuid": "267bfd1c-0798-4d6b-abf0-75cf241071b1", "value": "T15C530886F8818A11C5D412BBFE2E118D331757B8E2DF7212DD206F647B8A86F0E77916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677542643, "uuid": "c02bb422-32de-46fc-a45d-acc45cf4b8e0", "value": "1536:4UnYdNXMCm9KZGQFdcz7YpeRzQI8iD33f1WZ:U5MGZGQHcz7YE33f1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677542643, "uuid": "2857e61c-b355-47df-ab12-b148acb9a728", "value": 63048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677542643, "uuid": "d0f9e4fe-4c7a-4de6-9668-a43633028a61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677542643, "uuid": "a50aa34b-400e-4040-9681-52b3a050468f", "value": "bab3af0510bb7fd39d42733dacb68b2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84b63cc-b6fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1677542776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677542776, "uuid": "4479332a-7e37-42ee-bb81-aecdfc528831", "comment": "Malware payload (Tofsee)", "value": "7de86d8af2610d799f181ac80b1df56f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677542776, "uuid": "b12e3815-5115-4afa-809b-f255b5d92b3b", "comment": "Malware payload (Tofsee)", "value": "3e8ac08892d633b002ebe862b10025b870e33a7a69435886c2203aa352fd2025", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677542776, "uuid": "9f33be22-256d-4c94-9293-19fd0799ef75", "comment": "Malware payload (Tofsee)", "value": "4686de9e2cce40cd114225107f91576676289c78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677542776, "uuid": "6360272b-1c79-4336-9b87-6508341ba34c", "comment": "Malware payload (Tofsee)", "value": "58fa8440811a9120fd7f327c70d0a0c2e4113687e22e18d94a478f57321e0dbc93933f7d67396b018c2c61f6daf7d051", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677542776, "uuid": "8ba71e8f-2ce6-4869-ac02-7fdb1338a738", "value": "T1CD66232322A25485D0F5CC368723BED4B6F903678F4668B8709F6ECB2F75C54A217A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677542776, "uuid": "f554e125-548b-4cbd-91cb-c36701de4655", "value": "20fcca9c4f6d6a96b55e9305c9ac59ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677542776, "uuid": "8c69f2e8-12b3-405b-877e-f35ae44ff6fc", "value": "196608:Wa8wedf72B1SyzA59tF/eem5pcdnxwkFuAt1DVQDVk1e5:Wa8wQzTlF/eemQdnx2QsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677542776, "uuid": "e93d4758-f5d1-43ee-b358-a3c292f796d6", "value": 6861328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677542776, "uuid": "78a4e098-431f-4057-be43-da5c7ae89202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677542776, "uuid": "1d679752-276c-493a-b537-735fe843646d", "value": "7de86d8af2610d799f181ac80b1df56f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68146e07-b73f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677571847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571847, "uuid": "7fd65e54-1604-45ee-913a-ed273418b7c2", "comment": "Malware payload (SnakeKeylogger)", "value": "34111e48340e4aa93faf00d6c785dd8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571847, "uuid": "559d2a0f-a9ca-4094-83c0-57dc106c80fe", "comment": "Malware payload (SnakeKeylogger)", "value": "3eb8a1705cb3e9d04bfe1179c0e577d4faa5dd265ffe45484fc3b7a518ba6afc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571847, "uuid": "6f0ff39f-e30f-49ce-973d-70c50c0519e9", "comment": "Malware payload (SnakeKeylogger)", "value": "2f686038d2d61cb75e5a6299c582fea20a5c5125", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571847, "uuid": "56e547a1-329f-4e70-b0bd-bb3df91713d0", "comment": "Malware payload (SnakeKeylogger)", "value": "43eeb615638d026d3d22305dc9c73cdf50d2305c9e7ac1bca9b362644b28c3c53d6f2db2f546df023b42207ce8eb65b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571847, "uuid": "d6351038-1797-4d47-8695-5fd70233f16f", "value": "T15335AD4853B344B2FBEB11A51875224C0EB872CB3585F21A5F773691A522AFFB29F503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571847, "uuid": "a3e0676f-490e-4e1e-9156-3c7828a1ea10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571847, "uuid": "f08620ae-1969-44d7-af98-7a60b587cdab", "value": "24576:cWgmenuCAnl7R9L7wdb/VMHvn8Jrf/+o9x/6qW:Vgmenu7l99odjAq3+W1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677571847, "uuid": "87f9e681-4506-4309-b410-8f164b343619", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677571847, "uuid": "21a69f2f-bdcc-4009-a080-1d653a31d552", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571847, "uuid": "b6b2e792-5e39-492e-859f-5a7663bb3b1b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a386e457-b771-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677593422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593422, "uuid": "85f65169-86a6-4f10-b39b-533e64d130fd", "comment": "Malware payload (RedLineStealer)", "value": "6a0fef7e07a68833b60abc2de6c1815c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593422, "uuid": "b16c1fe4-698e-4ec6-badf-e62cf9981508", "comment": "Malware payload (RedLineStealer)", "value": "3ff7f05a50256140c8f4a04305d3b9129d01b626d92e863ffaf2b2e63edac3eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593422, "uuid": "bf2112fc-c49c-4ad2-8d4c-8d4c586eb321", "comment": "Malware payload (RedLineStealer)", "value": "907b0b3d0755328f77ebc02d7f073dc99ef0c9f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593422, "uuid": "6c6b20f0-8e96-4ead-8ae4-763dd98fdd7d", "comment": "Malware payload (RedLineStealer)", "value": "132f22a92a3fe74f591735710ea563144dc1246047fd01f9752f1550d2f7385308d1b1bdf72ab68ea67b443793930348", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593422, "uuid": "83fbb220-9830-4e59-93da-2eff658fdbf5", "value": "T11B65231377ECCD72E8612B7059A202D32B36BD714B79C6AA774E98870835674A23137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593422, "uuid": "5f4d7dc6-fc08-4373-9583-eccd7b4ce36b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593422, "uuid": "c6f816f6-2d04-42f6-8fb7-49ad28fe4808", "value": "24576:my9rXJUiki9fWvpqqiANygjioQfCeEomvgNGaE9Zfup9BlHcQvSvf5tq:1lJUpixqixgjioQ0Ph9ZusQavBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677593422, "uuid": "9d086fa0-a7c4-4c48-a53f-39570c51d045", "value": 1426432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677593422, "uuid": "5ccf4265-e879-4212-aa91-33201e2738af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593422, "uuid": "8ef2126f-4acc-4222-ab47-f45ef8bf1f97", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb72adb2-b740-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677572443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572443, "uuid": "5f6a7e4d-125c-4393-8cda-66ef1a5bdb49", "comment": "Malware payload (AgentTesla)", "value": "c84a1d6e09f85d2aa57605126a130570", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572443, "uuid": "1bb4aa6c-9390-4bfa-9091-73290112a762", "comment": "Malware payload (AgentTesla)", "value": "3ff8d9d0be3bb8ccf5dc74c7c3c29162869b61048c9bcbeec5e9f33153c526da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572443, "uuid": "21738bdb-fe5b-412f-8815-ac49e462fa85", "comment": "Malware payload (AgentTesla)", "value": "3436075edba50a7a23d8782869981c2029c5740b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572443, "uuid": "cbc7a6ac-ce8f-4df6-bfbc-ba3ef8d0e736", "comment": "Malware payload (AgentTesla)", "value": "67100ef77441af23145160193f893a11f432d34bb46a710dbca14a81fa5fa5b37e617a11bfb1a833020d0cd9ec07d756", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572443, "uuid": "7e7852b0-ff09-4351-a93f-a499ae47770a", "value": "T15C150215E351AC3BE4639838E487A0D751186C3A6A41DA4F36C2731F1673FB24FBAE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572443, "uuid": "8df50d3d-3a72-4f9e-9734-a3108750ba24", "value": "24576:FmimkbM/DFe9xzuwGnmQmbWRQKKywkJIhmrbr:/UBIawNWRnKywkJSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572443, "uuid": "6aba82ca-9ea4-4526-bd2c-be08b199974b", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572443, "uuid": "e3c6dbfb-a570-474b-87b4-2a1a0d9f7e55", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572443, "uuid": "bbab52ee-171a-48b6-9881-c1045a934502", "value": "New Order .xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3523708-b70d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677550579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677550579, "uuid": "9cad232d-52f6-466d-bbf5-3c40fe719432", "comment": "Malware payload (RedLineStealer)", "value": "ed5eedee3eefad3c59aad333674333eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677550579, "uuid": "d790cc5c-80d2-466e-bbe1-28bd20a38854", "comment": "Malware payload (RedLineStealer)", "value": "401fcba4be1f247963ac49e386e7db3855574fa5baf6ed5ffadac583fdd55be2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677550579, "uuid": "dade6a94-546e-441f-bfcb-ef272cc80a06", "comment": "Malware payload (RedLineStealer)", "value": "33f3993b6a03a0d543d04282946786b6dc4ce715", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677550579, "uuid": "3858b441-1a76-4999-9935-44a1c41ef584", "comment": "Malware payload (RedLineStealer)", "value": "ebfd56f454287d2183449461d722a7dd6384f3ef7a55c378651e4e593f31336ac5c771ce72379057023f28d540f6e799", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677550579, "uuid": "85cf0cda-9a61-412d-808e-a9f2a9c08202", "value": "T1DA552343E6EC9226D8B45B7049FA03C3063E3A655A3442D7135ED91A0EF39E073B677A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677550579, "uuid": "f0ec2cfb-135b-4db8-856c-0149785e4943", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677550579, "uuid": "70950184-4961-4a12-b0a2-e16705f087a1", "value": "24576:lyzWdsOwYnSOQESsSpnc6naH2GLNo2mqf0atTwsx:AzVO/SPEPS+6aWGho2Bbt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677550579, "uuid": "3016a87b-abef-4570-8d73-6cb8288311d3", "value": 1350656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677550579, "uuid": "de771831-abb9-43c5-a1f0-70088ba24512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677550579, "uuid": "43604fd4-4d9f-411a-8eff-4bee4041dcc4", "value": "ed5eedee3eefad3c59aad333674333eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7796ff-b740-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1677572364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572364, "uuid": "5761b77b-7d82-4f6c-98fa-8666f31ab986", "comment": "Malware payload (Socelars)", "value": "7921ff78022f5be11c2c0c594bf22f0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572364, "uuid": "6eece95f-52ff-4ebc-bc98-2462738421e1", "comment": "Malware payload (Socelars)", "value": "41bb2e0152856ce743a8990789347fd1760b4e846c4ea88c24fa2e34b517bbf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572364, "uuid": "5f304f1b-bab7-4f36-aa16-21fcf5fff56b", "comment": "Malware payload (Socelars)", "value": "21eff5e29362762362c957a6819eec5de1b9d779", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572364, "uuid": "d1c1307e-ba20-4935-82a8-0a173a61af00", "comment": "Malware payload (Socelars)", "value": "060fe5630b01167e6e53feee6e91f589a91582006be393c7bca84cf538de48f5edd2436315cb87fb07262cdbcb988753", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572364, "uuid": "95d5c59f-01d0-4e6c-aa96-aa89a28f7eb3", "value": "T111658D21F7C26032E8E310B745FF66BE9D3C6A114708A4D7D3C81D999B614E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572364, "uuid": "daef772c-4d43-4d22-8974-d8eaf343a13f", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572364, "uuid": "c4d214df-494c-48d8-a976-1b082c712beb", "value": "24576:MGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dR7Q5hFSz:HpEUIvU0N9jkpjweXt7785zS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572364, "uuid": "b5787345-0339-4942-b755-2c670320e5a1", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572364, "uuid": "5639218c-75f6-4f4e-92bf-cfa30cefeb6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572364, "uuid": "2ac3892e-bd32-4c22-9576-58d86b10ccd6", "value": "7921ff78022f5be11c2c0c594bf22f0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017e31df-b73c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677570386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570386, "uuid": "ce24797c-52b2-4f51-a588-300337733f90", "comment": "Malware payload", "value": "7cb324e65243cdcf0f5865c7c8b75ce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570386, "uuid": "13d38a37-17ac-4ac3-8772-928b2b46378f", "comment": "Malware payload", "value": "42221d7bb5d6b59378bbfb8eb4de65be4c1e5d3902436176cce02b24d7e58df9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570386, "uuid": "c68af5f2-8cb7-4b12-bff5-a9dff36823d3", "comment": "Malware payload", "value": "92f22bc1c8fc23ac0980d2fac97653f48452f32e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570386, "uuid": "b6a9cf71-f43f-447b-98d9-afe3a5ad0731", "comment": "Malware payload", "value": "29d1c73821b229975e0116a84011177bc4a53ce6965f0c119f798c0147abb471bea9ebccc07996755baf1bb599710b59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570386, "uuid": "6b92da51-3e6f-458c-8f84-5d675176429f", "value": "T1DAC1C711A3E84736DDB74771BC73A34156BDF702AD978B6EB8C0118B6C126888E637B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570386, "uuid": "d031e8f4-83fd-469d-85bc-98408b81571e", "value": "96:5Gu4iJZk5jN4FkLnmM4pjYqLZxXkQ4fDQBzNt:5GWJZ+ja6LypF0vb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677570386, "uuid": "05f7c872-aeeb-4513-b632-fd00b3f398a9", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677570386, "uuid": "fd66450e-75f4-4e46-b210-73bf60809183", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570386, "uuid": "f556a8b8-d350-4bce-8f59-0cf4fdeddfde", "value": "Transfer_copy.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4c8b7f-b76e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677592260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592260, "uuid": "2ecafe76-4130-400c-9350-0c4dfd0abb14", "comment": "Malware payload (AgentTesla)", "value": "17abea15ceaa3ff2d1891f592c8ba4f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592260, "uuid": "1a8e447a-b124-4da6-ad70-28fe7c4b719c", "comment": "Malware payload (AgentTesla)", "value": "42abd330c19397d45018aa34f642aa60fc5b01d110174229401794d20ff0c9db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592260, "uuid": "048adfee-99f2-417f-a096-59a303bc21bb", "comment": "Malware payload (AgentTesla)", "value": "3691ead4fb301715b0b923cb8e1b093868b0aa2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592260, "uuid": "b6398cb3-da16-4e58-ab28-1c47d0b4c172", "comment": "Malware payload (AgentTesla)", "value": "a0e261e44a135fcaac8979993236a46ed9b8d12b8c7c129b7e66f0c22970e704b5b8211ed40a89164f2ef4f771eb1505", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592260, "uuid": "907264fc-def5-4233-90e0-c4921e28bb5f", "value": "T192641228FAA0C4A7D4D702724EB70B17EEFAF91D18F869DE57080E59B832145D81F369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592260, "uuid": "b52d1a99-f308-4e04-993b-27ad78aacdc3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592260, "uuid": "7f142f70-3b2d-4bdf-a6ee-cff07da54956", "value": "6144:vYa6SQU4ikxO3j06oIH5iDHjMK00rdBYAb2eAR:vY0f4i2OT06H6f0KYreAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677592260, "uuid": "171188c4-4693-4459-ae09-1b815c1eb6f7", "value": 326261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677592260, "uuid": "2bc32a3d-b0ba-46a6-baf5-3efc78bb8a78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592260, "uuid": "e2b96683-16c6-4900-ab47-6f52f813241d", "value": "Doc#80045123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ae51a8-b7c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1677627413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677627413, "uuid": "73d8070c-df5b-4e34-926d-6b7d5ffffe82", "comment": "Malware payload (IcedID)", "value": "9f6369487c0c4f8fad753f28f0871932", "object_relation": "md5", "Tag": [ { "name": "DIGI CORP MEDIA LLC", "colour": "#FCCA64", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677627413, "uuid": "27f20f96-8a75-487c-a208-78e66cd83af7", "comment": "Malware payload (IcedID)", "value": "43ba07032ca007ed25935ef123c2d408b2f4fd1f0e428b5d03b58b476da336da", "object_relation": "sha256", "Tag": [ { "name": "DIGI CORP MEDIA LLC", "colour": "#FCCA64", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677627413, "uuid": "9de449fd-4256-4ad9-9e12-63bb6911ac2f", "comment": "Malware payload (IcedID)", "value": "a7df99a2ed6eabc98ca1d4e20d7a0306c50f1f1d", "object_relation": "sha1", "Tag": [ { "name": "DIGI CORP MEDIA LLC", "colour": "#FCCA64", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677627413, "uuid": "5d43bbd7-3aca-4f02-ac3d-d0ae5e04a177", "comment": "Malware payload (IcedID)", "value": "490db6ce8a1603f764cc8961f08256aabb5c716aac94455959bfc5cf71a7fc3c376771652b26aae592e55524948ce105", "object_relation": "sha3-384", "Tag": [ { "name": "DIGI CORP MEDIA LLC", "colour": "#FCCA64", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677627413, "uuid": "b41c2ac3-ea41-4a74-83f0-b446f6f5ae39", "value": "T1C2540F459E16FD78C9E0967136653173F32339A8903EDB9779E1EE10CF29342B8AB640", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677627413, "uuid": "c324c494-727b-4195-b533-c74cdc2553a9", "value": "7f252ab32d95da3c51f0ac0ae737d3b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677627413, "uuid": "c6be3678-e6c7-4b53-98e6-b4d8ffbea9b0", "value": "6144:TVVhBoNGz8Rf7NPTY5e3wogq3tWQKLcH1AAdUj8J96j7wWFR3rERjGeoiea8l3fa:vhBoNGz8Rf7NPTY5e3wogq3tWQKLcH17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677627413, "uuid": "d5fb6319-d818-4d6a-baf2-18ec59cc1e19", "value": 293528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677627413, "uuid": "de5ef101-0ad2-496e-afad-30cd161565b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677627413, "uuid": "aa2f02e0-3b91-423d-ab5f-833a69c31e47", "value": "Contract_02_28_Scan#318.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c3673d-b741-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677572618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572618, "uuid": "bb1dab72-7c18-4a96-b0c2-7ed73697faf3", "comment": "Malware payload (AgentTesla)", "value": "00a88c06f5de90fa72533a8bb4a0dc37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572618, "uuid": "3eaa9e03-d7b7-4b76-838a-61f707d551d1", "comment": "Malware payload (AgentTesla)", "value": "44064013130a42814f21bb2f178d615d11ca0cf2014f0f925d7bad69f3ff29a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572618, "uuid": "7ca71c56-d235-4585-8794-3d05eb153756", "comment": "Malware payload (AgentTesla)", "value": "a998f72c5ae5f914618ca93e82ebfc852accf750", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572618, "uuid": "520d5c8e-2107-4f81-b58d-89e116038658", "comment": "Malware payload (AgentTesla)", "value": "1ed603db0ddc629b7c1f406338f814cce45ade6a46ec64bc5ca0626f614c0231462cabb42eec8ab3e060ba2d5ba124b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572618, "uuid": "cb55ddbd-d1d8-4df6-8fd6-73b2eca71220", "value": "T1BF15021AAA82DB00C744CB76F1C38176139EE58B35B3E75B2E2AD8650F513F45E893C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572618, "uuid": "f9b91473-08e6-41a8-b455-395d24eaef9a", "value": "12288:SsMMfgygkDeFs59h5O+w+kM2oq3vJXN33Y+pWsTyAUNthS8Y77OtI9JOb:SszgygkScTcf+q3BNnYKTHUNtU5POb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572618, "uuid": "bdb08fef-bc0b-4bdc-9c68-64576834096a", "value": 903752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572618, "uuid": "815f81a6-9f51-4ff6-83f2-babcd03026c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572618, "uuid": "55592d4c-442d-4133-9371-c9f2e34a2c76", "value": "e-dekont-20230228.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6322cf-b7b1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677620815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677620815, "uuid": "9dfdb54e-db74-4a2e-a387-0132435b7217", "comment": "Malware payload", "value": "e273bf8c8df8d32d7bca05db9b155803", "object_relation": "md5", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677620815, "uuid": "49538cfc-2bf0-43e3-89b8-a609c319f7ae", "comment": "Malware payload", "value": "442420af4fc55164f5390ec68847bba4ae81d74534727975f47b7dd9d6dbdbe7", "object_relation": "sha256", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677620815, "uuid": "25a2a788-fb98-45e4-94e2-0609a936f3ad", "comment": "Malware payload", "value": "8b612f4f4a49e5cfa2057395fe3a0d0353f55b05", "object_relation": "sha1", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677620815, "uuid": "2e19c682-889f-4969-997f-3eb40ba1a2dc", "comment": "Malware payload", "value": "30a484ab851a81f5d7bc20a9d7008505ab364cf4d2f3a31771cd9f8f96bf8a658d1b37e84dc64713597d01dfa31678fe", "object_relation": "sha3-384", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677620815, "uuid": "379bb239-8ea2-4a89-8fbc-4847a1f4f822", "value": "T1C4D47D1176DCBC75F27A023479B9A27955B9FDB15C39810E739C2A1F2E30682BD24B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677620815, "uuid": "c41f41e2-c749-423b-af4a-d5972cb20e9d", "value": "001b26f64621bf924e8e5fcf57e6ac98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677620815, "uuid": "40e014fe-4f07-4968-9fce-c4b695b5cd6e", "value": "12288:dt1VOakzj7hpQynG+6g1zJACP406bvcgW+oMfu+3:dt/xk37hyyzl1BP4ftoeu+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677620815, "uuid": "f880de91-e476-40b6-9baf-5e45537e6a14", "value": 606304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677620815, "uuid": "e1614055-e49f-4463-9be2-88f15ac10c41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677620815, "uuid": "ccf9b21a-cba1-423a-8452-9642b73b90ae", "value": "2023-02-27-Qakbot-DLL-returned-from-67.207.84.43.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f8c401-b779-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677596650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596650, "uuid": "c6361ba4-7c30-45ea-a81b-0d67c4ab1eea", "comment": "Malware payload (SnakeKeylogger)", "value": "29451a33ac007137e798c1e63a136c8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596650, "uuid": "4011dec1-1d40-4acd-a18d-c4f930dafd69", "comment": "Malware payload (SnakeKeylogger)", "value": "44e90dc0d1ece69f2d0c57a54984110927e97a3491ed20047963467f4edbdf1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596650, "uuid": "5f0c4f56-57fb-40e6-95db-f29f65cad034", "comment": "Malware payload (SnakeKeylogger)", "value": "04cd10689b6da48e4a9b7d0d7f2f74e041f6dd62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596650, "uuid": "0818997f-6e91-4708-9fa3-d7fd026e4023", "comment": "Malware payload (SnakeKeylogger)", "value": "8f6dbc0c5cc087f04a4334068e2d3319f894b81f3c8573b2ab7e30da6189f8019fc25b6785eec35942fcf5e07ed7c4fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596650, "uuid": "732e4d44-2d13-43a8-a385-6e5577bab143", "value": "T18A657D89A3708C77E8DB01B15C5661681DF2BDCE6454F20D5BAB77026AB33E7708EA07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596650, "uuid": "5675d03b-8b91-477e-984f-bba9b3ad3cc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596650, "uuid": "db549212-4b0d-4b70-86ae-1da988336273", "value": "24576:0dkOD7SzYnJdyeMrZA+7qcj16WXZ5DCIbHMVdTNKxbCA6/+otq:0KO3SzYJd3MrZAAqcZdHW1TxKha+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677596650, "uuid": "9bc51957-4d76-490e-b6d7-414801297fdf", "value": 1539072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677596650, "uuid": "1cacd57a-f52b-42ac-95ef-56caf8814aab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596650, "uuid": "2fbf33ff-b937-47e7-98cc-bfc9d003e95a", "value": "Belge.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c27715-b6fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677543074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543074, "uuid": "c0a73ee2-ead9-4f28-bdc6-50cb082fac15", "comment": "Malware payload (Amadey)", "value": "0ee98011e493350e9f24917c3942b10d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543074, "uuid": "feedda27-5f80-4fa9-92a7-7a6ead9d3b4d", "comment": "Malware payload (Amadey)", "value": "45a6028f5eeb500f7a7b10aa30d96ab7f3f3f30308ccf6a9ebbc2bbbdfd66654", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543074, "uuid": "27c0e154-fe61-47cf-a44e-9c621c36d77f", "comment": "Malware payload (Amadey)", "value": "8b744832d627257b73fb235ea382356b54318c4b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543074, "uuid": "081a4620-dada-478f-b691-d35f30861188", "comment": "Malware payload (Amadey)", "value": "4a13cb530432cda2946d110e1725e084ae880e723a20384b3adfe969b07fcc45cd7ad2cba22ce9608ad5680efb06c0dd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543074, "uuid": "5c6725f8-08c1-4fe4-9bec-fb481367da67", "value": "T16855231BE6DCC072E87967B16DF702E30939BDA0693483AB274F991B0871560B63971F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543074, "uuid": "8ae5c343-f45e-4d9e-9f7e-585f374bb026", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543074, "uuid": "0eca26a0-8ae9-4010-87a3-d02259886e50", "value": "24576:zyuIwy31OhpqNiWXJrbnVFr0p77MRgXR4hY+WzoUL2Spm/:GZ3niWX5VCSRuSYtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677543074, "uuid": "e6427d09-5cd3-44da-9bab-2868a5f9e828", "value": 1350656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677543074, "uuid": "10b4cd88-7302-4c51-8746-9eaa590a3fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543074, "uuid": "381b481b-8df8-4a4d-a658-096f84170ae8", "value": "45a6028f5eeb500f7a7b10aa30d96ab7f3f3f30308ccf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb788695-b775-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1677595207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677595207, "uuid": "2bc02c83-4250-4b7a-ab57-29a15993d5ae", "comment": "Malware payload (Gh0stRAT)", "value": "c75ea8dcb6d4bd86c8e44f7cca73dce8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677595207, "uuid": "ee1bf0d2-f8dd-4dda-9477-bb61f657f3a8", "comment": "Malware payload (Gh0stRAT)", "value": "45ba685ea7d66e5c0ac91b4c19a11dad0dff029f56afd15e87f8553f30f72d27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677595207, "uuid": "79b6915b-f5ab-4a52-a32e-21f73ac5d729", "comment": "Malware payload (Gh0stRAT)", "value": "104bb8d627556b7a46017ffdee38e62a3198d8e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677595207, "uuid": "4d69b215-24f4-4776-b577-59b8d73cf4ae", "comment": "Malware payload (Gh0stRAT)", "value": "ca944d5a6ae1a565e0ff01b4ec65a7960f8f9ca8a9f4299d5b0890f87a5b54d2c5447f3879cd85282dad3b03db979a14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677595207, "uuid": "289c624a-e272-4539-a6c8-afbb4d99cd09", "value": "T17244123412AA55BFE1828BB11AA6F975FBB5BBE13B4910073F8D3EEA7974413D001217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677595207, "uuid": "cd0683f0-90b6-4f9d-af3e-004f3a3b2b5a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677595207, "uuid": "35aa22e6-3b14-4002-8d35-67dc4adbd3fd", "value": "6144:lhRN6bO4Mvrynyba1cm36eWRwd5B2jLAz3Dv15EkTt/qaB:l61VKeOQ5ELAzDjBTYaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677595207, "uuid": "863139df-7154-46b0-87e0-f25c4ba1b3ed", "value": 263386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677595207, "uuid": "28872fcb-c9fb-4216-a3da-df7764f48394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677595207, "uuid": "ee592685-9f2e-4f88-a587-28767b4f1a81", "value": "c75ea8dcb6d4bd86c8e44f7cca73dce8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f591e5d5-b788-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677603438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603438, "uuid": "7ae1589d-e447-4db6-b198-fd9bb30fd7bc", "comment": "Malware payload (AgentTesla)", "value": "c238eade1b9932a7ce645130b7585094", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603438, "uuid": "eb7a7027-ad77-47a8-aa4d-1a280bae84d0", "comment": "Malware payload (AgentTesla)", "value": "462d53b58f158d715d7498179ad8f8383f5dd0171505571c83b333febdc13fad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603438, "uuid": "39c422b6-dfb7-4980-8f10-7c3f3496f605", "comment": "Malware payload (AgentTesla)", "value": "05968ca5f4a9dfdfa00a417d1bac9b81316eb91c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603438, "uuid": "cc5fa69d-1d51-454e-a851-f4adae702055", "comment": "Malware payload (AgentTesla)", "value": "e0521e09453609d332078b16262a30f09d5e816b0a6725763abbe4336c053137bbd3f816f0b91065ffd7e4abab261d36", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603438, "uuid": "1f3302eb-90c3-4c6d-b924-fb17f7abcbc6", "value": "T17D64130A1374E03BD9218B322C7A825F9FF1E906655C831F37989BD57D72AC2C61EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603438, "uuid": "2630128f-70dd-4ca6-b25d-db61c1c4dca7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603438, "uuid": "7ff72f16-f72e-420f-93f3-ae185141d04f", "value": "6144:PYa6hBEPtEi/e5DeGHTZqLoHxj3HUEaNwjAHKermxUErDtcDPAbGc92g/OKM4x:PYzyPei25D1zZqLop3HUntHLmiErD+DC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677603438, "uuid": "3f044389-91fa-4fa8-853c-860e6111c477", "value": 331702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677603438, "uuid": "2a082cf1-d47b-406b-98d4-526046909bba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603438, "uuid": "82584fc9-bfd6-4658-9c90-3959cb4cc42c", "value": "shipping bill.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48fa9e84-b741-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1677572654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572654, "uuid": "7b8e1323-4d00-4928-9112-d93be1f6a490", "comment": "Malware payload (Fabookie)", "value": "1c3f780f65e892860830e4cd8d5934a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572654, "uuid": "1be3c511-368e-40c7-93e1-04cea6d8573f", "comment": "Malware payload (Fabookie)", "value": "46459d267c5af74edbbbb5e507b5535119570b0474fb6fe071003d509d70ac6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572654, "uuid": "7116f2e3-a946-43c1-999f-80d1c2ddf068", "comment": "Malware payload (Fabookie)", "value": "91c859d835e3445ff488ebe8079b4774e4010ebf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572654, "uuid": "1f87580c-c8e7-4c30-93b4-ed6f19828486", "comment": "Malware payload (Fabookie)", "value": "615712f45951a293187eee31a2b9c75706c0eaf6ca6ef8f9550e648b0cb57c8ba2eed80e882282bb5f0803943bd0841c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572654, "uuid": "ed34e207-98ea-438b-a058-5c7d73d29296", "value": "T1F1F502BE21A83798C44E883C5433ED5872B5281F47F895EDB5DE7AC1376B510EA82F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572654, "uuid": "9d719f74-04d4-46f3-a751-018daab20faf", "value": "ac639288a9537d81bbe3cfbc1135d815", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572654, "uuid": "392b429b-0188-4fef-9c0d-fae6668b6b2e", "value": "98304:BHicnGr1seO0fnGXT84s5aPdKW7ETdVI3C:BHGr1sT0adqaKWWVCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572654, "uuid": "a21fa2d3-5fe1-4956-839c-a52d8db9f2a4", "value": 3643904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572654, "uuid": "7ac615d4-1454-4df8-81ca-18b36af5ae3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572654, "uuid": "d0c24da3-3039-4088-b7e7-b77937f0be0c", "value": "1c3f780f65e892860830e4cd8d5934a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd6653d-b731-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677565896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677565896, "uuid": "b60dea43-4d3d-42b5-9d86-d280646f271e", "comment": "Malware payload", "value": "c261c6e3332d0d515c910bbf3b93aab3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677565896, "uuid": "b16e4cb2-66b0-4408-812b-ad2207563401", "comment": "Malware payload", "value": "4663715548c70eec7e9cbf272171493d47a75d2652e38cca870412ea9e749fe9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677565896, "uuid": "63bcb9bf-d22e-4813-bb94-acd7349a91cf", "comment": "Malware payload", "value": "ff730b6b2726240df4b2f0db96c424c464c65c17", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677565896, "uuid": "db6911be-da74-4831-8d0a-3e85588bfce0", "comment": "Malware payload", "value": "1a0ea77f74a6de6596632304cbe26e5469dcbb75a688d04549165908a1cebbdc523f995db807e24fd9cf6774193a7aac", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677565896, "uuid": "3396d4ba-cf86-4b33-baab-72e949192328", "value": "T1EFE21A74D3C31170D28EDE72A6B39BB94B37561B2A5B316E390DA3031EA2184479732F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677565896, "uuid": "60609970-7642-4444-a9fe-4a9bf0a1a730", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677565896, "uuid": "403de29d-257a-46f2-bc9e-8c978f7ca68a", "value": "768:Tyc7/ovNV004AjWU3GQelVUlidf+prtbjzjy1QVIibtYcFOKc6K:Tyc2z0ajWTQelzdGDbjzKQVIi7OKcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677565896, "uuid": "df50df73-d324-4ddb-a101-9db21c56bc11", "value": 31744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677565896, "uuid": "0ca07dac-ee43-4e77-8151-9307a6b90a63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677565896, "uuid": "e4406839-6451-42d0-b048-fbaee6e6dfbc", "value": "4663715548c70eec7e9cbf272171493d47a75d2652e38cca870412ea9e749fe9.bin.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d37feb-b6fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677543389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543389, "uuid": "c5bba892-293e-4c01-8a54-ca14b181602b", "comment": "Malware payload (Mirai)", "value": "206a0107f791237ba825dcc1e324604d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543389, "uuid": "2dced261-c522-4ffb-b8f6-787bfb081655", "comment": "Malware payload (Mirai)", "value": "482567f4878e7f32286fd9c0b5d46d647150ac50353de607cac3c770e6037163", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543389, "uuid": "90856a1f-55ee-4eb2-a83c-d246220cbe58", "comment": "Malware payload (Mirai)", "value": "8399b636eb7af30afddf16233a1bbd4ed1ea671f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543389, "uuid": "a1f76e95-1ca5-4d4a-a9a8-9ba8ba6c1ebe", "comment": "Malware payload (Mirai)", "value": "984127583787e21d41a263891670c9a6702ad6ffba561c26d346bd9c0ee1242e222ee59be6996bbafa01a4a4a3ddf9c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543389, "uuid": "f3c1268a-ea64-4699-95ab-67acf85e4bbc", "value": "T19F332B027228094FF9D61EF0393F0FE093AFE98064E0B585694EEB458676F771586F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543389, "uuid": "8e2daeb8-7c06-4907-a74a-cf7f652156a6", "value": "768:opgPdUwOe1Po/7wni3RiAPSnPfvPK3Ctjcxt8mizjrvVwipnpBX9Qe83:D1FOe1Po/kcE9mFomi6wvXeB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677543389, "uuid": "5a9fd460-0a85-4637-a123-e1173b307a6e", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677543389, "uuid": "329fd63a-2228-44ac-9d80-0e8b60b8e8e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543389, "uuid": "29a08365-266f-474f-843f-98af0efaaf53", "value": "206a0107f791237ba825dcc1e324604d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0fa9e04-b766-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677588800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588800, "uuid": "f0cf5901-8500-4577-b745-1f25eea4fbf8", "comment": "Malware payload (AgentTesla)", "value": "91dab8c8361ff2dfae64ad3643e8ca3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588800, "uuid": "89246bd3-c6ac-436e-98cf-48bf3e8f3689", "comment": "Malware payload (AgentTesla)", "value": "48fbd6968e8aa1914d0eb20fea7f0b3b6d84458379ca56eaa21a2d86c79191d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588800, "uuid": "6362dd58-6771-4338-bb68-88e080553ebb", "comment": "Malware payload (AgentTesla)", "value": "70997e731056eb1a9cf581827b31094afb452c9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588800, "uuid": "300e4097-4ab8-4419-9120-935ece41f320", "comment": "Malware payload (AgentTesla)", "value": "4cd790b3f2c1ab361faf80a432d4752fda90f0bddcb6a20ed7a50d37015a3fa6299b8624c125090418104112bac7eaed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677588800, "uuid": "547b5eab-93dd-4509-b54e-70d110aa5c70", "value": "T184559D5C63708C72E9DB01B2548522DC4EB4F4CB6516F35A4BA73742AA8A7FFB64D203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677588800, "uuid": "5278aca3-8653-467c-afa0-f120c214cfff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677588800, "uuid": "5e04b52d-c3aa-46b3-bc1c-f5ba3a8bdf49", "value": "24576:4r1/4D7SzYVJd/jTKx+POWOjfO2ZfL6mOf7ovYnIvNuUCRxbCA6/+otqo7:Kg3SzYbdbo+POWkumu7ovYIFCRha+3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677588800, "uuid": "9d997496-7765-4b49-b240-5f494b6ff0f4", "value": 1298432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677588800, "uuid": "063ff215-31c4-4882-a874-e4d2bbf6569d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677588800, "uuid": "04d23442-646c-4c6d-82ff-896e4ea7e0de", "value": "purchase Order for Servo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b787be34-b781-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677600327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600327, "uuid": "b543b72a-4c71-4579-8ab9-6be94d3e697f", "comment": "Malware payload (SnakeKeylogger)", "value": "2187a019e706bbd61c23e8bb6e8c52d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600327, "uuid": "baecd428-a023-4229-b840-777cab13f5f1", "comment": "Malware payload (SnakeKeylogger)", "value": "4ab558181de9bd2dd00dc75eb66840c18c9243c62d72ee90d4e037d9be472721", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600327, "uuid": "4a413250-38b2-497f-beb0-b95f38a02a58", "comment": "Malware payload (SnakeKeylogger)", "value": "c6de153270978951a9583b5cf53f76f14a1d6392", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600327, "uuid": "d4caea06-f42c-4ef9-9cbc-4f06c62cb6d8", "comment": "Malware payload (SnakeKeylogger)", "value": "0081c4ef0a9c59f1f4a2ac9cfeb40c8fa6d922bba0f09d8b3c5c87084b3c23517cf8effbe1f4f33ace4b99bfc184d66e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600327, "uuid": "72822ebd-c29a-4099-916b-c1c1b1d39d16", "value": "T15C5412B97751C02BE8B715B00EF3160663A2E51598739B1B13F09F2CB822695D70FBE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600327, "uuid": "f6019c68-77ba-49e0-bc53-693e4846f46d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600327, "uuid": "df7c0b00-ba7f-4ebc-a960-4264ac1b75a5", "value": "6144:9Ya6bgG4b0kMEMSz1RMxASpy6xLfkMGC1rEwZzFCuwyIJSm:9YF1AHHzXMPpy2LfUC1JpFkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677600327, "uuid": "d16a0fbf-5771-4c18-b74b-cea8907fbb3f", "value": 298623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677600327, "uuid": "580483df-dc54-4630-9ad4-0f51a9317ec1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600327, "uuid": "bd28350b-b1ea-4cf6-9622-9f0b82573bb6", "value": "hesaphareketi-01.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e56ee884-b799-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677610712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610712, "uuid": "d7f9c95b-6e5d-4224-ab48-77fb342a61d0", "comment": "Malware payload (SnakeKeylogger)", "value": "cc47aff040473c50f7dd20e75fc9c722", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610712, "uuid": "77757b34-adca-4795-83a5-f1ec653848f1", "comment": "Malware payload (SnakeKeylogger)", "value": "4b217e79d0c538d6d0e711f20df8ce47dcbb1104d5f4ad7634a4ed70ad0a34ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610712, "uuid": "2421d7fb-d8bf-4b06-a30a-2a4e433681df", "comment": "Malware payload (SnakeKeylogger)", "value": "e7f69b5c8adcec07df775111b257a09fcbcfdab2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610712, "uuid": "5a9f37dd-5dc4-4781-84fd-522a0d3ae3d2", "comment": "Malware payload (SnakeKeylogger)", "value": "78e177ba3e3642421450cf8cc2ed10253b34384e608f9999b83ff81a9f7eb5d1c4091acd46f6578397780754727f483d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610712, "uuid": "a30dbf97-87ae-4a6a-b298-772fb75c5055", "value": "T165E3181D27F89800E5FF8A7705B15212C776BC42192ACE1D5AD2F5192A3DB908E1BFE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610712, "uuid": "b254799f-a354-4df3-9344-bd619fcc3a1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610712, "uuid": "5c6e5cf2-3da0-493f-ac0c-22a38ad4ab20", "value": "3072:aAgAEAb97xSIU8di1wXb8hPCwBQ2gFbY:nNHnsyb0220b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677610712, "uuid": "c0665781-2bff-408b-a37a-814070d46237", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677610712, "uuid": "eaceb79f-cfab-4064-ae39-ed9ec4b7cded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610712, "uuid": "ff67ba97-9f87-4796-a740-3f7b3fc6ac68", "value": "cc47aff040473c50f7dd20e75fc9c722.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2bb88b-b751-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1677579691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579691, "uuid": "ca983551-0405-4d46-8095-2a102e27785c", "comment": "Malware payload (RemcosRAT)", "value": "6cc798249343310071329f2505937c24", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "agoziem", "colour": "#985FBA", "exportable": true, "hide_tag": false }, { "name": "ezeife-kozow-com", "colour": "#80D626", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579691, "uuid": "4690355b-1b6e-4b7b-8e91-375d8c2d90b7", "comment": "Malware payload (RemcosRAT)", "value": "4d12b9dc3abe7b7660828ee452e411a0acb0a57beb81e7dcb23d5ccec175bfdb", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "agoziem", "colour": "#985FBA", "exportable": true, "hide_tag": false }, { "name": "ezeife-kozow-com", "colour": "#80D626", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579691, "uuid": "16ad2e4d-6a8e-4320-91ae-1fbf272cacda", "comment": "Malware payload (RemcosRAT)", "value": "bf04ccc43d57a6ba158dd32dbe8b2fc69539ecbc", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "agoziem", "colour": "#985FBA", "exportable": true, "hide_tag": false }, { "name": "ezeife-kozow-com", "colour": "#80D626", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579691, "uuid": "2f44262d-42ce-4b32-a382-2f61f037d946", "comment": "Malware payload (RemcosRAT)", "value": "97d7a94b873334d61904d5383810833c7493fb51c03a5a28fe387ff2a4910fdf1885776fadb131d0a5a9d8a6c812b50d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "agoziem", "colour": "#985FBA", "exportable": true, "hide_tag": false }, { "name": "ezeife-kozow-com", "colour": "#80D626", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579691, "uuid": "99b37b15-0e95-4780-959f-4290dff2cfa5", "value": "T192C4F1253F5887FF41D6E245CE27EC0C6B507E7E8858B6EAB3D65BCB0688805BC16835", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579691, "uuid": "6d2f4b7e-37b4-46b0-951f-3a4f829fe020", "value": "12288:RdTnS1n+PufdX3qYEw06ydo2gQwsAcGGGKWp6d3p9iA:fTnS1+eXj0Pd2EGGpzviA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677579691, "uuid": "2787d04f-804a-4075-a5b3-4e2b18a339cd", "value": 551250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677579691, "uuid": "50142a7b-3ed5-4836-8161-d5a684921951", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579691, "uuid": "aaf0df3c-7894-4c55-81ae-8edc4cad7a2f", "value": "Booking Information.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be2b5fc3-b761-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1677586594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677586594, "uuid": "3d2b9863-6ca8-4500-b0a4-c7e9bfd0a042", "comment": "Malware payload (CryptBot)", "value": "d7cda88f4933d4acf4c86589ad96f272", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677586594, "uuid": "3a2e7c7d-eb04-4d7f-975f-fde609e09852", "comment": "Malware payload (CryptBot)", "value": "4dd43cd1ef81ecab7244b6128abf24e30638cf7f20eea778a20ebfa21016f4cc", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677586594, "uuid": "1d70074c-8d53-43cd-9bbb-91e73f8277c2", "comment": "Malware payload (CryptBot)", "value": "19d2da437a1023878c1cccdad6efd03d6e23006b", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677586594, "uuid": "9f69ba46-d6ab-4658-89c2-6909a2430f4f", "comment": "Malware payload (CryptBot)", "value": "cf91a0fc112bc09486c9e874309e08a49b77d10077cf700d457db900b9ce207039eba77dfe85820a050a49dda2acd4ee", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677586594, "uuid": "4707f3be-ffd9-45bf-9e55-8379c0381960", "value": "T1A805F139B081C0BDD6532071E938C66653787B23552BE8AF73D02DDDFE6D2219B2BA41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677586594, "uuid": "6568ff5f-c387-4251-8ede-2dbee0e6f9dd", "value": "12288:R+7saPRgOSJGwWCxyUQa2v9WlSdKwuB+GgKImx7MctWLQinituvKqS1yK6fjJL5D:8oaPROP2XdK/gKbFtuvGkfD7eGNTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677586594, "uuid": "44a7893f-82aa-4524-8046-98a1ac281c5b", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677586594, "uuid": "51b2c363-7fbe-4d5b-ac7b-81ee3ffbcc9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677586594, "uuid": "25f2ea3a-5808-46f5-9524-8dc74bdeb1e5", "value": "d7cda88f4933d4acf4c86589ad96f272.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6455b7f0-b73f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677571841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571841, "uuid": "ffa738ac-0e6e-46a9-b2b6-71df3fa39e9d", "comment": "Malware payload (SnakeKeylogger)", "value": "616db202364aa9fa2287eb58b95bb467", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571841, "uuid": "197ed108-e810-4416-b47f-69b4f6a6e03f", "comment": "Malware payload (SnakeKeylogger)", "value": "4df4be182aa3353f0ee72854252cfa59de21cd35b728f4f458ca00a25f260352", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571841, "uuid": "8e0c2741-bfee-4c24-82ab-8e5b691c1f67", "comment": "Malware payload (SnakeKeylogger)", "value": "eb32bfd74edf93f3b109654f6fe5f8df6c619203", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571841, "uuid": "cb4b4555-719b-4011-9f08-cf9a69f03350", "comment": "Malware payload (SnakeKeylogger)", "value": "dea3c82fb14bc53c699003dd9cc33851b6e9c1da5832b0b36c702428a69bbd9b08f721be843257c1f63825682cb179d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571841, "uuid": "75f95e85-a827-43dc-abde-a0700004ac46", "value": "T1A635AE4853B344B2FBEB11A11875228C4EB872CB3585F21B5F673751A522AFFB29F502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571841, "uuid": "83a1cdb0-1ed0-484a-9b5c-1f0fb7aec113", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571841, "uuid": "bfe1f635-beab-4be6-bc3f-59b8d17f212d", "value": "24576:EYgme3WxCjnMrEssRMnB48pRlRf+l4Y0RerCA6/+o9x/6qW:7gme3W+nesKnBPPlxY5a+W1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677571841, "uuid": "832e5387-fba1-489d-afe1-de0802d07b68", "value": 1151488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677571841, "uuid": "6dcaf04e-0dca-4d6a-b072-5c679ee14a0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571841, "uuid": "50f99a54-8acb-4841-9d48-ddd1ed410791", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a7ace72-b789-11ed-88f6-42010a9c006e", "comment": "Malware payload (Reductor)", "timestamp": 1677603714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603714, "uuid": "23bf6e3c-2e18-405e-be16-c820cd8707b3", "comment": "Malware payload (Reductor)", "value": "7911f8d717dc9d7a78d99e687a12d7ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Reductor", "colour": "#DE2248", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603714, "uuid": "2c2aa9ca-cce1-4683-bff6-91e7f8986d08", "comment": "Malware payload (Reductor)", "value": "4e2d038e9d72ee4d660755ba973a31471dda167d1a51bfdfe60abb2b3de78ba1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Reductor", "colour": "#DE2248", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603714, "uuid": "8012987d-1beb-42bc-a991-9911df7f2968", "comment": "Malware payload (Reductor)", "value": "e49666f7882f299c2845c7e31e3d842a387ef10d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Reductor", "colour": "#DE2248", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603714, "uuid": "a7123f57-dc14-403c-bd1a-7f53bbc9065b", "comment": "Malware payload (Reductor)", "value": "2134e03873ff84da00631f0deb4760323eb7077bc6970d66a5694af5cd3902249833800dc94fd8413dc01300d9267ebc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Reductor", "colour": "#DE2248", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603714, "uuid": "1efeb973-ad9c-4dac-9f6e-1fe6b4dfd74d", "value": "T1A8E3528BF7BA20E5DCB6E0389652722BB9A2786443749FC7961059074B72BF4BC3D740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603714, "uuid": "fb90d48d-98f3-4953-ad44-04735af4279f", "value": "e867c507f4728897d9e273f6db324e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603714, "uuid": "3a453ef6-4a48-48cd-bb4b-c953f6e35628", "value": "1536:KCnGt1AnxGhRoE0JLEaolArglgidmpHACgaSz42tpAonFcP+i+9:jG1hRoE0JLE8Qjg6aSk0LE+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677603714, "uuid": "748695f4-e400-482d-b94f-ed967528ee4c", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677603714, "uuid": "62301258-eb49-4cdc-b20c-eb16999d4bd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603714, "uuid": "a2b5ffaa-29d9-413a-9a02-d368f8814366", "value": "reductor.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913f8c1b-b788-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1677603269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603269, "uuid": "4068d376-99f1-4d9f-b49e-55fe6a8fa6b3", "comment": "Malware payload (AsyncRAT)", "value": "8e46edb03c48c88998a487b86e030194", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603269, "uuid": "5a994007-ae61-4090-8b48-ebc47f6ddbca", "comment": "Malware payload (AsyncRAT)", "value": "4f446d66e7188a7f43b8ee052092c081602757a882d76a08421fff6545e8072a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603269, "uuid": "497bccee-849f-43e6-906b-56c06f8da03d", "comment": "Malware payload (AsyncRAT)", "value": "dce8fb14e84afe5697599f4e6c5ba882e4c49ffc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603269, "uuid": "d8265f0a-ed96-4002-a41b-afa168ef3b2e", "comment": "Malware payload (AsyncRAT)", "value": "b804903664a92b87f24645c2469b64e8974c4f62e79b58e6a4fa75cd1928a23c39025f2e0fe2eeadd275b604ad7e3143", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603269, "uuid": "0b6ce64d-4bf7-4dbc-b981-6caada8d3ad0", "value": "T1539423345FCB5CE99AFA127F306E4BE5516BACC4895077DF02AA444EE043B629D0F2D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603269, "uuid": "a1e41f9f-8075-49f4-9625-4e639a75abd6", "value": "6144:oG3Hh+vRZcdmHYagMa/riLK3r8hXiljKA3i3cs0NWnMC0ky1aEFVicMPFH:ZB+pZkmrgMtL24hXG2eiM2/qHFVicM9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677603269, "uuid": "f5b9729b-475f-4b24-a6af-29813ed4a843", "value": 419902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677603269, "uuid": "58a456cc-cc81-48a9-b9c8-90112ff5478f", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603269, "uuid": "30fe107b-5695-4cd0-9cdf-71d9cb8ad863", "value": "Invoice 575367.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96e63c8-b76c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677591311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677591311, "uuid": "46826381-de61-40c8-a63c-70ca6a62b707", "comment": "Malware payload (AgentTesla)", "value": "c642f8452f037b56b5e3cba459d35dbf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677591311, "uuid": "ef6daf62-efce-4d2c-924d-bab0d899e45a", "comment": "Malware payload (AgentTesla)", "value": "501b37fe66a037f8eaba5c9f49f961ecc72ae6f1dc8ae399997f26b9744c369a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677591311, "uuid": "36c1362b-20bb-4b7b-9934-ce79bec4273d", "comment": "Malware payload (AgentTesla)", "value": "352d9be4402bd4d45fa36579e5c1895b03b42bd1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677591311, "uuid": "d8a2c939-4df4-40a5-a2da-942cf44b4c8d", "comment": "Malware payload (AgentTesla)", "value": "11125f4355066190298738b6788a559244949d1ac963ad160c9db2606c8b6860fba8774318a8df66be30a726d143db2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677591311, "uuid": "5498b606-9050-49f8-b007-a77bbc2c85f6", "value": "T1136423A131132BD8CBC7520BA1FC57A40A6D57D68F794D878136BF09EBEA93932D0271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677591311, "uuid": "19cb32f9-1278-4814-9255-f891989f2072", "value": "6144:C4/ANvWJ05wfxw5u3ohdxJgbg73gyWpet3+RNBLvSahpvyCz046:CwwvWJ0SwUAxJsgLgyW++tvAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677591311, "uuid": "05c594a8-4925-497b-bb99-44d164e95b2c", "value": 316872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677591311, "uuid": "db9dd0e6-b586-47c5-b8c2-48ffa87bf0d0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677591311, "uuid": "0107b53c-892a-4222-bd4d-0b55e209f1eb", "value": "Shipment_notification.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10afa1d6-b76b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677590598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677590598, "uuid": "bfee7bb7-7670-4850-8a98-456956699c24", "comment": "Malware payload", "value": "bb68ae2c7bbf64a67dd4f4dedee55cf4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677590598, "uuid": "d3a11119-8649-49c3-924c-0c57029a3f50", "comment": "Malware payload", "value": "50359feb3206da32877f56ecc4caef6141d7d764757b87513dfd0ba921f3fcca", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677590598, "uuid": "13df544e-23b3-4f0d-a02f-5ea5217936d8", "comment": "Malware payload", "value": "e35ad4ae4b020fa397c7b2532bd0d2678fb480e9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677590598, "uuid": "1c74ebc5-10e3-43a1-b4b5-220ca8116af8", "comment": "Malware payload", "value": "09be96fafc808b14b3ddf6b1dc94eeec1f318b8b92d56ef81b681152632bae9c2a94cd5f76b5be752885c57c342f773b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677590598, "uuid": "d8137b7e-5aba-4cc0-83a2-a183fc408e34", "value": "T1A0B3103077D01CD5F2B71A3C7CB1211280EE7C91AB1F929E0994296EA5B07A054FEF36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677590598, "uuid": "1a7fe95c-cbf7-4e01-81f8-1ea142304a1d", "value": "384:2YzYW5+q+5OiH0VY2COsHphiHytawiw5OipA7J0a8T6DEy+Vvf81W4pyb85W6KGW:S0VYbOEpseP1vD4wbOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677590598, "uuid": "d4b12eef-4edd-44b3-8edd-ae9c0a778f1d", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677590598, "uuid": "51288416-72dc-4a9b-bf40-36ece4e34009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677590598, "uuid": "055da481-cdfd-4c71-947d-06eae14e3211", "value": "1803424376.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef9be2f-b6fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677543431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543431, "uuid": "65417066-f646-471b-bd5d-272a41aefce5", "comment": "Malware payload (Mirai)", "value": "8484cc8380e3700138495e64601b8ade", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543431, "uuid": "2b125d97-25ea-4f3a-acd5-8e30abe95da7", "comment": "Malware payload (Mirai)", "value": "5106d1684290e7cd1d155948009468aca0c3c5dd369d25a18b986b3beef745ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543431, "uuid": "5371f8ba-5569-42d8-855e-8e44acd62916", "comment": "Malware payload (Mirai)", "value": "d8941bcce4bcc685d8abcd8ed5a5928c55d7b1b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543431, "uuid": "4416ea09-72f7-46d8-bd9d-fe1d9d0b7ab4", "comment": "Malware payload (Mirai)", "value": "0a63a5a1ab49525eef8c28b3502c2b54df06a012e7fe6482c1d1d4fbd1d216c636c43dd67505884d597f16881df87bdf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543431, "uuid": "9d93d342-e5dd-4971-b6b6-b51dee670893", "value": "T1B7333ADAB902AD7CF98BEABE80120E0AB23123541053073777EBFDD37E321549956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543431, "uuid": "0ae925ff-2d3b-418e-9735-b2612394c175", "value": "768:mLGOe2kf9e9X9nbenyIvvch9QnAs5gFHviPuzWeHXpi2UJTpDnH638gp:mL/4f8F1ej0wYFvimzpZi2UJJnHY8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677543431, "uuid": "15064066-0a4a-4f3c-a829-33e3ecdb4ffb", "value": 53056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677543431, "uuid": "0c1776e0-41a8-466e-a6f6-0d8ac72c9f52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543431, "uuid": "3c3432cd-f964-4124-9fe0-a753f9cc97de", "value": "8484cc8380e3700138495e64601b8ade", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74c0bfd-b772-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677593965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593965, "uuid": "5c61c6c5-6fd9-4124-8047-685f4252e7e6", "comment": "Malware payload (AgentTesla)", "value": "1bc1c0679663179abd828d24b8f26989", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593965, "uuid": "23f5a750-ff35-4e2a-a17e-894d62e35bae", "comment": "Malware payload (AgentTesla)", "value": "51a4fb3b2148da43d34a86a9af619af67ff8611f8bb7448e4edcb9d3207ca1b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593965, "uuid": "aa074df3-f120-4a01-9857-79f3e5f23683", "comment": "Malware payload (AgentTesla)", "value": "4b079342ff5557fccfd0bff56a4cf2a968c5d707", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593965, "uuid": "933f236e-ebda-4aae-b725-319793752fa1", "comment": "Malware payload (AgentTesla)", "value": "0fe8786ee0cd242c6197f9c2603d1d498679da33205e4a69edb2cac1a6f46bd8cf97fc690228f226a2215e41184ee0ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593965, "uuid": "4eb05816-52ee-4ca1-ba44-4683560576df", "value": "T14F45AE4853B344B2FFEB11A51865228C4EB872CB3585F21B5F673751A522AFFB29F402", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593965, "uuid": "3fd2b32f-ca2d-4866-98e0-216ff2c225c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593965, "uuid": "abd8e5f5-848c-42ff-a650-f27885bca9f4", "value": "24576:7FgmeTuCA6/+oGHQl1yyQqvednkTxFy8EFpZkAsfx/6qW:BgmeTua+DHKyH0yFpO1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677593965, "uuid": "613ac759-b72e-4f70-9799-94badf4e4f8b", "value": 1198592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677593965, "uuid": "6c271cf2-dd12-43ea-ab5e-5ac1d31cb527", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593965, "uuid": "c9afdf0d-2fc7-460e-87b6-6521052bef1a", "value": "payment Application copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a86b7a-b754-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677580728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677580728, "uuid": "307eb438-1cb9-4540-867a-36adb549ac41", "comment": "Malware payload (Mirai)", "value": "bf5d36c1f5f5f08f74bd1f508ffa2c10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677580728, "uuid": "838b339e-b941-43b0-8d91-ca0ab53f8f75", "comment": "Malware payload (Mirai)", "value": "51c700bbd1e77ed4a1e2ca3a4721d82f684692cfc5d00ae2d755e1c14229e1cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677580728, "uuid": "53d269b0-9543-4398-a102-9ab3d05b46dc", "comment": "Malware payload (Mirai)", "value": "92fec881ed3add29434822ece2baa15cf1156beb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677580728, "uuid": "372e0825-9dee-4917-8354-40683f02381a", "comment": "Malware payload (Mirai)", "value": "ba07e88b669372abf4898642ea40c872005cad8bfae2a0b20cb7b14224cc515c85bea074bae9c51721facbbf3caebec6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677580728, "uuid": "1736f594-5ff8-4464-abe6-c10ec381eb86", "value": "T1AC4364C5AE537D7DC3C2EBF6EAABD14532D78744D3972382A0D90BA0896FC89091934D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677580728, "uuid": "7eaf8b5a-6af6-4b19-8a19-7b30455ccf0b", "value": "768:q/M8YI05MPs4Wey4dXtnzV3nnwCVy/zO5HshG1bWw/prIibf6kCtjBObEZQqdH28:q/Mp5GIKz9+1nJqX78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677580728, "uuid": "b3211613-2a71-4f37-8611-2e8bc64794e6", "value": 55773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677580728, "uuid": "89d9ac6a-7122-4a4a-9ef7-0530c1f06fb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677580728, "uuid": "86df4e13-c721-401a-83d4-7ba06e4e34ea", "value": "bf5d36c1f5f5f08f74bd1f508ffa2c10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b67888-b722-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1677559253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677559253, "uuid": "1fcbd9aa-d871-45d3-a6a0-7a7c78960aa7", "comment": "Malware payload (zgRAT)", "value": "438b8952d3f237d76722c3a9dcc6a145", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677559253, "uuid": "10f9d626-6047-4c33-aac4-0b91ba33e78a", "comment": "Malware payload (zgRAT)", "value": "5387544baf398785c27d5040a508073232dbb27a57a0d8b97896abc117b9cc84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677559253, "uuid": "8b7aca65-302e-4fef-b510-3775396a2b2c", "comment": "Malware payload (zgRAT)", "value": "5df9226b0ca07b0343be11fb5c46060ee7860550", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677559253, "uuid": "a61c368b-c26d-4234-953b-82c145fc2eaf", "comment": "Malware payload (zgRAT)", "value": "e67adcb806fa3a326e28036532a647ac68a9ee0f52ba1ae6b2a38a4832874879cbcddceec5ca29fbf92ddaa45783d141", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677559253, "uuid": "94d885d5-ea76-4abf-805a-db438701ff37", "value": "T1AE152282762BD4EAC1134572FDE37F612B50DAA488C7231A689AEC77690BBDC3D444DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677559253, "uuid": "0c531058-45c7-4256-a5a6-7e30e69192cd", "value": "24576:JjICGH5u03CrFOgJL/NPnPtlWWUrVq9L3/9:VIVHPvoL/NPPnWaZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677559253, "uuid": "37207a99-361e-4e74-9b86-e94783a4bceb", "value": 907776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677559253, "uuid": "db2b56ea-f18a-4499-80d4-ddcf3bd6dc19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677559253, "uuid": "78103819-1873-46dc-91cf-83bc4eec367e", "value": "438b8952d3f237d76722c3a9dcc6a145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16575e5d-b70b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677549376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677549376, "uuid": "ff27eb96-57e0-4a54-be88-75c8d8ce2189", "comment": "Malware payload (RedLineStealer)", "value": "0a0189e813291ae80e9b37d2f1a66937", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677549376, "uuid": "96fc45cb-cff4-4b5d-a58c-70116a757d51", "comment": "Malware payload (RedLineStealer)", "value": "5574de6595712393c2c7424df1828a0c1b58a050b4e9c7936c06c1aa6aeb69da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677549376, "uuid": "2fc24c86-2f29-439c-9a3c-670102bd534f", "comment": "Malware payload (RedLineStealer)", "value": "fd2949ab1f99d362bd898dfd9b8c9a7893f117b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677549376, "uuid": "ed996731-5496-4fed-9b38-405bb9e2bc44", "comment": "Malware payload (RedLineStealer)", "value": "68f6a3604878dab0cbe6864486ffc51ae6b5d9a1135c5126136cd7df3d074ed40bf4de440cdc1792e74553b6bc42a5ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677549376, "uuid": "ce5da872-d843-4a6f-8fdf-f7d6bd9e5a7a", "value": "T1A8C40247E6E88036ECB54B7018F643D30B357E615A388257139AAC1A1DB2AF4B27177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677549376, "uuid": "5b99514f-6ec9-4c9e-98af-a8def533b7c8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677549376, "uuid": "bce90992-7de2-4b2d-9c17-71e41831b695", "value": "12288:gMr/y90tvIYI8Vzvn5gMm7VoOLXKVFn0ZF7etSCE9sK3Zl:vyZF8Jv5TmjX8tSsK3Zl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677549376, "uuid": "fc663445-b912-4d1d-babf-64132c52a816", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677549376, "uuid": "ab921ad4-fbad-4180-823f-332ca2759da2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677549376, "uuid": "b200f1c6-ce30-4dd9-be3c-0f2585ab6804", "value": "0a0189e813291ae80e9b37d2f1a66937.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385dcb44-b741-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677572626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572626, "uuid": "cf3c128f-7cc6-47ea-bbb5-a2094e721810", "comment": "Malware payload (AgentTesla)", "value": "6f2f58821efaf703ce41f8b94a231e54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572626, "uuid": "19006f4f-4276-43ef-b6bf-8d1be704370b", "comment": "Malware payload (AgentTesla)", "value": "557d0d47587e8d23fca2ae3d299c64b44092bc4466a11d30b14085efefbce8b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572626, "uuid": "dcd15d88-33e1-4a80-9f90-288035519658", "comment": "Malware payload (AgentTesla)", "value": "ee7ea4c43977d335c52de2645ed1772744382493", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572626, "uuid": "ccc279dd-43c8-4dfa-bcc7-abe2ee4f44e4", "comment": "Malware payload (AgentTesla)", "value": "47999be497ba5330b790592d0e6a113949e0b0eaa17fd684194bc4e1bf5dae5457541a831a42bc14c2822f54adc4ebd9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572626, "uuid": "2c2c6f8e-5974-4e60-990b-f800e39672b4", "value": "T12B15121927958A05C388DAF190E3696507EAF14F26B7E38F3E4E90944F427FC694A3CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572626, "uuid": "c88f0643-9cf8-4c4a-b7c7-2a3f12674b59", "value": "12288:b4FzZXbb6k/G6D3Judo0au8CdWIw8PWPXT8qCBsXgEpMunFcx38sRVWwDXQvqfi:UBZrv/Ge32jVdWkzq3TnC8IVjQyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572626, "uuid": "07ccdc00-1f9e-48c9-ae3b-f411d0206b55", "value": 913480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572626, "uuid": "31100b2c-1070-4b92-a408-ac3e826aa78b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572626, "uuid": "4ba5e5f8-7b70-425f-a956-9dbe558da86c", "value": "e-dekont-20230228.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e139213c-b7b8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677624019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677624019, "uuid": "97882abe-4e9e-413f-bb64-216079adb4e4", "comment": "Malware payload (RedLineStealer)", "value": "c787b7712afc98bc7242d8d8adcdb790", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677624019, "uuid": "6dee211b-92e9-4f91-bfdd-042bffa40160", "comment": "Malware payload (RedLineStealer)", "value": "56144143f531340466f958339038a80288473e4cf073eee82955f0b866b4106b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677624019, "uuid": "b9956c0d-76f4-4178-82c1-6e739730d57d", "comment": "Malware payload (RedLineStealer)", "value": "0523f42ccd3d49fe12d0aee2e50c02e337b71e5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677624019, "uuid": "5805391b-94af-4d53-8a44-ceb46de455ff", "comment": "Malware payload (RedLineStealer)", "value": "32f87477fcfe20cb885c9d9d046b3acdcd7726670a3ae976cf77c9463bd9fc7aa901308f59e4906130cba4ff7e1636cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677624019, "uuid": "ec3df194-a25c-47a9-abd2-afbe478d37f8", "value": "T1C8C401036689AF93DA3D06B280232C516BF69C129501FB1F7CC931EE19F6FC10B16A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677624019, "uuid": "410abdcd-2f7c-4be9-b5a8-066dfd040aec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677624019, "uuid": "c67ecde9-b9ae-44fc-bf77-3abc60382310", "value": "12288:sMjmOVDf3DES1C0MYxO7MOitKKRK0spGZ:sMlD9CIwlifK0spGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677624019, "uuid": "2979b153-d874-4c9f-8b72-16fbd6124307", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677624019, "uuid": "c48b51d9-f876-4327-91c7-9a49fc50720d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677624019, "uuid": "2a6b3a00-3a07-41ce-b9b4-a624592014a2", "value": "c787b7712afc98bc7242d8d8adcdb790.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0960b26-b7b3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677621817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621817, "uuid": "3aae3afb-4ed2-42cf-b141-1d1f1b628ba5", "comment": "Malware payload", "value": "e4266866858a0df7c219b76ef3583825", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621817, "uuid": "11f12737-5023-4e6f-9080-6c41f2288916", "comment": "Malware payload", "value": "565092806576e8ac3b4d249e58f84bf91411d38d3c9c68f070d20550f55d1d1d", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621817, "uuid": "4fbba6df-27f5-4903-ac71-66fc49a57b45", "comment": "Malware payload", "value": "8303276fccc97326a817259d2879f7823745457a", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621817, "uuid": "8bcb3054-e4c5-428e-a729-0ecbf39e7fb4", "comment": "Malware payload", "value": "7b00b062f34369fd06f35b87892f9bed16b043e56d687de23b6b83266fd3113046242a610a8287d151bdc14d60346eb3", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621817, "uuid": "05b4fe90-09f3-407e-804c-ddd33573c954", "value": "T191B40143AE83C1A6D5064A72FEE23F421B6196F6D8C7610319EDECE0764F78A38090DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621817, "uuid": "4e575bc7-127e-454f-bf95-b820102f95bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621817, "uuid": "a78e1a2c-a53a-4fba-bb5a-e67eefce39ef", "value": "12288:oJozSTdwSGyhaNZQWQj4PMPErMvOGyyNlftRL+:yZ2yqQb8kErMvEyXVRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677621817, "uuid": "5821e9c4-030e-4c8b-a1fd-3effe2d08117", "value": 515072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677621817, "uuid": "a9226e1e-defb-4bba-862c-e6c8ba129ff9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621817, "uuid": "e3ce7346-0c2b-47aa-bebc-8ebb41b0ca4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd38dc8a-b704-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677546676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677546676, "uuid": "7d428386-1c8b-4a96-bd56-67d32f732136", "comment": "Malware payload (RedLineStealer)", "value": "292130e8d0edb79f53a28ba69b5b924b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677546676, "uuid": "5b181b1f-4107-4213-af84-dd360c2507e1", "comment": "Malware payload (RedLineStealer)", "value": "565b5c55be6f6433f28290b2b7fb190ff371be9b4ce4922054f73a94f979d075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677546676, "uuid": "f603ed62-9b67-4a9e-a4ca-78112271d642", "comment": "Malware payload (RedLineStealer)", "value": "a9115231fc924b86a4eba1c590878cebf221edf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677546676, "uuid": "135d39b3-6068-4c9c-b356-11967ea56e29", "comment": "Malware payload (RedLineStealer)", "value": "4c4d1996c77f55355e65b684e15635c0d6e5cd7cbef05d9b4e29ebf378ccb87fecd52b026aad9faf0e39b98841e5133e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677546676, "uuid": "b6666ede-8504-41ae-9b00-7bfd85395e16", "value": "T1A4452347DAECC562F660177418F706E30B39BEF02D31935E279A8C5E1D731A8A13936A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677546676, "uuid": "643d258c-309f-43ea-a4ca-8af21919a571", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677546676, "uuid": "48c29e72-5e63-4317-ad8a-dd6d30e6c682", "value": "24576:eyWMLia2yHzC5bll9A5ykoSOqRi7bEhF9fBWzT:t5l/HzCBll95yOV7bE/ZBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677546676, "uuid": "f95c9120-6dc7-40b5-8040-7ef542d58280", "value": 1166336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677546676, "uuid": "8b8767f0-1bb1-48b5-8650-7ce6c16d2fbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677546676, "uuid": "58b07fe1-e905-4fa4-b0f4-6fffb9b28e45", "value": "292130e8d0edb79f53a28ba69b5b924b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bdf5f41-b771-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677593382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593382, "uuid": "b0945776-2e0f-474d-b561-71e4097ed889", "comment": "Malware payload (RedLineStealer)", "value": "5920ee45742387dcb5559540b953c3b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593382, "uuid": "fc19895d-81f9-44fa-93d7-7f4ed413408b", "comment": "Malware payload (RedLineStealer)", "value": "57aa83c1093b146313786986b0e1b712ea2a53f0d0c95e1125df1313c0c9bba3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593382, "uuid": "dbf0dd14-39f5-476b-b1d1-8b976e11b803", "comment": "Malware payload (RedLineStealer)", "value": "f778ab90c38a9fed1c2ca3b77a7abc500c7d3127", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593382, "uuid": "36369e1d-1c06-49ca-af97-23f2afb63043", "comment": "Malware payload (RedLineStealer)", "value": "752ede4ead133b52a63c0e433451b546916c07ed71121a5359e46a874c41aae18f25120467df2f4c5f026f0da572991c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593382, "uuid": "431485ee-9186-4072-9c2d-d9bca06bbb82", "value": "T1A884F1013681C072D74741B45936EAE8AE7B78BE4759C87B33543B2F3E70291AEB6217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593382, "uuid": "69beea63-223b-4b5b-ac26-8a418cd4092b", "value": "a66ab37f013146fbca029fedb3c9defb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593382, "uuid": "defc82c9-dc74-4e72-b091-2d3f6c391590", "value": "6144:aLLIasQ2FJKReMQTX6kI1aQRED2DkbGeouV8FNDY6o2:kwQstMiXDPQRED2iTouVG+6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677593382, "uuid": "6b378a6c-42c9-4dee-ad50-0128b2a2be4a", "value": 380416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677593382, "uuid": "6ee4d981-96de-48f4-95d9-86fa9ad91904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593382, "uuid": "9b16cc53-f284-4ade-9ac9-a7bf1128823f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d0d1d1-b706-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1677547233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677547233, "uuid": "2b52ab04-d35b-4a23-b3a2-0691fa0eacdd", "comment": "Malware payload (CoinMiner)", "value": "dae65cdd910167bdf61d4c019e8f139f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677547233, "uuid": "2980ed6b-ebd5-4aab-97dd-9eea40c79606", "comment": "Malware payload (CoinMiner)", "value": "57c0a9a19646427caebe78e8f7cd16f952e9b1be35e44d49a382f1e078645f41", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677547233, "uuid": "5203e4c3-a22b-4e38-af04-35a1b53c68be", "comment": "Malware payload (CoinMiner)", "value": "fb92624385ac89067a3aa9540658bd8faf34c201", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677547233, "uuid": "48c4992f-0ca6-4bb1-be6f-896ded8410c7", "comment": "Malware payload (CoinMiner)", "value": "9279157d1c7bc6ea2c95d579a078d0204217ecf44fd1491118abce1c59c5b3ef131ca146daa4c254cbda614f258296a9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677547233, "uuid": "5fb91c22-daaa-4040-a126-14c02adaa94f", "value": "T1FF14AE923290EC31D4361631DD6DC6B46B6EFD618A785AEFB3183B2F0E741A19673702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677547233, "uuid": "636eb4e6-b8c5-467d-8da9-5b357b9c3a8e", "value": "42540a9ca466c55bb4a1cb282423a3c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677547233, "uuid": "97df99e2-62e3-488e-a6ac-dc0a211c6a15", "value": "3072:AH0XBeJKdgDhX285vOrPwhzhECz1LTaWibDGgrzfqx1GD+Z:a0xeKdMB52rPwhOMVTgbDxrzfE1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677547233, "uuid": "9224a028-7901-4cb9-9108-bfcb1a59c8d4", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677547233, "uuid": "f28062b9-a763-4cad-ba1d-36a3c7ace525", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677547233, "uuid": "5a06db84-3f8f-4926-a8d4-93a94c1af103", "value": "dae65cdd910167bdf61d4c019e8f139f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3916668d-b733-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1677566614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677566614, "uuid": "b989c105-7853-4312-8a13-de5564e78a11", "comment": "Malware payload (GCleaner)", "value": "9a2a5477cd003ae4aa14cc461c1e73be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677566614, "uuid": "381b923f-9cdd-475b-b1b8-db55f45e4604", "comment": "Malware payload (GCleaner)", "value": "57d1efb1caef7b6c2110a578114000fe949b48004f5eb380c3a09726c0952304", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677566614, "uuid": "85cef472-89f3-48f8-bf0f-03b265d891be", "comment": "Malware payload (GCleaner)", "value": "394b796a3d876de781f9690f8f6bd2ad82023f76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677566614, "uuid": "03795fed-b838-43ba-b21c-b44936e847d3", "comment": "Malware payload (GCleaner)", "value": "cf5bbcd947a391ead2baebfdeb682ba7a5084c7d7d46bdba1190d829a6dc9de0e2c78269b640d970bbb68d4e511ad20d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677566614, "uuid": "d9fcd0b9-5f3d-4560-be49-8493b7843b0f", "value": "T165D5334A67919BB9F3810B796C2F24522EA27463B734AA867B79C78F0337530D308F45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677566614, "uuid": "774cf806-9f83-4f11-9119-1db969f4088f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677566614, "uuid": "c77dc5cd-8a95-4439-96d2-353dd65ba248", "value": "49152:AGA4QwQW1g2BLaVPSocnIejMUeH/c1IR2CKJus8krT7d2ml4BAl3aOKz:dA4QwdCPPc3MUek1uTKJttF2m6rOKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677566614, "uuid": "a0099910-0051-45c9-94a2-67d52225385e", "value": 2834413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677566614, "uuid": "b46526d9-a591-4b96-a47a-9c954bf1fea0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677566614, "uuid": "bd69e940-d467-43dc-9ece-fbc5dc1a9a80", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104b8c12-b7b5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677622380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677622380, "uuid": "97407c07-c2c1-42dd-a436-706790dba2d1", "comment": "Malware payload (AgentTesla)", "value": "7f1b58a398995997b2807c235a5a2769", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677622380, "uuid": "262e8061-c44c-4aa1-92d6-3459139abb5a", "comment": "Malware payload (AgentTesla)", "value": "59881fd0b6ff879c3e30f5c581ba0724fdb854176893af098333f8cf13222f9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677622380, "uuid": "2bd7aa55-e0cc-4d92-9bdf-a21c8134e04b", "comment": "Malware payload (AgentTesla)", "value": "a8bb2b0216403ae862fe5a8daad5fbe08c73025d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677622380, "uuid": "e2e32a9f-cd01-4d20-aa51-6478e84cbd8f", "comment": "Malware payload (AgentTesla)", "value": "0295ed48aef69cede37582cd3a90a1baaa0299cd8b8f12b7ac5a5ee0059cb2972556453b090b43f71023462534d7f593", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677622380, "uuid": "ee7b56cb-7a5a-449d-9089-d90b1dfa73c9", "value": "T19345AE4853B34472FBEB12B51875228C4EB872CB2585F21B5F673751A522AFFB29F402", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677622380, "uuid": "5da7f780-8807-43a0-8baf-0db3ff3fee4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677622380, "uuid": "9ad223a8-b065-494a-9a0f-e9a1e74e25e5", "value": "24576:IEgme+uCA6/+o9x/6qWXtJkR3fNgat6bh7Gg9m4f4vh1rb:zgme+ua+W1BItuzt6bh7Guf4vr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677622380, "uuid": "10fbc1e4-f1d3-4d6b-8c92-bf3d66e99701", "value": 1197568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677622380, "uuid": "6dc069a1-b921-4e62-bcb3-4d6cfa9779a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677622380, "uuid": "b866d80f-4dc9-4c76-a701-9325574472d7", "value": "SPECIFICATIONS#515050.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3aa198-b757-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677582192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677582192, "uuid": "b8d670be-3189-4d36-9b2b-0aa91d6d962d", "comment": "Malware payload (Mirai)", "value": "ed7e3167fc3488b3106660a8cfcc0f2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677582192, "uuid": "aba678e0-2f73-40a2-9d5d-30ec67250bc2", "comment": "Malware payload (Mirai)", "value": "59a887318db289d5252e728643629ac4849f0300b4322646094151f4e228e593", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677582192, "uuid": "ce6399da-baa2-41f8-977e-8b1fc73d482e", "comment": "Malware payload (Mirai)", "value": "7114e0928f14ad270d3f46b50f9a26dc61b3ddc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677582192, "uuid": "8c7a4a75-25f4-4d4f-84f2-da64bc982ef1", "comment": "Malware payload (Mirai)", "value": "e40d7111c17a0332423eda4a917148fd7701f48003420c08e0177428274d04f1fded2ebff0b50e43cefe2c8af8224b0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677582192, "uuid": "8f49037e-c797-477a-b4b7-b0df5e2e6af7", "value": "T1E123C4CA9F533D3EDAC5FBF0E5A6EB4425E6092097930246F2DA8D50993FAC4385934C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677582192, "uuid": "5b0534e6-5e7d-48ff-8552-f1856bde604a", "value": "768:ehJtuuSEHNCO38OtqRjflXtiho/kVO4Xr/GV:amuSEH/WLXi+2/GV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677582192, "uuid": "37bb4a4e-f6e2-4aa8-ac7c-7f05e8ff178a", "value": 48119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677582192, "uuid": "64ac59fd-cd01-43c8-9e80-e05adc77e499", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677582192, "uuid": "a5d96ee9-4e48-4852-81a8-8dd949f5bb94", "value": "ed7e3167fc3488b3106660a8cfcc0f2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093566e4-b782-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677600464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600464, "uuid": "2a1091cb-534b-4124-aafa-54b2eca3ecd2", "comment": "Malware payload (Formbook)", "value": "f9fd49f28204d58fe67ec08c7e8a0815", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600464, "uuid": "c95ede94-1bfa-4850-bd16-16238f7dc4b7", "comment": "Malware payload (Formbook)", "value": "5aa47f37d752f2be0e81960995899ad5a4a42cba75b045c2232942524ef6c9f6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600464, "uuid": "22e8914d-c2e3-4719-83b2-a2e321c359fb", "comment": "Malware payload (Formbook)", "value": "2c7d6590f7a2c6f3e545b4ef8e107416728c2bf5", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600464, "uuid": "f80ce82b-ed25-46ae-be53-ab25aea305e1", "comment": "Malware payload (Formbook)", "value": "ae4adf2eac22524589edd123e418cdf6a5f27e1b34748a66b7c66dc7445f4721453c402cce753fe62704d89b218c20b6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600464, "uuid": "6209ca52-73c6-47c5-ac78-f7f26e906231", "value": "T1C405121AE7819877E4135438E088609391186CBBB641DA4F32D6776F4373FB24FB9E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600464, "uuid": "dfa90c3d-ece3-4f4e-aab2-6202fe5ec911", "value": "24576:WXm94JPiFeOVEezjIlmwiJpg8W6d26qxwFJty:WKeidaOiVE2dwFJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677600464, "uuid": "ed8afb0d-82e3-404d-bbfb-40c21a8ba8f2", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677600464, "uuid": "95cd799b-d217-4ef1-9efc-6a45eda111f0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600464, "uuid": "8373bf4e-4800-4fbd-a829-e0d42d5987ea", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f18bb4-b786-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677602168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677602168, "uuid": "dacbfd32-f1e7-4b27-abc5-8e90cc3c199c", "comment": "Malware payload (RedLineStealer)", "value": "da4360b12f0f88c9b17d67c96505e4c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677602168, "uuid": "c6b99c44-e44c-4911-9e7f-5c1103adc17c", "comment": "Malware payload (RedLineStealer)", "value": "5bade268b67fbd24241fbc7759697cf2515dc54f4812ffc753e12a3db23945ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677602168, "uuid": "2d54e10d-1e4f-4b8d-a19a-6be601dc6e4f", "comment": "Malware payload (RedLineStealer)", "value": "1cd70d78a30236f05e0cef16da51df1ad7f77d1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677602168, "uuid": "648d99fc-db13-4a1f-a275-5fc1b0f14e2a", "comment": "Malware payload (RedLineStealer)", "value": "04c05a11dee2cf4dd85445129a9647c6dbf4526b34ad13d0c9eb750684affad24e9b327a78376fffe7789f93fbf8d873", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677602168, "uuid": "2b8ca222-8f4a-42c5-8ae6-f32b3e5202bc", "value": "T10C752601B5F38025C86F1D7534A8FBF1AE3B79D0466D39BB23C816EE2A6C780916C575", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677602168, "uuid": "d2b11dee-c5f1-4be0-ab46-3d737f4383f7", "value": "17e63e07e252d3a78f45635bbeae878d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677602168, "uuid": "024e3c25-4295-41ea-b985-db090beb40f0", "value": "6144:dsGMTIQl2t9xKQzAAOf6yqTmwMCWE3rlPl:dfMTIg2xANYTmJC/Pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677602168, "uuid": "8dd41e05-e5cb-40e9-b768-879666bf2632", "value": 1565184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677602168, "uuid": "bd48235c-f3aa-4182-b490-6dfed7cc26a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677602168, "uuid": "a19465e8-7366-4bb6-8110-fbdef423dab6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5997f713-b73f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677571823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571823, "uuid": "e7a4d51b-9102-4c9d-ba39-3d6fbbe4c4b8", "comment": "Malware payload (SnakeKeylogger)", "value": "be55db5216c26b549a45f928108e28af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571823, "uuid": "4d19c3a9-36db-4928-90fe-78ba223644fa", "comment": "Malware payload (SnakeKeylogger)", "value": "5c5fd777f5614ffbb6c05c6fc6ade0bf259dcef62f4865d39bfebb16050f3e4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571823, "uuid": "617eff9a-6d3c-4697-b3a2-3b9c16ce0482", "comment": "Malware payload (SnakeKeylogger)", "value": "0f2cf7a9093fb1a6ab802af6ea3ca2456c2ceaf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571823, "uuid": "08be7265-1316-4da9-b221-800474251640", "comment": "Malware payload (SnakeKeylogger)", "value": "fbf98c0d2db5ff6a57e2ffb43e401d260c63c3291822edd0628f243dfea42aed96fb9f86f21a7d5fa00a11bc4fc05662", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571823, "uuid": "6f00c26f-2dfb-472a-ae2b-bcb61a18b06e", "value": "T1E994F197AA5BC6ABD00653B3BEE23F011F1085F298D7611215AEECE4654F79A3D0C1EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571823, "uuid": "4c4ce68f-2972-49b1-a60f-ea6c6d46795d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571823, "uuid": "c56bc72d-aa62-49d4-85b1-2653be6b82eb", "value": "6144:tz/oapN9b8dR50LLzJnAfBml2QCNNycT01lLAUQhWbTOpkRvIJX:NHp32c39AZ0LANynTLAUQaYkxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677571823, "uuid": "4b131a55-a71e-47bd-a5a2-8e5944a99913", "value": 445952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677571823, "uuid": "f7857002-129d-419c-886d-d64f96fd7dbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571823, "uuid": "07560a0e-1eb2-421c-b7b9-5f64ff99b1cf", "value": "Consignment Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c20c6933-b7b6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677623108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677623108, "uuid": "c7a9f915-a800-4e52-9611-6977a54c950a", "comment": "Malware payload (Smoke Loader)", "value": "cefb18d7fe4fbd36bcf83b46930298cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677623108, "uuid": "a271bce7-623b-4c3e-a2bb-e9d3eafc5ac1", "comment": "Malware payload (Smoke Loader)", "value": "5ca0e870b471602e5a5fd8e99d7e1821f12bcdccbd86bfbb240627895ad36419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677623108, "uuid": "780b9ffc-aad4-4b09-a6df-ff50fade0437", "comment": "Malware payload (Smoke Loader)", "value": "b88ca43ef509de9ec235aad496793715553cd61e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677623108, "uuid": "ef4cf4e0-f410-4d6f-9de2-cd653bf3c5b5", "comment": "Malware payload (Smoke Loader)", "value": "9f552078114528b7048b8dc3e965c8340cc2882a8bafef3748f29b6180540723d54acb3ef40f46dbf2b08e9b083ec04a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677623108, "uuid": "b4cd6d39-d2f2-4cc4-af5c-f7644cefdbc2", "value": "T10D76E122D300705AFCA20076E53B2AF6B6746630638195FB93D5A9C53F726E1FE36943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677623108, "uuid": "49704cca-20a4-413f-a099-320a254af3ea", "value": "f9644890a52aa13e3e994733d15fcb99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677623108, "uuid": "ac24cda8-5581-4fb5-9f6b-a9453f43af33", "value": "196608:9dJpzFkyz68/3vLrZxGcxZ/4F5tIBRvukMugxsuVgrGaZ9kx2:f1P68/TGcxZ/3ujHNV4GaZ9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677623108, "uuid": "7875bd68-dddb-4db8-bed4-fffa5efc0e86", "value": 7597056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677623108, "uuid": "99a8a5a3-87fe-4780-9e02-7f3ffcdbf46b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677623108, "uuid": "0ac6ff20-b088-492d-a8ca-0d65f2c89ef6", "value": "cefb18d7fe4fbd36bcf83b46930298cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7688ce-b737-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677568336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568336, "uuid": "8f8d6081-950f-43c8-9bca-77472808542c", "comment": "Malware payload (DCRat)", "value": "9c33b7436a997d5bfb2e934f0dcb2786", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568336, "uuid": "95f384f9-459d-4a07-be54-63e93a4c5fd3", "comment": "Malware payload (DCRat)", "value": "5ccaadfe92d764f0088bdd04b2d2373b883f412c11825d62e7505340e88123bc", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568336, "uuid": "f76ebd9b-707f-4418-ad2e-f53f49a3afc2", "comment": "Malware payload (DCRat)", "value": "cd41b7c06bbf1743311b01e9c00dc81b4010c0ec", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568336, "uuid": "334c4fba-4ed2-4ae3-a8f3-87fe4543b645", "comment": "Malware payload (DCRat)", "value": "a1b42f1e693b4a0a810b64e545a238773ee4fbbbbae120d9919b6cd3654dd6b868141327d6d028c13d47a03cc0dcee9b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568336, "uuid": "b1d34fbb-48f4-47ea-af23-9473af10b30a", "value": "T1F44539027E44CA12F0085633C2EF454887B4AD526AA6E72B7DBE376D65123B77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568336, "uuid": "7680fc91-4c94-4489-8850-6f31fb2273fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568336, "uuid": "f69de856-83b0-4756-827a-59e453d8ea35", "value": "24576:9rdxNRewBHRKwoOnZT2J4BfAvXbxqxWWlisRsNi6OppHOu:9rnHerwTnfW6WWQsRLpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677568336, "uuid": "e791bf55-f56d-4aef-b9af-5e968bfec80a", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677568336, "uuid": "e59c08ff-050b-45c2-880b-9ec714fc4cff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568336, "uuid": "4fd74ca2-36a5-41cc-85ba-81c74ffd60d2", "value": "5CCAADFE92D764F0088BDD04B2D2373B883F412C11825.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e608c517-b736-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677568193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568193, "uuid": "328f45a4-7b4f-416a-8d40-2ba0bd664238", "comment": "Malware payload (RedLineStealer)", "value": "326d4889c7a8c79cbb7625e0ad57339a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568193, "uuid": "36656fe5-ca9f-4e10-be15-9447334285af", "comment": "Malware payload (RedLineStealer)", "value": "5d4ce68169234b19e4ecd154bb21d7c147e9fe422b8085bb57e35d6fd9a110d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568193, "uuid": "b89ec819-3821-410a-9441-6b8c9693eb3d", "comment": "Malware payload (RedLineStealer)", "value": "801c711a6430992d724e58465399fef0c297ee10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568193, "uuid": "3515688c-9858-4c6b-8253-8a16aa6b433a", "comment": "Malware payload (RedLineStealer)", "value": "45a2ec5b117d5e7c3c1cf7964aab7c50b95619cfea32531a28cc1d9ec68733399b90add6950d0cac4a139e0380677bfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568193, "uuid": "6c5efc02-7a6d-44de-9173-0bd8efefbae0", "value": "T14184F1117D50C4B1E402F5749524CAA8EEBABCE19745BA8733087B7F2E706A147EE362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568193, "uuid": "ae822a23-6a20-4a6a-ac9f-fd8e725377bc", "value": "f192690a5206debc62d28b9f6b6694b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568193, "uuid": "65c28cc8-4166-4c3d-853e-153fd1031969", "value": "6144:iGLQE3GZ8ZeMnaDU0HDDYrrajtVcXgF7P7E05nfp1:iGEEWCZeASDDgafcXAjb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677568193, "uuid": "954aeb62-91c4-4724-a736-630dae20c40c", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677568193, "uuid": "b8a95714-ad15-44fd-8600-55e914fb121d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568193, "uuid": "9b89db2b-d00d-4683-9ae9-55a9e4d36581", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c37263-b755-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677581374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581374, "uuid": "0ea01805-0ee5-4a3c-a65c-80eebfbac017", "comment": "Malware payload (Formbook)", "value": "81c49f86b919c3c9b15d15c4890bde3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581374, "uuid": "9ff85f2a-a670-400f-8111-7130a2c0892e", "comment": "Malware payload (Formbook)", "value": "5e517d06a3b252c0bced1ed16f1741fa73b4e0d4b81ec2daf71b57954604afc8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581374, "uuid": "3a6bbeff-0c33-45fd-909a-64a600ad7761", "comment": "Malware payload (Formbook)", "value": "79eeadcecf430ef3845c416fefaf399980667589", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581374, "uuid": "666f91a9-c650-4ef0-96cb-f2cc8c473ef4", "comment": "Malware payload (Formbook)", "value": "fbe930421ab9d958e8fb7a407907fdddb3dc1978660f7fb615e6025b1ca84fab1a2bbc4bb228677f5b0b30c71bc37877", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581374, "uuid": "aa5c9130-5cdf-4527-8b9f-b9867170b2bc", "value": "T12554129097D5D80BC4619A729D7C028E9BEBED1654FC8307B3B88F1DFC50761A90E3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581374, "uuid": "56ac924a-1626-45bd-ac27-1105f8e104f6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581374, "uuid": "db5b262b-1b5b-48c3-84fd-410af36ef598", "value": "6144:DYa6O1OoBgLDcXRikTfafrGbsi6uoloeJPAvW3K84wR91uID:DYs1OoSLqXVs2EoVW3pvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677581374, "uuid": "2a47cb78-153c-4636-a119-6a7c156aa02e", "value": 303814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677581374, "uuid": "7c514251-7af8-4958-9eb2-3defd925eebb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581374, "uuid": "33e1f100-c97b-424e-80ed-30d06bab31c2", "value": "81c49f86b919c3c9b15d15c4890bde3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81d4759-b788-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677603442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603442, "uuid": "460f52c2-3fc6-4e88-bc43-8e0ff31abdd4", "comment": "Malware payload (RedLineStealer)", "value": "25d5d34f99e405fbb0706ac641410209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603442, "uuid": "fb184c9e-b50d-495e-aaac-fffb448160ec", "comment": "Malware payload (RedLineStealer)", "value": "5eaf8796f3db7a20b37155f03271b84333e6d5d6bf606d484917af3293946ded", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603442, "uuid": "d925f3fd-fa04-42a9-91e7-987961a610f0", "comment": "Malware payload (RedLineStealer)", "value": "e8f088b2a6c8bc96a03023eef5f713fdd3c7a2a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603442, "uuid": "f2aef75e-dd1f-4130-9d86-e28cf29ec023", "comment": "Malware payload (RedLineStealer)", "value": "999717aa26065c61fb504a9481bfe12adfc8677ed5b7650b6702d0f081cf6954660148b0be94acbf6defeaf1721c9acb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603442, "uuid": "d571a7fa-b1fb-44fe-aa28-ee8a663685ac", "value": "T160452352BFFC4036F8B257F119F603E307397840A730969B678A996D24B2AB06635737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603442, "uuid": "67d1ce4b-f267-4fb4-a298-6365b9c094b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603442, "uuid": "0e7e92bd-4aa8-4814-808f-8a1065ba48e7", "value": "24576:FyjMWTOwrl4i2IjrNPhUt7n+apCee9JWKjoS0COhIFkTFKk:g+wu4r5Kt7nRpCejKs1iFkBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677603442, "uuid": "3532c778-c02b-4c22-b419-457f8fedca2d", "value": 1236480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677603442, "uuid": "a4e5be9d-e064-454f-a883-42e6df30f4a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603442, "uuid": "7ebb4ce6-2fdf-4661-9592-823031368a55", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e82701-b7b1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677621051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621051, "uuid": "7cb33191-d7e2-4e3c-b24c-5abd622f07fb", "comment": "Malware payload", "value": "a6c04015085e6ab05b73171b7debdb23", "object_relation": "md5", "Tag": [ { "name": "password: 764", "colour": "#AA75FF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621051, "uuid": "cce264ea-8d37-409f-a27f-9eea08bdd031", "comment": "Malware payload", "value": "5fb714dfc9206ab4d188bf3c0cb35c44fbf5246f863c1efd5fdaecaa0891bd7a", "object_relation": "sha256", "Tag": [ { "name": "password: 764", "colour": "#AA75FF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621051, "uuid": "eeaea973-7422-4d31-976c-722e99a77014", "comment": "Malware payload", "value": "7117fcee603c8085bab74bf52929562b407ed579", "object_relation": "sha1", "Tag": [ { "name": "password: 764", "colour": "#AA75FF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621051, "uuid": "01bb773c-ab9a-464c-966e-7886acf1b69e", "comment": "Malware payload", "value": "facb2afee7ef61f1c2efffd1551d4f174e982c9bd3fd70e6a4bddc5b529874ede690a19bf4546d2701a0fe02d8265f3e", "object_relation": "sha3-384", "Tag": [ { "name": "password: 764", "colour": "#AA75FF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621051, "uuid": "0d750ea3-f9b7-4a21-b983-7e1466d0661f", "value": "T1C38423AF5E354C8A0834BBD9965A4D57918FDB1626782D2DB0DEB723007278F790E832", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621051, "uuid": "be27a66c-35b9-4adb-95e0-f5657c62cb22", "value": "6144:xggNqBSq/GZQb4N+IraKVDu/hhwkIbStcqaOC3NbPN1HNF7eZF9DiHRydoOtzL:5vZmdI6/hh3IbSt/aOC1N1HNpqTDiH2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677621051, "uuid": "e650533a-5d8e-49ce-9f62-d4548aedb5db", "value": 385552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677621051, "uuid": "1e04811d-5e21-4c05-b8b9-1a9dcee474a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621051, "uuid": "c6ea4b48-f0d8-4daf-88a9-86445c80254a", "value": "clamouring.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1926e9-b752-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677580011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677580011, "uuid": "c17ca0d1-5145-4f1b-b1f3-68a7b64a9856", "comment": "Malware payload (AgentTesla)", "value": "cc21ee18d95ba921412f6292b009974f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677580011, "uuid": "d235121b-1ec5-44e5-8e76-b4544c040861", "comment": "Malware payload (AgentTesla)", "value": "6069a5f7271cb47b90c868d43a74848e46a26db0fb10b292a2b3ec00c54ab9e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677580011, "uuid": "6d3bd6c9-8847-4a2b-aa3a-2b1cbc2898ed", "comment": "Malware payload (AgentTesla)", "value": "01b69660dd234fdf42aeb90f52f2415794f89b99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677580011, "uuid": "e17437f1-4117-4027-b5a2-439c464ed757", "comment": "Malware payload (AgentTesla)", "value": "1dd752876b66e4309e17ede72a0d5de53c4ff794667f21e22053927d39ed94358a3ad650c14c0ba01785785db3ab326b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677580011, "uuid": "1931e72b-32ee-466e-9388-311422f8553c", "value": "T100257E61CA1D1A1A4D6F1F9ABC834D898AB9C8284327053AFD99538F610F65CC37FB1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677580011, "uuid": "1b66467e-d96b-4fbc-935b-f2c92fdd28aa", "value": "24576:kamo1m7oLwwn4lBvVN2aLkitp0+cYcG9HysmxGh2:3M2wLOQ0Zxsm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677580011, "uuid": "afec9422-b599-4f63-b680-bb31c3b09d56", "value": 1013581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677580011, "uuid": "ffaa50d4-f8ba-400f-ab00-659cce06ab64", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677580011, "uuid": "5aab0b78-e43d-4db7-a08d-956afed5e9f4", "value": "swift_028.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a6cd92-b739-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677569097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569097, "uuid": "076cadef-9183-4a51-8a70-179e3626a0d2", "comment": "Malware payload (Formbook)", "value": "1d9ac6f809b0c42581a34c93d6355811", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569097, "uuid": "38ce6b6c-2351-4200-992f-ad55f5d526a1", "comment": "Malware payload (Formbook)", "value": "60f76d9d307eedba98f865fb56e05df71a77a37940d89a00e68b8117d9c1382d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569097, "uuid": "b64e72b8-9e08-4587-834c-87914cf59d32", "comment": "Malware payload (Formbook)", "value": "b01ca7f35c14c4d1b71491f5db8ca3afc749bcb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569097, "uuid": "6b88e2e3-2e9e-4902-929a-d9d37a5cf0aa", "comment": "Malware payload (Formbook)", "value": "b5c30f24482bf0c2a8d35bcf5a2bf4ec6325b317e5504d7d6a559f5362366dd8a6bb529cc17486cf171b932c2e61a990", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569097, "uuid": "591a7d2a-11c3-4302-a49e-641b7f0f1feb", "value": "T1AAC18400F3D85732DDF64B36AC7243410679F352A8979F5EA9D4621BAC263894A73BB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569097, "uuid": "17753571-c1a0-4377-b784-52879063fd91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569097, "uuid": "48f6f9ab-e341-4253-a4fb-6cc81a4423ce", "value": "96:VHrtAvySl5HOYLmKcAc2mZwNS1lCkaB1uNBzNt:1uvLmKcEmZwNQvaBwND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677569097, "uuid": "2c92c536-36f7-40cc-9623-03e1758c8d18", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677569097, "uuid": "4bd81dd6-a0f5-4585-a412-648685f01d35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569097, "uuid": "9ef85976-d15e-4cf4-8423-62f8aacc8fa4", "value": "here.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95746885-b778-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677596404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596404, "uuid": "597045eb-bb8a-48db-bdf4-6acdd881234f", "comment": "Malware payload (Mirai)", "value": "3a41355c5e224b9f8f7b2ed9f53c9f1c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596404, "uuid": "0b16e769-0076-4f48-a20f-13a31dcab7c9", "comment": "Malware payload (Mirai)", "value": "61afb1ccc711cdd14be640db19762a550f049c84449efe69261d1a6af6144713", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596404, "uuid": "ace0f7f1-2e58-433f-9ee5-f01ea9cc0ad5", "comment": "Malware payload (Mirai)", "value": "a515222139e0524eff6be4314a9f2cdc4fb5ff1b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596404, "uuid": "f28dff5e-276f-454a-b56e-f7ace25cb83b", "comment": "Malware payload (Mirai)", "value": "ab05ea6a0aa119ad5bbc715395e9f7f8b6dad8401c966288cec0bedbf074c205f86a27e4f2e8165d9047366f4c691b98", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596404, "uuid": "19800d36-e845-4125-9c41-6d5f25475bf9", "value": "T17B536CC0EA83DAF6DC1146B8307B9F32CF77E1791196EAD2D396A933E841541E21329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596404, "uuid": "0f2b181f-ff73-47bb-82dd-0f6b78b4825d", "value": "1536:JkuKcYq/E86/lautoAG59NRTrxhZSULXiVga:icYKEN/laNx59NRXxnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677596404, "uuid": "f2b1d67e-6bd5-4e60-bbd5-73eebc9870bf", "value": 62480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677596404, "uuid": "3a60cb94-cb2c-4bcf-ae31-85c84246d7e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596404, "uuid": "72de9ee9-9364-4b42-8441-46ce2aa62c91", "value": "amen.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26adb5ce-b76f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677592353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592353, "uuid": "55393fbf-7302-446e-97bf-3fb350bd6932", "comment": "Malware payload (AgentTesla)", "value": "635eb6abcc1b58d7754715f14e576bc3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592353, "uuid": "7b7dbb6c-ed35-4a82-8ec1-2089c9563b90", "comment": "Malware payload (AgentTesla)", "value": "620e2051b6bed232f84070e04ef93e43118c4ad92d6f1c12c002148890204b64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592353, "uuid": "7360a1da-3c5a-4b5c-8cd1-1c31ac5963f2", "comment": "Malware payload (AgentTesla)", "value": "4aee829791f55e5f1aeea8d7dd6417f4951a7557", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592353, "uuid": "45fdf774-b246-4b1e-b65e-34f90ac8c75c", "comment": "Malware payload (AgentTesla)", "value": "b0abbeb7615f1ff5826576db04cff4ca6e3766154e0d30ea10226c2e1cd9981503db687b0070608166f42c7723f8e7de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592353, "uuid": "a77b8a04-8652-4e8d-8c93-5a90817ce902", "value": "T17B6423547790D033C5A306312F37AB477EB1B91211B5A32F1B243B81B9322A6DB5E7B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592353, "uuid": "a236409c-8b12-4b58-b524-6d57ce748dc6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592353, "uuid": "170b3829-c86c-403b-a66b-304277a8d446", "value": "6144:vYa6aiitPHYfDabthFI6XeEtWkJOJs5A08j9y3TrhRmugtb19DjU5Wz28r0rp+PD:vY87tfu8tQ6uE4kJOJiAqNRmugtHDjU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677592353, "uuid": "164d88dc-c33f-4b27-8c85-d09c4d79f191", "value": 323846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677592353, "uuid": "b26e7748-e0b4-4f48-8e30-0dd9af74c614", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592353, "uuid": "162137c3-f4c2-4645-9b87-3a922741ce69", "value": "SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2427359-b759-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677583112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677583112, "uuid": "e38d5754-4eb2-44ac-b847-8eb8d07f9db2", "comment": "Malware payload", "value": "842ff3818aab3bc168f997aa43163434", "object_relation": "md5", "Tag": [ { "name": "1677576236", "colour": "#542660", "exportable": true, "hide_tag": false }, { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677583112, "uuid": "084eea30-550a-455d-8826-ca3f86903457", "comment": "Malware payload", "value": "628b7be2f1bb39f173458d0595ddfed907157ef25a574d34faaa4bfd80129071", "object_relation": "sha256", "Tag": [ { "name": "1677576236", "colour": "#542660", "exportable": true, "hide_tag": false }, { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677583112, "uuid": "bc3a8552-059e-4922-b79d-5a10783ddc52", "comment": "Malware payload", "value": "ba69ce91bcc57883ed2989749a9c05c2ef8bd899", "object_relation": "sha1", "Tag": [ { "name": "1677576236", "colour": "#542660", "exportable": true, "hide_tag": false }, { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677583112, "uuid": "e50a2b0f-1e9d-426d-8209-28f146c60182", "comment": "Malware payload", "value": "0cf28dbd6fe9c994f9b8d5981df828bd227625c5fccbc26992ef3f7e07add9deecfc3e7ebbdc0dfefced5c0505d3cdb9", "object_relation": "sha3-384", "Tag": [ { "name": "1677576236", "colour": "#542660", "exportable": true, "hide_tag": false }, { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677583112, "uuid": "a3123649-92c1-4a0f-90bb-517d60d56318", "value": "T13474AE91750045F7F79B13368868E63E20BEEA402BDA41EB6F9CDA8D1E646C1FE30553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677583112, "uuid": "2b69f6ca-502a-4421-8fc1-fbd84cb696e1", "value": "59b79dadf67766ab27d48f7cfb8bae34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677583112, "uuid": "e5701afd-683b-40bd-b1c6-555c4e97c746", "value": "6144:znCkEzy3WOKrHe7EPvIbQP952w7QNlC20wHa8zbC6+fYyf9unVes12qxWCla8aGN:NEyrw2s20wHao+mmeWCl9Vdsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677583112, "uuid": "e1281c89-e2e8-4a72-8b56-d1b837dbe0ee", "value": 356506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677583112, "uuid": "3015f61c-47d8-4f2e-a5a2-64e61aa4ee0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677583112, "uuid": "02116cd7-aeec-4c29-bcd0-973c6e80aec8", "value": "StrangulatorySubduedness.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec205126-b775-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1677595261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677595261, "uuid": "9ff41188-286d-49e9-912c-3036a194dd98", "comment": "Malware payload (TeamBot)", "value": "b9ecc851ba2894c6e650da341ec4e284", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677595261, "uuid": "bafde720-89cf-4958-b38f-803ea3f96f58", "comment": "Malware payload (TeamBot)", "value": "62b9a52de944af4cee1aad0f29f994c24b05ea9dd114f4883fd9203f22f8ff1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677595261, "uuid": "5f39d499-9acf-49b5-8d06-c253343d09fb", "comment": "Malware payload (TeamBot)", "value": "6061f6807aba21e5c83e55c498e42551caa0d5c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677595261, "uuid": "d685f520-5830-4676-9276-04ace2265485", "comment": "Malware payload (TeamBot)", "value": "b5b94e76334d9aef459188f73bbdbb921dfa229fd941e2ce71910dbe7248fb45f736cceb22487bb9702dbf6ae3bf36b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677595261, "uuid": "02523264-d55e-43e0-9368-6cdc030a6017", "value": "T13D54D011B690D432CB8EC6709824EAE42AFABC725A55894B373C3F6F2D712D217B7351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677595261, "uuid": "ddeb7410-268c-41bd-98f1-1ef9bc105c38", "value": "2ff441a58ff638ca2d2b64ce6ffa9559", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677595261, "uuid": "23e276db-1402-45b4-81bd-010f726f0c7a", "value": "3072:g8tLusZwojhQ9lV4XYmx6EGsC0F6j7FJtjKrEQeSsQqumMVDx7U5L0frbRkC:7LuojhiNcC0I/FKr/eSZ9m4Dxo6zbR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677595261, "uuid": "8ae3ee89-d808-4b93-a83d-dc4d4d87c6fc", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677595261, "uuid": "43f782ce-b40c-4478-9226-f4922576d20d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677595261, "uuid": "b48af9f1-4430-4e71-aa9d-298fa2b97aca", "value": "62b9a52de944af4cee1aad0f29f994c24b05ea9dd114f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829760c3-b782-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677600668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600668, "uuid": "9cb6d718-6d1a-4ba1-a17b-41b240118cab", "comment": "Malware payload (RedLineStealer)", "value": "c9cf9045516866c727b502ca4c932ac9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600668, "uuid": "ab0ab5c2-1c31-4cb3-b0e6-111cf4884183", "comment": "Malware payload (RedLineStealer)", "value": "644edb969974be394b9e614c180558e27b6bf3b40dda8949afe22c3fce24dd73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600668, "uuid": "b5b953cb-c84a-42fe-bdf4-5dd17d1aa7f4", "comment": "Malware payload (RedLineStealer)", "value": "75740447500a209f3d25fc21f8f5e2916b128ed6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600668, "uuid": "54b1189b-afb2-44de-9284-01bc72a5079d", "comment": "Malware payload (RedLineStealer)", "value": "fc0dd2f8b319692686e2c0533a302daf8c5d4f11beefaf4860904082858aadfc80f0479464e4157918a683262cb44e39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600668, "uuid": "aad3dfea-b626-4b1b-8eff-9dd3c644f705", "value": "T12A058DE106ADC7D5E8F60F3806283D146B999C97837DA17E7EC7247B84F674A40783A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600668, "uuid": "4678b7ab-d561-4573-8c2a-603ef9ca93d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600668, "uuid": "ca91157d-815c-4d2a-8f85-2604663932bd", "value": "12288:qDnGS45nJ1XDckQbuK23/b+hgeqBjoSfyavQrstyHXOf7LZmwZtD:qDnGS4J6qKQOvqBjbyavQrstyk7LZPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677600668, "uuid": "4b6b8658-fe11-4eca-aff8-5ec958098671", "value": 838656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677600668, "uuid": "9532272c-9c3f-46dc-aae4-3cdab01dd982", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600668, "uuid": "21d057b6-f5e9-4799-a0da-c8228ea6143a", "value": "c9cf9045516866c727b502ca4c932ac9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b493f979-b7c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677627380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677627380, "uuid": "4b8c65a6-b64b-4e2a-a8e1-ae2bd541bacb", "comment": "Malware payload", "value": "2df7e49521bbd4a69b7cc609da14f62b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677627380, "uuid": "a46ea343-6ae3-4f58-8687-f7d4277d537d", "comment": "Malware payload", "value": "645011d2ee07591468b09e552c6ea2f3522b9ab272f52782e84fc44d2b08cad8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677627380, "uuid": "942522c8-6e9a-4283-b588-424fafa816de", "comment": "Malware payload", "value": "dfc6af4d52d7310e003bf42778fe504fbe1b56c6", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677627380, "uuid": "a6389328-0831-49c9-ae96-75649a21e138", "comment": "Malware payload", "value": "55d1e3a41fcea4c8ad484fd6e41408d2306932d7e9cbec8ca3e8431f1e0a588d521184956c8a88056a14f624186fe368", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677627380, "uuid": "5eaf3df6-91fb-4ef4-b0b1-7501b2fb0e9c", "value": "T1B2B3123987A61060D4945F35BF7667309D402BFABAB9EF0C1C9985E43A0E6A1344F74F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677627380, "uuid": "450fa69c-928b-46ec-9a01-8b2acd7e3af5", "value": "3072:evYIaPelxkHwdBjsBSj1cXiV6ptKBnnurHsK:evYIO2eeBgSNV6nQwsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677627380, "uuid": "6db5a617-ed4d-4d7f-abc8-6b272cc8699c", "value": 117098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677627380, "uuid": "427d9d14-e6a6-4d0a-b63b-1da2a966203d", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677627380, "uuid": "16b7af45-e962-4211-bbc6-7cf349c1ba86", "value": "Contract_Feb_28_Scan#160.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267b4630-b722-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677559282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677559282, "uuid": "42b4ea32-2ae9-4a82-b35e-25be1cee4ce3", "comment": "Malware payload (Amadey)", "value": "afe3c7dc346a800ba38207c259a0159f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677559282, "uuid": "76f53367-1c4a-4bd1-aae8-a7a7a95e1f9f", "comment": "Malware payload (Amadey)", "value": "658f50cc321f063365b083381e617e0e5703491a2063cd6b8c2adb47b1196b40", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677559282, "uuid": "ee5aa327-3348-4d2b-952a-8f58072d50f7", "comment": "Malware payload (Amadey)", "value": "fc53ef7d6e2e0a49ce285656fc44d6179db38952", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677559282, "uuid": "c6893976-bb55-4211-baab-d6bc923a7840", "comment": "Malware payload (Amadey)", "value": "74ed3a1d031ce87cabd9eade483e3eaebff8b61e79c536e85dcd51526babf064162dda8a68d45d2c3ae2005c2309c0b1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677559282, "uuid": "4717effd-7651-4354-a906-4b9cb21a1661", "value": "T11F652303A7EA0431D86443B15AB603C31E37BF716B78D2AE279E8D9A0D724D4B670767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677559282, "uuid": "e5edb352-fb10-42b9-91f6-698ada0e1c9d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677559282, "uuid": "50044bfe-950a-4b5e-a1e2-d196632dbac5", "value": "24576:MyCxzTdSSofFuSjWRzFKcqCsZm+xM0zel2E+IQelLofq05DEltv4ejzVUwpKDlq:7MzTwSEFuGWRxcCj+hzYT+d0Ez54/QoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677559282, "uuid": "7c1879af-0823-45c1-8dde-38050b122517", "value": 1416704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677559282, "uuid": "cc9bc89c-86ff-4d17-be13-21e9be6da52e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677559282, "uuid": "58daae93-921c-4e8d-995c-28fe26545eaf", "value": "afe3c7dc346a800ba38207c259a0159f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e67a8dd-b75b-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1677583884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677583884, "uuid": "d634f264-2105-4b98-8d1a-2e50facf6e25", "comment": "Malware payload (CryptBot)", "value": "321f1b8ef87969de7d0a26046eb9759e", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677583884, "uuid": "fdc7fec1-85b9-4233-b513-de08a8d4fdc4", "comment": "Malware payload (CryptBot)", "value": "659588e896509b99b645b6e67db16386c2189cbb3e22005d60973b27f1f5717f", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677583884, "uuid": "271438b1-23e4-4a2e-a76f-17a0e21083d6", "comment": "Malware payload (CryptBot)", "value": "c3fd51797fe33c4705770f2d7a64822466966eec", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677583884, "uuid": "42d048c2-d275-4b32-b4e3-7a066f9fc71f", "comment": "Malware payload (CryptBot)", "value": "35d0960500419fbff1fce46e749419bbb8fe222f5d9e18cdce75af15ebd50668b455f5b652d447b416a9bfdd4fadce87", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677583884, "uuid": "d212c93c-7e4c-4ad5-8e94-6b2a909641c3", "value": "T162050113BCD1C939C18713728817A73952F8BE234972694F63C47ABEFE5C8D29722A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677583884, "uuid": "ed3588c6-e8a7-4e5f-85e5-7151ce0f1b80", "value": "12288:RQ4q3sYFYqekykDcI3g5lteZ2T+jn3tlfT4k27Fgy5JBKLwxgv1LDtOaTyH:dq3syozI3Qlte6G3bskCFgydZgv1IaGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677583884, "uuid": "d693a581-10c2-4f98-b365-9cbfbfb49209", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677583884, "uuid": "9e7c8ef8-e1eb-4ca8-be4d-1dd2effd965b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677583884, "uuid": "23e1e57c-fe56-498c-8386-b76054bfd53a", "value": "321f1b8ef87969de7d0a26046eb9759e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2547bb86-b74c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677577318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677577318, "uuid": "afb9fdb8-1f77-4d43-a347-7257b6ff9aae", "comment": "Malware payload (Smoke Loader)", "value": "581823c1dc821bf51d22273d260ac1a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677577318, "uuid": "10483821-421d-4892-bc1b-99936ce824fd", "comment": "Malware payload (Smoke Loader)", "value": "65acc0e74fc63de8c2da949a543237ffb4a95d6b613dd62fbb42faf866707c4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677577318, "uuid": "1b963a55-9653-476c-b304-0a485e23dc59", "comment": "Malware payload (Smoke Loader)", "value": "83f5b4d8cf445bdda820f95e38e0470020068167", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677577318, "uuid": "e33b235c-754d-48cc-8a51-4e6a0a3245b9", "comment": "Malware payload (Smoke Loader)", "value": "f14b694d0b26750dcf9671f3051e11275778b42f9b0fd384df232d3d51996e65e9e8c38c02bac6c9d9f881fad4fb7551", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677577318, "uuid": "a77c409a-df2e-41ac-a665-f7995f833d69", "value": "T1E324D03276D0C431C88205B55828DAF46EBFBC7256A9C54B331C2A6F3EF13D16A76366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677577318, "uuid": "abfec97d-2c9e-4578-91cf-449f143a5b51", "value": "8b8924b9f5a673fd70977d21932a217f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677577318, "uuid": "13860cb6-191f-418e-a7a6-2694cf570b0c", "value": "3072:XXkQUL5KdOCo9tOnx4R5Igtur3aj8rcv0/wbakCj:nkQUL8Jdx43H2wrba1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677577318, "uuid": "d6de92c4-4200-4701-a403-ba245525abcb", "value": 217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677577318, "uuid": "85d36440-bb80-4d72-8642-56a5d817bb9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677577318, "uuid": "1e72980c-1b1d-40f0-b2aa-220af627a916", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61646fae-b779-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677596747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596747, "uuid": "2e2891ee-7714-4cef-b317-95d0e1a6bc20", "comment": "Malware payload (Mirai)", "value": "960d8f9c67709505a24376a9365ed06c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596747, "uuid": "3bfb5e22-4665-4e99-a379-c1e7d8f69810", "comment": "Malware payload (Mirai)", "value": "66a48f7d0b8d9f5a9600058ed7e2b5353195bd9401a0fec3698885323121ad15", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596747, "uuid": "b64b36fe-2b6e-4cdb-9e39-c3c5f754f096", "comment": "Malware payload (Mirai)", "value": "c76db7fa8b4fa4bfe9d6f756a6a0535a49d3a4b2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596747, "uuid": "07800b37-2bde-444f-b123-2d34c60f8065", "comment": "Malware payload (Mirai)", "value": "37b00dc1d7bfd8ccf074c7410742de513a5eece98c2ace8e4a880f5a31425b33daa31764891e67530477d3ef4545012d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596747, "uuid": "11b23ba7-5403-4999-9188-f6b538743033", "value": "T17F41F21E5F801F37DD66CC36054B27513ADC842F616A63916334E964BD3E605A7D38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596747, "uuid": "7e02ec64-82e4-414d-b092-2db3ab411f53", "value": "24:uY23H/ki9mpHHSSixZuDa9mCt5UJL4mmlZ9GpeIgO/qM+UTK8mKUlu/OT5bwFLCg:kff20nuDW3U6df9HOScTLmPkOTSFSXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677596747, "uuid": "e7d44050-511b-4751-8b52-f17ac45aab18", "value": 2016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677596747, "uuid": "f83a8ab2-0432-40a7-9b27-13f45cf4f4cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596747, "uuid": "f8ba92b4-a497-4fdb-aa4f-866bdeb2402b", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a3a81a-b755-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677581419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581419, "uuid": "09b2b816-951c-4ab5-b68a-7786e9774a33", "comment": "Malware payload (Mirai)", "value": "c63d99426e903f9e28e7d200f91282c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581419, "uuid": "a6c2af46-0458-4f96-a618-49b3dacb31f6", "comment": "Malware payload (Mirai)", "value": "6749743fb0d584d31e69c42a0e559cda01fb95eb289e60bc95a537f3fd41d717", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581419, "uuid": "d356e7c5-4b0a-47da-b9f0-662e72bb1d4d", "comment": "Malware payload (Mirai)", "value": "852ec0e19d501855b5121b5a8eb12a671df13061", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581419, "uuid": "33fa8f23-f7c4-470f-91cf-31d015ffc6b0", "comment": "Malware payload (Mirai)", "value": "d5ebb7d16377ab54c76fe0f87e515774ca6204938b6de3027e8e02c5a9ddec32a62067d3b877375aa04d81f4be86e425", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581419, "uuid": "7f3f4e43-49cc-4ed8-8c47-65116203d7e1", "value": "T19553A5C79F633DBBE5CAEF72A5EAE70420EF0401A3991762B4D4CD00D51F98D18E6668", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581419, "uuid": "5de8b747-1932-4f02-a175-c187593353af", "value": "1536:/7Pqph23KC9BU1yrLhMySqq7me+mG1GEv:/rqph23KC9W1y/hMyvq7mN53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677581419, "uuid": "c06eba8b-036b-414f-be17-7c9d2bc236f4", "value": 64222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677581419, "uuid": "11282a42-9d47-4642-bb1a-46a580ee19ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581419, "uuid": "b71a6191-9bd2-4a0e-b008-71a464396775", "value": "c63d99426e903f9e28e7d200f91282c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04379c02-b73c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677570391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570391, "uuid": "ee81e72b-4806-4f7b-b3d4-920b67b59b49", "comment": "Malware payload (AgentTesla)", "value": "fc153e34133cfa02c80ebb1599e8d63e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570391, "uuid": "c0a72e0b-eafe-4a65-89ab-601d8ae31458", "comment": "Malware payload (AgentTesla)", "value": "67694aa8ad851eae7f51b1e7067470d051f773f7d8ece3e0866290290556e06b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570391, "uuid": "407743b1-c087-4d35-90f1-9c98853e3517", "comment": "Malware payload (AgentTesla)", "value": "434a6b55f306ad1b55de328663b49d42db831b1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570391, "uuid": "433a0baa-93d6-441d-b377-7a34008306bc", "comment": "Malware payload (AgentTesla)", "value": "9715a6849ee05a8c4f7edf2fe60f0df43717ea78d665a9c09566bbe296f70ae825bcf54ad03d74672758115c3b5b8f2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570391, "uuid": "d10533f9-678c-49fe-9860-b521408d5ebd", "value": "T10B45AE4853B344B2FBDB12A51865228C4EB472CB3585F61B4F673751A522AFFB29F103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570391, "uuid": "14f87ba7-3e33-4144-9859-ea3cdd80f43d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570391, "uuid": "4661a246-0d1a-4fc6-875f-cc23303e668a", "value": "24576:ifgme6uCA2zNUvghyCzHa8PQksEELBwUecTLED/+o9x/6qW:+gme6uLvyywHIkuLB1u+W1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677570391, "uuid": "3d66efc9-6ef6-44d8-9e8f-ab915b81b4fb", "value": 1202176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677570391, "uuid": "0ec40c03-7a1f-47ac-9f03-0f608b5b9ac9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570391, "uuid": "edcdad56-0906-4fa9-b8b9-70032e04da6b", "value": "Awb# 8457108962.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34d35c2-b799-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1677610708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610708, "uuid": "5f129897-1c7e-4a57-91dd-2cbcce196868", "comment": "Malware payload (LummaStealer)", "value": "94f8f695668d53f5f3cf31055eb3abfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610708, "uuid": "53568c36-d992-4efe-adf6-fdf534173c63", "comment": "Malware payload (LummaStealer)", "value": "67ca128ea8602afc98ac85b6acf3c5a6b34a8e975727081128d47e226464e891", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610708, "uuid": "2bcd72c8-4ea8-4975-b726-bd184f3dbca3", "comment": "Malware payload (LummaStealer)", "value": "60f844dc526078611902acbb2c9886a0fc2b4cb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610708, "uuid": "c486ff72-1f74-4ec0-9933-3aa016b57f9c", "comment": "Malware payload (LummaStealer)", "value": "f468e63e4e9a74868237b348c5f67ab5510bbb3960afc854392236df3f5b5318192ae5b4f7f31b522ad6e882058cd1c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610708, "uuid": "7ede5d6c-8d14-4304-a1d2-23a7a11fd586", "value": "T1DF955A12B751A018FCF721FA59BE206C952CBDE0075894C792C87AED8779BE17C32627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610708, "uuid": "47521375-a23d-49b9-a93c-531425bda4e7", "value": "c719f7e835c2bd55d00706b6be3ed4c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610708, "uuid": "7b199b0f-ebc2-4acf-94fa-12af2538bb0f", "value": "24576:5pAEVa1muuQnwx4ORzkUfc1xQdHM8yffmmnkax6M/AjwMdmXpCLf:5pBWQQnwx4ORzzM8yGmnb6M0dmXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677610708, "uuid": "1df2c0c4-e1c3-420d-b9b7-223c8ce29508", "value": 1968128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677610708, "uuid": "6f1d7d21-ad57-435e-95a7-470c9ba5f08c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610708, "uuid": "4654f345-acf5-4fdd-9136-6c08733f3934", "value": "94f8f695668d53f5f3cf31055eb3abfa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d692272e-b727-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1677561724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677561724, "uuid": "9881ae02-3aa0-4824-a2f5-aa5eadaddbee", "comment": "Malware payload (NanoCore)", "value": "93d73abe5ba18297866efc9dc417e8e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677561724, "uuid": "9c483a5d-6d67-47a2-ad9c-d1811edeba53", "comment": "Malware payload (NanoCore)", "value": "68e07e239fb2fa8584947770bda2ad99453f1cd9e9d64c628760505417579d81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677561724, "uuid": "da81769f-9705-4cb0-b71f-c1659548801c", "comment": "Malware payload (NanoCore)", "value": "7f6ea177cccdcc82dec83cdc0e66540f1e0e01c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677561724, "uuid": "c383f765-5f4a-44a5-aa8c-a3afc11766c5", "comment": "Malware payload (NanoCore)", "value": "405ed82dc0d222f974c06db0f9b4476443730890cfbefd453791f0913e59842afff5b2cd7394b4e334856b1e2b185c5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677561724, "uuid": "8c8ffc90-b39f-4bf5-aed6-6430062e1977", "value": "T1FF14BF5677E94A2FE2DE86B9602211128379C2E3E8C3F7DE28D454F79B267E406071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677561724, "uuid": "68a1f42a-8a0e-4cbb-8667-93007bdf5089", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677561724, "uuid": "a97675c2-5da1-461c-a12b-207b18889851", "value": "6144:wLV6Bta6dtJmakIM5flWUu5LYkO0TrWS1y:wLV6Btpmk0lM5LYkO0TKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677561724, "uuid": "f140dd75-f8d9-4ac4-8219-5718d9d1b62b", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677561724, "uuid": "b647aa44-5058-4ac1-b0eb-91c02bcbdbca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677561724, "uuid": "ba2f4a2f-2024-4f08-a942-49919c35758c", "value": "93d73abe5ba18297866efc9dc417e8e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803832eb-b740-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677572317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572317, "uuid": "45dbcfa5-63a8-4bcd-9826-0ea5dccaa713", "comment": "Malware payload (GuLoader)", "value": "1a23979cc8b986a5de55d490dbf68221", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572317, "uuid": "3995f443-4d21-408e-b39f-82ef6636f2cb", "comment": "Malware payload (GuLoader)", "value": "69a98e4e6347741aeb2659e126f0d50e00d1099e9f7fcc956dacbdf68d39db2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572317, "uuid": "682e9efe-8be7-4ed2-97f2-bda267958ac3", "comment": "Malware payload (GuLoader)", "value": "378dda5d1f9adddfca81d7d726737a076fc88abb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572317, "uuid": "5b2151e9-25ff-4c8d-9c73-00e0a18d26b0", "comment": "Malware payload (GuLoader)", "value": "72de0c3c6b8a4b45485de2274e81d3af6d2996fac94424b20dd4317cadc809d72bc8797b95a4cb648de8eb7901360276", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572317, "uuid": "89f626d8-0408-4903-afa7-9e79a0f7bb37", "value": "T109B423401650E8B7C9230FB24DBAAAB1C9F6539744ED5B5B23608B58FD5BFC09C0D25B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572317, "uuid": "c247cb26-9492-420d-a1ea-0baadd11ec44", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572317, "uuid": "e409b5ab-72a2-43ab-8dd1-5669a6657275", "value": "12288:1i06hEUyDOiE4cnblqcRhNxTAoi+079k60HJ+LshLi:1i0o4dcbRFLMkHHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572317, "uuid": "fdc386f4-46ef-46e1-ba9a-f4697fa9324e", "value": 504848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572317, "uuid": "54479f72-da15-4a71-b6c0-d8a54abec4bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572317, "uuid": "875aa7ff-b5a5-4b34-90c4-1095d9d9a1b8", "value": "NEWORDER.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9896162-b799-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677610719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610719, "uuid": "ff3483db-595b-45cf-8bf9-0678af13f4cc", "comment": "Malware payload (RedLineStealer)", "value": "7ec0bb3b32831dc65979396901748a77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610719, "uuid": "75ef88f2-86f7-4c09-a658-1f12289c6774", "comment": "Malware payload (RedLineStealer)", "value": "6a656edccc9611be28aa5336a3ed8bc433fc010cb39e303853e124cd68346e34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610719, "uuid": "6f1faa96-1e9a-45c8-8efa-7870a52be00d", "comment": "Malware payload (RedLineStealer)", "value": "cdec99cfe021a689026a14f939ebb253ee5b0757", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610719, "uuid": "e8a2b95f-d3c5-4e05-ac11-b24f2f4c3236", "comment": "Malware payload (RedLineStealer)", "value": "af1bfc2c58bf6429b410509280b4dad34acb8e90a269eced19bf3b175d02c7a911a3f9b1def93a774b05793f377562b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610719, "uuid": "07faf1b1-7481-4d4c-a01f-fedc9ff1c0b8", "value": "T14145230BFAD88021E4F5277129F503930F7ABE215AB493AB264E6C4E50729F0F572727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610719, "uuid": "c5d29d55-d859-427c-ad15-06dceebf9151", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610719, "uuid": "0a28d3a4-e95d-48f1-b249-8b968c62ad27", "value": "24576:LyFH6+u8i220jBKuLcm2BMVO0eWEFXIMv4ROM/ns8t:+FRRgpwCf4RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677610719, "uuid": "1f450a63-9434-438c-a977-70b24d95a583", "value": 1222144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677610719, "uuid": "6d3ff6dd-d9f4-4308-8c22-8c2869368270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610719, "uuid": "f1a2bcbb-ab22-457b-a5b6-46d30d593cd3", "value": "7ec0bb3b32831dc65979396901748a77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00939839-b73c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677570385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570385, "uuid": "357663bd-f4b2-4e66-abe2-c6c1d629f308", "comment": "Malware payload", "value": "6701fae1d1c4fe8ba227103a3889f248", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570385, "uuid": "0dfb0314-4518-4003-be30-3f747d8f2ce0", "comment": "Malware payload", "value": "6ac384d4d5aa59c128b1fe0eb9a3507c72d1ecc1722e0e5bc4467b524e0211fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570385, "uuid": "3eb5660e-df44-403a-9789-83e8edfad08e", "comment": "Malware payload", "value": "e85db281de40249d16d2b085072a8014c235f205", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570385, "uuid": "a6611c7d-5c0c-411c-9fd3-6cc2ce7e34bf", "comment": "Malware payload", "value": "e77a399605ec8fe4f284b9e2b97fc5e68d6c3e832b277b9a451a9b77e8e0355c34ece2d70b858771194840040aa1f636", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570385, "uuid": "2bc22aff-de54-4835-a85b-e4d487009614", "value": "T118C1A840B3DC4336DDB34B31B977A34117F9B752AC538F5D6984510BAC166C88A62BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570385, "uuid": "f85d55f6-76fb-4c9f-bc24-1f7fd3211377", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570385, "uuid": "660863bf-d74a-4a30-8650-2358958af268", "value": "96:qTSJQ55vUCfffFULUmnaqALtaxXknppWBzNt:qy85vUCfHqLYqWK0nHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677570385, "uuid": "ade1edce-cfed-4220-b433-686c5aef6255", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677570385, "uuid": "bd69ff27-8cc4-48a7-af5e-f1cba5ecb9db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570385, "uuid": "3f4875aa-aca2-4525-99d4-199b2ed5aeea", "value": "Transfer-copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c96a52-b778-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677596407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596407, "uuid": "97bdc3bc-ab86-449d-b013-f2a4b3d02d9e", "comment": "Malware payload (Mirai)", "value": "2a3fd87ac2a092e78c3d9a2710aa9c23", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596407, "uuid": "7ba8a47b-7b5b-4a4f-b4d8-71af9fb6736e", "comment": "Malware payload (Mirai)", "value": "6c6757c3ccbb3077ede0679b03bd6c80f7eb480df796a7b79f10f50fcb04c3f2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596407, "uuid": "76857297-3004-47f9-8e32-658eb0db8cc4", "comment": "Malware payload (Mirai)", "value": "38290dddc0241681b8be410eb6ed3a56a6a273aa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596407, "uuid": "d4ed9366-b9df-4b64-9712-7cbc88bc8abe", "comment": "Malware payload (Mirai)", "value": "2fe2cfabead669b58412792f6831bd1f35890e386ba428aeef8a83c2cd4f95f3a807be7d7ce6957d724a6800e03b2a39", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596407, "uuid": "86b55d9d-933d-4d2a-b99b-bee9045acc76", "value": "T173E35C46EA818F13C0D1277ABAAF42453332A754D3DB33068D189FB83F86A9E4E77505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596407, "uuid": "2c6fec73-e10a-4038-be68-a56cbdd58960", "value": "3072:D5cOSd8Pik0uv6LbHgtooPqJanuCwEWhfci/XGUJM/9TP8LaW:DiOSNaCw/UanuCwE+fZXGmM/9TPeaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677596407, "uuid": "f9192883-ad28-4ed4-8b4b-4fe5ad9a4dd1", "value": 145908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677596407, "uuid": "24673b56-82cd-447a-98dd-1c24d27db115", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596407, "uuid": "2265ec0e-cde2-4453-8153-bdf9365253b5", "value": "amen.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8cea1ff-b7c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677628220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677628220, "uuid": "4ab1a5eb-b491-4a5b-bc10-75cf1f422b94", "comment": "Malware payload (RecordBreaker)", "value": "d94710632b4615de25b80d1e1eb69131", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677628220, "uuid": "dbe043ce-2601-476e-91e1-f7e940c98838", "comment": "Malware payload (RecordBreaker)", "value": "6d0ff2c18bea7fe884610ad954c19ba97cd140e4723ea654f556da3ba4bcec2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677628220, "uuid": "7f9e5eaa-2733-44be-a51c-15752c9b00f9", "comment": "Malware payload (RecordBreaker)", "value": "3bec73deece471e0219059c8e4aab89efe916481", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677628220, "uuid": "99a1b919-f46e-4295-8ed1-c997e1bad5ae", "comment": "Malware payload (RecordBreaker)", "value": "3da283e296dd9e64fabaedcbaa2c88e3e5239a7f422468befa31f7fd9c1d76b3be763f624b6a75c4c04bb65490d591b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677628220, "uuid": "a4af06d3-8520-4777-9174-bd1d04e70171", "value": "T139158C5129A747E6ECB98C7472B8E51422A14CD2476E9D3EBC862E7E8CF330F4456B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677628220, "uuid": "d81f2a5a-aa30-4afe-93ec-600db1331206", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677628220, "uuid": "91f63f9f-5ac7-4720-8842-bf6bac90b133", "value": "12288:8njaaqnGkFrVaTmBS45nJXsfWJws6GdRhDIvLrSMOOglv82O1qh0JFgCjNjTTT1/:SiGkFr0SS4AOJkGRRXOAhygCjDQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677628220, "uuid": "9491f045-f48c-4d1a-aad4-50b872ff1c05", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677628220, "uuid": "b7c9a9cc-5612-4d73-901e-a86747020448", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677628220, "uuid": "93ef54e4-c1bf-4b44-8a15-116dc419b037", "value": "d94710632b4615de25b80d1e1eb69131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946586f3-b700-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677544863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544863, "uuid": "5dc0df4e-0615-441b-acd7-99b38d8eb080", "comment": "Malware payload (Mirai)", "value": "beb9f30b4b6cc51913e911a12111d149", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544863, "uuid": "1d27b4f5-a08d-46e1-95e1-4f566e74d2ec", "comment": "Malware payload (Mirai)", "value": "6ddee88ccae6817681a3aa01f1bd99f2c9f3a167b6f5973846facac82c33056f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544863, "uuid": "bab22b0a-dbe7-4a36-be9b-8dea2f9ad97f", "comment": "Malware payload (Mirai)", "value": "8b2a5b4555be79fe2482a55379c2b6593d364ba3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544863, "uuid": "ea1a465b-fe1c-4534-8486-4acbd70b789d", "comment": "Malware payload (Mirai)", "value": "e32e716befa065d371ade5a56d1d49f27c7cebb8ce7d3a64f2a12b50849bc9c5d935253681955f991546cabb03d52cb1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544863, "uuid": "475b3135-ab35-49cc-a1ab-60550dd93caa", "value": "T13763A50ABF214FF7DC5FEC3745A91B06259C640A21A97B397E34D828F64A24F19E3861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544863, "uuid": "38173bf0-d678-482d-a478-a454590a19ae", "value": "768:pxNCJ0EYlDYhHuf5qsFSqwLX3U6OEAN6PNoUyO05jheleWTeKrmoNDpkdJLXirMD:pxNCJBYl5kqwwcAwP8O0fEfT9rmXLZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677544863, "uuid": "cfb1629c-71c8-480e-b36f-ffd17353b75b", "value": 71528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677544863, "uuid": "b60ccc61-d7e5-4dc4-a392-b808ffdef395", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544863, "uuid": "d272a2e5-7dc3-4bf0-a793-0eed53cd1294", "value": "beb9f30b4b6cc51913e911a12111d149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46405b0c-b741-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677572649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572649, "uuid": "85645f13-4702-4209-97b7-4a7ee957366f", "comment": "Malware payload (Loki)", "value": "1f5cd29e9046586b64c05dea0830ffac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572649, "uuid": "eef7f281-edb8-4281-b4eb-75e02d6af833", "comment": "Malware payload (Loki)", "value": "6ed50a5868a27769876f8cbff4f93982ed20881ed73f6a17ca7626b7da81e565", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572649, "uuid": "9c73c718-d130-43e1-95f5-58e44e8754f7", "comment": "Malware payload (Loki)", "value": "dcc0c846497ba35618f9955b864bc0b061a2eba7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572649, "uuid": "6f135b8e-83e5-4eaf-8306-38a15c1e1c27", "comment": "Malware payload (Loki)", "value": "405b47523472e2686b8696782e785a2b0183aa51a3170c6a43450cd3812da70e82c827eb4dfa02d27d3a7ff08c6048e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572649, "uuid": "76fa22b7-5c5f-4c85-b973-97896c829101", "value": "T18314AE923290EC71D132FA319D29C6B46B2EBC518A7C6ADB73582B2F1E741A1C573713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572649, "uuid": "fa24573b-86c5-4d49-a0bf-0e50af2c5917", "value": "42540a9ca466c55bb4a1cb282423a3c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572649, "uuid": "1aa489e9-e770-4bc0-b918-c338fe2d715b", "value": "3072:rO0Xe98GWhRDycPvZLq3Qq7+vrV+H9SLz1P2RlttCOP6pTZ:q0OqDTPRLq3EvrwMEfCOPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572649, "uuid": "258b5b11-141d-42f0-9620-3f0c08df9f1d", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572649, "uuid": "7f39c651-82c5-45af-b137-b6907d2e8ccf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572649, "uuid": "bac3a415-e90b-4570-ad62-68a5f618d789", "value": "1f5cd29e9046586b64c05dea0830ffac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0dd7a9-b759-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677583099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677583099, "uuid": "45c2b4a0-b858-4fbd-ad89-ceb5ff11dc3b", "comment": "Malware payload", "value": "874b4dce502f7acc0b3efdb3ca617fa1", "object_relation": "md5", "Tag": [ { "name": "1677576236", "colour": "#542660", "exportable": true, "hide_tag": false }, { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677583099, "uuid": "bb7bf5ad-9cfc-425f-b45d-37df4f9e3e19", "comment": "Malware payload", "value": "6edded3fcbe82400d74f5c47591eba7837bf46854d697da762bf5b3f174474a5", "object_relation": "sha256", "Tag": [ { "name": "1677576236", "colour": "#542660", "exportable": true, "hide_tag": false }, { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677583099, "uuid": "9e3ca7ba-560a-43c5-b072-fc0bb2eca38c", "comment": "Malware payload", "value": "e9af4b1c34f7d8932232d56a9a66e6a4eae541f2", "object_relation": "sha1", "Tag": [ { "name": "1677576236", "colour": "#542660", "exportable": true, "hide_tag": false }, { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677583099, "uuid": "4e9e6bba-47d6-49cd-a485-2eeba4284f72", "comment": "Malware payload", "value": "6a82ed72365b45bdef0fdb497b5e8ade2b76a1ff635bb5365b6ac6e6bdbf2dfae4c73744df80523254171a03290229c6", "object_relation": "sha3-384", "Tag": [ { "name": "1677576236", "colour": "#542660", "exportable": true, "hide_tag": false }, { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677583099, "uuid": "724db828-04d0-435c-9362-32340edab7b8", "value": "T17405CFA8A75819B6DD17537EC842C2919A347820432316DFB3E14A7F7B07AD8633DF29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677583099, "uuid": "b73f243c-7628-4d2a-a80b-58b6f902f552", "value": "24576:Uc+rVt3mWrs/bJKpBK1EqASIrkIPk0hmOhTR:UBrVtNrs/FK9qASIrkIPk0hm6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677583099, "uuid": "a439060f-9566-4ede-9f7a-0f78386ed8ce", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677583099, "uuid": "a5a2faa9-bf11-4d7c-a209-7d3be45927a0", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677583099, "uuid": "d0ebc104-a23c-40a6-a1d4-63f12afa5435", "value": "SurplicianRectilineation.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a14d52-b73f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677571873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571873, "uuid": "fba7c2e8-f9b2-45b3-9725-7cfde01131c8", "comment": "Malware payload (SnakeKeylogger)", "value": "0d4f36fc654b1e690c37e29416cfd456", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571873, "uuid": "de595ea6-1d0b-4cdc-9a6e-8943476f72b2", "comment": "Malware payload (SnakeKeylogger)", "value": "6f348c018ac94c81569f0fa17c77dc6dbe28f06f99697d9d77cd4ce9e8242d36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571873, "uuid": "514419e9-66ba-4ca7-ac54-93c8f06a3a24", "comment": "Malware payload (SnakeKeylogger)", "value": "900c25c09fd8f3e7743c22dea9099c8bddf1c78f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571873, "uuid": "d57d071a-d40c-4189-8846-60a4da0f1a40", "comment": "Malware payload (SnakeKeylogger)", "value": "78f8aaac23524892dabc0d557ee942f459ac4af3a69b70834d22cc3d34e29c05630c4dc691ba70761348fb082ec4333f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571873, "uuid": "55f27ba0-3df9-4ead-af15-57ffee431e1e", "value": "T160356A8032F9D155EDCF323D091C568E7D79A207A162B22AEB7676D2A3077F772D8081", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571873, "uuid": "a63567e9-2ed8-4965-9f7c-fc2b2d23c34e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571873, "uuid": "8b4f99b7-3079-4ff7-9239-b1d4b65e40e6", "value": "24576:Swk1fdSz8ds/gllf6BpqGVwkP9IzHm0pdx2vP:1k1kmldepqPklIFfx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677571873, "uuid": "1523f70c-ef6a-4f02-938f-22a6bef28f89", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677571873, "uuid": "6318f332-13dc-45ed-a363-c89223acac8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571873, "uuid": "f7aaf7dc-a726-48e6-a334-3cdbf83977bf", "value": "p243HSeoZ1NiiLk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae66319-b766-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677588790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588790, "uuid": "2b85e54c-bb0b-4ae9-ac12-88199b1d6fba", "comment": "Malware payload (AgentTesla)", "value": "7c8a0ac26cca5e3322b29ad73a62fed9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588790, "uuid": "c02091a9-2097-4192-b042-c0e266beee66", "comment": "Malware payload (AgentTesla)", "value": "701a167404adf57eb83f6b3c0992556abb162823deca6589c1d3d33ecfb7225f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588790, "uuid": "cc1910ee-408a-4d70-9acf-be87be0c8c15", "comment": "Malware payload (AgentTesla)", "value": "804870e8c7291bd0fea78785c432d1926f4fab51", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588790, "uuid": "bca9f3f7-ffb1-4b6c-b196-0288176d89cd", "comment": "Malware payload (AgentTesla)", "value": "dc6ea41a497c8dcb41dadf8fe91a91fed8633b950d12344438a5b2986379edcb7e6e62838d57be1aa4378caa87a2f8f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677588790, "uuid": "383f1827-95ba-4126-846a-518d404cf532", "value": "T19025336D4DB12A5BF7A19665639430381C2404BB6BE3550204ABEB0F6AB713FEF3D931", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677588790, "uuid": "d0f73741-cd76-4b86-ac84-d5aac69220da", "value": "24576:3rBwBTbJF45+PO6Ojf2cZfLGmQfdov8t8vN8UsiDeAV:9c3q+PO6kKm2dov8e3AAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677588790, "uuid": "c151383e-7351-438e-9236-e817eb8a53db", "value": 1020667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677588790, "uuid": "dc674173-3839-41ff-a2e8-7d26981e8fa0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677588790, "uuid": "8870cd1a-8c41-4d31-9e8f-ffc4c50d0f00", "value": "purchase Order for Servo.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac63443-b6fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677543075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543075, "uuid": "7bdfb8a4-4a3a-4710-a595-5bbc0b7c14b0", "comment": "Malware payload (RedLineStealer)", "value": "7974f0f7e552ea3236517eb6fa1c2101", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543075, "uuid": "28c5c0a3-c892-4ba9-9fe7-4ec511480665", "comment": "Malware payload (RedLineStealer)", "value": "712898898a61ae5605e730b1ce5776cb4ab8322b520483720ec1ee6cceaaaee7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543075, "uuid": "c2bfc752-fff1-4647-b8c2-9c827e732c4f", "comment": "Malware payload (RedLineStealer)", "value": "bac731aa0020423589b26207c5e87ce64f36604d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543075, "uuid": "4e357118-dab0-4c46-afa8-5e529fd279be", "comment": "Malware payload (RedLineStealer)", "value": "a577273360860d63c0b2c08cd318287776de9aa3ab6e16bdf824e63e7a2acf7f0fc8e1cd9f7630903f817632943a9f36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543075, "uuid": "25bd0831-8fc4-41df-844b-8a274ceb6224", "value": "T11F352307F5F8C063D4B0037069FA02D31D397D616E39838B638E6D4E1873595A679BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543075, "uuid": "ecb2e0e0-afa9-4118-ab70-0b3ba63c1347", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543075, "uuid": "65a42df5-9ebd-4713-a0e4-1d0673411545", "value": "24576:zyG1ZxPCHiURPkalV1WFdFCYxtB+4G8IYjMGXIQWcAVCi:GG1ZxCiUtjlV0FdF5k4G8pAGYQWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677543075, "uuid": "d6b7db6e-b755-4003-b074-f3ceabb8374e", "value": 1141248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677543075, "uuid": "ed4765a2-7977-40e4-a1b5-525ecf903462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543075, "uuid": "4fee9d5d-dc82-48fe-b80d-41e11da7d919", "value": "712898898a61ae5605e730b1ce5776cb4ab8322b52048.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8cb3bb9-b762-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677587042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587042, "uuid": "3ef11e67-b049-4989-86c8-98bc10742a73", "comment": "Malware payload (SnakeKeylogger)", "value": "8e5d4b26d24046674a9074f07b02e021", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587042, "uuid": "b6860cee-8b16-49f2-a227-68371c77407a", "comment": "Malware payload (SnakeKeylogger)", "value": "72040e3903cbbeecc6f5b1158e93839546e92a55626cd6c17b31cc39a1f57be8", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587042, "uuid": "b8b56694-8c92-4849-a79e-c1191fad296b", "comment": "Malware payload (SnakeKeylogger)", "value": "dd58d3f0ea4bbce406d770abc7f4ff4ad1551b09", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587042, "uuid": "0be19912-2294-446e-9da0-6a05ea94db34", "comment": "Malware payload (SnakeKeylogger)", "value": "75e684e86fa31bce42532194439f508186d703006a511d8d57f7d1c2db6edc717900500ad917ea815e5054f8ba851236", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587042, "uuid": "c0b7099a-9145-464f-9da9-7430f159a919", "value": "T1770533A652E7B647E200D532B2BB7C8D60E2DED3DC1D8050DF46C3BBAA5E31534199AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587042, "uuid": "a95ccbf5-6ee0-4c34-9789-f943023c9759", "value": "12288:Dr5Xas8qo4Hq01NiC5c9Sc89KIVRI7KNgTDK/YmulBl7YTeUDt3FPY3o7r7Ky+o1:Dr5lbor9S7UmRTN6et4kTlHQ3o7J+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677587042, "uuid": "c98d0e91-5001-4bba-a2a6-3e87e786cc94", "value": 817527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677587042, "uuid": "c48d03fc-1818-408a-83a2-47dd14c53a45", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587042, "uuid": "4011840d-6bca-40a5-a46f-d1e088ef1c39", "value": "proforma invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58597d86-b752-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677579981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579981, "uuid": "cc25d77b-2652-449e-9495-c4039757d7b7", "comment": "Malware payload (AgentTesla)", "value": "77d63acd68e5d2e08242ac3d8a2b7378", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579981, "uuid": "ed36bc73-36e4-4605-9c20-b6f3f5d16bbc", "comment": "Malware payload (AgentTesla)", "value": "7291ec3c376ef815f0e1f30935478f84658457be2d9f8fcbc54a1126197e70e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579981, "uuid": "bb81ca61-e2d4-490c-9a47-5045a4fdfbfa", "comment": "Malware payload (AgentTesla)", "value": "814dc26593f35c950e529ec52cb3322e5c43013f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677579981, "uuid": "23a0540e-134b-4485-a6e4-755e092d88cf", "comment": "Malware payload (AgentTesla)", "value": "3d5351f0ed236c4485b2acc58b4c07d15a95eefa1111e4d0f281980abfdc28b56a67d4d3bffb61ca057ff08800ee0774", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579981, "uuid": "0055664b-0c07-4839-b888-9f9a9f2c67f9", "value": "T14BB4234358D4C663E9AB44B8C84CECE7A37168237407B88628FEDCC668E77D14E67617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579981, "uuid": "c0df6e08-6746-4a33-bc90-039a8a90cdb5", "value": "12288:umXSarY9yKGICmooYMCrFVrceuEzZLp7YijCcHh+:ulf9ECYMmFFcE6KCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677579981, "uuid": "a1b8b8ae-9f3e-473f-b37c-54fa1abf03df", "value": 516504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677579981, "uuid": "5b35cbb0-c97b-4502-8a36-8750a8d5509c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677579981, "uuid": "2c7927b6-74a9-4de4-869e-cf99b814595b", "value": "20230224-695738.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e46a26-b738-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1677568815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568815, "uuid": "fdc0e630-7665-484f-9483-f9cbe27ebda6", "comment": "Malware payload (Tofsee)", "value": "0b71857b2363f362995055727306dc8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568815, "uuid": "d6cb22f0-4eeb-4509-9ebf-3845f3e45290", "comment": "Malware payload (Tofsee)", "value": "72da01f8e5450978f3945b3a8c0f459d5a77a4606a7272ac06978a4d97f14a24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568815, "uuid": "51eade48-1f0a-427b-81f9-a3a832d08a0e", "comment": "Malware payload (Tofsee)", "value": "6b168e92a79cf4828afdc76b30f0997b75563eec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568815, "uuid": "da9e197d-bfa6-431e-acda-50251f33ff7d", "comment": "Malware payload (Tofsee)", "value": "56d498378c5807fb982d44ecc3e68a43c409363b068171e534cddbaac4cc0b9ac049cf34e1c96dbcdfc0f97ee68f1165", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568815, "uuid": "da895a97-501d-45f1-8fb4-0a64cb4b6039", "value": "T12D14BF167298AC70E45E4A324D3AC6F52B6DFD628D246A9B33343B6F4D702A0C5F2717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568815, "uuid": "455c0cbc-b2de-4878-acad-5d4add46d94e", "value": "0943fbbcdf22e7af9e2a806addc5948b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568815, "uuid": "443d8066-7bb9-4e34-bac0-cce3a48f0803", "value": "3072:V/c4d5LBfJ+W2L/1tIHrkd/y/7K5wHGwIAl7A3uxWUuFQewRy:VfdXh+W2Lzarkdq/7K5wXl0ucUuFKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677568815, "uuid": "8af12969-d4d7-44c7-bb1c-14b57d538315", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677568815, "uuid": "98e1666c-badc-4ff2-88f4-c667b84fc6f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568815, "uuid": "8f247a1d-2b38-409c-8707-e3d9f920afae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea43180-b738-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677568986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568986, "uuid": "78d6974c-acab-4542-8637-657c99bced42", "comment": "Malware payload (Formbook)", "value": "e4bbbdaab00c221db7e8f6ffba2aff81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568986, "uuid": "2169ecab-16e2-42a5-83d8-d8e92ee36fc9", "comment": "Malware payload (Formbook)", "value": "730fa0df480a7101f3ba68bffa45423b39901c43b204008dfd509fcfff75d9b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568986, "uuid": "db2e5cd6-ff57-483d-b550-d7984266ba11", "comment": "Malware payload (Formbook)", "value": "d68707c826b168a6dba09714fe8e12742ecdc57a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568986, "uuid": "2d1ac08d-377f-4774-93bb-080ac25a8e31", "comment": "Malware payload (Formbook)", "value": "464bfe63fcf1d36c76de4ea0ca46593e359d9f4295c9dcafdf3bffa6b644310fef4782768122280d4be860fb6e06afe2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568986, "uuid": "882e66ab-646b-4e8f-9a6a-f6539bc25d15", "value": "T19C5412247AE0F867C9700A721DBF5B9FAFFEA0135846D60F1351652ABA235118D0F393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568986, "uuid": "2849b1fb-ee78-4165-99d8-4d35c2d0878f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568986, "uuid": "658ea9d3-8dc4-4c1f-94ee-5a4643801a9c", "value": "6144:vYa6AoK5G4mixD3tm+O3qyQEMWb/icAxtPxseNQz:vYuowdxD3s+O3q1Cu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677568986, "uuid": "db462144-42d1-4752-ba96-5f7265d6ab83", "value": 306355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677568986, "uuid": "817f4691-5111-4fbe-bb92-3f4ae1ab7371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568986, "uuid": "ec64e9f2-cf27-460b-8b5d-2d95d74c0328", "value": "DRAWINGS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d1cfcf-b741-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1677572602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572602, "uuid": "d130f5c8-98fd-4ad8-a79e-528c033599ec", "comment": "Malware payload (STRRAT)", "value": "6b23a74022ed579c5bc50d52e2876648", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572602, "uuid": "dbd23602-6c60-47d3-ace4-caec0f51d3e8", "comment": "Malware payload (STRRAT)", "value": "736c46cbc19813113b77ea29f42b32609735953f65a6e597ae73d7018dfc873f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572602, "uuid": "59b73b8d-d20a-416e-9fce-bb25c1f18200", "comment": "Malware payload (STRRAT)", "value": "4fe9512fd26ab40029ad565416760d2e34649a34", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572602, "uuid": "42f7b718-072f-41d0-b878-3a19d516af55", "comment": "Malware payload (STRRAT)", "value": "a0a8828ba109694cf968bddf76d4962fe8eff10c489a57beab22d8d063507a374f2ea317b43dd556bf354fd3fda14001", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572602, "uuid": "e953fd12-8369-4946-960c-ecd1a4ff81a6", "value": "T12C745A259DC706279F650004DB9AEE518196FFD81E3CD81B46F53B5EAA22DCC832E1EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572602, "uuid": "b2651479-8fc4-4619-a352-2c4125630480", "value": "6144:GQyO6sqZ/bjVK/7XdO4jBkiM1jy7T6XottffXplERTN7tEmCMpO+49MYWg0N9:NyOfqZjKzdOekiM1jalNZlA5CMp/4Z0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572602, "uuid": "36d3706b-17f5-4335-8084-6b7ad953bc5a", "value": 355361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572602, "uuid": "65e9122b-14eb-4b67-ad8e-0a86a1093cda", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572602, "uuid": "e0638c8e-46c6-4175-ad36-235989c57355", "value": "000000103-8L SCOI 96X160 - SNO8NH4114.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c93e9e1-b770-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677592793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592793, "uuid": "b15608bd-fc47-45b8-b3c5-66b5d2bc920f", "comment": "Malware payload (AgentTesla)", "value": "d6ad6e2b1d91c734eb3e90e3e8751969", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592793, "uuid": "9398a500-36c4-48b3-a316-2c1db39135e6", "comment": "Malware payload (AgentTesla)", "value": "7581026b5d2f0521ed0e40ef5ad28dec7c9b3e2b113cceea5eb63483af1463d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592793, "uuid": "66933b8e-5c90-4c7c-b2c1-b79a2f7e465e", "comment": "Malware payload (AgentTesla)", "value": "bcacca6567d2f696718345605f27510ca55766cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592793, "uuid": "2438a781-a645-4241-9b1c-ec02694250ef", "comment": "Malware payload (AgentTesla)", "value": "e71a16c6d14c2ef44cd6db34b588d206595b8dd4f3ebd297a3d70c2b06ab22a24c832b3d27b8f807efffd4e5aaaac5bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592793, "uuid": "651408ff-398e-4b6e-a2fc-29dbf4cc8da3", "value": "T1F26422155BC0E837DF964AF60CB103698ABB68352490EB16ABF42F4BFF56042D50F7A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592793, "uuid": "4c67ff7b-378f-4eaf-befc-2e9c97bf76c0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592793, "uuid": "08755b6d-b23d-492d-9d42-99113a2a27c8", "value": "6144:/Ya6lB+TUXisRpacELICZm/wqD/LLHzKPYiGJIh3yaJhGs/Rfss5Z:/YXI4XispaDLICZg/LHkYidh3ys95f7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677592793, "uuid": "4f9c214f-b3bc-4520-96cc-e36312e4e961", "value": 323989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677592793, "uuid": "7be26dc3-56dd-4223-afe6-27359225e526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592793, "uuid": "39249a2c-b108-4260-9874-f50e53c544a9", "value": "SO# A56DX04471 JOB#SZYC23021891.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb94f0d3-b73d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677571209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571209, "uuid": "0764fed8-bf57-45d2-8945-4bd03f20e925", "comment": "Malware payload (Mirai)", "value": "40f9bbf5dbe58c9f4c86c0adefa1049a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571209, "uuid": "dd94c267-bd37-4f70-81e5-98629b035bf3", "comment": "Malware payload (Mirai)", "value": "75c1734c72f9f93183eb5f1caf5be90bce32b45aed6b39bf81fefebe3b56d10a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571209, "uuid": "3d3ee32a-597f-48e4-bee8-c11f2de7b146", "comment": "Malware payload (Mirai)", "value": "913d2c2d0db2ecd5ba9ea3e553c6d44184e639b7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571209, "uuid": "d5009749-d598-492a-b9c2-eee6612c8d1e", "comment": "Malware payload (Mirai)", "value": "c52246442a4d9caceed08238af3b068f5411a5f19f47f996e5052407a9a8837d73519561a76e88524abef73b8ca3f0e4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571209, "uuid": "42c8bcd3-f8ed-41ee-9a4d-42a0f993ecd8", "value": "T1C3C2DF7016667E20C57008318C28C7DA6B3737F9D169B8E615740BECD4DAA8F687DBC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571209, "uuid": "c1ac2e62-e872-41d2-ad92-c47384c564f5", "value": "768:eQaaX8dMsZUIj84/11d5PKBEVXjvI4MS238s3UozbV:eQaaXP+Fj7t1KmFwSI5zbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677571209, "uuid": "9632eee8-312f-4b5e-8e69-03e48a7d4448", "value": 27928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677571209, "uuid": "3b26bd68-80e3-4d73-a851-639d4fae932a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571209, "uuid": "6bd1867a-e6ae-4007-8c40-00522dd78b10", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc3097f-b72b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1677563480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677563480, "uuid": "be75feb1-6748-44a4-8021-57bac2dcb098", "comment": "Malware payload (Vidar)", "value": "fea802cdf69c99ccb3b1f586f60a5a07", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mixsoftware.tech", "colour": "#BA6028", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677563480, "uuid": "7a0c4042-093f-4498-b3d8-0057dae0bf3e", "comment": "Malware payload (Vidar)", "value": "773e4ab3c1d6b3b202da037436d1788579074e94978a84951eb124b840757fa9", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mixsoftware.tech", "colour": "#BA6028", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677563480, "uuid": "dd533f80-edd6-4868-a631-6bf9ee8893e8", "comment": "Malware payload (Vidar)", "value": "93d71c3291ae4d5198f52cde6d861fd093507f1a", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mixsoftware.tech", "colour": "#BA6028", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677563480, "uuid": "7f991829-7068-491d-83ec-275a11cfea5e", "comment": "Malware payload (Vidar)", "value": "2ebb471a766ad7662d183f4c87fb3ee5a614dc8d20e1215c8be353cca5937471c25800e5a2a3f4f2ea7587ce836815c9", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mixsoftware.tech", "colour": "#BA6028", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677563480, "uuid": "8d366a98-8d6b-4f3d-b709-abb674e95e12", "value": "T118A6CC879B1959AAE838637051E74F20ABE3C52817B21B471FB0242E2C77355BF70ED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677563480, "uuid": "b866d529-4842-4364-81f0-46dd0870c659", "value": "196608:iw4W7K6A0aD7L4B9MtQiVKOPH1N4sBSc7zA0adqBDMVQiAwGPbU:iyNeX4qQiVjdm2d9IqgQiAjzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677563480, "uuid": "49e1c281-550a-44b3-99a0-b7eb1db390f3", "value": 9974072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677563480, "uuid": "6c8d714c-267e-4638-b5ac-05dd02f9250c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677563480, "uuid": "b4105c13-5696-49c0-bdb4-c1f19f9cca65", "value": "AdobePhotoshop2023 (7).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a84ce90-b79a-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1677610855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610855, "uuid": "bc674c59-802c-4aa3-aa20-cb80299c0fa5", "comment": "Malware payload (CryptBot)", "value": "ddfa9e1444c2503117af3a760cab583c", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610855, "uuid": "0949febc-274d-4fb2-9733-5ef851e1ee21", "comment": "Malware payload (CryptBot)", "value": "775ad3bf15913e6b80e129f23c5e482d6ca4b4b4b613ea894f45d02ca6c50fb5", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610855, "uuid": "b7513f4e-9094-49cd-9cef-eb00d49b6cae", "comment": "Malware payload (CryptBot)", "value": "8488669627658847c0158b3bbcb81c99dcdccd96", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610855, "uuid": "c5733d99-daa4-4dc5-9c74-05fcfe19a601", "comment": "Malware payload (CryptBot)", "value": "9c6a34dccafbf4ace53f7b8717223793f65d4833101766398544c400fb0c22e759467267778c880abd26f1343b094208", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610855, "uuid": "570fe145-07f1-46da-9126-6673138c7b7f", "value": "T18305F1E2B8A08277C0560A7ACA6E5137933CFA174417655B33D0AE7FF97C112DB922B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610855, "uuid": "8e54fa1d-f512-461a-82f5-f3df5a6ba942", "value": "12288:Ricj7kqzxDv6fa7xnU65CQq5vXt5DPEhCDaCf0EBN9TjDwBCS6pINJ4svbI3/E57:sG7r+J4QDaCf/n9vSG0Lb5lNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677610855, "uuid": "ecfb3dd8-d79d-461c-8ce1-c58f780b2955", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677610855, "uuid": "0812bbf4-aaf0-4106-b483-fc7780219efe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610855, "uuid": "5b348551-072a-4017-932a-c01910acf8aa", "value": "ddfa9e1444c2503117af3a760cab583c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d867606-b765-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677588043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588043, "uuid": "9e85bbf0-ee29-4f8e-8a1f-b3c060355959", "comment": "Malware payload", "value": "f944cbdbd878521516eda2b44a909dcb", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588043, "uuid": "422c89b7-25e6-490c-8b79-08255f14ff5a", "comment": "Malware payload", "value": "77a882ca5aef02c166a86dd430a6e70744c5936be627bf6d1c3b945b535d171c", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588043, "uuid": "98bd5978-70cf-4e54-8794-7a4ee86c43f3", "comment": "Malware payload", "value": "0b3704b40f45910a71049081b72e823d811439a4", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588043, "uuid": "fb8ea6b9-9023-4f44-8982-5b2bbb1b797a", "comment": "Malware payload", "value": "4006c56e28dbaf3922df1c15b4a7bdb083c29228aec03db9371625cef61033e1f6cb604ab22b5616ed300b61d50716c0", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677588043, "uuid": "c6e45edf-83a3-467c-a2a1-9645cd67135f", "value": "T1AD62C051165BB52C9890F53899BE3FCA0F3626D42D81DDF2993B5E5CD089838526903F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677588043, "uuid": "83b59799-8c8b-4435-be3c-549a6e937615", "value": "384:1Ur4JSFFbg1oisNw0UmHzEsICJ0cVm6GcSRqO:1q4JSFFbg6Rx1H4sJ+6aF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677588043, "uuid": "e41e5ee0-96e9-4e1b-8ed2-2ccfb35bb169", "value": 14870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677588043, "uuid": "1b50b060-6c14-43e5-81db-d93b73a3e840", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677588043, "uuid": "140239e5-1be2-47da-94c0-88180ef7b11a", "value": "0bd08c14-b583-4514-8a3f-08db1964f304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12056d5-b781-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677600290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600290, "uuid": "762960be-823f-4198-978c-abf286b821e6", "comment": "Malware payload (SnakeKeylogger)", "value": "c7054f006405261d87b7f7b916a52934", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600290, "uuid": "c66b0f1a-e1d4-4912-9e71-94be9963764a", "comment": "Malware payload (SnakeKeylogger)", "value": "79aed49f0c68c31e73f828fe6796a1fbaff39a50e79e14c4d8436d57ecac944b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600290, "uuid": "269a50eb-1a85-45cd-ac8c-87ac059dfb57", "comment": "Malware payload (SnakeKeylogger)", "value": "ea05883b09ccc6fdb0ed87f696845a4355ceb323", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600290, "uuid": "5cd5a6f3-4db4-4361-aba2-3a9f86239ca9", "comment": "Malware payload (SnakeKeylogger)", "value": "85d78d7450069c21d2ccc8ab62168c6a63955f395fdf99cd898142031c9c44d0ae1c875c193cc89b77305d5c3b461e08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600290, "uuid": "e3333c71-1a16-4d0c-b268-d18565c33d09", "value": "T1E9157E320193BE9D5B672ED5E50473B28C5CBE779B15C214BEC80FE811A62389D5CBB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600290, "uuid": "391e5462-896a-4458-a5b6-89e3ed9d6014", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600290, "uuid": "8ab5bbfe-7619-4b4d-b8fa-0d9c7a7d105a", "value": "24576:kvE74gr3ENDyEtminWoucmB4bRvPIs/IlnOAhSNqk03N4GtTG2x1:tjbjtc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677600290, "uuid": "38a9f2de-e074-47be-985f-24c119b2e360", "value": 936960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677600290, "uuid": "db0c1a73-2cfe-4904-a80f-969ed76c03be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600290, "uuid": "b8350667-aae4-402a-bc7d-4d6c28fba2e9", "value": "c7054f006405261d87b7f7b916a52934.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb6bfa0-b73f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677571833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571833, "uuid": "f00f1b3d-e1da-44fe-afd1-9988b108407e", "comment": "Malware payload (SnakeKeylogger)", "value": "4ec7471d5e7d29ca1e37fcaf25d187cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571833, "uuid": "3ec16211-652a-495f-a7c5-4cb424bcce81", "comment": "Malware payload (SnakeKeylogger)", "value": "7ce06c4227d8b111e23ea4af903379bef4211205ff6a6a582aa7c74149ec8b47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571833, "uuid": "21e568da-6bba-45ec-b7b8-6aa1104876b6", "comment": "Malware payload (SnakeKeylogger)", "value": "19e3989eb432f342521412cf69d0c27c54c71319", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571833, "uuid": "45171df7-8d59-4973-825c-551a7c606bb1", "comment": "Malware payload (SnakeKeylogger)", "value": "99d236ddcc36fba380eb5f590014e52f32483d82251cb63ca076689529c05e6f94b0ea86d57a88d8a37942b76ba8a96f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571833, "uuid": "7c11ac82-cce1-47ce-9146-a47ad9cb7845", "value": "T16235AE4853B344B2FBDB12A51865228C4EB872CB3585F21B5F673751A522AFFB29F103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571833, "uuid": "fe0c9d79-67bf-4cd3-8451-179c8f74e26c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571833, "uuid": "5595d25c-afca-4b48-8924-f9d8c1bf61c0", "value": "24576:QdgmeCuCAbc+hkvPYDO75jlI6UrKZZLkVsJ3/+o9x/6qW:2gmeCu3soy7plI6UrK7kVsJP+W1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677571833, "uuid": "54be7138-3ea5-4cff-a64c-d4970fc52233", "value": 1155072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677571833, "uuid": "16079766-217c-4188-a0fe-e83efa7706e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571833, "uuid": "fdda2d89-36b7-4255-9ba1-75656d8be8a4", "value": "AWB 5331810761.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93841df0-b728-11ed-88f6-42010a9c006e", "comment": "Malware payload (CMLocker)", "timestamp": 1677562041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562041, "uuid": "0ee675e1-06b5-488b-9d93-f6d835a78502", "comment": "Malware payload (CMLocker)", "value": "fbaeb3757e8d010e5da5f4366a77f88a", "object_relation": "md5", "Tag": [ { "name": "CmLocker", "colour": "#79C7D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562041, "uuid": "2ca5d604-c293-4e67-b587-4965844e331e", "comment": "Malware payload (CMLocker)", "value": "7cea77e77026b7fd48d2e2cc1eb6c7a4e020acadf44cfe2f5fe10fbcd1d3738c", "object_relation": "sha256", "Tag": [ { "name": "CmLocker", "colour": "#79C7D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562041, "uuid": "052df9ea-e34a-4b6a-afb1-a1e920c875d1", "comment": "Malware payload (CMLocker)", "value": "eb604d0e919f4779cc524f8a837f3437acac2833", "object_relation": "sha1", "Tag": [ { "name": "CmLocker", "colour": "#79C7D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562041, "uuid": "27892340-0df8-400b-bfcd-6010b5fbd728", "comment": "Malware payload (CMLocker)", "value": "e67bc8df20836898ca8d19cfca05596cbc767f4cd19ab1a707d335a9e132decdbec862e21e1b01c7fe065af5a10a0e23", "object_relation": "sha3-384", "Tag": [ { "name": "CmLocker", "colour": "#79C7D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562041, "uuid": "d99e0f67-b757-4d58-a120-2f658d834330", "value": "T15535020FB958CF20C7C46EF985D79C3917A6E8A3BA72B34A2F48725C090577A9C43785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562041, "uuid": "0576f7df-c148-46af-a367-0d75cef32930", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562041, "uuid": "bb83a9de-4bc4-424f-ab05-cdd776df0dc1", "value": "24576:RTvx8CkABhpfYUSxw/V8LnGGS6xdCsIfvIMeEybL7pma6dc38FrDwUc:RTvS+nfxAnF1dCY7Ey1V6C3KrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677562041, "uuid": "93a7ff58-9785-41a7-99e7-a692f6fcaa0a", "value": 1129472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677562041, "uuid": "c8e85d35-6502-49f8-90ae-5eb6a716d746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562041, "uuid": "2149998a-b1a6-4a1c-a69b-fbf9091affeb", "value": "Client.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c0117b7-b73d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677571075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571075, "uuid": "a4a7e444-13a5-457c-85b4-79abdd062b58", "comment": "Malware payload (AgentTesla)", "value": "a0d3000e5792081fa970184fe592808f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571075, "uuid": "b8a1158a-f0ef-47bd-92c6-5c278d02f639", "comment": "Malware payload (AgentTesla)", "value": "7cee2955d8fee68f5501d86c84159f3e8cefcd52476a950a5712b84bbb1feedd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571075, "uuid": "0759edb0-1e4d-449f-91f3-f99589c740f2", "comment": "Malware payload (AgentTesla)", "value": "551941fd7e55cb98ea3a2f315fabe1d2b0a0b935", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571075, "uuid": "d1bf169a-72af-4d12-b0c0-dfa3dc49c5a0", "comment": "Malware payload (AgentTesla)", "value": "7a66c3a2fdb86a3a88f7e3c84b34545ea16fb67fcb13122dbef98607f3f422cf418885b91506e53bb7829b19ad2d2f24", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571075, "uuid": "a6d99ef8-e4d1-4571-8679-4ce67cf2c22c", "value": "T1846217505BCCA5F2C328E133912AA05A84BEA577705B09D8B5CEC0D17BFE20D86F96B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571075, "uuid": "bc34406c-2129-4a96-87ff-b755e5dab5c6", "value": "384:jLK/OjcpXkr/SgxjvChYcsVGUXMrZc6LnqDm:jHG0r/SgSYCuMrZc6Lq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677571075, "uuid": "fd67851e-d51e-4fe7-9a2a-9614a02966e2", "value": 15305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677571075, "uuid": "0a7d4e0a-13d5-448c-9066-9f29dcd00960", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571075, "uuid": "8bf84cb7-7671-4e6d-85c3-f6d1feeb4020", "value": "a0d3000e5792081fa970184fe592808f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e3c6d4-b7bd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677625980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677625980, "uuid": "49b7f141-1624-483b-8692-bf35a7900cdd", "comment": "Malware payload", "value": "d074377211ab2c9016460b7568451bfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677625980, "uuid": "ec22a5d0-d2dd-4e74-816b-679961b9515e", "comment": "Malware payload", "value": "807dba280d2922afbdb7334fe3e0a602f59dcf597276c6b4948e8140090bc19b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677625980, "uuid": "97e88c24-d097-4b3b-84f2-79de1eeae3e8", "comment": "Malware payload", "value": "957e90633dc68232b3bf3388bcf9d10ab57467ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677625980, "uuid": "463ffe7d-e5a7-4c64-aa16-2922869b7929", "comment": "Malware payload", "value": "883972d9ac6768dfed5a316688bd7170c609db6a7b03f209f66f3301df3432d758320c4085b958e0612b69c48b1aca54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677625980, "uuid": "1366ae95-d22c-4b46-9e47-6380305958a5", "value": "T1A3A4D023EF0D4564F75AB8F807C05973A259B87A174F20C29389092E36BDBF59C71366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677625980, "uuid": "d66bf13e-1d41-4814-877a-553f20ceddff", "value": "5e56c23cbdafb3c243efd0d012267996", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677625980, "uuid": "3ddb7d70-9325-4c21-81a7-3c7678d32a1d", "value": "12288:ZiPlNsKGv1GteG+S7SvnVde+3u/sXpbB:ZiXVM0ejvVd8yB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677625980, "uuid": "b7310cb3-eb62-4115-ad5d-4a7ac3cda791", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677625980, "uuid": "f8d92a92-c47c-4fab-aaa0-4f8d5928f947", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677625980, "uuid": "f46f61f8-d55e-4900-b5b2-605e451874e4", "value": "Adobe Photoshop crack_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99f427f-b781-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677600304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600304, "uuid": "e49b93d5-7011-4cda-9468-4508fa9659f7", "comment": "Malware payload (SnakeKeylogger)", "value": "25b935141b81a5881db9f0b83bd22be5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600304, "uuid": "7b3f2ca4-9c70-4759-b550-6e9acf9bb520", "comment": "Malware payload (SnakeKeylogger)", "value": "813355fe326601b1d743b357c0a54915ce954270bf7eb9225a5cbe832c406ef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600304, "uuid": "98766813-3c20-4b0e-92cc-743792164ba4", "comment": "Malware payload (SnakeKeylogger)", "value": "c108c6d4765207e72720fd66d962a29bb12d09b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600304, "uuid": "17e3e640-5d17-4d58-a53e-d06a215aa4c0", "comment": "Malware payload (SnakeKeylogger)", "value": "5211fb8294887529c5e14cf5376f080e07a0f08c98ec5141a82ba8fb52a67a01b1f8c0945802b3ca09c12ecf8c287261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600304, "uuid": "002d0ba0-dc2a-4e88-9a6a-6578b8a86cbf", "value": "T159656C84B3708CB6E8DB01B16C5661681DB2BDCE6454F20D57AB77076AB33E7708EA07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600304, "uuid": "d0c5546c-5026-4fea-a898-df6d3f512ade", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600304, "uuid": "49857b74-7007-4f30-a64c-7567acd706c5", "value": "24576:9KClzfD7SzYeJdMR823vGZtAMNHRwRKWIhFtOigLHou3v2LxbCA6/+otq:w+73SzYEdMR82kPNxw5gtVgLHoufChaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677600304, "uuid": "fd762b04-af1e-4f32-a6ea-1ab0f2e4af28", "value": 1541120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677600304, "uuid": "97ac7721-36f2-4722-9e35-0f4aeddc37c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600304, "uuid": "6f565914-17ac-4252-9023-1c8fa67a725b", "value": "hesap bildirimi..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a0e6ce8-b6ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677544255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544255, "uuid": "3e86cb5a-a237-4d84-ab12-da2e47dfec4c", "comment": "Malware payload (Mirai)", "value": "f3ed443707824742a21d2b0131f54d1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544255, "uuid": "3ec617ce-76b7-4582-bfe4-0b9c1c1f99d1", "comment": "Malware payload (Mirai)", "value": "81f498cdf6aecff393f32174b0d409dae2bf4f857b7b22fba74ed6a150107d69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544255, "uuid": "5ba63a56-25eb-4ccc-812e-d543c10b1345", "comment": "Malware payload (Mirai)", "value": "e1026bbc650e539e41582ca86e8090646015edfd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544255, "uuid": "6e80c3ae-cebe-4323-b5b6-b9a5c5cec822", "comment": "Malware payload (Mirai)", "value": "d00a39b70a054768622405cee0143bb9b537e7f0c3d6a78e33ca543c7219dfb41cf919c723258ed0f6219495e1426e50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544255, "uuid": "c609e90e-6c9e-44e7-b47b-9c0b4f3664c5", "value": "T18E239E77C879ADD0D1588274B9258EB81B23B901C6A33EFA4A45C6774043EBCF6293F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544255, "uuid": "1d4455cb-379e-4d98-bd8e-b2317747ad1d", "value": "768:naywtvenDMWebeUyuPe2TYOC6kArCnynzkvCgoui7sOCGC:naywtvk7xme20ukANkv4uTOCGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677544255, "uuid": "b43fb5e8-ddd3-4259-9af9-0d562951ce69", "value": 47732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677544255, "uuid": "0a1ea325-bb84-4f50-9a44-112d8fe89c4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544255, "uuid": "57165c74-f2de-4e29-86b7-77eac7f7e469", "value": "f3ed443707824742a21d2b0131f54d1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a709fb8-b7bd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677625994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677625994, "uuid": "bc3016cb-39da-4eb1-bd21-8ccbd9fec9b9", "comment": "Malware payload", "value": "e79f2426c1a863d534c84b246e22925f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677625994, "uuid": "c3d45759-6f21-4380-8285-53bb44dac4b0", "comment": "Malware payload", "value": "823ed9160c90cb222748a1dace33e1d5c9557c4a0ecb3db3ce9eeea43b6dfcbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677625994, "uuid": "f745d36c-da4a-4bbf-b18b-85c8afbcd5f9", "comment": "Malware payload", "value": "911d0b28c5bce88c855c9872291442761e33c505", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677625994, "uuid": "0ff04df0-f575-4327-8fb4-73f202aa7e4e", "comment": "Malware payload", "value": "e5cf85de099e87190af8f4bb674e5907f5b1444cb2f398d46b92ca57066acd6c0c9842d6813fbd33e5b96e2ca18e843c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677625994, "uuid": "5af34e96-ec32-4bf0-ab49-d5a7c2863006", "value": "T17405F05C6CB0C316D17DC2BE8AA25634E3BF7E83B885D21E198271DA1DB97D35048D8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677625994, "uuid": "6afb826f-b3b2-49c7-9659-3b09fdc22aff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677625994, "uuid": "7b867175-33bd-4fa1-b8da-ca4ff641391e", "value": "24576:9HCtn9BoO/NXSQlQXDU9lN9TW+Zi8V26VhaQMNDHqHn2h:6HKIr9T/h26za362h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677625994, "uuid": "2d195982-be3e-4b14-9825-6c00a3d2aa51", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677625994, "uuid": "f462170a-10cd-4378-810e-bc4c179d64f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677625994, "uuid": "978acea5-ac3b-4f21-9ac8-86efdd92032f", "value": "Installer_patched.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c884ab99-b7b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677621830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621830, "uuid": "7b2ace44-9f34-4e29-b733-2527d8615c5f", "comment": "Malware payload (Formbook)", "value": "ed638c860f727bb53e05d7738c8cd6c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621830, "uuid": "bb7919aa-f461-4c3f-865b-d547906de100", "comment": "Malware payload (Formbook)", "value": "82bb5ca075a83da9c44b1a9214aa7590bf992d8206038b4f3edd6bd8230f966d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621830, "uuid": "13ba930b-9dc6-4be5-9543-6b7dd511b1ee", "comment": "Malware payload (Formbook)", "value": "795c348b71ef960c93d67c749f658bf68628eff9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621830, "uuid": "aae1f611-1d73-45b7-905c-34056040ae09", "comment": "Malware payload (Formbook)", "value": "cec5fc966a8547f00f769cdbcf535a544fb2a4aabca4e2c7dda6fd04425b3eeedfe3e92a81c19280cc97674157a74a14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621830, "uuid": "c9674921-8805-468f-85b3-885a535f19e9", "value": "T13F4413AC6BE4C597C8A70C761D3A0B678EA5A51120A1371B6F705F9CBDB2B40CD0B762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621830, "uuid": "8a63effc-980d-498c-ae8e-8877c73e339a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621830, "uuid": "f2b42072-79cb-495f-91dc-03e1bca96f07", "value": "6144:PYa6KRh3te6ehdGdtvtE0tpcupf7gQcnBqg7fU2:PYMRpt0dGdtvtEgXUBqwU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677621830, "uuid": "997f6134-9d9a-4299-825c-c70a631d5fa1", "value": 277903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677621830, "uuid": "e3e06a33-63ed-4187-acb5-b88303cd27ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621830, "uuid": "669fb23e-8045-4798-bd3a-a6c2abfcffa2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec1ee51-b759-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677583079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677583079, "uuid": "1ea970d2-9054-47be-8024-3edb320d74f6", "comment": "Malware payload", "value": "f625044bf506e91760ca600d46058c14", "object_relation": "md5", "Tag": [ { "name": "1677576236", "colour": "#542660", "exportable": true, "hide_tag": false }, { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "pw-764", "colour": "#A66378", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677583079, "uuid": "05265f51-3c39-497e-8a2a-0571195e1080", "comment": "Malware payload", "value": "82fbd13e8e660f10904cbb23064cb41530e0469147f6fc07dd33e180b5842cd5", "object_relation": "sha256", "Tag": [ { "name": "1677576236", "colour": "#542660", "exportable": true, "hide_tag": false }, { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "pw-764", "colour": "#A66378", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677583079, "uuid": "bff59ff7-e244-44d7-8527-943848fcd704", "comment": "Malware payload", "value": "217b57b392fd6d31e0f3952676f5d1bf71e9971c", "object_relation": "sha1", "Tag": [ { "name": "1677576236", "colour": "#542660", "exportable": true, "hide_tag": false }, { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "pw-764", "colour": "#A66378", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677583079, "uuid": "c0052ad3-5c0f-49a5-ab25-4173efe3ca7e", "comment": "Malware payload", "value": "00f8eb368792f0fc11d4ec352c2980e1c00d79fb187678eca9149cb4ed42ff57c141fd3954ccbc388a3d8b86511d32f5", "object_relation": "sha3-384", "Tag": [ { "name": "1677576236", "colour": "#542660", "exportable": true, "hide_tag": false }, { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "pw-764", "colour": "#A66378", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677583079, "uuid": "7c1b6aa8-9122-4554-bd96-7bbc6a42266a", "value": "T131942336BA76BB431640C7C42D56CE3787CC0C45FE089FD54AB7181A6DAEE1A3198E63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677583079, "uuid": "199e242d-bc95-4031-9e1d-7f2a4d44b7a2", "value": "12288:gAUGPlaKEeQGf7Q0muTgOgJKWNB50vp7RRLRdofMwnqP:gAUGPl9f9gOgJKaB5YpFBRdinqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677583079, "uuid": "4d4e3536-466a-469b-9353-63f5f3e34168", "value": 448749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677583079, "uuid": "840b0a05-ca37-4b13-a043-f739d603711d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677583079, "uuid": "99f64133-56e9-4b1a-ae27-a1e9a3f3e1ce", "value": "SurplicianRectilineation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e80800-b73c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677570392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570392, "uuid": "d5cef7d3-dbd2-4991-86b1-a8d649b77b9e", "comment": "Malware payload (AgentTesla)", "value": "b07e0915d95f2e3cd160ea78b03a4498", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570392, "uuid": "f0e2bce5-af4e-40bf-a856-6327157c2e47", "comment": "Malware payload (AgentTesla)", "value": "830259122e9c75a4977848c7a340c7a13efb927302035bf9f3460530c5f4d7dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570392, "uuid": "4ebe2120-e91e-4ab8-9d14-859c0f347d04", "comment": "Malware payload (AgentTesla)", "value": "2b9ec076e0aede9f17358793a92c38f6c77ee7cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570392, "uuid": "df3831e7-83e9-4f27-b73a-e58690d45f03", "comment": "Malware payload (AgentTesla)", "value": "2b413b16d8b019dff029cf3063a9919ea71ff32691a163d2275bf8b0bce50f86e3f9a9e78fc3776f24d6514dd94c279c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570392, "uuid": "a68a5b39-378b-4f39-b5d5-18781c6c7ce0", "value": "T1EE45BE4853B344B2FBDB12A51875228C0EB472CB3585F61B5F673751A922AFFB29F102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570392, "uuid": "dd1b5ca7-1c99-4c00-956b-d9a0c289bc35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570392, "uuid": "abca56d5-34ee-49fa-bb7b-13e4eac92ee8", "value": "24576:EQgmeVuCA6/+oeypH4Q2F7cgqwFPx/6qW:zgmeVua+50H4Q2F78KP1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677570392, "uuid": "7d92e353-a647-43ec-8627-fca4f3f6a540", "value": 1250816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677570392, "uuid": "e160173f-92fd-46f4-a1dc-77c25e55bdf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570392, "uuid": "ebd8b58f-483a-4241-a78c-4ef95ea1c162", "value": "8FeZj5adaVMCh74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b0ec60-b713-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677552979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677552979, "uuid": "835a72e4-028f-44d1-82a4-3e9c5a6f07a8", "comment": "Malware payload (Amadey)", "value": "b0cfa5e3d91138c5d227129879992a55", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677552979, "uuid": "ad0c3f14-70fb-4462-989e-7df6f156d136", "comment": "Malware payload (Amadey)", "value": "8508f6a591889fbd963c6d9dad0ee968888abb577d036878691594622e3e8221", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677552979, "uuid": "a643647f-4e6c-4f6e-bb64-451da2352727", "comment": "Malware payload (Amadey)", "value": "71d780bad15b8718308620c2a5020798348846c0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677552979, "uuid": "67e34fa3-19e0-462a-ad09-4faec2fc99e5", "comment": "Malware payload (Amadey)", "value": "23e1c7cb2339a28360b4685d180ffade81a4ba09c1e99912b7848c64f70992b38ff9a005e2e2e18482b4f02fc02c946b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677552979, "uuid": "d06cf74d-32e4-419e-9028-c7f033c2555b", "value": "T17F652323B7E4A922E5B06B304CFE01C70A36BD615D1DC78B265BCD1B68B2174A73536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677552979, "uuid": "5efc7646-30d5-4b78-a540-1a4f5290904b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677552979, "uuid": "3f15a958-919b-41c8-96b3-aa1bdfe55495", "value": "24576:1ynxcnyp88ufD+4YLR6oK+yeajdysZgYQsuXOLGBteKsdPihFil:Q6yPcD+4Ywl+ye/xBTgP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677552979, "uuid": "01daacda-a098-4272-9ec5-2edd25bd94c0", "value": 1425920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677552979, "uuid": "6ac4243b-b833-4d4f-8b94-7271146baa87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677552979, "uuid": "ea55b5dc-822d-4fbe-82c2-28d674a13ee3", "value": "b0cfa5e3d91138c5d227129879992a55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c923b6c-b753-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677580471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677580471, "uuid": "1e90ffe9-c436-442f-8fe3-9c6571440541", "comment": "Malware payload", "value": "15772ec21b0bc3c7abc1b504d45b3308", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677580471, "uuid": "08abca30-b835-4dd3-9481-4b3dc5dcaca8", "comment": "Malware payload", "value": "85d3d3fa90de54e60a599a4ec3ff42d0ad01f1f79a7bbeea08adf736de0ffbf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677580471, "uuid": "e752eeb6-294d-4630-ba2d-bac2593fe69e", "comment": "Malware payload", "value": "881b500287d868d8d34e0d3f3e22ea593132cc21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677580471, "uuid": "03f84970-28c0-4c05-b30f-08d4f4df95c8", "comment": "Malware payload", "value": "eb7763d2c625fbe223dc173f7ec885b76733232b8583fc9f27cc462a078cad157280e9c718cf1dbf4a754526c172ec65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677580471, "uuid": "b29dc6d1-35e6-429a-b23d-5567a3d679b9", "value": "T1CAB1C987DB6108F2D61CCFB8257B886C8DB85250065163BDAA979DCDDEFA721340361D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677580471, "uuid": "70057532-e69c-4338-8040-252be0b884e6", "value": "61c23319a91805ecfdce53fd00ef205e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677580471, "uuid": "f777b811-442f-452b-a363-80225d13fd1d", "value": "96:BvWjCrhD7IoZ6O1O8I3Pmoynw364DwflHh+x:lyC9v6VtPmoynwK4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677580471, "uuid": "6e2d0cb0-8b3b-4f74-a9d8-e7d43071cfd4", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677580471, "uuid": "2f563cba-d693-4788-88f7-6bf9b488b890", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677580471, "uuid": "e2bcccee-91c0-4cd6-a360-4bdaa40c6e12", "value": "SecuriteInfo.com.Trojan.Loader.1272.6059.28209", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e49dbb-b728-11ed-88f6-42010a9c006e", "comment": "Malware payload (CMLocker)", "timestamp": 1677562015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562015, "uuid": "169fad9a-79a4-469f-89eb-e9cbc6095ac3", "comment": "Malware payload (CMLocker)", "value": "d0ca10593ce01e8d4e3dc0a8da0947d2", "object_relation": "md5", "Tag": [ { "name": "CmLocker", "colour": "#79C7D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562015, "uuid": "67603b82-770a-4aa8-8ccc-799d27a545f1", "comment": "Malware payload (CMLocker)", "value": "85f4b80608c2f5d7638654d2ea3c428220af27f66cb23f162c1c527d86a46b10", "object_relation": "sha256", "Tag": [ { "name": "CmLocker", "colour": "#79C7D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562015, "uuid": "be890a23-e823-41f3-8c30-1af84f671e66", "comment": "Malware payload (CMLocker)", "value": "7625cf4b4cb9ce54f92fa09323e26da7899df12e", "object_relation": "sha1", "Tag": [ { "name": "CmLocker", "colour": "#79C7D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562015, "uuid": "6a72380a-9c5a-431f-ae8f-f111db007c47", "comment": "Malware payload (CMLocker)", "value": "cbbac989dd33e2beac57206fce69b1d79dd0ac55e3b3c489a8e135ab5f4776df898761b525b653dd4d9921e2ed53c4e9", "object_relation": "sha3-384", "Tag": [ { "name": "CmLocker", "colour": "#79C7D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562015, "uuid": "45149c07-233b-41a3-8fab-b0b807b44c7f", "value": "T17D63950B6ADA79ADE02B5A735D9B7E4AE6687C433C49CB1166D0074F80674CEF207C93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562015, "uuid": "2b29ad46-011a-44ae-bb38-36729dc812eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562015, "uuid": "1117c270-5de1-47eb-b598-8265dbbb0d2a", "value": "768:Y8Pf1TmgdKBNgvkUZNoftI6B/e9btv/AeX3bAC2e/23uTyhS5rL29HQ3TZKrouP6:dPNTmlBgNoW+Abt6y23Luu/251R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677562015, "uuid": "4cfa8e42-0730-476a-a76e-148a50620d4f", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677562015, "uuid": "b2114254-a916-4ca6-bc96-f22b2678293d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562015, "uuid": "0abc114a-6772-4fe5-b28c-1def74770edc", "value": "ss_protected.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f4b28a-b755-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677581425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581425, "uuid": "4c9bad67-1021-4e53-acdf-a06be030e953", "comment": "Malware payload (Mirai)", "value": "5c894110a3a9cd441a0ae49471f7aa36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581425, "uuid": "06476866-7483-4a26-a212-5692de8bbe4e", "comment": "Malware payload (Mirai)", "value": "85faaba6d44fd6ed8732bc9209f50b179e1e6c39f492f7bb69c6c885db58a039", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581425, "uuid": "50300a08-529e-4163-90c8-038c0d4d32a4", "comment": "Malware payload (Mirai)", "value": "57f287d76c5b021057e3357fa34e18b668dca325", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581425, "uuid": "efb4bb4b-a808-41b9-8097-7ecf80dce19f", "comment": "Malware payload (Mirai)", "value": "ed638af361a4deab1ab8511e2f01398a50b69196c3f715eeba048772eb16351fec9ec35f4d34cdf991713ded0c06d094", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581425, "uuid": "ca9a71fc-22a3-46a2-83f6-0beba00ab06a", "value": "T193E2F136D046B76187B46CB6FBB21DB72F051DBAD0073259E16CD93CA0B1A4F836A583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581425, "uuid": "fba217c8-2ad1-4ce3-a20e-f3b2542654ea", "value": "768:2eHlHk29rbDTcTJQsr7FsZypqIws2qYMci9q3UELCD:2eFHzVfgTW8JsZiwsh+LE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677581425, "uuid": "3dab9b0d-95bc-4180-bf65-7fbfcb6fc04e", "value": 32188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677581425, "uuid": "aa99c8cf-f502-489d-b3f5-b1adcabdad9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581425, "uuid": "c03e6711-315d-42f7-8092-7be6d949d36e", "value": "5c894110a3a9cd441a0ae49471f7aa36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffbad1d6-b773-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677594435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594435, "uuid": "356292c8-d912-4787-bf2d-3bba26d9c0d2", "comment": "Malware payload (SnakeKeylogger)", "value": "0a652b03cead9014d9d597eec6e80ba3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594435, "uuid": "708b48e3-41a6-4dbb-8fc5-1ce3002b173e", "comment": "Malware payload (SnakeKeylogger)", "value": "866d465a933b54f6e0040bdf12733133060d760c298ad648f2fdb6574f96a867", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594435, "uuid": "715971e5-a2a0-40a1-bdfc-7dd9ffc57c4f", "comment": "Malware payload (SnakeKeylogger)", "value": "7bd9c3133ba1fe0fced6895311b782e32ecda7c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594435, "uuid": "f71e728b-12b3-484e-bd30-6a164f638e9a", "comment": "Malware payload (SnakeKeylogger)", "value": "379284987d7a70693b6f59854cdc8775aeaf83bd882937cc7f9bfe68734e94053b7116078e3100b329235b954bb3573b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677594435, "uuid": "102f9786-1dd9-4baa-8969-553f39c621d2", "value": "T1EA35AE4853B344B2FBEB11A11865228C4EB872CB3585F61B5F673751E522AFFB29F102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677594435, "uuid": "6f91651d-f3ca-45dd-99d5-6adf756dd155", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677594435, "uuid": "4b30b9d6-498f-4cc9-9898-835dfc076353", "value": "24576:fpgmeGNRe599xVlmTi4ozdbslsQivBIj8CA6/+o9x/6qW:hgmeGqDsTib2sQaIj8a+W1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677594435, "uuid": "64de9171-2022-4623-810f-af9c344dd118", "value": 1156608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677594435, "uuid": "199a6f27-9ab6-433b-96c9-05dd662cc2dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677594435, "uuid": "1ceade30-857a-4fae-a0f6-e830fc840999", "value": "PAYMENT COPY 71000.00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac71e615-b74e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677578404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677578404, "uuid": "4e7c790b-81dd-4316-a967-fa74811efca9", "comment": "Malware payload (Mirai)", "value": "24e9d862336e0daaf716f6c2b00ccea8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677578404, "uuid": "b4bc0f72-1c94-43e2-8227-31e84d6c602d", "comment": "Malware payload (Mirai)", "value": "86a6dab88eaf0960d33d646a1a778c5aa271db44dae3ab78b7ffe9d1de75a8c8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677578404, "uuid": "e99b3176-0556-4a16-b2fb-1eaebd41a81c", "comment": "Malware payload (Mirai)", "value": "0e6ddd5c37de283f97fb08aeb26732405e423a54", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677578404, "uuid": "511d858e-4d99-4d6f-9f85-c9b4e8f09b78", "comment": "Malware payload (Mirai)", "value": "3945d20ceaced1dec5145d6ebdd2b1f43055671b9bda4789d743eab3e92527d0175fbde04777c000ec1474afcc702a4a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677578404, "uuid": "27e7bc3b-7048-4d10-8ee1-d0f7190ddda1", "value": "T1504376C5AD52BD3EC3C2EBF7EE9BD24832E68644E396334291D90AA0D56FC89194534C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677578404, "uuid": "e2f79f19-8d7f-403e-af1e-61086c72dec2", "value": "768:/EixJmX20QSPz8AaW5v8jOUxNHX7wCVy/zmJHUhG1jew/BU1sgKLfSs6lz5OjEx1:c4kg2j56xizpwR8IYFfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677578404, "uuid": "ece2cafb-95e2-4e8c-9949-da2e0894873f", "value": 57106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677578404, "uuid": "a503bed1-36dd-473d-9f7f-b89696841182", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677578404, "uuid": "668fccfc-bbbe-4cff-bdcc-ffac7853cf82", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984c90fe-b73d-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677571069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571069, "uuid": "8cf0b76b-33ec-4668-92bc-0711059e0ff6", "comment": "Malware payload (SnakeKeylogger)", "value": "fd45b5dda04e2273e59f4a5a2c1ee398", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571069, "uuid": "cccaec55-7ad7-430f-9a9e-68e3237a93b2", "comment": "Malware payload (SnakeKeylogger)", "value": "86aab438cacf92cb5f7f5d2fb06541e9047191b52e72066280ea230d7e707e9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571069, "uuid": "7cae3c1e-eb5f-42fa-8a27-d7508231014b", "comment": "Malware payload (SnakeKeylogger)", "value": "9880f45106a91e4e409a72de5080909bbb3c05a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571069, "uuid": "51188534-264d-4e4a-923f-7f186783d4d5", "comment": "Malware payload (SnakeKeylogger)", "value": "79852d72ed6741797ee126bdae2a1194f337ae624f1e96566b74b957b5297087aa7460b39e62dac6291c552ac88458f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571069, "uuid": "679cf26d-3b2a-42ff-9311-8b502f4cf390", "value": "T1EA547B11B261B796D8361375CF7ED498FDCB2ED46CD081AE81E53E7B2271A80D88C91E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571069, "uuid": "20e0f35a-17f5-4c94-9ad0-57c14811cdba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571069, "uuid": "b1cfbdee-3c55-4e80-b9b9-f195611a6532", "value": "3072:ID288/YYYYYYyYYyYYyYYyYYyYYyYYyYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYS:nPJK/zes7ROPWBtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677571069, "uuid": "bbe9d88d-8084-4f9e-a443-6c7519071796", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677571069, "uuid": "8381ecf5-376e-43e5-8b3f-24750c2ac588", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571069, "uuid": "037f95dd-f2cc-4481-bb1f-a5b36f036d4e", "value": "fd45b5dda04e2273e59f4a5a2c1ee398", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce760fe-b784-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677601490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677601490, "uuid": "581dc403-6d85-495a-8da9-b56a22ee0b59", "comment": "Malware payload", "value": "f3cadf0f29fb5af5f4550c5506fc132d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "harly", "colour": "#DDAF41", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677601490, "uuid": "8822d4e6-c840-4429-9794-8bbb96a1c718", "comment": "Malware payload", "value": "8734e2533ae53516b46667a930e58df201e97ea03562b444fa50c19965cab4b9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "harly", "colour": "#DDAF41", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677601490, "uuid": "50c0888c-670a-4f55-83a4-5917358b5996", "comment": "Malware payload", "value": "a05fb565d6855e63de2e6090729ed9b22fb40cff", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "harly", "colour": "#DDAF41", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677601490, "uuid": "2b392639-9cc7-4762-afe6-44578555a310", "comment": "Malware payload", "value": "c0bde73f34b54013f9d84a2c2ef5cce1e6867cb6c51df47d12443c93508466efd1c92ea12adc6d2e700351c78cdfd13f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "harly", "colour": "#DDAF41", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677601490, "uuid": "4c44922a-31bd-4c4d-84d2-4321c3a40e4e", "value": "T19976128BF318646FC9B7913249BA622112570C674983EBD73D45B22C1ABB5C05F6EFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677601490, "uuid": "9b733eb2-f0e0-46d8-80cd-f70958fa83b4", "value": "196608:rVxS0w+rH9l4uu3sLv2LSEfEf8bmVQs1gfE:rVg6rdXu30GEkbmVQs1gfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677601490, "uuid": "9a3b189b-47b4-4381-b884-dbd224851c57", "value": 7248797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677601490, "uuid": "a4d15ba7-212c-40e1-8b6f-ce3a1c378493", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677601490, "uuid": "8ae6cd37-d08d-448a-b4c3-b684cb8f4476", "value": "com.pude.archo.aiart.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfe49a6-b73f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677571854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571854, "uuid": "67138ecb-ae0a-4784-bdb1-8c225e7739d8", "comment": "Malware payload (SnakeKeylogger)", "value": "1aa28841db218223e451a6bf9fc93f7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571854, "uuid": "f3347a66-8b7b-45cc-8d3d-e864151b2213", "comment": "Malware payload (SnakeKeylogger)", "value": "87e41dc2adfc3158321d04fbc7809d2b51c10c8508a31ef928be87fd6bbdb9cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571854, "uuid": "d0ccdb57-b19a-4ae6-9e4b-8b58f77c0815", "comment": "Malware payload (SnakeKeylogger)", "value": "defd39e690c50f2458f83d767eaaadc04c742f67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571854, "uuid": "b7065835-43ef-47a9-b397-c58d55fabb74", "comment": "Malware payload (SnakeKeylogger)", "value": "0912020acda2372992f9a38475e8e2023251d147680e18b44c169e9a6e82cd32fba8d1f9e4b8cdb8a58dd8dffdedaa9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571854, "uuid": "34651961-72f9-4542-9a31-8c49fdeb21be", "value": "T139256B8076F9D211EDCF326D091C568A7E79B107A152F22A9A7736C26307BF776CC482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571854, "uuid": "e180eaff-a515-4ad6-bcba-77a9bc3ad25d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571854, "uuid": "812fb979-ed18-4b42-8b3b-e88d583e7520", "value": "24576:/5Fy+jFy+QA5S/G0ofyyAh33w8qpBZUE+d/:RFrjFrQKj0ofyyA13GpTU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677571854, "uuid": "64700a38-6c60-4501-be67-6df9b0f62689", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677571854, "uuid": "28aa30b2-e193-48fe-90d4-511eb97d912f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571854, "uuid": "fed7e717-97ad-459a-9ce0-6f3f44b5b8ef", "value": "1aa28841db218223e451a6bf9fc93f7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edeac971-b79a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1677611156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677611156, "uuid": "83389f9b-00ad-48ea-9a49-f42ce9beef37", "comment": "Malware payload (AveMariaRAT)", "value": "3be8d8895a8accf4fdee8110ef331582", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677611156, "uuid": "eb11a41f-0e51-4513-9fd3-86c6a98bee52", "comment": "Malware payload (AveMariaRAT)", "value": "882906861fb17c5cd1c3f43e8658b13c9de18b8179b1809ec607cb9ed3d6b44d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677611156, "uuid": "c16d360d-6939-40d0-a620-885bb7950370", "comment": "Malware payload (AveMariaRAT)", "value": "cc5fb06bfc363d560ff3a832e8ea0922a50d3420", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677611156, "uuid": "fbe81ad3-c4a3-4ad0-811c-069964e757ac", "comment": "Malware payload (AveMariaRAT)", "value": "3ea8721bd1ffc64da9f266defaaa5ac04c77c83f37313cc56306adc727e8d77e78e83c968f5e9f5f60eef60fc2d3676b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677611156, "uuid": "250465b1-ef79-49da-b98f-a6abff1354f9", "value": "T108C1E812A3DD6737DD724B79DC63B3522239FB409D52CB9E5C88520E6C42B864A43B60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677611156, "uuid": "03dfe0db-46c9-4369-8a53-2898c5575430", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677611156, "uuid": "ae59fb99-8cfa-4308-8723-fda060094d59", "value": "48:6CiefPIMNvaYiCEsiloFozZlOVHaCH8k/2z13LPdDaqgDFWu2HxVHy916sbqBHE+:fnhusiLOVns8q/3VHyf66koxbXbFnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677611156, "uuid": "f2f8cf89-232d-48b9-bc2d-b9961953fc85", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677611156, "uuid": "e3db5ffd-7cb7-4b41-a3a7-d3d89fdf355a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677611156, "uuid": "704bbd12-9b26-414f-a6e6-3395dfef0bcf", "value": "3be8d8895a8accf4fdee8110ef331582.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cad034-b788-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1677603134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603134, "uuid": "44790053-8f94-4982-807f-d79a884f4e4c", "comment": "Malware payload (Tofsee)", "value": "1591e8ac678c4db7cd5425f48e14f827", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603134, "uuid": "063e4dc9-f585-420c-b5a7-7a65570f24e5", "comment": "Malware payload (Tofsee)", "value": "892591210389d486498fd4af8a2e89a94d5608b73d3cd0fa1fbb29c179606365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603134, "uuid": "b3bc6732-1859-4f3e-8da6-7e2e894130fb", "comment": "Malware payload (Tofsee)", "value": "9479fad4330ec7b9e434006093ac764dc7be6acf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603134, "uuid": "ca19a553-19a9-4366-bda4-005e2db04b90", "comment": "Malware payload (Tofsee)", "value": "53772e0f59e2f0608672fc43521f085db1e98fe3f7171ef36bf9f595d3a2e45db1191ea845d7f8a3bde5b4050c07e81c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603134, "uuid": "9c26cfb6-6b3a-435b-8355-4a12a02b1297", "value": "T1F154CF12B591D032C94745B05834FBEC6E7ABCB25695899B73183B2F2E303D16BB235E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603134, "uuid": "28e2ae4b-e78a-4063-ab73-72531981c918", "value": "3a84ad57cd6d9aa470f58e07991568db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603134, "uuid": "13fce233-7427-4107-8aec-a8739291b0e9", "value": "3072:veR1L9psxI0GUMkL/JidjctPe637ZvYlXizXFxjEbn70HIv02K:2rL1BEFG61vYRebjp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677603134, "uuid": "5b79caed-2230-44af-b7f2-da3a5f6a2d76", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677603134, "uuid": "e81f8f76-116b-4dc7-9145-5067818aacbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603134, "uuid": "f0f59e65-47f0-4f0d-aaff-451f4727aad7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a516577-b782-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677600547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600547, "uuid": "674c406f-2e5c-4ceb-a642-8b628dbc6d61", "comment": "Malware payload (Formbook)", "value": "232a21ed97a3dce9ccfddba5c1887f83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600547, "uuid": "1d5c582d-900e-43b5-9102-65753589fbf3", "comment": "Malware payload (Formbook)", "value": "8987e10cdb8602039c7980d8a3d3736dbc9c65da17ffbc1a5844ae1da1d2ea9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600547, "uuid": "99d0388d-8ec0-4d5e-9ae7-a9c32372f56e", "comment": "Malware payload (Formbook)", "value": "4e808b324e8174c5402cc21dfe29fac92b45089b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600547, "uuid": "d39ebb24-3c77-439f-9acb-4a42ace3c814", "comment": "Malware payload (Formbook)", "value": "4a18c799597ca5b9c7fdc51065ea5ae00d303cdbbf1009f3dbc409a765e08ac121a109301915b8ec3a080d0385f8dbb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600547, "uuid": "55805e8c-1ba5-468a-ba10-6eb03d619c31", "value": "T116459D8C63705873E9DB00A5545422CC4EB4F5CB6505F3AA5FA77B42AECAAFBB24D103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600547, "uuid": "f7d9e085-7a7b-4608-a5f4-e329706b4875", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600547, "uuid": "2f88b549-cab8-4c63-aab8-6dcca654ac8b", "value": "24576:qVfV1fCD7qSe0cJI4/2biuviVU46n4COtQYSx8G8c+CA6/+o9x/6qW27:qVfV1fC3qSe0GI4uWXVL6n4C8M8G8Pa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677600547, "uuid": "fbd66a4f-c327-4478-bfc6-5a372a2067f9", "value": 1231360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677600547, "uuid": "5588139d-5a43-41d8-a843-f3c6fb98e092", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600547, "uuid": "f9b72125-15fe-4707-ab8b-eaaa10992169", "value": "Banka odemesi havale bilgileri TL9985000080_28022023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9477171e-b73a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677569774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569774, "uuid": "4330dcec-9a6b-4d14-8287-15fd93518923", "comment": "Malware payload (RedLineStealer)", "value": "748179affb153055035c7125a68a4936", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569774, "uuid": "58bc526c-8625-4dc7-bdd5-30d00b7b853f", "comment": "Malware payload (RedLineStealer)", "value": "8a9f64d2e41cf2c8ec27961a169c3afff63bd657ab5bd4d28a99c96eecc9c100", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569774, "uuid": "48a8fecf-266c-4cd1-adac-cb1c27f8aa2a", "comment": "Malware payload (RedLineStealer)", "value": "129cb795c8b760c215fdc06488a6349578e82bb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569774, "uuid": "f686e876-085f-40a5-8de4-d65fc2206c02", "comment": "Malware payload (RedLineStealer)", "value": "62c32945ffd284844f0e3431e61dbfbd8e3ea9440c8a71b55b7e9fbe2bea84e498c4592c7cf1d34162cb7bcbef5dbf48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569774, "uuid": "0d47a642-431e-443c-b77c-bc936ad6c77d", "value": "T12904D51437FCCD11E1BA1A3F6961A05086BF9802AD42F25B76C767CD0E36B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569774, "uuid": "e1199ee5-8cc4-42e6-839c-ffbbcfb84056", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569774, "uuid": "de8713bd-4768-46db-b223-be27b289e17b", "value": "3072:LxqZW11a2kX8fmROUqcwMeZ39XhivxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jk:dqZkmROLvnXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677569774, "uuid": "da128784-e78b-454e-a7e7-87ac89a0f50e", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677569774, "uuid": "a70cb58c-2d4a-461e-a3e6-b6da03e4ea22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569774, "uuid": "e06b39c9-5f01-48eb-8848-0a7578321472", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f1e7b4-b740-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677572384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572384, "uuid": "34657018-46d0-49eb-9578-b5de2a530c6a", "comment": "Malware payload (RedLineStealer)", "value": "ad4046bb28d9f928614c85d6ccd20da3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572384, "uuid": "42111c56-f9b6-451b-919f-a38d9f25f2ca", "comment": "Malware payload (RedLineStealer)", "value": "8aaf7dcdacd1b01484b12c95a4a550cdd5850f17524d2f09d581418ca40c1e72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572384, "uuid": "c400aaf4-f609-42fd-8d77-b7f31cbf6e85", "comment": "Malware payload (RedLineStealer)", "value": "23f3b7c4dada9508186470357f1df18b6a89d5ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572384, "uuid": "08b69ba9-df5e-4231-9036-78f2e304a264", "comment": "Malware payload (RedLineStealer)", "value": "e9d75ec3402ac7d2f374f1652e549059e1107d1fb9b542b7f8dafe18e0c5dd38345392db2e6389b27ce6f736a8cc026e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572384, "uuid": "bf34ee69-b13b-4968-8b90-eafd2303f0be", "value": "T17835235BF2CD4162F87A577068F6018306363851A77882DB134A6D5F6CF32B8B6353BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572384, "uuid": "7625f977-d05e-45b9-81c8-a1ea40a466c0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572384, "uuid": "ff815ba6-6dfb-4b8a-bcbc-65ba65fb5b2c", "value": "24576:QyWWMs96+wqMx+Gx2ymvH8AUtNS6iaqtrcYqtixvMT07uV:X0e6Gk+GAlvJaqKisau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572384, "uuid": "10675d88-d309-4570-ada5-0b0a8dcf49ab", "value": 1097216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572384, "uuid": "2dca2888-a102-4077-bc9d-32dcac14442c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572384, "uuid": "bbd7533d-8489-49d9-8cdc-093637e201b8", "value": "ad4046bb28d9f928614c85d6ccd20da3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4c3cf9-b781-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1677600359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600359, "uuid": "191efec0-5e24-4bc1-afbf-885fd2177c53", "comment": "Malware payload (Vidar)", "value": "04ca884d1642ba6051f501ca5c66375a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600359, "uuid": "bd149e8e-85a0-4a15-810b-fab7af36f417", "comment": "Malware payload (Vidar)", "value": "8b08628b3b7ad95bef5be23120ed741dcfca5d30f0d2dfdf83166b94c56f15d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600359, "uuid": "35562e60-6e33-4815-a6ff-3fad50fb6c56", "comment": "Malware payload (Vidar)", "value": "ca1f3a4503b3f9c9e765fd9a23e3513a13030a94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600359, "uuid": "d0a443b8-121d-4f07-be36-844d3d23b3bb", "comment": "Malware payload (Vidar)", "value": "fab2195dec31335c2e1550a700f16d25647cba1d6baa563c27687b05dab402e8f048d2c583e711f99a5c79e73812a4d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600359, "uuid": "2addf748-084b-4cb2-9f7a-d6dacbaeedc5", "value": "T1D184F101B981D032C49645B0486CDAE5BF79ECA18675CD9B33182E3F2E322DE5FB6356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600359, "uuid": "dd047201-d505-411c-b2e3-482ab87735fc", "value": "2ff441a58ff638ca2d2b64ce6ffa9559", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600359, "uuid": "fbe30d6e-7a31-4346-831e-4550259f4211", "value": "6144:UQ5LTyBvrHTRCReZEqnZFzuk0v9o7rH0RFj1:UMPyBvrHURmEWZFD01PR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677600359, "uuid": "7154ac6c-7e46-42be-913b-fc71d957d1de", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677600359, "uuid": "99efdff2-7675-4b0d-80a3-6277541131a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600359, "uuid": "6851c451-b6be-4576-9ca9-74c5a5ecdf9c", "value": "04ca884d1642ba6051f501ca5c66375a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7fd7d22-b700-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677544896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544896, "uuid": "eb43d939-093b-4396-a919-e8c02b4117a4", "comment": "Malware payload (Mirai)", "value": "600eb3f1820b7e2f5681742d7fda65f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544896, "uuid": "f899d390-abe6-4092-b76f-d4065e8da455", "comment": "Malware payload (Mirai)", "value": "8b41a14b21add1a397ae8ab471df877632c2f187736df74505f8b39a050cbcf5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544896, "uuid": "de7d1a13-a5b3-4aa4-897e-a68c0c8ce0b0", "comment": "Malware payload (Mirai)", "value": "20f53e43e961efa7e5b70acf0708d720c817559b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544896, "uuid": "15667776-0681-467c-9c3d-e327a89be367", "comment": "Malware payload (Mirai)", "value": "9d4fc4be20c67bb40360e05f2a6b75490a5d9dc5c04318d04e06bf0aae37e1e4a23228554424c112cc45f402bcb102a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544896, "uuid": "f1cf88a9-e7bb-4845-8f78-f1b5e2dd97a8", "value": "T10B330885B8C19A16C6D413BBFA2E51CC332563E8E2DF3203DD252F15778A82F0E67695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544896, "uuid": "2ccb6a9f-69da-4364-aa16-514164288317", "value": "768:CCE6Il+dwa+7bFgJ5QgbHiZvJA/wHBlWoY8nScePit5+C/NPOBRTMzzS:M61dT5QEevJA4jrnScuit51IB+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677544896, "uuid": "123a1345-f8e6-42bc-ba9a-d1aff490da2e", "value": 52932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677544896, "uuid": "4b911eef-df6b-42b5-b991-7b5db5476bb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544896, "uuid": "4dd00c3b-104b-4a45-aee5-50e14e78ce76", "value": "600eb3f1820b7e2f5681742d7fda65f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9272138-b706-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1677547609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677547609, "uuid": "a94075e4-7b61-45f2-a30f-875ba38d5e8a", "comment": "Malware payload (AveMariaRAT)", "value": "6268aa7baf3e305e3719837676a68beb", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677547609, "uuid": "2169bff1-ebc4-4c81-af9f-b48513fd72e8", "comment": "Malware payload (AveMariaRAT)", "value": "8bda08d3f496963bfe69b61b77363ea31352ca56a56ccfbc8b17b86a6ada2bc3", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677547609, "uuid": "1179eac9-bf32-47d3-9280-2b8d1c56c0db", "comment": "Malware payload (AveMariaRAT)", "value": "a55a03d01304c4b9b95898b48411014bb2356a32", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677547609, "uuid": "a1e16ea0-602c-4f03-8d68-966bb90b7953", "comment": "Malware payload (AveMariaRAT)", "value": "d780f75d16762202b6447d17b4907c3ce5613b88b98ba74b36a23c4122a45db525f55a2d95cfe5d94403c77cd6d55803", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677547609, "uuid": "6434c68d-4ea1-4e1f-af55-6a15234ccd35", "value": "T160A4F153AB53C2B7D16657B3BEF33F560BB486F588A75112009DECA43A8E70A39084DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677547609, "uuid": "9770f662-73b8-4e75-8234-e9fb606cd318", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677547609, "uuid": "6927ada4-d9dc-4cef-b387-e2422f6b2de7", "value": "12288:g3cNEybixPz7WS60tY8E+uMxALTPhc027husFmS11nhoe0:Uxxr7WS60tjE+XAHC0OEsFZ1ye0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677547609, "uuid": "f285d892-43de-43a8-bac5-6740764ddee8", "value": 476160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677547609, "uuid": "778e5c84-4fc9-4e26-9f92-5fde2f3d2f62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677547609, "uuid": "de222f96-582c-4f58-9691-e3885a6b2f43", "value": "6268aa7baf3e305e3719837676a68beb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b3fffcc-b75e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677585006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677585006, "uuid": "f0c53bb8-c403-4d1b-85d9-7f22c85d9c7e", "comment": "Malware payload (Mirai)", "value": "35d75a3eef550a296bbce3f8f1d93af3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677585006, "uuid": "63c3ce4f-7156-4350-a313-8a1a499f962d", "comment": "Malware payload (Mirai)", "value": "8caa475329d1ddc8f1fea10370489fcdc38f0cb716a10ad1d068f5c0376f061d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677585006, "uuid": "ea7d98bb-e581-45a8-943e-c4b11ff9c5b0", "comment": "Malware payload (Mirai)", "value": "9b0eef9626144aa151e3d5e28127de84dcbc2f03", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677585006, "uuid": "9be932c5-98ac-47e4-90f6-961ad419947c", "comment": "Malware payload (Mirai)", "value": "ffe8d7138bd72ba30f4a40136d0d72624b5fa9c2ac686b74b72b0a22b9f2879d2a2b22ea2f5f247e28c991ec5c558392", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677585006, "uuid": "27b167c0-0684-4963-a80e-91ee9aeb0dd6", "value": "T1C2635AC4DB83E8F5F95716702177E7328E36F57A0129FA97EB9C66239C42A50D20329C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677585006, "uuid": "456ba017-6a43-4c07-a8f9-6cb9bc787609", "value": "1536:5v1eGCq90Y5udqXMTVQTcbnscIlnEFoVKNHqYmYi49ybRbSESuq:51eGv0Y5udqXMTVQYbsdlWoVKNHHm/4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677585006, "uuid": "664c3000-db68-4d99-9fb6-f5faee8bad37", "value": 70548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677585006, "uuid": "104cb1ac-6bba-490f-8b44-18cdac2c2cf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677585006, "uuid": "7840e1f5-e91e-46cb-8a82-d61f1680b353", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c14e7de-b75e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677585007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677585007, "uuid": "2353e3fa-b9dc-4477-9e3b-72c8c98c3440", "comment": "Malware payload (Mirai)", "value": "5e39e02f898757ab4fd976980249304d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677585007, "uuid": "95065715-9a52-4a5d-bf7f-16db57307924", "comment": "Malware payload (Mirai)", "value": "8dd0b95db5128f41fb70b36c1ce364554b7d4139c76d42aa2ade8c64dbf8a98e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677585007, "uuid": "de509692-8ed2-4abf-b096-f9190424fe43", "comment": "Malware payload (Mirai)", "value": "ee5c551ea429ef768f29e654649eace1d6e43cd6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677585007, "uuid": "139f61b9-3cd3-429c-9c58-0261d21dbd22", "comment": "Malware payload (Mirai)", "value": "5b2734b1ffcb32f6fe3f12ddd9fc1791513360a7f14b98b6d3b176da6cd20192b0cfedf0bdb6ee31f0365dbdd3ccb227", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677585007, "uuid": "3eca008a-21ff-45ad-947f-7286d53cab27", "value": "T18F833A55BC819A13C5D522BBF62E418C372A53F8D2EA320BCD219F01778A92F0E77B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677585007, "uuid": "4d981395-c2ec-4d6d-8a03-3178cd056163", "value": "1536:WalkIx/44TTPuHJ2plKTGekwDU1n+kleXsbZE954nD8eBICsLkhrarv/:WalkIx/BTPuHJ2pXen4xscbZE954nD8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677585007, "uuid": "4e86890c-a56a-43f1-a8fc-666c6cc3fb34", "value": 80764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677585007, "uuid": "6fe646fc-9cf3-49ea-a0e0-4339af7d2ac2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677585007, "uuid": "8e6a0149-d2bf-4415-9945-97f9b25e56e8", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79ca49f-b74f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677578960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677578960, "uuid": "1368eeb7-61b2-40c1-bb09-5a6d9d30a5d0", "comment": "Malware payload (Amadey)", "value": "f1e218ed236d42e6da0698609906f236", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677578960, "uuid": "236aa1c9-827a-4080-8681-bc44be86e808", "comment": "Malware payload (Amadey)", "value": "8e6d08b10865946f7d76bd85de4fdd583301b3061dde50ed2046ab5bfa9beca3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677578960, "uuid": "0edfd2f7-b33a-4b96-a83d-07bfe57422cd", "comment": "Malware payload (Amadey)", "value": "e1f479fce5e05c25d8acc22e0ae6794aafbfc097", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677578960, "uuid": "d611e1a0-1f1f-4023-86be-642563d17eb0", "comment": "Malware payload (Amadey)", "value": "385ded925748b75407dd379d9b1fb6de15d238cadba6e0d3a4bed8d8edec32abf5cf4382379a20ee3f836f13f4a88cc0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677578960, "uuid": "4fc7cb7c-c842-43ee-900c-545501e06fff", "value": "T187652387AADA4133D17097700DF203C71B377E41963C939EAB8AB9591C736A0A93477B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677578960, "uuid": "960f0fda-baf5-4d9f-a3e4-345df1836c1b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677578960, "uuid": "47160813-6974-4c5e-af6e-51d2973568eb", "value": "24576:pyA7LVu4R9kAHC0TUNcVRtR8VhbeZq27Xn67/AExexm4Hm4wWcAUGWRQeUeHj:cuu4R9RC0YNGdFZZm7/3gxNm4bcAUG8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677578960, "uuid": "235f0d5f-e0f6-4eeb-9b7d-dade199f835a", "value": 1419776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677578960, "uuid": "806659b4-8bd4-493d-994e-1d23abaa9d20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677578960, "uuid": "d2d206c9-95ca-4d89-a6e3-1b2442d0c168", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef15064-b77d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677598541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677598541, "uuid": "f828a898-b736-4ced-b472-15321cf72df8", "comment": "Malware payload (Mirai)", "value": "742110b6d5f8386cece9ef44855f8992", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677598541, "uuid": "0183ccd3-7405-421c-8073-a468ca59ff4f", "comment": "Malware payload (Mirai)", "value": "8fda3dbb748ec4e4e83cb9cfc0848e03570724d1af4c9b8508b24bc89bf3ced6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677598541, "uuid": "402842bf-1d88-4ba2-8b5b-711b16c01965", "comment": "Malware payload (Mirai)", "value": "6505862209f74a5b20cf748a7438bc6f20fe7988", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677598541, "uuid": "9ef6f1d5-ffe4-4915-a4c1-7996d3f1f924", "comment": "Malware payload (Mirai)", "value": "40118c94a8fe4435eac4ddf0772aeff14fbda4c241667b88be3eeb516cfae14edd67cd46d65a5917509fccd05a3614e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677598541, "uuid": "5ead1a63-a29f-421b-aa4c-774095f2e210", "value": "T13621CC7BFBBB8717C860907A0E6363153670C89C0024DA2ABB216B5E9C526517F922F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677598541, "uuid": "60bf54dd-b80f-4317-b6d2-b63a50332a63", "value": "24:3L3Dq3N0yTKE9kRPo38MRQPhCrjSkvFqJ9lmHNTawq98:3WVTl4Po38MtDvG9UNu38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677598541, "uuid": "25a175cb-da9b-4544-9ef4-ac79f6658b6c", "value": 1264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677598541, "uuid": "3e40b59b-817f-41d9-b743-c09a73218ed0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677598541, "uuid": "86b6d37c-09b3-4494-814c-938c9cdc458a", "value": "742110b6d5f8386cece9ef44855f8992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d383a754-b7a0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677613688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677613688, "uuid": "7c0c803f-750b-4997-97fa-e8a37263247b", "comment": "Malware payload", "value": "0e78fdd576e7936d5c866f9307979fb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677613688, "uuid": "97e88491-607b-451b-8cf1-be375316e018", "comment": "Malware payload", "value": "902f0e40972d39b34ce4f03e000d16b77c3ad9383fbaa6a49b7428cae1b08e93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677613688, "uuid": "c3aa51c5-b0e9-40b0-a0cb-67860acd3ad6", "comment": "Malware payload", "value": "7bf21667ceae63881bc00fca91dd9ee98994730a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677613688, "uuid": "9c5b49b9-75e1-45c4-a960-1d71eaf627f2", "comment": "Malware payload", "value": "d3adaecb8fcefaab6bb15b13ab192f75e6e076ba48aa7bd4b275093ca5f496f85f8fbccc0cd1fb4b2ca882c3d67861c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677613688, "uuid": "545f2a1b-b102-40bf-abdd-258f2f5db960", "value": "T1EEC4D06FB7D01A21DEAEF531D4760A4CD7B1DA660300A62797CB15CB3F2A20B6D06ED1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677613688, "uuid": "c0a0789b-892a-441e-93ec-34cf364b7e68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677613688, "uuid": "51bb9756-8f9d-4d41-b1f1-e15897eea83c", "value": "6144:xvgQNODKe/eIhJdQFlzynZim5OpzvruB2ZElQNJDSb6i9WH3c2WInOAG:aDN/eIhkUEW2/NQbz9y3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677613688, "uuid": "2722cbaa-95af-48b5-a069-5f26be558302", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677613688, "uuid": "85803b99-dce3-4e28-9016-ed91f294853f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677613688, "uuid": "89c72559-fc76-4219-969e-ad5adce4babd", "value": "SOPORTE DE PAGO DETALLE DE CONFIRMACION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bed7821-b782-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677600469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600469, "uuid": "937ef0af-5dca-49d1-af50-89942ca3c15f", "comment": "Malware payload (AgentTesla)", "value": "7c8533661103a75659b20fb35926d8ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600469, "uuid": "4b151dec-6d27-4af0-9bb1-cfd05b151e64", "comment": "Malware payload (AgentTesla)", "value": "9171eb8493cde4aa21d9b31e6633bceb25512f9f4801695fe86ba968894a343a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600469, "uuid": "11e4616f-91e8-48f7-bd7c-cd85a643c88e", "comment": "Malware payload (AgentTesla)", "value": "5e95eebc54fd8c293214df79349f5d68de4d7667", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600469, "uuid": "d728a076-ff78-4f0a-846f-7f462821bf45", "comment": "Malware payload (AgentTesla)", "value": "963b9335995ba7375fbba69c4c53b121e834e362cadf064f5084d3f7e6c432599b397c5099ebf0156461f9acb88d6262", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600469, "uuid": "dc19a9de-f18c-424e-a15c-fbce77454934", "value": "T16CB4F148F395A877E103507D6688D5B74208ACA6E902CA4B30C2B38F1777F635FBAD65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600469, "uuid": "eba0b51f-90d1-4128-9d3b-8d8f8943f5eb", "value": "6144:JYi0uJltoOzcOvwzcOP3TnX/eu3Y5YwzcOPALoYsTHBel8IpcgwF8jZy8aaMvFI8:3ltoOzBvwzBPTv2YwzB5tMFY3tanV/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677600469, "uuid": "18b16461-c05b-45a5-b873-e12816975176", "value": 541184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677600469, "uuid": "eb2ae5b2-72bf-46df-94e8-e69ed27835e7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600469, "uuid": "17f0d05c-6e77-44da-aef1-0e5d20729792", "value": "Shipment Document BL,INV and packing list For WAybill 8553263563.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cddf5adb-b740-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677572447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572447, "uuid": "015089ee-e884-4078-8a10-37af6406476c", "comment": "Malware payload (Formbook)", "value": "7be48d9c801faa3dd5a62321af3dcd83", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572447, "uuid": "1c3129af-bb53-4ea8-a375-88479788d676", "comment": "Malware payload (Formbook)", "value": "91aa652ad839887ae0c15a7877a87a62f588532f6c0480227b00b8ada2f18c34", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572447, "uuid": "c7024ecc-f71e-4b51-9a8c-71d42f7562fd", "comment": "Malware payload (Formbook)", "value": "1709da7101b7a9768306d0121e21d12e041e15a7", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572447, "uuid": "8cb91dbd-9815-46d7-8d9d-e8676402ca73", "comment": "Malware payload (Formbook)", "value": "1ddb3eff3d1bb75e5826d980d786a514e69cfac53b431a1c040f4f21230887aaebe682a1c6a2ba33501bbd4b8fe51fc2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572447, "uuid": "09d97538-f7c5-4afa-88e0-425164868b5c", "value": "T1D9050219E746D82BF423143DD88564D742296C7AAA40DA4F31C2B30F4736FB64F7AE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572447, "uuid": "bc545947-2594-40eb-818f-70a71302e4ea", "value": "24576:CmHjSzKFemuwI1mrJk7IRl5fDuTW8XpN:BUKowvq7Idfqzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572447, "uuid": "f8b10ebe-8b2b-4b03-9d77-e8cfed3617d1", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572447, "uuid": "fad22d7e-d7a3-4690-94cc-e587a7a449bd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572447, "uuid": "2e24ad7c-40a2-44ee-8307-bf7110182637", "value": "PO-230581.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e26c6d-b709-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677548781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677548781, "uuid": "9c08c7a4-ae22-4231-9f8b-9848a080deef", "comment": "Malware payload (RecordBreaker)", "value": "d2eb3462d10fb0336843940581afaba9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677548781, "uuid": "52d9665a-dcf8-4e57-8772-8c8503e86cdc", "comment": "Malware payload (RecordBreaker)", "value": "91b8833d045e42de89fceb8698a75cd45b3a1b45fc67d1115cf9a181d7ca100b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677548781, "uuid": "be863bce-21b5-4bb4-82c6-5242639006a4", "comment": "Malware payload (RecordBreaker)", "value": "1920af9e9037a07b91537c73ca94f8a02ca85d14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677548781, "uuid": "0c16ecb2-10d5-4406-80ec-e4bc56323dca", "comment": "Malware payload (RecordBreaker)", "value": "6ec06c27047da2773a23c2b3005bfcbe2e2bd29b3433a002ca20b9209bbcba4eeda06dc7367bda7fc1d93086f8f6b215", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677548781, "uuid": "b1ec9b40-0064-45c4-b71e-47143ff8aa89", "value": "T1E4662323A5551481E5B589378633FEE030BEABAC8B08F875B0FA76C41537DD1EA11E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677548781, "uuid": "430a3128-d0db-4c7d-a647-cb9fa39ec49f", "value": "161839a78ef6f07a30d3f07895f6fe23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677548781, "uuid": "77a43e71-8fa8-4a9c-a916-1b2733c1a522", "value": "98304:s2N71XVjYSIX9SquY8YSGA2rLHXYQhLZGVGzp9l1Y950EadPnUUPCmQU4:VpXKSU9Huy3YQaVe/y0dUUPCml4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677548781, "uuid": "21a9e40b-dd8a-45cb-b655-a5517d784c6e", "value": 7066112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677548781, "uuid": "29c9c804-c95e-49bb-a689-db04e6c45787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677548781, "uuid": "c160e77e-a608-44c9-a62f-fe4983cfd8da", "value": "Installer_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8e84c8-b774-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677594589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594589, "uuid": "bafdcb28-0781-4683-8ad2-f53fb56f1279", "comment": "Malware payload", "value": "9fbb03199ddcd8e0721d26678a93a85b", "object_relation": "md5", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594589, "uuid": "63b10c56-00a4-4dfa-ad32-16b29c7804c5", "comment": "Malware payload", "value": "922e91442d3c5d76371a35bbb05d85185ad885d4810f8226b30ca283d354e0c6", "object_relation": "sha256", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594589, "uuid": "d5ccc754-04ea-4498-b128-0fe9791e4109", "comment": "Malware payload", "value": "a89af303deab99205ccd02b8daf03f517829350f", "object_relation": "sha1", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594589, "uuid": "a723b081-06da-42c4-8132-68ad0e112e00", "comment": "Malware payload", "value": "03f3abd1eedceab1925f0660ebd3a0cc3e77a510670242a764346013139f4a0e304bfb1492a6a7d3dc2163270e2fae1d", "object_relation": "sha3-384", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677594589, "uuid": "1d24efbf-0d47-4b62-b0a7-ee1e31e1cd44", "value": "T147648DF0EA25027B2E9B279F9C555DC19A38861281031599FBAE239D63435CC437EF3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677594589, "uuid": "95c30b83-1edb-44df-83e1-6ae683d2ceb2", "value": "6144:W2eUlkn0MKxEuTZaHqmxOnpW/ewuXIfuZFdaziCN4wJscHPBtwtZy/:7lk/KxE6ZaHBIgnoIf4YH5OHy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677594589, "uuid": "7f3325c0-dd04-4cb3-ab5a-47ecf45ce662", "value": 308772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677594589, "uuid": "9f8abbce-4728-4b11-ac42-be2753895c4d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677594589, "uuid": "f65a621c-eb88-4551-8e77-89933d6a3b3f", "value": "Practice.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8d5a69-b767-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677589066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677589066, "uuid": "3231e81a-af89-449d-913c-d7b496bdf415", "comment": "Malware payload (AgentTesla)", "value": "d5fc221236b52d415af8e9f56981b72e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677589066, "uuid": "cf10a64e-9bb9-4692-b0e1-99a95238872c", "comment": "Malware payload (AgentTesla)", "value": "9348a8be3573c9a31d3d2b87307e1075373323ecb26e1baaf7fcb3460d19629e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677589066, "uuid": "8d4d719d-73f6-40b0-8a34-877a41ea9c78", "comment": "Malware payload (AgentTesla)", "value": "5fd596dd86ea0020a4543eb133c1883aca23b979", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677589066, "uuid": "eb47d823-a404-4d87-8571-bb36b300d469", "comment": "Malware payload (AgentTesla)", "value": "a033733c875de98da17d43d96b94161fa100435bd4a4b36eabb3e4394f5bcaa8a0ed886d86ecfaf75b425507c6d39b99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677589066, "uuid": "0953da1c-38d5-430f-8420-f6ad31ca62c2", "value": "T1476423D4C0677090DCAFB9D3E5890FA4BDF356A67DE8A1CF96978763C90084877A9023", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677589066, "uuid": "bb7ae48a-be5c-48da-9636-1f7a678f0548", "value": "6144:a/jUb7Z0E1EQtWjPbsJ5pvMuLsNMCKruCgxKu/9WmECTCekj8Zt6P:arUbF18WHDgVSpu/9KEPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677589066, "uuid": "b5b5442f-1097-4499-a8a9-7f1ac21b9477", "value": 320858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677589066, "uuid": "35300b47-3d62-41ce-8f3d-d7235e2af428", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677589066, "uuid": "83d4d9a2-dc70-4bce-8a5c-71779afbc117", "value": "TT COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffbe0774-b781-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1677600448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600448, "uuid": "c21cb4c0-bbf3-4563-935e-6fd757f30956", "comment": "Malware payload (GCleaner)", "value": "b5d2845d8527d553115463d631b1702d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600448, "uuid": "15376b7f-bdde-402d-9d5a-cc096b736a31", "comment": "Malware payload (GCleaner)", "value": "94551b68fcb65d49a5d1d29a0dba5ec3f2e98252fef337a4fba2416ecb8cea76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600448, "uuid": "b9e834b2-c39e-4b22-b7ca-dbaef8834ebc", "comment": "Malware payload (GCleaner)", "value": "b63b39d1b3d2f477f965b460ebc05e765450723c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600448, "uuid": "555478c3-ec5e-4bcd-b627-15b4431817af", "comment": "Malware payload (GCleaner)", "value": "897d41597f6fb0c9d519735043bc54999156efa9cf9b731a74f5f68548ea451f02d537254ba5b756a2315d00e1cddc1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600448, "uuid": "4062edcf-ab7a-4d62-a5c9-0f6b97118309", "value": "T11B54F1623D80C931CD5521709872CF9D09BFB8631A255B4BBA78369A7E713E03B72397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600448, "uuid": "65621f04-dca3-4f3b-88eb-0c568bcf9eec", "value": "8fae7a7705d344fefbbe3d51a799fab4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600448, "uuid": "097564df-ec85-45f3-bafb-cfe6f039395d", "value": "6144:ZOLRv3eI/62feWK3az1MbbhOXXASgyA591:k9vf62fS3MSbgndS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677600448, "uuid": "46ae9702-6d48-43a9-9829-2798b1e70709", "value": 287232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677600448, "uuid": "4ef17fd1-6a5c-4d3b-8490-637a2fb5bb24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600448, "uuid": "e2678628-a30f-43da-8be0-99bbccd32e0b", "value": "b5d2845d8527d553115463d631b1702d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a442d435-b755-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677581397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581397, "uuid": "8b811423-8ff6-4416-862c-24e67e197e47", "comment": "Malware payload (Mirai)", "value": "76c686a7a79fd5376b305456e5674bcf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581397, "uuid": "af4e04eb-0d65-46c9-a681-a2ca0b32749f", "comment": "Malware payload (Mirai)", "value": "94e45a590dd7983ec3808307291c7543e319e5617b9002593b04d557a7d64f0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581397, "uuid": "4f2da734-de88-4ec9-9743-47cd10214afc", "comment": "Malware payload (Mirai)", "value": "06e3f665aaf5fb8c20ec41143716c9da007f3925", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581397, "uuid": "aeac883d-40b1-47e9-a914-d015dda464a8", "comment": "Malware payload (Mirai)", "value": "e43870959d16d99f4c33e9434a6d2f1cfec1a9637d311a4641b4371c897c959603234b94eb9e08aeb9c07d4e578a0944", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581397, "uuid": "d800581a-d146-4e58-99ad-9b1926bd219e", "value": "T186831B9EB4414E2CFD8FE9FD55314E19A920321156830B16A6ABFDD37F722E8CD42D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581397, "uuid": "42dc914d-46fc-4e40-9f35-dc84d704a253", "value": "1536:NV3mIDvLI50hQuf/Wxx7IDeg1pW2BmD4sbvgPEUedm1yn83:NY4LI5ytDHpWB5jgumwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677581397, "uuid": "a197ecd9-5a10-45e1-9038-72a1b344079a", "value": 84392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677581397, "uuid": "19b5e2d8-2937-4aff-858b-6f5006fd53dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581397, "uuid": "c6bdc3f6-aa1b-4172-a9da-fca5172b1b7d", "value": "76c686a7a79fd5376b305456e5674bcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d362990d-b7a9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677617554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677617554, "uuid": "73e9a60a-76d4-423c-a7f1-a79d63c071ef", "comment": "Malware payload", "value": "610a07ec66e0182a1851057fde52cdda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677617554, "uuid": "5c655ee8-fc76-4edc-9ff8-8f1280affedb", "comment": "Malware payload", "value": "9502c0807bac29897aa5821ded393326657732af0a21ffc08341a03c9b219004", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677617554, "uuid": "f0ef3594-b859-49dc-990c-6e1b55cb5906", "comment": "Malware payload", "value": "328f7599fe1f707c40f1128fe989a0857f4761a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677617554, "uuid": "370f7f19-daa5-4c26-949f-298dabb1dcc7", "comment": "Malware payload", "value": "fbc5e5abd7dbe9d61f1cb61ee39abfbe3c7d5997f2419f552274302cffbefd6ffe14282c0825aa188dda7592693c787c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677617554, "uuid": "cc8ea468-6945-4724-8607-97b98d289a3a", "value": "T12DC4E06FB7D01A20EEADF9318436065CD7B1DA660301E52797CF15CA3F6A30AAD06ED1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677617554, "uuid": "3fc55cf0-9b0d-4cb7-bffa-c28fa3c119a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677617554, "uuid": "d6ea23b6-7f3c-4cdc-932d-30bee0a59a0b", "value": "12288:uDN/eIhkUEW20ilF9xw8ib+giqHcAPmiex:uDpeIiUD20ili8e+gN8Imiex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677617554, "uuid": "3c6bef82-1589-43a7-ab01-7d9b1441c506", "value": 590336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677617554, "uuid": "9f97f782-bd66-44c9-9dce-e807b951f920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677617554, "uuid": "54a2c65a-d7f7-4686-aafb-71593411db6c", "value": "INV# 181240531122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47724d57-b741-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677572651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572651, "uuid": "776f5d06-a362-4346-812b-a27daba4c4cc", "comment": "Malware payload (Loki)", "value": "6afd59f194e98f8771028baa45821481", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572651, "uuid": "fd24510d-9a01-4f3c-b570-5107beac87c8", "comment": "Malware payload (Loki)", "value": "95709146a788e3cae6af75199ba67b1aa327c8fe1c605f2cf8341861389cd011", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572651, "uuid": "669b8783-2f88-401d-9da7-656b10412856", "comment": "Malware payload (Loki)", "value": "42b5a8865d207337ed40b1dcbcf8ef0b0e0c0e30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572651, "uuid": "1dfaa5ca-e52b-4d1c-a815-f06ef476b391", "comment": "Malware payload (Loki)", "value": "dc31e41655233f7c2080953f5c2991b27c0854cdc427c6c0de1e51b2e10489df5f7822666c42e1a36dee9c46304fd831", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572651, "uuid": "f04eb9ea-1745-4d98-9291-03517494a7f6", "value": "T10F359D4853B344B2FBDB11A51865228C4EB872CB3685F21B5F773751A522AFFB29F102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572651, "uuid": "c1b36f62-cb63-4e3e-afde-43fd37b81891", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572651, "uuid": "7633aeed-8fd7-4c91-99dd-69fa1415535f", "value": "24576:XtgmeO7qbH2LK240wOD95Xt7lOdxNCA6/+o9x/6qW:dgmeO+bWLKLCPUa+W1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572651, "uuid": "58995fd9-f546-423f-82c2-e22e9ce1abaa", "value": 1123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572651, "uuid": "fd3cfca8-626b-4ec0-aa46-839ca9aad6f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572651, "uuid": "74957da2-a69c-4600-bc79-18272f7ea5ca", "value": "6afd59f194e98f8771028baa45821481.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508ade16-b782-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677600584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600584, "uuid": "3c5d1208-e73f-4f18-bc87-710ea371f55b", "comment": "Malware payload (GuLoader)", "value": "580c544427d0ad4567855c6aac1c1e6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600584, "uuid": "7f733f20-f24e-4002-b4e9-8ff2dae410ba", "comment": "Malware payload (GuLoader)", "value": "9586239ad11eef29d939fc6327a562f2b00a88eb169b60b6b5c15f306ab21d0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600584, "uuid": "46a0323d-a506-4fa1-88ba-8e69a44c4991", "comment": "Malware payload (GuLoader)", "value": "abd2ffcc2c94ca807949b70cccad0710b44e5a39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600584, "uuid": "be693124-7a50-45a5-8158-db1bcdb49494", "comment": "Malware payload (GuLoader)", "value": "ed639c489d2e708246d1271dae3103ea870b0aa179b4a37a61ad164a38f766cd0720731c2ff17a615271d7821a67b841", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600584, "uuid": "c6cc0053-3c7b-45d4-a4f8-27752b27a86b", "value": "T1A6B412C351C568EBEAD209760EB15E785ABFBF97622057CF3B213F586E363839400856", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600584, "uuid": "57683dbd-3cfc-4e58-bcab-361d33137dab", "value": "59a4a44a250c4cf4f2d9de2b3fe5d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600584, "uuid": "a3a976de-f4ce-4e0a-802f-d4dc6d987190", "value": "12288:ghUQSp7ajt8LE6LwHYJhDZ7JXQekbuMnGncYsOdQfl4/vRI2:pT7aN1H+hZtKC1ctO6WvRI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677600584, "uuid": "926452c7-1df2-43a1-bc0c-d217be83b666", "value": 509848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677600584, "uuid": "cbf889b7-f5d0-4608-a81e-77a3ed530c69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600584, "uuid": "51e40109-5d1e-4477-b84e-6d8063348283", "value": "Ordem de compra 31913.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56555038-b73f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677571817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571817, "uuid": "b7270f58-3b01-4483-908b-817fa5beb29a", "comment": "Malware payload (SnakeKeylogger)", "value": "9b1d67dec515da29f17017f4f79999b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571817, "uuid": "2add8319-1519-4dbe-acc0-67085dbe1a50", "comment": "Malware payload (SnakeKeylogger)", "value": "95e99a4cd63781476093426f5a3f71e2962385262235c5cbec23e4a32802fab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571817, "uuid": "98b7b7e1-229c-42aa-b197-f132bcf2af32", "comment": "Malware payload (SnakeKeylogger)", "value": "ec24a2c5f497284d3d30d5f97099bb86ab402038", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571817, "uuid": "fbce2e96-e494-4d66-a7d0-7765e1b5e2db", "comment": "Malware payload (SnakeKeylogger)", "value": "f276d8bafea3cdda5aadf0cd9aa58bc0cc6a7c11b1d88dae43b2628f21d00570c84137d37870c8607655296f0e12c9a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571817, "uuid": "cf2ddfe1-9016-4fb9-9c76-67c3e5aa065c", "value": "T1D2243A1A7BE49810E5FF593304B09561C77AFC421A2ACD1F17C1A62A1F796D0CE1AFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571817, "uuid": "43a520c5-b0ed-4350-8962-4cb6bdd9f143", "value": "12115494f2c86ccfa8a7bf3471dfac33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571817, "uuid": "224ad5f7-2b01-4f4e-acc7-781533c1f60a", "value": "3072:HqqaM97eOTPiK3DruiiF/XbKjPc18lxKnk3UInPX86V4Xyb8FC8KMwBjOfFbYd:KCteODDmzKp3k5skybX8yONbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677571817, "uuid": "90017c8e-ac88-43fd-8076-5cd2f0212af1", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677571817, "uuid": "afd6dd8d-8bf2-450b-b11f-4cd4ff0f1276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571817, "uuid": "b2befe08-a8e8-4ef4-a34c-232c0dd7ae23", "value": "9b1d67dec515da29f17017f4f79999b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620765c9-b768-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677589446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677589446, "uuid": "8a0a602c-9c02-4ae0-b4e8-1fc1a42f476a", "comment": "Malware payload (AgentTesla)", "value": "6997eb39e68d1527a5bf09b3695861f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677589446, "uuid": "05f963df-4e21-4cf3-aff8-06c8b0197c17", "comment": "Malware payload (AgentTesla)", "value": "96c8c2196fef322e2105038652779d1db20d20318af282cc3dcb9642d998dcbc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677589446, "uuid": "eca8510b-984c-422f-a6df-d4386834ca2e", "comment": "Malware payload (AgentTesla)", "value": "d20886b18ff8c733ae18d489c6b4f0a3c4de9244", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677589446, "uuid": "cf165e28-a779-4d27-8ca1-acaa3dd1265f", "comment": "Malware payload (AgentTesla)", "value": "8f91a3163a57d91efcd8eeb89360a536576a80a5a2a49b5f4f4e00929875a05027bb17e7bf426a28b1f4ee8c78a75be5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677589446, "uuid": "599a8ab2-5e54-4e38-9e1f-c7afb7b66f5d", "value": "T1F9642377DE67F70F45AC212AB8F1AA0801BC93A5F3AC915BB44CAA304C2E535CF547A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677589446, "uuid": "8462ad99-a7bc-4f9a-8ea4-21034661bfd7", "value": "6144:yaETiN/vNPjkh7B7cFcXjCGg3Zfd+RD++Z2ZtZ7+Cr4JIze3I:miN/hm+yjCtJfdcD+A2ZtZPeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677589446, "uuid": "355488cc-33ce-470e-882b-a72deb7e4c62", "value": 320541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677589446, "uuid": "9ce953e8-62ac-440e-b443-3af13ad63f84", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677589446, "uuid": "5773e8dd-d3b8-4135-b991-6932de74804e", "value": "Shipping Documents 7639081.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b99a3a-b721-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677558982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677558982, "uuid": "aae6aca2-ef18-49d1-a94c-78188ceb2aed", "comment": "Malware payload (RedLineStealer)", "value": "e787fc76e92396c5b4c8e70df700bee6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677558982, "uuid": "7ad5be55-24eb-47dc-9d27-5019a427f972", "comment": "Malware payload (RedLineStealer)", "value": "9710dcfec130df350584d7bd3942cad6a95f89241c132ea4bd3f23580bbf3298", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677558982, "uuid": "9b8b9b25-464e-429a-9c07-a742fd24c5e7", "comment": "Malware payload (RedLineStealer)", "value": "cee5850c01a7de480e0bb85f79af5553bb2a4a12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677558982, "uuid": "9565a595-8000-4fbd-939b-9a8454e54eff", "comment": "Malware payload (RedLineStealer)", "value": "7867c38fd591a3715c16d6b9e3134597754bbfb5dd2f0e1e8cdb964d2a6b2319533b8eaff0a92f2ff1beef553faa1103", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677558982, "uuid": "da6cc219-d618-41cd-8746-7121c9368981", "value": "T1A045224FF6F94532E9B1173019FA03D319727E605BB9978E234E5D0A0D32AA0D27972B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677558982, "uuid": "db041d07-7271-46d5-8760-8228e70af97e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677558982, "uuid": "7e887c32-a148-40a7-8e24-60235f36cb49", "value": "24576:DyPUD4/on5H1tU9dJP9CWGUtLGHIwPdbVfjTr+uc1ntIUPXW2UMHY61w:WP7/65HQT3CE9eFPdbVfjOuUHmNMHYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677558982, "uuid": "79beb261-f158-41b5-b7e6-4ed2a62198d9", "value": 1236480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677558982, "uuid": "14ffe735-7799-4504-874d-85f662f76303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677558982, "uuid": "f0459102-d9c5-4db8-a8cc-51774c924920", "value": "e787fc76e92396c5b4c8e70df700bee6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea92cb6-b740-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677572449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572449, "uuid": "5251d0e3-699f-4c0b-90b4-2140dd7894c9", "comment": "Malware payload", "value": "61ad6394770be7b35e626ce88fb17344", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572449, "uuid": "1374f2eb-4fd9-4d47-8719-5a1e959920ea", "comment": "Malware payload", "value": "971ace36b3417bc4c436b369422f4d8061092f80551eb4cfd8ca4fb630b067a6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572449, "uuid": "c6c39b48-562c-4ef3-bc0b-9eb165dfc143", "comment": "Malware payload", "value": "d1926471557257030b06dc51e619ba6a06b3f2d1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572449, "uuid": "7dcb77d9-b896-43a5-81da-096021e6160e", "comment": "Malware payload", "value": "0218df0db92a03126569acd95a4f2e8dd75d91c82c8c1b8b13c2afb51b870a51083d16ecd128527335f35406d50f9076", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572449, "uuid": "9b0460fc-c15c-49e3-9933-067a51fe0d3b", "value": "T158450106E246D827EC779530A447248382154CBAED49D74E31D3731F9B32BF24E7AEA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572449, "uuid": "59da5e04-b930-4b52-af0d-d276c37729b0", "value": "24576:GFeLQMdISRUmDLNFeJFFdTVa6msWw6DrnNirbVU9GXIVb1XXXXXXXXXXXXUXXXXv:m9yL/ecOnArnNirbVU0Ykd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572449, "uuid": "f5522ab2-86bc-427e-8cdd-12772c9a8a7a", "value": 1209344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572449, "uuid": "916c9b08-b424-476a-8a59-f95e24c12ff5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572449, "uuid": "0dbcadab-cbdb-4903-ac82-965f67efaeff", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de58eea-b700-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677544879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544879, "uuid": "e1051075-4409-4f0e-8568-6b553c9e72d8", "comment": "Malware payload (Mirai)", "value": "ea44ed60b904abd018bbcda761ff6cb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544879, "uuid": "28ead933-b4f8-4e29-8b01-2434864d9efa", "comment": "Malware payload (Mirai)", "value": "97c134ecbc5d4b3c05146233d658495363c6e98cf760854dd2df06794894075c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544879, "uuid": "4065c22b-0df4-4f95-b4d9-fbbea96be1ad", "comment": "Malware payload (Mirai)", "value": "8a613f9df294f80152e81d98a5c6724ca1c6b8d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544879, "uuid": "a82012ac-1653-4a0e-bf86-725340767d23", "comment": "Malware payload (Mirai)", "value": "52c18cd942800001217c799081fb3bb1e087dcb66ea2fce1e224ad84f31bb1bd640f71e698478fb301a37063bb508f5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544879, "uuid": "72992528-02c1-4705-a299-64857bc59481", "value": "T1F4233BC0A682F9F5EC11457C307BA7729E77F436A03AEDDFD7D9A423A841602920729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544879, "uuid": "edb603a6-2c15-4ad3-b870-898a278e5887", "value": "1536:Ovmt6GStZRjrMcPzOubNw1poPYdIYfQ5Igomv4aZ:O5GS1HMcPCuheoPII7iavjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677544879, "uuid": "f56c7c17-f985-40ff-bf42-cbda9b23c6a0", "value": 49852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677544879, "uuid": "180951ee-2a9a-4051-91da-9ae17d3c9a20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544879, "uuid": "5cc602b4-ec9b-4bb1-bc2c-e9676628561b", "value": "ea44ed60b904abd018bbcda761ff6cb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962f4b49-b771-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677593399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593399, "uuid": "2338a6d8-1bf6-4958-af1d-7acb4659f7e5", "comment": "Malware payload", "value": "b6fed6e99b305dd86e9bb5c5b8fd07e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593399, "uuid": "7227e29f-f02c-45b4-8062-0bed1cc3f561", "comment": "Malware payload", "value": "99c4634000865b66a0c94d7fc30af5f0e3e8300a8f5f683551d532e6bc26b6d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593399, "uuid": "676aaad6-934c-4393-8163-07d759c297ac", "comment": "Malware payload", "value": "882dc3688b66d87d39cbd11b36f178b8e79df644", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593399, "uuid": "38f53900-bf4c-4315-9223-664a6d64cadc", "comment": "Malware payload", "value": "5e55c00a2d4b0f83f0b5e340397227f0cd2f3effeba7908a31bafd3cbfd12f619ec1082e1ef9a7a84121a3180c6859b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593399, "uuid": "ca10869d-3f95-46a7-abba-9d036fa7baed", "value": "T1A0A6336876B845EAE9EBC03BC8288435C1B1B4134794C28F17AC97175E6B6F07E77B09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593399, "uuid": "83fab86b-4018-4fc9-85f1-68af48d24692", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593399, "uuid": "d646ac2f-2422-4e7a-bde4-0c7d0ccf0fec", "value": "196608:l4+buXkrc45SyY+GOe42yOJICteEroXxD3zlxZV3Gu5D4S26HCS3o/NONjv1:S+XnSyY+k4tOJInEroXV14S2WyNSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677593399, "uuid": "bca4373d-72d8-490a-b0f9-135f5dfc74f1", "value": 9550070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677593399, "uuid": "9b8aa6d9-e426-483b-9bfe-b9750dcdee3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593399, "uuid": "40a0c89f-5633-4cc1-a3db-cafc6cca3029", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451a86e6-b741-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677572647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572647, "uuid": "4fe097d3-7903-4d80-aa95-3de42b3f5ba8", "comment": "Malware payload (Loki)", "value": "c9a3853a9a7cc35eb051ae15a708f468", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572647, "uuid": "4b3e99c0-d2af-4fc6-a59b-f8e25dfbaaa7", "comment": "Malware payload (Loki)", "value": "99d0215079e5fa7783a1f4a945b9dcc57fde6bfebff9ecabc408fdb3ff29ba87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572647, "uuid": "8bccad66-eeac-4c75-ae14-750142d0f592", "comment": "Malware payload (Loki)", "value": "25f874f1fc2ffdfcac46b5e2e6acb40c34f60817", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572647, "uuid": "cbd4a7ef-987e-498f-884a-8cef72aa2b5c", "comment": "Malware payload (Loki)", "value": "405859ae34e24621ca2aa74ac498e616231b1509407a2f55e9e6d4dd0c70b9e2911f15f33701c63fb79f073711ddf6e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572647, "uuid": "4152d4ad-d534-4684-8225-3826444542b9", "value": "T1D214AF137290AC71E03E16328D29E5F42A1DFD615E349AAB33747BAF5EB02A0C5E1717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572647, "uuid": "26f3e8c8-d09f-4eab-9827-fb5f90314019", "value": "07340ce8c20f4f23c0d978bce3848650", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572647, "uuid": "a6f5b7bd-18b3-46ab-b9d4-dc348cc18fe3", "value": "3072:/VZ0pmJ3wXrAm6BT8O9CKJWlyiFZiFWBKkp/sL7kPHQjVysyz:/VZKidm6BwO9CKYlHXAkmNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572647, "uuid": "a397c894-1e88-4b61-b56e-45f83cf9b6ef", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572647, "uuid": "be91ace2-0114-4ca7-90ac-728437b5517f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572647, "uuid": "81c58b79-3f45-43d9-aec2-45ccd5d7e61d", "value": "c9a3853a9a7cc35eb051ae15a708f468.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e668a158-b764-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677587950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587950, "uuid": "c4f078ea-78ad-4e93-828f-91d57a1c0f3c", "comment": "Malware payload (AgentTesla)", "value": "106f83ceca740fc83a226a80a27f3a85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587950, "uuid": "fd05ce9c-8029-4a60-ad10-97c9a0ff3a57", "comment": "Malware payload (AgentTesla)", "value": "99f8b58cc35942ee1263c39d53425a6317ca0ded571c82539398e7f1822d20c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587950, "uuid": "27c4fe59-cc45-45fa-a01a-54a5fdf0a82a", "comment": "Malware payload (AgentTesla)", "value": "a2fa2b9bd81042749f5609965add19fb4f6507e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587950, "uuid": "5f366097-b88a-4d7d-9950-ac5dbab2c32b", "comment": "Malware payload (AgentTesla)", "value": "bd9c0db41684ab324655f446df5e41b08fdbb36b723cb81b9e59f4e601a78e10e3da4129b0e35908aac5f53f8bf10e1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587950, "uuid": "bb4edefe-a28b-4669-8bbb-7b31cdb57204", "value": "T13D559C4C63709C73E9DB01B2548522DC0EB4F5CB6116F26A5BA73742AA8A7FFB54D203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587950, "uuid": "316ea173-5d6b-4bce-8b62-32f311c9f3b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587950, "uuid": "117e520b-185c-458c-aecb-76feb4bbde00", "value": "24576:9MCctD7SzYQJO/ZjEVGTHLanl82+70wxU09btGxbCA6/+otq:U3SzYyORjEVEenq7dxZtGha+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677587950, "uuid": "43f4dd5a-b14f-489a-b608-6be6cd5809f6", "value": 1329152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677587950, "uuid": "ffc02e33-70b5-44de-9898-cc72ca0be751", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587950, "uuid": "1589f0ba-7bdc-4e47-beaa-c0880a00792c", "value": "TEKL\u0130F \u0130STE\u011e\u0130 HURK75BS\u0130l_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793c1e3b-b7bd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677625992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677625992, "uuid": "95dd370a-de3b-4783-9f41-314033d22a19", "comment": "Malware payload", "value": "38edc8ad904029a9607bd4106879cba0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677625992, "uuid": "aeb3bbc1-f04f-40f0-b2f3-8031db8d785d", "comment": "Malware payload", "value": "9b288865300a7261da921b78271ead94f23ac05573956b1d1bb9497843740b20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677625992, "uuid": "cd494517-38b7-4c69-a346-7049eed349e2", "comment": "Malware payload", "value": "c99350fcdaf1c1376415b12513cef7e5a7406b88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677625992, "uuid": "1f05dd80-aa04-46dc-b03d-80280b161755", "comment": "Malware payload", "value": "ea330824c2fcd9969579b10897e5ebcf0de9193b6c48caced67a3193ac511503bd3cf368df487f47040160833df77c87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677625992, "uuid": "b35fe197-5897-4bcc-8580-036c60a97692", "value": "T1FDB63333A4140982E9F6943B7133FF9570FA7B5E8604B4B576EAB6C21872DC09D36E12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677625992, "uuid": "e2fd4d1e-e832-4138-b9f9-d027481949e4", "value": "69ced1ad11dc0af68759e861c3ff436a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677625992, "uuid": "8f104c2d-a057-423f-bba9-0fd182ec22f6", "value": "196608:guDF5ssyfmKJu4fS8xqR5vlfbEpBerajBFuhKezpVR77esXabO:zrsnrJBj0mpBera1FuhKWp+sKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677625992, "uuid": "037df4c3-1cee-43d4-9007-ab62b432fa2d", "value": 11372032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677625992, "uuid": "fe031d3c-1deb-48d9-8656-5b9422988f3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677625992, "uuid": "a29c4273-0c4b-4561-90ed-ddeaa4f6265b", "value": "Installer_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4357937-b7a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677613690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677613690, "uuid": "7ef636c6-80f4-4f61-bdf0-4ab6a236425c", "comment": "Malware payload (AgentTesla)", "value": "aa89fdcc30ab4a0076019e1d01da2a8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677613690, "uuid": "93beb4d4-2d4e-4bd4-b111-282cdc233125", "comment": "Malware payload (AgentTesla)", "value": "9c08966b170f8f713f07c3be1ed598d62e1efe93ab427fe4f44a4e372454a3c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677613690, "uuid": "d7ee055d-ad72-4d44-8da5-5a7380721ee5", "comment": "Malware payload (AgentTesla)", "value": "e5525157e007ea7bf8da12d6a690f90a845b0076", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677613690, "uuid": "48b9606c-8ec8-4e2b-8f17-3066f35743dd", "comment": "Malware payload (AgentTesla)", "value": "de1c1a7f93c74ea3a89191b74a0b771b92609b1ceb9e70672b55260020a67c1e20959df3488f9a733fe38e1dffb9cdd3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677613690, "uuid": "2755712f-f718-4946-a642-58ef918643ad", "value": "T149459D4C237048B3F9EB02B5145522CC4EB9F4CB6515F25A8FA73782AE99AFBB54D103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677613690, "uuid": "bf0563b0-0b6c-4427-b8c9-d29a98bcdf1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677613690, "uuid": "9b973e0d-8dba-4be6-b223-27bcc37e130c", "value": "24576:1D7qyeUm8fMXgHU6tfoVQ2eUoFNq2T/ghZs2o80qBoCA6/+o9x/6qW:13qyeUm8V1tfoXelFNnEZg8Fia+W1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677613690, "uuid": "48c1e842-228f-4a2c-bec3-3d6829926ed4", "value": 1267712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677613690, "uuid": "458cdd0e-6b57-47cf-9392-93a8fa709809", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677613690, "uuid": "541cae24-bc7e-4cbb-b16e-3d37175f72a4", "value": "Invoice overdue.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9032ee54-b771-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677593389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593389, "uuid": "92df71ab-4595-4abe-9dca-cf44da8e91c2", "comment": "Malware payload", "value": "6c13cfa37c442520c5a0f923aa93f1cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593389, "uuid": "f7586005-b3c0-4206-bc7e-4d8a5a7fac48", "comment": "Malware payload", "value": "9c4b4f7a530bbef4d4b00126efac07c315127ed16cdb710b698bb3788780617e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593389, "uuid": "2afb7b10-ef8f-4f26-80a8-8a4648bd0f6c", "comment": "Malware payload", "value": "86f926f052a66b300272c18846802cc56c5a1700", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593389, "uuid": "8ad50dc2-f22c-4fe3-ae9d-17d90477bb18", "comment": "Malware payload", "value": "b2bb14ba694b791fe50d22483cdfa1ca09862920a1f81258db8ddabfff85dac69601d959484888f73ebae17a869cef41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593389, "uuid": "4e2000d4-2d2e-4c50-ac4a-a8354d331199", "value": "T1F08333E0776D81C8DDB03EB8D87B257186664DAD2A68CB1684F2733CAFF708534974A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593389, "uuid": "1fb63110-e5c9-4573-9249-a8f9f451a29c", "value": "665c4c0042de2fac7d388e8a44d8e77b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593389, "uuid": "29239e42-37cd-48b8-9c60-bb99dc909fc6", "value": "1536:yDTOlmyW5XXrtxfyZ7V9N4INCxVnA2rbxM3pf7IO6CFQ0:uyqnbE7PWvy64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677593389, "uuid": "5fde44e9-3744-4ee5-be21-16125c9d359e", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677593389, "uuid": "3586dd95-3ce6-416e-868b-c5025230b716", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593389, "uuid": "369a8d5d-2d7c-40fb-b322-b8b95bbe5fe6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10112db5-b739-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677569122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569122, "uuid": "cc7f3607-90c9-4e99-ac5d-04997244e548", "comment": "Malware payload (RedLineStealer)", "value": "de9baaacc74f9f1165a4e0219a1b7074", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569122, "uuid": "70da67e8-96ee-4ed7-8503-af163d70b5ba", "comment": "Malware payload (RedLineStealer)", "value": "9c5a9d62bf2bbbf630e5c91e30b6f62d28bf67ac0710797174b5dcd9981c3d41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569122, "uuid": "7d57bace-a1c6-4d51-a367-2db115acf118", "comment": "Malware payload (RedLineStealer)", "value": "09a8dff8710aade0018064cecdaed781a08ad195", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569122, "uuid": "17757f49-324c-4ac0-9bd4-bbd14a014458", "comment": "Malware payload (RedLineStealer)", "value": "ba0c00fd1559bb9373a069ba6ee78104960c6bbfa542152a3f1b0879e25a3ddcefb60d296db26b60b074039e9350e7cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569122, "uuid": "b823469b-e8d6-4cb4-9b69-2713f3f3a078", "value": "T1FD452347B2DD8425E9B497B05CB602C30C377D211A78C3AB664E9C6E0DB56B0BA36377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569122, "uuid": "ab368860-8511-4216-aef8-f26340b05492", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569122, "uuid": "18a7d523-ba20-4766-ba43-a78a0c399a29", "value": "24576:IyBWw+UN1kOl0Qzk6rKb7m+oLxbBqorW4jEehiUkzV:PYwlnkOVzPKPm+oLqorW4xZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677569122, "uuid": "6b578f59-29c4-4ec4-ac8f-23a61766159f", "value": 1233920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677569122, "uuid": "f0444345-d7fc-4333-91b2-5544abefe96a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569122, "uuid": "cffe441e-9abe-40b3-b584-f5a9976a71cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee189aa-b728-11ed-88f6-42010a9c006e", "comment": "Malware payload (XWorm)", "timestamp": 1677562034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562034, "uuid": "908e4c8d-8566-4ec6-b6da-8461379fda21", "comment": "Malware payload (XWorm)", "value": "496d1732aa751553fad2448a69b7a5b8", "object_relation": "md5", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562034, "uuid": "27ccfb09-dc20-41f1-a92e-4f686dca7a18", "comment": "Malware payload (XWorm)", "value": "9cc2a804dd840e979b6481c0cbc8045c991422d193b3e6358bacd082dd657c35", "object_relation": "sha256", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562034, "uuid": "8dcafd0c-f382-405c-b88e-811d516fcec6", "comment": "Malware payload (XWorm)", "value": "3b4c2b7ad0e5b692353a48b7e24767d5d21a85f9", "object_relation": "sha1", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562034, "uuid": "2d527293-c90d-4dab-b634-344770ba070a", "comment": "Malware payload (XWorm)", "value": "66bbe8d8cfd0cdd407a4a8b17dfd1471904b6715847577a25ce59a521be0ad344b4fa9f446ab69a6acfb2fe780c8d8a4", "object_relation": "sha3-384", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562034, "uuid": "4559848a-e1b8-46e4-b659-749a9edf6160", "value": "T1AF035B083B998326D5FE1FB599B6910103349D07D923DF5F5CC8AEAB7F67A8002013EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562034, "uuid": "1e76117a-34b4-4838-90d6-87e525ec9fd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562034, "uuid": "414c89e4-be4e-4c76-a5dc-22716a25ba1c", "value": "768:4rgECfLH1MYAoRbv2uBFE9RAfKOqhvblds4S1EAd8IIN:6gRxv24FE9RACOq1xdS1EAd8IIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677562034, "uuid": "22341709-22cd-4ff3-95f3-dd481a35ac9a", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677562034, "uuid": "590d8f92-9675-413f-b5c7-77a728803b3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562034, "uuid": "b879efdb-fae5-45c6-afa1-0e02c9771fa8", "value": "26_02_2023.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ae2516-b7a1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677613806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677613806, "uuid": "e62df7c0-0768-4349-a762-ca44ea4fd6e3", "comment": "Malware payload", "value": "807d409cb5cbb548dc504bac9dc13b6a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677613806, "uuid": "61beedee-efb1-4e98-a2c1-b0a5aa6a7678", "comment": "Malware payload", "value": "9e63adb228cc6c3c604986a1432fb5e2382bfd48a067df51a231b91638a0e45c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677613806, "uuid": "fe5859e7-524a-4577-bf6e-bea9d988556a", "comment": "Malware payload", "value": "bd6c7b7d40b33ed40c448bd119380e517471b1fb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677613806, "uuid": "b1075938-25b3-4297-9136-b546d52cec48", "comment": "Malware payload", "value": "7b703edc7b3e007e9270bdc03f7b5b9b1477004cbf3fe8dad234a528b2fb7fc899bf54ba4953c0d2d611577170718f8f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677613806, "uuid": "e9c174c8-8cfc-44a7-97a4-3f437eeb89e1", "value": "T155231841B8818623C6E4137AB66E46CE372563E8E2DFB3179D221F503B9682F0D67F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677613806, "uuid": "c0effcc3-eca0-49fc-ad43-379d04ddf28d", "value": "768:p9T3kFvFsOvIZg3VevqKxpn9m+/8KTUfPoV1//N+WX7JTzLgwY:L3kFvqOv0Q8lg/fM/z91Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677613806, "uuid": "a7caaec8-a4a1-408e-ac66-ef9668a782e8", "value": 46864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677613806, "uuid": "3b573da5-8af7-4f37-8a91-52d8c06ba86b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677613806, "uuid": "cd2c07b8-fa65-4bda-82ae-ffc6314375c7", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747aeea5-b78a-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1677604080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677604080, "uuid": "283f4460-465d-4705-841a-5fa59985dc88", "comment": "Malware payload (CoinMiner)", "value": "310ad4f57eff4a82c55e34a2723dd283", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677604080, "uuid": "3b445378-de90-4d49-a031-1881d6b6ac47", "comment": "Malware payload (CoinMiner)", "value": "9f7dfb962e2bf51b8635de5abf80bede395c54abdd19ce0e7caa2343667fefe9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677604080, "uuid": "51a75a15-e779-4a5e-817a-bbd8cfc35b85", "comment": "Malware payload (CoinMiner)", "value": "57aec7958f04644ce076e1c78df730cb698e31ad", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677604080, "uuid": "c2a84c0e-79b9-4056-ac33-534bc7958fbb", "comment": "Malware payload (CoinMiner)", "value": "204d2dcec9759ef787cb3ad37e220bfd7c437e883e41e0271abe024ac0b51e24a3bc58717a575fc7eef79b33d0cf3d85", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677604080, "uuid": "8bdd138a-b248-437f-b767-ed5375a4e4f0", "value": "T1EA66335306879C6AF9C3BFFC59B6482469F92A04048C26F8CED70C6747E77690A37639", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677604080, "uuid": "bab0c00e-3a51-4666-8c4b-95189313d11b", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677604080, "uuid": "fc188001-fa5f-4519-919b-48177ff8b91a", "value": "196608:ly3FwVssRJTy/xr85Z3MBRDnglLOIeyqZ5:lGFWsyu8b96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677604080, "uuid": "7195682f-9cef-4d6f-bcbf-8f9cf25ca333", "value": 6840832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677604080, "uuid": "c30eb899-e2a4-4463-8436-f2672a3d194c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677604080, "uuid": "d223bbe8-5c0f-4ad7-a419-43d077207343", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ce9f8f-b719-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677555682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677555682, "uuid": "1e390183-f32e-40e3-94c4-dc7de2a5fb52", "comment": "Malware payload (RedLineStealer)", "value": "2db6a82b983f51685b2fbe98483a1d25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677555682, "uuid": "acd41d39-557f-48ea-ad28-6cb49ce1b27f", "comment": "Malware payload (RedLineStealer)", "value": "9fee121afd09c7e1f46008931583e0a9dec1f58525ac2094a82d66250416a49c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677555682, "uuid": "5978d126-ffde-49d7-abbc-c28b45dd704e", "comment": "Malware payload (RedLineStealer)", "value": "0624af8efd2a4772325c0cd81b8cc2584ba23175", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677555682, "uuid": "bfeb3536-8bad-47b6-93dc-d091150e7510", "comment": "Malware payload (RedLineStealer)", "value": "2b4fc863ad3ee82d1d2f84d6b59b9eb447751324f531c960c22161852d3d26f1d4d6f8c3956e7593ae4b8f354cc38951", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677555682, "uuid": "e856c41c-9869-4675-adf4-46979fd131a3", "value": "T18E652346A6EC9272FD70077049F547C32632BE208B38479B63AB6D1D1C73D4971763AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677555682, "uuid": "210a0f92-7e8d-4f83-aa6f-a09db4fbc3db", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677555682, "uuid": "d9fa3643-8c30-465e-87a8-1c6c72b7f93e", "value": "24576:RytvYJZYzH+7NBdAEyuqBsjxn5UbwY10TJJi2/xWK8/1jXcor07eQWmi3x:EtvY8zwj3tJNJWhjZ06QW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677555682, "uuid": "9d68be0e-56b9-4fec-acba-487321b12ad7", "value": 1427456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677555682, "uuid": "c29e9e29-f7cb-481d-b5ab-0bcb3685a281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677555682, "uuid": "80ab10e3-d2b9-4eb7-aa7a-5c3d92041d69", "value": "2db6a82b983f51685b2fbe98483a1d25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe2e9121-b784-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677601734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677601734, "uuid": "18f95859-7ab7-4a69-a568-c3b1ce96131c", "comment": "Malware payload", "value": "4c42f0902775f4798fe2a632731e4c9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677601734, "uuid": "35d5a943-848e-4023-8e9e-7f1bd92e6c30", "comment": "Malware payload", "value": "a0c64497d91a1176f91723beabe68fd5521a32a2531664ac5cbb02ff9abad8b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677601734, "uuid": "0264a3de-e783-41e6-8637-c0fb9aed6e67", "comment": "Malware payload", "value": "030a8969eaa5ef46583811402d6839e66939413f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677601734, "uuid": "971e61b6-a84f-44b6-bcb6-b8fa9c23effd", "comment": "Malware payload", "value": "6b1b8ab06287ab8fd7cc330fe97a3d79e4c9809e4c174ee1d7a3041942557ad840e78f0819efaa545948121919cfbf3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677601734, "uuid": "dc9784b3-bdf9-4ea7-b9e3-df9e60d3e16d", "value": "T1C986232427A4EC6FCE304B747CA3F2600179A7BF9CCD45CA587BCED815669AA3A03517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677601734, "uuid": "9227115b-3546-44cf-a0f9-f13f092baf52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677601734, "uuid": "f8f9f387-e144-44a9-8cef-d58880dce293", "value": "196608:A1lNa8RXSehxqJlFfyfdvZXwyuUa4pI7/u:A1ntCTfyfdvRla4pm/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677601734, "uuid": "ea7af168-8af4-41ae-88fe-99fb563ee724", "value": 8245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677601734, "uuid": "a313cea6-f30d-4488-8595-351101ca57ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677601734, "uuid": "f9ab0e58-968c-4fde-a857-e0d38235fd8e", "value": "SecuriteInfo.com.Win32.RansomX-gen.12924.8987", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b96f5f-b785-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1677601852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677601852, "uuid": "3ff1d4aa-cc4e-4cb1-9f13-84668054b024", "comment": "Malware payload (GCleaner)", "value": "7f98c166f70871edbb5dad2c03ff41df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677601852, "uuid": "d2be2c21-d693-4717-9b65-c0357961d939", "comment": "Malware payload (GCleaner)", "value": "a0cfcaa3c8a631ea21d343f051b80c7973de9bdc2dd624ed6f6799d442e2d271", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677601852, "uuid": "a6a588d0-917e-4df0-968b-ac747bf376b5", "comment": "Malware payload (GCleaner)", "value": "9e04a9dabda8159a23bfb133bc2d361fa95907e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677601852, "uuid": "e4542521-9e01-476b-8d64-74a7f08f60a7", "comment": "Malware payload (GCleaner)", "value": "e591cf353eaacc96d24cb6fbaf4aba3558c0bf7cc0b3255da80fff6abec764d6e00ad8a8a808f60f1e31cbc4dc0743b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677601852, "uuid": "03ae204d-06ed-461d-85e9-dc82bcd46e5f", "value": "T1F0C53366D9E96C7AF2F042782E2EB400397734767661848897F98B0D1F2507FDE44B8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677601852, "uuid": "cde7658e-c98b-4485-8f74-6f5cf5133f6c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677601852, "uuid": "eac27df2-e3af-4c82-8d31-88e57bafc63e", "value": "49152:AG/BuPz+oi0dVOJFHti9j3BOogJj6TvQlormMnYrSH+fYcshv8CjOKz:d/mKHa0HIbrgLpMTcsh0CjOKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677601852, "uuid": "d046f211-1d70-4d0f-b54e-f425c665022f", "value": 2673749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677601852, "uuid": "7f2980a5-b6e7-4d39-9442-221e578b98df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677601852, "uuid": "79494f75-6e24-4a29-81eb-8257f4ad3ac5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154a09f1-b740-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677572138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572138, "uuid": "220edd2f-e9c8-427b-beda-c2026fdf22f4", "comment": "Malware payload (Smoke Loader)", "value": "f1daadc1b296abe0b93bce9c5447278d", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572138, "uuid": "aabfb2ac-be65-49c1-b2e6-f26cfd811df7", "comment": "Malware payload (Smoke Loader)", "value": "a15b65d3c2f6979e481c4d045514809c24d60c28f97893e9950858a878cbc5da", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572138, "uuid": "176d1024-2fd2-46ef-8ef5-2e4c1a8199ff", "comment": "Malware payload (Smoke Loader)", "value": "d33153c62151052a8db162d9175eda4dd3b62242", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572138, "uuid": "78271b76-28cb-44bf-bcd0-8e86eea95e73", "comment": "Malware payload (Smoke Loader)", "value": "3bfc69e87f0701a763dffdf8f3021de7660323e1660bb7963e84ca1a004d369c60a90fa13eb9e2cd87886b0d8fca8f52", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572138, "uuid": "588c4c5f-bf4c-4eb0-a627-db66b1204642", "value": "T11554D0117990F031C75741B4B834DAE86E7ABCE15B9589A733183B6F2E302E297BB345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572138, "uuid": "8e293b60-407c-4613-902f-c81639791859", "value": "1e96cb5984683b7e47e14770412e3c53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572138, "uuid": "7410735c-395a-4071-aae7-2f736a0d63d8", "value": "3072:Ba5D3LSsJjiO/Z2Ak9tyl9vOuyWtD4AZOUh8SYOrPEwuh/XKE:IZL5iokny7OU4A0u8rOLEZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572138, "uuid": "56b73b51-394d-4155-8f65-5fc064fdcd1c", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572138, "uuid": "fffd566c-0294-4d0e-b39b-90b125087c36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572138, "uuid": "1f004cf3-d7b2-4c00-9a43-ed18ce4e0769", "value": "f1daadc1b296abe0b93bce9c5447278d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b24a64-b789-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677603758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603758, "uuid": "6f649936-21e3-4ca2-8fa3-ff362ee88c01", "comment": "Malware payload (RedLineStealer)", "value": "99320a8c5fa164a5e8f98b60fa6cf0bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603758, "uuid": "84c62924-b711-4f04-b810-9253d6a750fe", "comment": "Malware payload (RedLineStealer)", "value": "a1a238d39334396ad19e82a3c4ccd3774bf8053586935a0af0b8e8abf6ebfbb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603758, "uuid": "451c9221-59f2-4612-b4ac-e244e9b85dd6", "comment": "Malware payload (RedLineStealer)", "value": "c66f82d69d6bcfbf4406710ab7adcf1b18b847f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603758, "uuid": "31536cef-13da-41fb-978e-1b7222fe888f", "comment": "Malware payload (RedLineStealer)", "value": "7b778581b983cea89375c720d923304124e59ac193edd2ab46580f70516ad4fa6d333c5e18e0a5159e3f3ba72a6d60f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603758, "uuid": "f12f88e3-99dd-4662-8dfc-7475e946a3fb", "value": "T19A754B0FA17FEAA5EB211FBB067443DA381AFC2D7F7B04769E50A61D4D9018C46E1E81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603758, "uuid": "deb32e98-9768-471d-b491-fd195225d572", "value": "17e63e07e252d3a78f45635bbeae878d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603758, "uuid": "077898b1-f459-4e75-9269-2a42006ddbf8", "value": "6144:0kaRT/SgvHJWjQ/AAOfh3KwRXE5qXPcp5WcVDS6Plj:0TRT/bvtANlKm3/cp5DPlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677603758, "uuid": "cb20b2af-f3ca-4d96-a969-35fe184aac60", "value": 1657400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677603758, "uuid": "c720b318-8644-4194-a31f-0d3c9bc260c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603758, "uuid": "e3708033-3252-4524-9e4f-287a0b2dcee8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d74d04-b76f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677592692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592692, "uuid": "5f5bea8d-234f-4339-a004-5bba44ca0181", "comment": "Malware payload (AgentTesla)", "value": "951807fc58ac28c3db3d6469ce092acc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592692, "uuid": "79370528-1dd9-46a7-b398-93ac25d20cc2", "comment": "Malware payload (AgentTesla)", "value": "a1e2e07c9b335493af4c7eb345f5e478d758efadb8ef2df597e08734c5ccffa1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592692, "uuid": "be3da158-dd4b-48b9-9be7-89b7e99c74f8", "comment": "Malware payload (AgentTesla)", "value": "c7b0d3d3b977c340eb6de0e73aba380b78c45160", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592692, "uuid": "0d25f00c-42e0-4ec9-b6e3-bd8e8fe88102", "comment": "Malware payload (AgentTesla)", "value": "6b035f2c431af47065225a6f71bb3abec94e69a3ed130829474645f63ea0108c1b05bc77ae79a4c3a08496457f10188e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592692, "uuid": "ad364177-eb54-4ccf-b191-699cc880024f", "value": "T1C825173D36739AD2D274F63386D3E820F6FC84926313D94A9ED60AC50F42642ADCE65D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592692, "uuid": "b6bf8260-fe22-404e-bd89-0ebeafeb3c3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592692, "uuid": "189a93da-e4b5-459a-b3a4-c18852c7335c", "value": "24576:SUEkKSPl2wETsIBMNjnNNOhAe/S0VK84RixZ4CZH/DO8F0o4dlI6b1YOcZiJJa:zEkKSPwwBRAzRDOi0ZdlIUlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677592692, "uuid": "35106a59-d31a-402c-bf41-42e30d3480bc", "value": 981504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677592692, "uuid": "d6cfb36d-9a34-4e69-8a14-4b66d039ab2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592692, "uuid": "0264124c-59b2-4f4a-8a19-53133ff3cca2", "value": "boni.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a053774d-b755-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677581390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581390, "uuid": "ecbd66a9-b4b6-488b-9674-39d06127deeb", "comment": "Malware payload (Mirai)", "value": "52002211768a9555f3dbd1c0f9912225", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581390, "uuid": "1168022e-9c95-41fa-b4d6-9eb88991717a", "comment": "Malware payload (Mirai)", "value": "a33d1a76cb833c3a02aee3dc1cb89d97dc1fcaa57c6b9f5001cd2fc612649fa8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581390, "uuid": "2d538741-166f-4d31-9174-ae5b4121ca82", "comment": "Malware payload (Mirai)", "value": "e29c2cd8410705c063e8908df8c08e15e014170c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581390, "uuid": "8ac9cb03-411a-45c9-8116-9d7a7b43a18b", "comment": "Malware payload (Mirai)", "value": "9a7073e08a35e33a92f65dcb02d863cc1a78c2bf28a1c3a2d8f6ddd8b946a8b6ed0a585d6587e86b06ddb3914a6a01cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581390, "uuid": "b0d405e6-595a-4ba2-a125-fdcece03ccd4", "value": "T10E33B7C0ED973DF5D2C6EBBCE8DAF27928E3850097A64256E4CD8E52C47F688110A35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581390, "uuid": "62f6d5c0-f2d8-4171-ab6f-c6128fa16d3d", "value": "768:Sa55ZhBY1qs+W17aKEh5UYmMVa/fWU0eT2t3C:xhQhTi5UrMVMflIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677581390, "uuid": "0673c3d2-834a-4286-9ec7-6de26ef0d426", "value": 53789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677581390, "uuid": "07748688-19ce-407b-ae1f-c950827005ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581390, "uuid": "71c9f30a-a940-476a-af39-ec518635e430", "value": "52002211768a9555f3dbd1c0f9912225", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3fdf1c9-b786-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677602496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677602496, "uuid": "5a15dad8-9a69-4a42-83a5-2a4113a7a0d9", "comment": "Malware payload (Smoke Loader)", "value": "c6ff04eb73522bb772885a1c08e684f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677602496, "uuid": "4d76733f-da23-496c-975a-a850494aa808", "comment": "Malware payload (Smoke Loader)", "value": "a40141fe394b8fd9c3c9983b4694757cffd3afa644fd8df02f74629212954a01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677602496, "uuid": "1090d2fe-0fcb-4e48-bd89-cf34e94afcec", "comment": "Malware payload (Smoke Loader)", "value": "7b6e09e7f42d8a396dcc52e0be4b043fd69885db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677602496, "uuid": "7997ccac-89d2-4041-87ed-a416eab9261e", "comment": "Malware payload (Smoke Loader)", "value": "d05bb938a42869bce6abc0e85addb96ff4637a9ce0924cda24b0949427f6c09bc4509f8d0b297d86e158513c4b182e24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677602496, "uuid": "f236deb6-54d6-46b6-a750-ce33bf320642", "value": "T1B254CFC175D1C83EC85741B08539D6F96E3ABCA29A95898B33183B6F2D303D266FE345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677602496, "uuid": "c67e4c08-2379-4ec8-9291-e23ef4978977", "value": "a66ab37f013146fbca029fedb3c9defb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677602496, "uuid": "6fe208c5-23e1-4f56-940a-1b902d5648b7", "value": "3072:67HLL3sxR5y1eMhPJM67mkMz5VsZzgwYr01akhNvHuFjE02K:WrLOQjD7qzzMSBRFjB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677602496, "uuid": "c99a3378-80ea-4a1a-b58a-6db021e3e044", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677602496, "uuid": "0e90f203-4e44-42c9-897c-5d18561acc86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677602496, "uuid": "46ab2e94-8622-4aaf-bae9-f281c206549d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a293084a-b737-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677568509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568509, "uuid": "0bb6c698-f8da-496d-969f-e466c7840299", "comment": "Malware payload (Smoke Loader)", "value": "80ca877e4d2a707683f09295db56a766", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568509, "uuid": "60915e92-4713-44d9-abdc-f692daf248ab", "comment": "Malware payload (Smoke Loader)", "value": "a47cdf8143a3bf2d129a875e19fdb95631e0ce56f435a4ec924696795727dcbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568509, "uuid": "6658c502-aa4f-494b-a376-d061a13cf921", "comment": "Malware payload (Smoke Loader)", "value": "57d65561c17a593c2546089d197aba0f84135f34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568509, "uuid": "a5fcf14f-5f38-4854-a785-ad3d2f009f9e", "comment": "Malware payload (Smoke Loader)", "value": "fabab7cc6941d07c1abc95cf6c291aa74bb1ef12977721f0333d53d44a574d783746f86a4ca0d731255526daf2c06447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568509, "uuid": "120ca827-d8d3-4642-9037-0868fb15f1ef", "value": "T12E54DF11BE90D472C84605B18835DBE12E79BC725A54B98B33183F6F3E732D167B2E25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568509, "uuid": "79d6e6a3-991e-45e2-8d59-bb97cc9dd7cd", "value": "e4b2d0ae8c37fbe6fd3dd085e76f3746", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568509, "uuid": "6be8be47-6522-4325-8bce-c6ec734e78c3", "value": "3072:JdjaL9s9kEC9ltsW1dKDjPzWUBq7o2uW7NbdMg0bQmDZiASskCP:LGLHEffy2qcwNbdL0bQzASs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677568509, "uuid": "abd3d707-bf7b-4f9f-9dd8-5afa71543149", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677568509, "uuid": "1b711375-2636-4521-a006-7071b8f7aa42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568509, "uuid": "69dfc5b9-8566-4495-b662-2aff94605407", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b7e718-b7a6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677616249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677616249, "uuid": "9f63d7ef-495f-46d2-9661-02503adb088f", "comment": "Malware payload", "value": "7c3265d3dac89cc2059a307d971693b9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677616249, "uuid": "01b46c85-0365-48c0-8949-767a9c2fa806", "comment": "Malware payload", "value": "a4a0d5a69de4a28e8f7f1dcabf902c514e82b9424a63235c34db17cd262024a0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677616249, "uuid": "803a4ac2-a514-471b-a1b7-e322f02730c1", "comment": "Malware payload", "value": "2ba7291fcfe5986344ee2567bb3f5552598ede89", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677616249, "uuid": "b06fb300-1f68-42c3-8055-594e870bee7e", "comment": "Malware payload", "value": "86ba1d5f0099bf54f1d011b677b5e80f0d8c33d3bd63fd6f7c92b3300d31ddefbd345dca2c7dd21f6dbf1b8bf48e6f28", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677616249, "uuid": "3abf7dd6-c5d8-4e30-87f8-c162d35134f7", "value": "T1DBD3F69D8B652641459E43B39E813CFE5053C223C6351CBB2DF15B4AF32A338A7266F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677616249, "uuid": "883dfee3-8a31-4722-9b35-e8daca3a98ff", "value": "3072:V3gJ9wa/isXTd4chwAEcvZmF+X56tkNVVHjhIXx0TS0IWViF4YvUWgn5ir+9b+3T:V3C9wa/VXTd4chw3cBmF+X56aNVVHjhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677616249, "uuid": "b63227e0-71e2-4bd4-976b-3c5621e51ec3", "value": 141520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677616249, "uuid": "afbaf753-fb6c-41a9-acca-ff0e6b08aa20", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677616249, "uuid": "248f555f-3352-4afe-8f7b-da29c3162261", "value": "Remittance Advice - JFK00040505.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417cfa52-b777-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677595834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677595834, "uuid": "538e62b4-f192-4eef-92f1-0296dc936091", "comment": "Malware payload", "value": "e17400ce92c53939ed13c6ade2e4ce52", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677595834, "uuid": "65922dc2-e74c-46cb-9f34-e2a6a747b67c", "comment": "Malware payload", "value": "a4d32181b2c75bac2caf55e05284221fde2a193d47164432a3b77c6dabd52478", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677595834, "uuid": "9dceb7bd-2a2e-419b-8777-de881fd8f62a", "comment": "Malware payload", "value": "bf45c458f66c0cf5c7042efeb7ba53c520e0fd94", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677595834, "uuid": "3298d1a9-3419-4386-9b51-78c6d7d93294", "comment": "Malware payload", "value": "5cf34c4d3303b579f50f83e9ac3ff02c2ce1688b9092f866112dcf63e79b76d91d3ccc6957d3eca31e3eb0f2acca2166", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677595834, "uuid": "ccb3390c-7144-4a9b-a113-94fbe69f23a5", "value": "T16411EBF62B2E5012C9B1CB421C47528ECF6051A268C00A11F9FD4E209E39122935FACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677595834, "uuid": "84f341c9-f026-478a-a4cd-bafb3bf9312c", "value": "24:DOVtyCi2KsFTFnswvpdPNuR71q2z8JAhqn:DOVtyCi2KsFTFMqcrqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677595834, "uuid": "31d4a42d-8f4e-46b6-9cc2-65833bbbfd52", "value": 1078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677595834, "uuid": "ac4c56b6-b4d7-4fa8-9fa8-83c9b76d73d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677595834, "uuid": "208e55f4-6fa7-4d52-970d-7b886119ceeb", "value": "Upi47Fec.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd32051-b742-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677573226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677573226, "uuid": "1f0b3914-8d09-4c9f-81c7-53da50664ada", "comment": "Malware payload", "value": "eca18b9058ac0ea13dd605b10f2f8415", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677573226, "uuid": "7c52375c-e6ed-41f9-8b4b-6a924cb46886", "comment": "Malware payload", "value": "a59d9355dfaa21c577b288791190d2d004346d519761e5e7f7b46f3e8ffee326", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677573226, "uuid": "b790d971-ed5f-4337-8f5c-6c54a76bf396", "comment": "Malware payload", "value": "cc27242c32f927ac39c77091542a7122a427f63a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677573226, "uuid": "fc9e0ac0-e270-4ea1-9267-4e0f39c38962", "comment": "Malware payload", "value": "3f3e16747afee5193524e4a0a074da8bb303e4fd016d8f59e4c9a56d8d9031ea427577c8f2df9737b6adde364620673f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677573226, "uuid": "28e9f765-b0f3-445a-9ad9-7ba4b5207d18", "value": "T1D013F1095F21EE55DF0108A32D9D96AC99BBB75A0B7F347198E0BD4F83961972C5B300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677573226, "uuid": "d8ea4562-f751-42ae-bfa9-55c177f52f62", "value": "768:pwkyTc9pHiGJ7bLxlpuYPW55oXnOsUkAtkgP1NjSfLL5UZmVelHOp:pxpJNlEYvXndUt/afLuZmVelup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677573226, "uuid": "77daa93c-0cd7-48f8-9698-0319e474408f", "value": 44888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677573226, "uuid": "a5f19795-529d-446e-9144-12aa401c26e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677573226, "uuid": "8eb5e9f3-7817-48fe-bb72-f449caf61a44", "value": "SecuriteInfo.com.Linux.Siggen.4218.4447.6296", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf88b88-b771-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677593409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593409, "uuid": "f96ff55d-27cf-436d-9158-637e52c5a095", "comment": "Malware payload (Loki)", "value": "98670ebe9e5db2358129c9bde06c920c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593409, "uuid": "e14826bb-ac55-4bcf-8f32-21263f7c8d14", "comment": "Malware payload (Loki)", "value": "a6ac2006aac0ffa8c47dab40a300aa77e707855d271ff284ee0afafa96396fd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593409, "uuid": "8691e110-fe63-4f0b-ad7c-df88ae7d4557", "comment": "Malware payload (Loki)", "value": "29411dba35e1f50fd9fb64773f6be09f26212a02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593409, "uuid": "8df1d57e-b36f-4f33-a498-c658793f1ed1", "comment": "Malware payload (Loki)", "value": "b04516693e1f3152790ca091c78f457691c8572ca97681c75e45ba2dbc44168eb31e78014a1187c588eabbf09d2ce91b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593409, "uuid": "05a7d6dc-8d1e-4f5a-9992-c9778296b61c", "value": "T150B423089AB5C4D7CAB350719A7A6AB787F98C5130D0138E27A04B8E39A7F52DD0F753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593409, "uuid": "8aac6dae-4605-45a7-80f8-1d35b977387b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593409, "uuid": "b3008993-a9e4-4b9c-9694-b6ff5de284b4", "value": "12288:vYAhs8HfpKM5d4P0juzY8N5mpUgxNT1OvV21vUlPjJn0:vYAhsaUeCPhzY8+hNT19yVn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677593409, "uuid": "8bb8edce-7912-4c1d-921f-016b8245a60e", "value": 537950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677593409, "uuid": "784ae156-1937-4a47-b737-295f61bd66b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593409, "uuid": "e1587db1-182e-47f1-b462-1e5efe97a96a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01598ef0-b734-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1677566950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677566950, "uuid": "ed38ce79-9679-4ce7-b083-c4d5f2caf8c7", "comment": "Malware payload (PrivateLoader)", "value": "6edf29ac9821ede19abcb355ceacce89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677566950, "uuid": "f00699eb-3ac8-4ceb-9d2b-9032bcb26c27", "comment": "Malware payload (PrivateLoader)", "value": "a77ca36f11de22e899aa57c96c8789dc2f59edabcefe865dfe0d1fc137336cb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677566950, "uuid": "3b519a4b-1e30-4239-a57a-62f46b13c134", "comment": "Malware payload (PrivateLoader)", "value": "fce8fa94ea2912fc1cf3e5ed7fb392676a70e2c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677566950, "uuid": "6e66d941-e8ce-45ab-8fc6-e7ddaa54e959", "comment": "Malware payload (PrivateLoader)", "value": "8b4cf217bc28a625e86da1161e9fa21a4ee3b04150801ca360239f6347dbfe1f9359b0235fa8c264e56b4352dfbd07f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677566950, "uuid": "3aa554a6-546c-4bff-b05f-6cf5f486f9aa", "value": "T17D5633601EB16E12D66BF0BCCE2A7F0E621C0959D927A28CFF489B23371D9D7B095714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677566950, "uuid": "0be1f66f-acbf-4651-9645-d81b82152159", "value": "348773d00220e600aabe04ecb8803881", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677566950, "uuid": "244c2621-6810-460e-968d-08c00b81f01f", "value": "196608:W6uz0HL8HG8MyqamaU4skojHJ4j5zp5Q+9mZPt:3ug4HGYYioDJQZmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677566950, "uuid": "cb16d1a9-9a95-4691-9885-565a55968b1f", "value": 6305280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677566950, "uuid": "90026699-ffbc-43a8-b014-f741f1715823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677566950, "uuid": "2d6674b0-47ef-4972-a11e-92b523ad7714", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d7b01a1-b6ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677544234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544234, "uuid": "6546044d-a400-4986-a000-53187d46734d", "comment": "Malware payload (Mirai)", "value": "da66a3b9b76a5e3f3a688b084c27d2bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544234, "uuid": "fe62b2e5-238c-4c07-8f9a-a721c3033bf9", "comment": "Malware payload (Mirai)", "value": "a7f9eb2f8d4e7a256baa3ebef4c036f4a6327ed9e6407e5908a00853ab0627ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544234, "uuid": "ec05cf4b-0b46-4978-bd1a-30871b0779a2", "comment": "Malware payload (Mirai)", "value": "1d04400ef55c54b0daee052cbc4fdab158aeb66f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544234, "uuid": "aa4b986b-2f84-4e13-8e92-703befbad7d7", "comment": "Malware payload (Mirai)", "value": "0b8c6870f298055581a22828763a13471b03f0d39feaf92efc745e4b132e62d6322f65763b0da0a49ec7807b3cb6583e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544234, "uuid": "e6d8d7ce-c7c2-4787-bb44-0e2e4800a6b9", "value": "T14C23F7C27942B629C3D157BBEE9F014E335497DCD1EA3353C8281B947A8AA0F0D67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544234, "uuid": "ee98972b-c1bd-45f3-8cc7-d8f719cc969c", "value": "768:GHEwscmmayqpSNRuCRvFtS1ug1/njv2DoCerCGme0Cf+5reSU7wCVy/rCxHghW1r:GVmOWSNRcxjvqe0CW5rnvhW05qpRJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677544234, "uuid": "1c981ab5-b030-499e-b6c4-c5adb628d56f", "value": 49420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677544234, "uuid": "7e47f0aa-5e04-480e-8df7-57c45d72edb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544234, "uuid": "5258c59a-eeb0-45fd-b0eb-87b584aa2295", "value": "da66a3b9b76a5e3f3a688b084c27d2bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267f5a5b-b6ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677544249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544249, "uuid": "efc01170-394c-4e59-a21e-5748b87547da", "comment": "Malware payload (Mirai)", "value": "c4a2965c83ad54c3f317f1d9a958d8c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544249, "uuid": "8e1d9f26-037a-477c-90e9-e540cba5238d", "comment": "Malware payload (Mirai)", "value": "a805e9d66cec5bf447a8bd9a19f98d1f5cbf761ad1443e50d8e3dea022881828", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544249, "uuid": "5a2727f6-fcc5-49fd-9439-50182bd13b66", "comment": "Malware payload (Mirai)", "value": "12eb73248b7f04550efae7b3a61d674a6614be60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544249, "uuid": "ea0ff2a0-f9a9-455a-bb75-60669f0dcf6b", "comment": "Malware payload (Mirai)", "value": "043478a4653876b3afc8f32ea96396f8b2e60470e1fafdf4b47ddd4c7c5618f57bd0409e901f0cbee298f2d401cc1580", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544249, "uuid": "6a447588-8306-4385-a9bb-6bd636f260fd", "value": "T1D763A51E6E219FBCF76C873547B78E309658339626E1C685E19CE9005FB024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544249, "uuid": "cd713ff4-66d1-4dc4-9740-70bdad981a43", "value": "1536:gyfgP53L6KdcklFY3+FHGofCTNIF+e9Rlx6IvQfx/Zprntmqlr:gZRL/dflWuFHGoqIODfDzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677544249, "uuid": "4a183686-03d9-4f1a-8975-4e6030f567fb", "value": 67808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677544249, "uuid": "aaf554a3-4e62-4fa7-84bf-d2b2728c9864", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544249, "uuid": "a4af0bcb-5b55-4c1f-af92-e7904eb61972", "value": "c4a2965c83ad54c3f317f1d9a958d8c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9e64e3-b733-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677566676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677566676, "uuid": "e357db0d-006a-47e6-acee-4d2868ad9573", "comment": "Malware payload", "value": "f9485e27a1e6c804d8dd38b82b6ff090", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9485e27a1e6c804d8dd38b82b6ff090", "colour": "#F12AB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677566676, "uuid": "3db12642-8b84-4b50-aeb4-5a0714e94d25", "comment": "Malware payload", "value": "a839835bc2d65a988def512abc9cb7426ab483cda1e16d9a9131fc5ec7544bd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9485e27a1e6c804d8dd38b82b6ff090", "colour": "#F12AB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677566676, "uuid": "2d7fb8f9-5315-4d4f-a037-ae1b9bf81969", "comment": "Malware payload", "value": "539952c2e5512f683e4dbb26dd79d73037ab5ef7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9485e27a1e6c804d8dd38b82b6ff090", "colour": "#F12AB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677566676, "uuid": "20a50738-5ee0-4e5d-ae1b-618fdc93bc08", "comment": "Malware payload", "value": "d2c7ee831395213e7af507bba200cb460ddc4562c51fe0103b5916015416ca5be4ffe73468f560bba2f704166a0b7351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9485e27a1e6c804d8dd38b82b6ff090", "colour": "#F12AB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677566676, "uuid": "b28c321f-94f9-415f-8400-e5779848ce79", "value": "T15DF45ACD30FB4431D53754394AACFAA68F3FA6344A620D9797D5891E0A2738EC62DC1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677566676, "uuid": "3d202b59-8b7e-484a-874c-adc567ffd656", "value": "0c09b077bbc4941fe51c751209f46580", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677566676, "uuid": "b6d01637-f6f9-42b4-bd5a-9735b44fa40b", "value": "6144:Mr4XDXiN9smJJzsOqaxbK3w55vYwDF6s7xwfLCF+o0cjRQSD4sX:M8XD1O5xbK3w55vtoBsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677566676, "uuid": "8db788fc-970b-47a7-8486-0651b06f993f", "value": 782119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677566676, "uuid": "9b0c5a06-8385-4712-88ee-481f2237cce3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677566676, "uuid": "b64df659-1b08-4e14-a0ef-b5d2a7c56e0b", "value": "f9485e27a1e6c804d8dd38b82b6ff090", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20783544-b6ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677544239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544239, "uuid": "558e1f35-5f5f-4a27-bbbb-c037bfc16693", "comment": "Malware payload (Mirai)", "value": "b7d530025a03edfbff76ed68bc95c089", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544239, "uuid": "95fe40e8-2fcc-4085-b940-bbaef45c8b3d", "comment": "Malware payload (Mirai)", "value": "a93a068f7ee38dc9fb7534569cc6f4e930eaf4036bbdbb9efb38e1377ce4d52b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544239, "uuid": "7b4ca107-2506-475f-8f55-54c828d55e6b", "comment": "Malware payload (Mirai)", "value": "32cc25da705294c98a9605ec5c455c954ffb71ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544239, "uuid": "43ed1c30-9017-4ab6-b6c6-1f92ff6b9efe", "comment": "Malware payload (Mirai)", "value": "de1feaa7bd7ba4722e3d93e3fe87a847ff14c42655fc6e6a09811f46625c9724e3b9f58e87c9ee300695c0fc3250bb97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544239, "uuid": "9735b216-755a-41b9-8db1-11bc39237a39", "value": "T1B063960A3E218FBEFBAC863847B74A219658339626F1C5C5E15CEE015E7034E745FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544239, "uuid": "2f0fde17-58ba-404a-a2df-bebcc6f6883d", "value": "1536:j9NLNxDu9H/hpVBi6yI4W0vK0pErAnGzUNPKkifS:xNL/Dw7j14W0CEELINPKkCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677544239, "uuid": "d950dca2-0104-463e-a65d-27e3a0191589", "value": 69416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677544239, "uuid": "cd8be119-2b18-43cd-8706-9bddca961767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544239, "uuid": "9bfd830d-6e5e-4ae2-9ce1-ae61b9bd61fe", "value": "b7d530025a03edfbff76ed68bc95c089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9acde083-b700-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677544874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544874, "uuid": "29a10d89-dbc8-4163-aba0-35f942f337df", "comment": "Malware payload (Mirai)", "value": "1575813fd0b85cd62089718a80f868ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544874, "uuid": "c75b4648-a119-41a3-980e-29f1b733e305", "comment": "Malware payload (Mirai)", "value": "a9891dc7e9725723d52748fe3cefcef58875917df8511f9974f82b3d8ab9772e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544874, "uuid": "6cd6f61f-6cd4-454d-a73a-4c2328b5d914", "comment": "Malware payload (Mirai)", "value": "ab92c223d719b9ef9e576e294ca6ec7f418f3264", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544874, "uuid": "ebc89e49-a8a9-40bc-95cd-f92330e390cf", "comment": "Malware payload (Mirai)", "value": "fa8599b1589ad7135bd26255245ca82e5e21c810a9d47c113b440b8595cf56a1e13e7f8a19e418654d318a6111a2b38b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544874, "uuid": "2386db99-9122-4d45-a6ea-f21aa53db577", "value": "T174131995BC829A2AC2E027BBBB6E118D332563ECC1DF3217CC145B05778A52F0E77A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544874, "uuid": "6a090820-c122-49c1-b9cf-99460d6f56bd", "value": "768:L8G8LA6k/8tIElJDnh+2EClY0Eg/QdtZHlecX/SoysdSceP+it5X62/Nu4N:wGek/GISECLF/QpFvtdScu+it5K2gg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677544874, "uuid": "7dcface9-16ae-4517-92c2-2d45ce61cd07", "value": 44112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677544874, "uuid": "c7698212-a304-47c4-9a6f-c3e053cb2fce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544874, "uuid": "a78f22f4-a5e9-4501-98e6-bcbb529c0145", "value": "1575813fd0b85cd62089718a80f868ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54abf759-b74e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1677578257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677578257, "uuid": "6631f400-e036-46fc-8a49-a9b51aef65d6", "comment": "Malware payload (Tofsee)", "value": "97014d442f6d511c30469c4cb99bb7cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677578257, "uuid": "0f3d5dfa-03ac-4a2d-adaf-d7bf1cccde75", "comment": "Malware payload (Tofsee)", "value": "aa7606b4a311e0ca7c1d8e0dd93ff5d86e9d6f3525e2e2c20ab5436580a27e96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677578257, "uuid": "61f2e8e6-81af-4869-aaaf-d80a34e4b5d5", "comment": "Malware payload (Tofsee)", "value": "b36f1425c0ffca853d508bbaec18d2dc0dc8122c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677578257, "uuid": "dbc21991-6088-489c-ab45-de625ce10eb1", "comment": "Malware payload (Tofsee)", "value": "bdd2fa72704b1237b4f85cfef77d32090a3e772bb378cbc93c8ec15f23cc376d9901d9d84e9c2f1c8e5519ea5e5c89b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677578257, "uuid": "afd12328-1fd7-4e15-87c1-c1da01c6b946", "value": "T1B924E1D17E80D431D80241759834DAE86E7EBC73865AC88B3318FB6FEE712D16AB6351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677578257, "uuid": "7e386cd4-88b8-493e-b7c7-6a9973029c6a", "value": "8b8924b9f5a673fd70977d21932a217f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677578257, "uuid": "e9dfa1aa-7524-4f80-b3f3-39d968356516", "value": "3072:Gtw3kL9pyF9o9tqNkXeNWee3xcMh0J9K1qRgPg3pA+kCj:0kkLOfWX0Wee3xcMhtqEg3pA+1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677578257, "uuid": "321b8b50-49cc-4829-b2f8-75dddc39283c", "value": 217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677578257, "uuid": "d6a041d0-bf17-4ebd-8826-415ae01b5d8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677578257, "uuid": "8ad4dd9e-7a8e-47ab-a696-ab1b4b0c6705", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60880460-b765-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677588155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588155, "uuid": "11da53ac-cbae-43fe-a8b8-7dc9e40f10f1", "comment": "Malware payload (AgentTesla)", "value": "916429ee910320606894d2d958e68ac7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588155, "uuid": "764a99e9-8762-48ae-bf5d-8d7384a96121", "comment": "Malware payload (AgentTesla)", "value": "aaf0aae0610d84f673e476995899a9fd5169ade32485bbfa248b6571132b100b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588155, "uuid": "d93c48f8-ebc5-4fca-bb0d-c79046ea8446", "comment": "Malware payload (AgentTesla)", "value": "db36ad832c292306611d0028abe5023bbe122776", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588155, "uuid": "539ea478-5915-44db-8020-dab68aa83816", "comment": "Malware payload (AgentTesla)", "value": "a3f6f5f1dccde1d784f81add5fffc8450c17ac0f54dbddfd5c4351fed8e45a44e599bef3ffabb8868cb2d5ca53a3e02b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677588155, "uuid": "183a3f4b-4b68-407d-a0a7-fd9c4c309d67", "value": "T130641390A1A6E0E2DC7B6AB36D3A07617FF7A52628B8934F53808759FD11540FB1D323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677588155, "uuid": "2b4aefc6-d5b5-40b4-a04f-fe06757d0315", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677588155, "uuid": "e4390925-36bc-44be-b241-1cef45ff4f2a", "value": "6144:vYa6++WRYB1EQtWjZB+J5ptMYLszMCKruC+dKw/9WmECTaekJ8Xt6o:vYo+WRQ8YVFgPStw/9KmB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677588155, "uuid": "547b11e2-cae1-437c-802e-3a5f3fe7ac5a", "value": 335630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677588155, "uuid": "150eadfc-8e3a-4007-8318-3171dec0db76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677588155, "uuid": "32d0cd16-0a84-4e21-b744-93223c322c09", "value": "cargo details PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ea283d-b768-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677589366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677589366, "uuid": "2ae3ae9c-d3dd-4f22-b119-086085eb0a75", "comment": "Malware payload (AgentTesla)", "value": "0868793ed70ba3a653229ceed5a76215", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677589366, "uuid": "bf2d1f66-773c-4787-b651-9b97ebd2e779", "comment": "Malware payload (AgentTesla)", "value": "abad321a7cc8772d23d0d125f1e52c843a6afd805172750d30a7de15b07787ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677589366, "uuid": "513d3465-71bc-4751-9493-94f2705fa7fc", "comment": "Malware payload (AgentTesla)", "value": "cc4529389d9d56b92b2fc74889069a2b759a9ed4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677589366, "uuid": "c4714770-5228-48ff-8576-d2fc6795a332", "comment": "Malware payload (AgentTesla)", "value": "809f148ae80f74986db719559ccd2c04ee66cb7a4492f7d39966d75d2c179386ac947d1c8b3a5d2cda29390d8df10dd6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677589366, "uuid": "540c4b48-d77e-4fbd-9ece-39bfd5cd1644", "value": "T170252361A088AA7A666C395F4C1F65D13CF7830DA0E515805F7A33224EFCE96C35A4FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677589366, "uuid": "ea123d76-6cd2-4879-8129-8a3cb85a2345", "value": "24576:XcxyIydnkavzZNtkpSWZaytSp8AYROlke7J7TLTeFKjHBrFZ+Ut+YKG:X13FUxttkH3JTP/jHB7+C1KG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677589366, "uuid": "646d4161-9610-4199-b5e5-30740041bb93", "value": 967222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677589366, "uuid": "ce9d8995-eaeb-4d4e-86d6-ae3a0fe511c1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677589366, "uuid": "ed0361cd-3679-47bb-accd-228d7de8fc0e", "value": "nxBA 100400806.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870c9dd3-b728-11ed-88f6-42010a9c006e", "comment": "Malware payload (CMLocker)", "timestamp": 1677562021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562021, "uuid": "ea16620e-9492-4656-b161-a50db3610c93", "comment": "Malware payload (CMLocker)", "value": "c215c99b4357c4ef8f9cf9186a1ff5c6", "object_relation": "md5", "Tag": [ { "name": "CmLocker", "colour": "#79C7D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562021, "uuid": "e1d423b0-40ce-41da-8dc7-4ff43eb9ee0a", "comment": "Malware payload (CMLocker)", "value": "abbda703c3fba08e50f339b1b449ec85382c224772d0e95e9ed4bfa8e6a2106a", "object_relation": "sha256", "Tag": [ { "name": "CmLocker", "colour": "#79C7D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562021, "uuid": "f56a9703-d98f-4967-be5a-ca0a31d28174", "comment": "Malware payload (CMLocker)", "value": "69bbd1202e69359f22eb6f109cf71b9ab54633a1", "object_relation": "sha1", "Tag": [ { "name": "CmLocker", "colour": "#79C7D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562021, "uuid": "7af41b9a-f9f4-4a89-8d24-633b970858e3", "comment": "Malware payload (CMLocker)", "value": "4f5719b485b264288511d4e005397bfa33d7cffa6d535ada75730ace04562f8ba2eb44c3e497fa2ff7a6025e36d007ba", "object_relation": "sha3-384", "Tag": [ { "name": "CmLocker", "colour": "#79C7D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562021, "uuid": "6237f5d4-e388-46aa-a019-e632b481596a", "value": "T197B3021552D14219CE7D9FBA48A2A5D343B4E63B7013ED6FBCC464616CF21D88E027F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562021, "uuid": "78ee2885-2733-4fbf-b125-ada4891b1935", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562021, "uuid": "43e66b28-ccd4-41b8-a4b7-5b01f271c3ec", "value": "3072:/nAKH05EVZDgaj5hppykNnN8ry35GzbM9+:/AK0WVZfppyeyO3s3M9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677562021, "uuid": "01363533-0322-4656-834e-99d9b93dad8f", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677562021, "uuid": "fe9e29fe-6687-4400-a4b4-21a1e6f3b757", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562021, "uuid": "a1f76445-cce8-450b-a95a-e506d2a2d2d2", "value": "HTAExploit.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f31bcad-b73b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677570087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570087, "uuid": "67e2607a-17a2-480b-bf15-1913f2a6cfd3", "comment": "Malware payload (Amadey)", "value": "70282b54a97a5c7b4d0b281cbff50c66", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570087, "uuid": "74dcf980-ce3e-42bb-87fa-ab190cf43603", "comment": "Malware payload (Amadey)", "value": "ad2f6d56265ff27eac37b22b32f65e51b39a2e1d8e612cb23df873a34f4156a7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570087, "uuid": "2fedca79-2ce2-49df-a8f2-65245746c88b", "comment": "Malware payload (Amadey)", "value": "5f2dc05982cbba8b59c77e5f25fc90503befbc92", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570087, "uuid": "12a72e2d-1e88-4ebc-9153-ef1b182d3833", "comment": "Malware payload (Amadey)", "value": "9672bb5c2365c8a019127a0084cc9a459529d2c71bcd97cefd74327cc38b1f5216455910f87d8a8f7ab41e2a15e6f908", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570087, "uuid": "2a6333f6-15b5-4999-b187-be7af8177398", "value": "T18D6523576BFE4272EDB923305BB613C3093BB9B001B88797765BA80E48735647A70367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570087, "uuid": "3e465d2c-ab01-4c4d-a543-3181097c72c1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570087, "uuid": "a41bd63a-2fb0-47cb-847e-88c8dc0e0774", "value": "24576:+ykAE+s3Hszmo/2/HNjqKmueWY9iqvUuTBloGKNX5/6LlHxoEHUH8mLEq:NkAtsgb2FjqKmuen9iqvUGBloGaX50d0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677570087, "uuid": "8c0f5efa-9e2b-427a-aaa7-c426b87c6e09", "value": 1419776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677570087, "uuid": "c50762b0-56a4-4d1d-8646-affa6158dea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570087, "uuid": "cf54faa3-b82e-4ec9-99eb-07a8ee6020d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326353ae-b6fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677543410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543410, "uuid": "d5694c11-e09e-48ee-a49c-4d789be4fef5", "comment": "Malware payload (Mirai)", "value": "4e34e285699278b236c079f71203a83a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543410, "uuid": "665f953c-739e-474c-a035-765a5bd14024", "comment": "Malware payload (Mirai)", "value": "adcbe9dc50467928186b71bb383fb0cc683259f9b071105960eaa4cfefae0efa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543410, "uuid": "df477908-dc7b-414f-ac80-002a1cb1fffa", "comment": "Malware payload (Mirai)", "value": "b86c8e9cea5196892ba2e6344a52f2cd341d1916", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543410, "uuid": "5e0bed69-d651-4a94-9209-c42e76276b6a", "comment": "Malware payload (Mirai)", "value": "96a207efe131e22792d58987525115195dc871687240445634096245afc4f6ce86ac2334efac9abcdb9806fe7a2a2df2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543410, "uuid": "5dace200-e620-4706-9552-2651c13f9c2e", "value": "T1EB63A516BF610FF7ECAFCD3749A91B05298C651A21A83B357934D818F64B24F49E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543410, "uuid": "1a4f0bc9-de8e-4f8f-9943-e872c6ac5712", "value": "1536:7CZpmm+J61Ev+jCgjci7nbOdCNZgErsAo:7ypmm+J61q+WdCNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677543410, "uuid": "4e16cf1c-abd8-4757-97c7-f3011df19d97", "value": 69024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677543410, "uuid": "f96a94fb-8725-4f90-a1a9-e1e89f1b7053", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543410, "uuid": "21fc3463-9884-4605-be48-d20242bb8a58", "value": "4e34e285699278b236c079f71203a83a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd267e9f-b744-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677574245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574245, "uuid": "38f11d8c-5d1c-403d-9b5b-dfee9e239cdc", "comment": "Malware payload (SnakeKeylogger)", "value": "33f321199ed7953259cce9e5076c67e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574245, "uuid": "5edd217f-be31-4fe3-81dc-a949cecdd057", "comment": "Malware payload (SnakeKeylogger)", "value": "ae1c76298164414736639b05b24e5c12078d7cffb85163b92cde019d943a62d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574245, "uuid": "19017428-9f88-49d1-a4df-34251cb15e38", "comment": "Malware payload (SnakeKeylogger)", "value": "43d9254298e9edf45e6754877b0a2dc6a9dd2350", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574245, "uuid": "31bc8413-ac1d-446b-b935-8f45013ce12f", "comment": "Malware payload (SnakeKeylogger)", "value": "659cfa1255ed55ac9a1c9da82a09fdc8edf4fc6e3241f737dc2a1e4a99363ea03de814b4683223a23744ddacfd09237e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574245, "uuid": "d16e5aba-1d97-45d3-a9b2-ecd9cea43de4", "value": "T14835AD4853B344B2FBDB11A51875229C4EB872CB3685F21B4F673751A522AFFB29F402", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574245, "uuid": "e65d7bbf-e136-4024-94f6-df87a571d64d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574245, "uuid": "003614f2-62a8-4590-8158-59b7ae8c975d", "value": "24576:Mhgme9uCA6/+o9x/6qWboYRgdfX8KsHChMGGf0cb8:Ggme9ua+W1B6fRIsHCXchb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677574245, "uuid": "f9dee2f8-1bba-48d8-98f0-cf763c5d6296", "value": 1160192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677574245, "uuid": "4f6f6c9e-e285-4f29-a42c-ce81ee5e42d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574245, "uuid": "8a1c9b71-0d94-45af-a797-a809b8989943", "value": "33f321199ed7953259cce9e5076c67e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76496eb3-b740-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677572300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572300, "uuid": "1bcacc48-a412-47b5-983e-86c5b932b5ab", "comment": "Malware payload (RedLineStealer)", "value": "dc41b3382c71ad8fb526761e170c9307", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572300, "uuid": "da475465-bb77-4d46-aaf0-34d9f5b42574", "comment": "Malware payload (RedLineStealer)", "value": "ae5b96bec145a1bbc7cf910cf707de756ef3999f5f78492e43bf00f25aee8cb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572300, "uuid": "729b887c-f8d4-47c4-9ecb-5ab9dfdf232d", "comment": "Malware payload (RedLineStealer)", "value": "6e92cf2e8c18bc40ee670521b6a56f04aad468d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572300, "uuid": "8e9bbdc8-2e11-45db-a1fd-7427f5f6d0f0", "comment": "Malware payload (RedLineStealer)", "value": "cda12f1016891051c5cc4c62bb4a4ddf0941b3dc361df508f65709529e28a1aa4ef4cbbcd58b44c935ed8eee413c763d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572300, "uuid": "c319ede1-5c1e-4bd6-b4bb-01b28ba8c9bf", "value": "T17D84F107E6F98062E8B5577019F707C30636BDA15B3893A7274F6C5E18B2A60B63137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572300, "uuid": "941db210-911e-4b6b-9b37-86c2914a2bb1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572300, "uuid": "da84926c-6169-422f-8c1e-f37957f85ca0", "value": "6144:KDy+bnr+xp0yN90QEkqgvNsVy6KyH7//c/sBaMtR42p0jl66q:ZMr5y90Pgq3cENU2p0jlRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572300, "uuid": "03ae1f5a-699a-47d5-a40d-1c81714bf305", "value": 397312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572300, "uuid": "a648ee4f-d3cd-4632-a66a-4aaae0fca961", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572300, "uuid": "cbcfbb10-200a-4731-9f78-089ef6892485", "value": "dc41b3382c71ad8fb526761e170c9307.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e00be2-b762-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677586955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677586955, "uuid": "e5204e85-f88d-4e4c-a0ab-7774cf47fd30", "comment": "Malware payload (SnakeKeylogger)", "value": "7eb8a1aa491214d7579be862b4319d00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677586955, "uuid": "d360a1b3-b551-41d7-954d-0013bd0d1d07", "comment": "Malware payload (SnakeKeylogger)", "value": "b09fcf660ce277000e39ffe2c942e40a72ef9de5932ad5e3e8d3984f108c4145", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677586955, "uuid": "88effa8c-16b4-4fc3-9bbb-62a70c2030c5", "comment": "Malware payload (SnakeKeylogger)", "value": "db9d764ac8ab884dd291a9243359056108b5da9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677586955, "uuid": "774f8019-67fa-49fd-8d8d-7577cbc2ff23", "comment": "Malware payload (SnakeKeylogger)", "value": "3bbe48bbb8367fd96d2d11f784f9b5059bc2a935f86f119b6515f8a574c8ef2f549f89ade65445059a345c08aa4eeb67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677586955, "uuid": "7dfe8a00-5a48-4eed-b52a-2c3659c97069", "value": "T13315AE9977B46073F4CB01FE5C38278D2E2026477519E22E9B77BB919270AFB72D8112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677586955, "uuid": "fed11259-f8ea-4da8-91bd-ae5cc7c71dfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677586955, "uuid": "909b936c-cccd-4caf-862b-6f51b1e6d180", "value": "24576:yOky9IISq8mlngLEMITdemks9KT8qpg3RAfJJ+Hl:yE8mlgLEMmemksaJg3qfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677586955, "uuid": "29e1a266-5db7-486e-b663-b56b21a4dcf5", "value": 948224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677586955, "uuid": "a29fcac9-c467-404d-861c-f3a227d93742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677586955, "uuid": "07d95abb-cc28-40e1-b112-6ba1e7572b57", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8eba04a-b7a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1677616248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677616248, "uuid": "757abab4-0af0-4825-a507-03b5aea3f425", "comment": "Malware payload (STRRAT)", "value": "71ebccf36638700e64869a462494e685", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677616248, "uuid": "8b429cec-7577-4f43-8d3a-9c921e04a890", "comment": "Malware payload (STRRAT)", "value": "b0d6e6a4b66ad173cb8721060440ba8c9215ac39c2acc6321aab1f2062a34512", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677616248, "uuid": "c952dfbf-86e0-4b39-bf6f-98b03d462655", "comment": "Malware payload (STRRAT)", "value": "a0f4df04ecbad09e34b09e5f88017c677f5f3c05", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677616248, "uuid": "475d24a4-9cd4-4dba-954b-59e89047c896", "comment": "Malware payload (STRRAT)", "value": "4e74477064d4a19556ffb4744505f7b673c98c89a9099d7db95a4a32f487aa5136a272043664677c04fd4a54ed7533cd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677616248, "uuid": "49fc98f8-7945-4f1a-a472-0b8918364039", "value": "T12CC5353047032C11263F9EB39B6C4851A796B976CBA02556F55D2172BFCEE0ECAF4272", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677616248, "uuid": "6a97c12b-aa49-46fe-b5e4-14af4f250e5c", "value": "24576:vsgBN2Px3UkeRAyMyGcz1ZLD8lqrCwa4EHkcxLB6KFVIWKtFyTkOxdqNLe66Yhth:EdW3kg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677616248, "uuid": "1d0ae599-56ae-4459-b700-f638568fd663", "value": 2549806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677616248, "uuid": "d19d6b03-5b82-409f-836b-8b8d12212752", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677616248, "uuid": "82210cb6-8226-49d5-bc66-280880da0c86", "value": "ORDER AT HAND.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5306e4-b798-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677610244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610244, "uuid": "05a4f7bb-63de-40a0-af84-d226d555a362", "comment": "Malware payload (Loki)", "value": "74d4c1cf25db3b1775b92c5ff4a3083d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610244, "uuid": "e6fa6a47-eec0-4efb-bb6d-46d6cee5b789", "comment": "Malware payload (Loki)", "value": "b173d8cc12b90dce7f70af597cb5966c54690319ff4b48c99cafb1b63f01ca04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610244, "uuid": "31be9248-79d6-48e0-a022-369c23751e89", "comment": "Malware payload (Loki)", "value": "0e74c3b52a0664c73ef543a323dd2dc8e84c8e4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677610244, "uuid": "50a34043-be65-4e8b-be9f-8f56e818b977", "comment": "Malware payload (Loki)", "value": "099ad0224f88bf3092e2ce94dc5263540dc0168859232c5d2fa70fd02b382e8bee71e70db33ef394a39988043bfc40a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610244, "uuid": "14ff3c37-ae71-40a1-85df-2d9e324cab6e", "value": "T1EF459D5C63708C73E9DB01B2488522DC0EB4F4CB6516F25A5BA73B42AA8A7FFB54D142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610244, "uuid": "9a133586-1220-4cad-9dc9-faeace47c079", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610244, "uuid": "33b46d1d-dc0f-4d5e-92a9-6398e3c1440d", "value": "24576:0EGeMD7SzYXJdk4O+sjjRQ9FmByUQ42xbCA6/+otqp7:0EC3SzY5dk4ejjRQ9F/ha+3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677610244, "uuid": "cbf76442-9d72-4638-9c55-689b8ba94def", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677610244, "uuid": "06f3ae9a-dc2e-49e6-bea8-0053636f3139", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677610244, "uuid": "872e5e99-72cd-43f2-ba40-86fcf8e050fe", "value": "MgumkBgA2tWrdkb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7beba5eb-b753-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677580470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677580470, "uuid": "80ac5fe2-af8b-42ba-abca-aff6e1b72dc3", "comment": "Malware payload", "value": "6a1c59a42a25774a29f3ff49a8c85243", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677580470, "uuid": "a215b0ef-5711-4284-b684-7488f3c3904a", "comment": "Malware payload", "value": "b17f2d7e4d622d75590e212a0c03a9507163cdc8f2aef92de8ab64858bdf23f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677580470, "uuid": "351cc42d-f00c-4d54-a544-495b796529c2", "comment": "Malware payload", "value": "c59b0bba44ca2ca946d69e86818eb6cc334792d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677580470, "uuid": "b2689bb7-9532-4a80-8787-914826094d24", "comment": "Malware payload", "value": "75d9bc2200df5a12524b1644b989d6b4bb14c7af74c487318bb8321c9edd26b4bdefe32d45b0dd7bddd1bcd1b06da318", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677580470, "uuid": "79a15069-f6db-4074-91e6-2548346bfb8e", "value": "T11335331084FBA5EEEA275FBA14093504A370ED675524AB483FEA71E35D378E90B44B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677580470, "uuid": "751ce260-e8aa-4c86-ae51-432ae9197a34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677580470, "uuid": "32d20c86-08be-4564-91f2-431f943359ab", "value": "24576:N8ZfJRJXK4Kd2P77IkFbMi3ZIt/FYW6rgLj3GaPgE:mlJXFKwTnFAiutdYW60Lj3hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677580470, "uuid": "fe3942cd-b75a-4fd0-b351-7e02fb166f41", "value": 1066496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677580470, "uuid": "8c2c4ae7-abbe-44f2-ad2c-694dd3134f9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677580470, "uuid": "350725f7-8f48-4108-8188-d3a7c10eb76a", "value": "SecuriteInfo.com.Win32.PWSX-gen.25090.14865", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b454832-b728-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677562028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562028, "uuid": "ec8df899-a0df-4e3e-8fb2-09a06e997677", "comment": "Malware payload (Formbook)", "value": "83b136e56255ec4ed9cc8e44cb1e864a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562028, "uuid": "21a5b148-8e00-4c41-b6a3-6655e5e7bfb4", "comment": "Malware payload (Formbook)", "value": "b3c471545f3477bc81b3e69d656691b67d9a6ec26c85e66bcf332f5b9d29cec4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562028, "uuid": "b8951257-1d9b-4e41-89f6-e39610eaa7ba", "comment": "Malware payload (Formbook)", "value": "2c8361dafbb0e62cf6931fd2e22fcbb86442a1ef", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562028, "uuid": "3ef8516e-0f5d-409c-8ff7-ca39b0bfd6e0", "comment": "Malware payload (Formbook)", "value": "125680d3e307987b187a7c3aaa44cfd5c7e50a03558301b332109cba3efbe2365296179adca42324d1ed7c92b23c0a75", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562028, "uuid": "385c362f-a59d-435c-82e3-5d09c7c3fae4", "value": "T1DC7417833B05DE42C93686F9596AD8B4B7666DD82811C3831CF2FD2BF1F34261DD9A84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562028, "uuid": "c7298052-046c-494e-9085-dc15716485df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562028, "uuid": "e0c60790-fb0c-427e-a0be-0a9d430c356c", "value": "3072:S3PnAKH05EVZDgaj5hppyNpXndxMhuruCbnIj2GL:S3vAK0WVZfppyXIhiBbIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677562028, "uuid": "ee744679-f098-493b-875b-ab1424786644", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677562028, "uuid": "b58a5105-a239-47d8-ab4e-860184384819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562028, "uuid": "d2147d3c-78bb-4bd9-ac22-602e58f1b8b3", "value": "Confused.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453126c2-b716-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677554179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677554179, "uuid": "ea90f645-0421-4918-ad5f-358da9be806d", "comment": "Malware payload (RedLineStealer)", "value": "9d5c537190361d4b65c67d98f051a5ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677554179, "uuid": "0401a821-9436-4a51-8025-3721b32dc0e7", "comment": "Malware payload (RedLineStealer)", "value": "b51b2ccd26eef943f32f70c482c53d73ae13b32f51d44e17b390ac13d24fa39f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677554179, "uuid": "680778e2-5496-454f-9975-737b397cd651", "comment": "Malware payload (RedLineStealer)", "value": "e4747714c11934720518c21dcca7eb890d6866d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677554179, "uuid": "1bf1d182-695d-4921-8c97-37aa24bdc237", "comment": "Malware payload (RedLineStealer)", "value": "638d26e0d57de672712adb3037c9874ea26798ee4da65c943f9929a1f2e51a75504b43cf1ed40d9d40f6f15be2ef8a52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677554179, "uuid": "aae5ee72-ce17-4dcd-a865-2fcdd3887864", "value": "T1ABC40217A3E98233E8B957701CF702C30637BE625679875B234FA95B28736A0723175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677554179, "uuid": "4c6d707f-882d-43a1-90d5-d5c284bc3558", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677554179, "uuid": "7c2c225d-1e48-442c-ba07-d1d66ed5172e", "value": "12288:PMrsy90gdNxSui2SEC/HnwUxBZe0ugmU9ZeX:fyQuCEC/QUKtgmU9Zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677554179, "uuid": "57059b99-6e3f-45a7-9812-2f00895985f4", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677554179, "uuid": "67ad1ec9-83eb-4eaf-bdf2-d5d14b0fac3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677554179, "uuid": "e22bde9c-7dc0-4921-8946-ff6e7f2637de", "value": "9d5c537190361d4b65c67d98f051a5ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f7c974-b738-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1677568866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568866, "uuid": "a03894c6-35e1-45cf-9601-088dcbaf5b70", "comment": "Malware payload (Vidar)", "value": "faf05cf8e3b273f5faaf7b00ef2920f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568866, "uuid": "707ea8d1-225b-409b-bbf4-e375c3c6975d", "comment": "Malware payload (Vidar)", "value": "b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568866, "uuid": "deb1ff5b-0959-4618-8c71-ed1a98936002", "comment": "Malware payload (Vidar)", "value": "25620983b555dceb1a8f1c57a8e03d9abffbcdf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568866, "uuid": "94bb03e1-d6a3-4414-b0f8-18bc5de17b32", "comment": "Malware payload (Vidar)", "value": "aad97a8829e4f53cba0d1ba4470c8a57973033fa2e83d5cd1ff8d532dccdaa0974207297d8bc7d62215f69b7b7a67882", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568866, "uuid": "42147fe6-d1f4-40bd-a74e-f5b21410346e", "value": "T145A4D023EF0D4564F75AB8F407D04973A259B87A278F20C29389092E36BDBF59C71366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568866, "uuid": "50cb56bd-389c-49b8-8ed5-86ae34c9f97d", "value": "5e56c23cbdafb3c243efd0d012267996", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568866, "uuid": "ee4834d3-0478-4a2a-8f21-764a7c21d5a6", "value": "12288:QN7xlNsKGv1GluG+S7SvnVde+3u/szpbB:G7ZVMcujvVd8WB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677568866, "uuid": "2bdfd3cc-40d1-4bab-9632-425a44ca9cb3", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677568866, "uuid": "4cc3ee5f-e005-47f0-84e0-dedc1c7cb778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568866, "uuid": "86777f44-b408-4c3d-9426-c9e4fe9c2d79", "value": "AdobePhotoshop2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0fee2a-b740-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677572310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572310, "uuid": "43d1a8fb-3d65-40f5-bfc4-ec2dd406d3bd", "comment": "Malware payload", "value": "880502ed2101ad8bcba6d2e2e2cd7124", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572310, "uuid": "d6134301-e811-4171-8322-f7672f173de9", "comment": "Malware payload", "value": "b5f90012b877cff4a4af07a995edf81c19235369365c4f9118202c909d157a69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572310, "uuid": "d66cb439-295d-4258-ac19-b8d09077b38b", "comment": "Malware payload", "value": "95072f5aa33b6061e2f0df748c25ce92fe00397e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572310, "uuid": "f04ebb03-4cec-4095-bc53-b84c022c5f86", "comment": "Malware payload", "value": "5f8ad6b8bf87887b0d399232ec569f0af668474286669140ca4edf5f9bec520c378da83505209587565647a3744191a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572310, "uuid": "d87e9dc6-6aae-4630-b5ce-8eb641f6ed61", "value": "T19DC63304B25505F9FC32213D4C61D5259DBEF13A4B02C89F8A8816A74F633E6E93BFA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572310, "uuid": "24196452-33c5-4707-9da0-c362939a6d2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572310, "uuid": "fa1b69ef-31d1-4762-acd8-d6aec4277d3d", "value": "196608:vqMOOyqaCsXDjDyfVW3q+09iq2pPeZH2WliXYrHW1mnFwoxCO/AhNOnKES:VOOybCEDmlh2pMH2ciIrHW0nKyACP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572310, "uuid": "72a11681-7af0-48cf-b69f-05dc535283af", "value": 11927040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572310, "uuid": "d7096d74-2dd8-4845-b1f4-d1ade73ce0f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572310, "uuid": "f1095684-5b38-42aa-9f21-33226918cff6", "value": "880502ed2101ad8bcba6d2e2e2cd7124.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8825c3a0-b73d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677571042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571042, "uuid": "75234793-259a-4ce7-8d9a-ac2962aa29a2", "comment": "Malware payload (Mirai)", "value": "bb86c0f7c7490bce14ffa7aa48788b10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571042, "uuid": "f2346e6c-1f3a-4017-ab74-2b1afa0365bb", "comment": "Malware payload (Mirai)", "value": "b626743b64cd334e93e5fadc320b48335142c10d1fb4f8dd1d09079fc0fb65c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571042, "uuid": "722c9f00-8d63-4d04-a101-d328020a7713", "comment": "Malware payload (Mirai)", "value": "ea42d36bac458a8b136df59164bffaeb62a60ed7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571042, "uuid": "2bcb6de7-daf9-4735-91d2-70938e1105c9", "comment": "Malware payload (Mirai)", "value": "c8052c148727c41693e5f5e3ba4d88396cec4daa564705102077822718bee2496e3c07dbd65af6dd0c97d53d94e4caf3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571042, "uuid": "d04dddd4-f1a2-41e7-ae43-0f37a193327a", "value": "T1B8D2E13417252771CF317C78A954AA8A1EF21B7CFA793277484C8EE4E9D14DAB0F9242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571042, "uuid": "54e3345a-8eb4-4a84-97fd-1a651b66a167", "value": "768:JCU4FbL6dqXwYSDXuAPiJ87B7Gs/GKvFpXg9q3UELG2u:J9MbLfwYSDXBi+Is/lTXpL3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677571042, "uuid": "03365ac4-2ab7-464c-bc9c-f329e8dd3176", "value": 29848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677571042, "uuid": "5805300b-9b86-479b-afe4-074015af57a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571042, "uuid": "27d7e8fc-6384-4bd8-8ad8-3ab6ef6ce7c1", "value": "bb86c0f7c7490bce14ffa7aa48788b10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0417be9a-b745-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677574256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574256, "uuid": "7ede68ff-d1c7-4e63-b6bf-4671bc38db80", "comment": "Malware payload (AgentTesla)", "value": "3fae3fc21728f828cd168b5987a4ff70", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574256, "uuid": "89c909c3-665b-4866-90a2-1aaa3e18d9f5", "comment": "Malware payload (AgentTesla)", "value": "b65c4b6176909f6ff47cb1c7321a4855995bfa97a473c0927aeef0e3b714cd83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574256, "uuid": "563e5c80-f8c2-4e96-8a8d-92fd61aa2f9d", "comment": "Malware payload (AgentTesla)", "value": "51c42d9dd4e47a08bf685b319a0472d11ed15e1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574256, "uuid": "32adb0b7-9538-41a8-84ac-ef150b1755e8", "comment": "Malware payload (AgentTesla)", "value": "59a1b8213a63de309f7a115eb1b87cc324ebe303d418d3ab842a3782b69bcae1141b9190a827a9b228fc26fb2c7ae1c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574256, "uuid": "b9dc0988-d4b9-49ee-8ecd-3884635141ac", "value": "T15745AD4853B344B2FBEB11A51875228C0EB472CB3585F61B5F673791A522AFFB29F102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574256, "uuid": "4c89f514-1b9a-41c3-8814-97d5f674f180", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574256, "uuid": "a6d891a1-b021-48b2-b056-e3681b5da6bd", "value": "24576:aTgmeXVxn3xsM6L/RcsqC5EjDYMzCA6/+o9x/6qW:6gmeXrnBsNrRcvC5ua+W1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677574256, "uuid": "3026dae4-5d20-4e1e-a633-9189cfb87019", "value": 1198080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677574256, "uuid": "bcb9dc7e-30e7-4e61-b2fd-500bb1fb126f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574256, "uuid": "bfbca378-8659-488f-8d1e-3ce055aadb71", "value": "3fae3fc21728f828cd168b5987a4ff70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2219f70c-b745-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677574307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574307, "uuid": "a1d61630-ebe0-46e9-b786-563148dcd53e", "comment": "Malware payload", "value": "f6dfe8a78bc6651d4fa2153063656ffb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574307, "uuid": "22801cb0-a7ed-4a3b-a039-c71b9a21ffe8", "comment": "Malware payload", "value": "b6f475e67a133bbd6806456ddedbc24f3588c4dea8d64df5058d8ccf37358ba9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574307, "uuid": "6353a0c8-24ae-4c9f-a614-9ef76ae71286", "comment": "Malware payload", "value": "6ee2540667535ce4d2735a795ebb191c1261b874", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574307, "uuid": "b17ddc3c-8030-4000-980b-29f0a28f21e1", "comment": "Malware payload", "value": "a2707f16a51d6893bf7fbe21c72839dd94c7e901157c1068801084cda8112127aad19a7d1e0060c3dc219519a67816b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574307, "uuid": "8fa31318-a7ed-404e-9c10-415794ef51e1", "value": "T16AE3D021B790C071D49722305974D6B09EBA7DA253B1898F77940B3F4F603D16EF63AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574307, "uuid": "7727613f-33ce-46f4-b10d-d9b5fb03e5d2", "value": "c702649e211ff4e9af2e81908e0fc8b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574307, "uuid": "84fb5a26-e50a-457a-9ee0-73d532892b06", "value": "3072:NELKOTCJeuGsIdhn9I+Xm2I+nSvLbTPxe9kZPGv:qHTCwuGVnn9IpekbTPs9kK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677574307, "uuid": "7620af63-1642-4e8e-a705-e80c41bea2f5", "value": 146929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677574307, "uuid": "007a9671-7b3e-4743-8cb0-46267cd288e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574307, "uuid": "d753e9c0-0cf4-4078-b661-455206bbdb04", "value": "f6dfe8a78bc6651d4fa2153063656ffb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43620dac-b774-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677594549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594549, "uuid": "888db692-95a4-4173-a48f-bb321cdc595b", "comment": "Malware payload", "value": "bdea62db6e6fcd70f6cde865b63ac709", "object_relation": "md5", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "pw-764", "colour": "#A66378", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594549, "uuid": "8618a7f8-7603-474c-8e24-6502ec114c2a", "comment": "Malware payload", "value": "b887d406e85a8ee1b78355b5980756b98e0583b52430eecda2c0767d2d36716e", "object_relation": "sha256", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "pw-764", "colour": "#A66378", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594549, "uuid": "a7cc276a-b8a5-4ea7-962f-08ccb7a6e1d1", "comment": "Malware payload", "value": "e7e589128fa29956cb1a6343a9837e947984c0fb", "object_relation": "sha1", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "pw-764", "colour": "#A66378", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594549, "uuid": "88fc91e1-35cf-40ed-a8fb-489b157321a3", "comment": "Malware payload", "value": "3d19e7062c076bc4a6518f4dfbc59339686f347df93d1433f2c2fc35abad3c871a045d005703c8102a4842acefcf180e", "object_relation": "sha3-384", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "pw-764", "colour": "#A66378", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677594549, "uuid": "9409b52c-6932-41aa-97b4-d292e6474788", "value": "T19274234B884355F762122E6CC77882AB595C834FE38A53F732CB804D1AEB5E558EDCE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677594549, "uuid": "47239317-1cfa-422a-8331-e17a3e5b2870", "value": "6144:6IXrN0sb6DnVPlq7fpSXn0UTfXyDaJMDZn14U8giIw4OYcHaqeTxvIDfSGh2W7LH:vXruq0VNqTpHUTfXgaJMdn1+giIjeHgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677594549, "uuid": "eaa1168a-ab1c-4fab-b4b2-5a2dc93d5b99", "value": 347760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677594549, "uuid": "f667c751-4041-489b-b845-08b86209c58d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677594549, "uuid": "f28ef9a3-23da-4349-928d-2fb0623120d2", "value": "concaveness.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b7ba7d-b725-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1677560733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677560733, "uuid": "5c045c67-e5df-42d2-af00-1e141c6ccb1b", "comment": "Malware payload (CoinMiner)", "value": "acbdc7d1292f8726925582cd16aab92b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677560733, "uuid": "85a4bf34-ad3f-40f5-9e15-cb0fc7e26e12", "comment": "Malware payload (CoinMiner)", "value": "b9b26b72ad632fad454dc3872ef1121a298ecd9ccea007c8295fab30a3819ced", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677560733, "uuid": "3c017669-1cfb-4046-92b9-186c75d04fb6", "comment": "Malware payload (CoinMiner)", "value": "9a573dfdbc708f49bb6bd7fe8907a0cab42737d4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677560733, "uuid": "3fd4109f-fa4e-4041-b3f8-fe0f90d67525", "comment": "Malware payload (CoinMiner)", "value": "b1f0e24cb29f97c7fc5f683ca158f5197f24726ecf4da1fd4747980526765301ddf86d9b96447aad042c272dd7209497", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677560733, "uuid": "16919657-e1c2-4ac1-ae57-7ec719b40356", "value": "T19854E0D1B981D43DC85645B45834F6F83A7AB8A18A54898B3F183B6F6D302D06BFE35C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677560733, "uuid": "d11b4c20-5af9-46bc-af30-c7eeb395a4f2", "value": "1e96cb5984683b7e47e14770412e3c53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677560733, "uuid": "92189cac-d7d4-401d-95de-61b0d88fc9a5", "value": "3072:ZkTy7L2xsJ9yC/ZB6d3s6d5Uj9yeSDfT6e9kbLuh/XKE:q+L2yyZs6d2j9f2ib6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677560733, "uuid": "48378c02-4362-44ea-bedf-4f31710a7a8f", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677560733, "uuid": "c90d3db7-adb6-42b5-b1fa-7fc82b05384e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677560733, "uuid": "44e6dd33-fb48-42aa-b535-e1cfb4b71578", "value": "acbdc7d1292f8726925582cd16aab92b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28721f9f-b741-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677572599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572599, "uuid": "99d37b13-10dc-4128-ab77-ae638cfc5710", "comment": "Malware payload (AgentTesla)", "value": "5470553086d83e8eaeb078277e7de498", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572599, "uuid": "aa5f2b66-1bfd-4909-a357-b15b0236fc5d", "comment": "Malware payload (AgentTesla)", "value": "b9fd7e1e9b204a2b8fe3c2ee138b05e10b49c76bb29dd20f9d4a0cebfe3b72b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572599, "uuid": "b28e7e7d-4044-427a-83d3-954c8b2b9efd", "comment": "Malware payload (AgentTesla)", "value": "e91d2bb4fdacd5280f838f60ea42c7ae81ca90a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572599, "uuid": "227d26f5-0730-42cf-ab47-a9173b3bbc43", "comment": "Malware payload (AgentTesla)", "value": "04da06a9abe9bb7f50e357c90327ca0f995be8a591886558578bc92f1a399c5b88ceedae71ca81f213945fcb2d6b5cdc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572599, "uuid": "13b435ff-c4c8-4957-83ba-24525d71c108", "value": "T14945AE4853B344B2FBEB11A11875228C4EB472CB3585F61B5F673751A922AFFB29F102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572599, "uuid": "f267b345-f956-4be5-a8df-b53539382c91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572599, "uuid": "39e3ec74-8c06-4bc6-998d-e9a0bb9a1167", "value": "24576:gjgme7uCA6/+or6dcs0tru7RVp8ke5GdvTTZh6Qjopx/6qW:ogme7ua+3dm5Ap8T5GdbTmN1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572599, "uuid": "a69132b9-0cc8-40b6-a4b0-7b8bbf0ad873", "value": 1206272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572599, "uuid": "8cf46f70-85e7-448b-a572-74b13c3a0fe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572599, "uuid": "eaf527fc-9eb9-4371-b7a6-34beb91e2fc6", "value": "DHL Express_ AWB#201045829822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebe636b-b739-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677569335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569335, "uuid": "e952fcb8-f352-41e7-879f-5a1afa5c9bc0", "comment": "Malware payload (AgentTesla)", "value": "2cb623f3d62fadb3459d6bb549c8bfcd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569335, "uuid": "7517f328-8a2c-4f91-b9ef-2defa14b79ff", "comment": "Malware payload (AgentTesla)", "value": "ba278e9a224009e14aa8b65a174afa76cd51e9a6fcfcf501d715abb7270d505c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569335, "uuid": "41579621-a10d-46de-a249-4e0aacd6e250", "comment": "Malware payload (AgentTesla)", "value": "b89237a0702bd3dc69113e4dcfce69bcfaf80c2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569335, "uuid": "aba4e37b-a853-4cc1-b168-1a01013b443c", "comment": "Malware payload (AgentTesla)", "value": "be514bc872a407bd7378ac0274803b00a43a5f75580b737e8cc4fb13cf3266561414852fa3f655c4651e42359e45f875", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569335, "uuid": "a89d890d-4e44-4105-9a6f-10dad2084404", "value": "T135056B4F62B09133F99E51EE5A3463CF2F327252752CF5161E3AA9888D06FFA71D8241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569335, "uuid": "8d2a8230-b9ca-40b2-a766-145e9b955fa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569335, "uuid": "58f769cc-7c9a-46cf-ad87-642a3fb1cc52", "value": "12288:VpJpTXwyhwxyfnAN9Pxk29rP3JmZ39krl0Kx7y6B3Zq391mgm:BpT1Cx7Nouu3ClxB3Zq391bm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677569335, "uuid": "54d3a639-8099-4469-b458-6be5dc29d15c", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677569335, "uuid": "79ea0fea-0307-4292-9e23-b8f6d7d515d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569335, "uuid": "7632903f-abf2-4c6a-9f15-fd45cf69e2b9", "value": "Banking Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be0ebc2-b74f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677578564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677578564, "uuid": "4b6d299c-9745-491c-b178-6c74928d5885", "comment": "Malware payload (RedLineStealer)", "value": "625387942f17559b5f02127b2d6a9850", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677578564, "uuid": "8961a6d3-b8a9-41b7-83be-d581d087de44", "comment": "Malware payload (RedLineStealer)", "value": "baabfabbec7eaa27ea28f5b0be822305c734cb3a46c054e9d2e1b35323536784", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677578564, "uuid": "80e5366c-cc26-4a95-8eaf-5dc42c759ae1", "comment": "Malware payload (RedLineStealer)", "value": "97f4853db48d501c222656537b8c36bc2ad9d7b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677578564, "uuid": "f50d0028-ee3b-4ebe-b041-7ee00ebe4d16", "comment": "Malware payload (RedLineStealer)", "value": "587a57b2de61801287d8eb68e971afdb7301cdec19923221f02df564c6de4b233dd9e6f572c682d158301fb0bfc960f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677578564, "uuid": "a90afddb-4aa6-4711-897d-e8c910043c4e", "value": "T1FE4523479AED1021F478A77454B60B830A3BBD521BF8934B664E4D1E2832674F3793BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677578564, "uuid": "dc1e83ba-0510-4dd4-b4ca-85625dff27f6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677578564, "uuid": "ce6263ee-46f8-411b-a370-3181a96d1d22", "value": "24576:LyBrFB4n1gZrnlnqfufu/hh4cMXSTnR5GV3Ro1nt3+s:+BrFB4Opnln9C3xMyRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677578564, "uuid": "aaa1d342-ddf2-4446-9265-cead372c99c6", "value": 1219072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677578564, "uuid": "cfeeaa2d-23d3-42f5-9912-d6e751901915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677578564, "uuid": "c4320f8e-db1f-40e5-905f-d1fa3393df0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5d4d31-b728-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1677561818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677561818, "uuid": "6c8b3c1a-c116-468f-966c-dba9a8c9b2a1", "comment": "Malware payload (Chaos)", "value": "62e53bc5aa5f2a70a54e328bff51505f", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677561818, "uuid": "6b849a66-40e6-4fe8-bdd2-dae5cce6edf6", "comment": "Malware payload (Chaos)", "value": "bb5ca9d8de51734dbd14dc081c7c892d819cd14fafd7ccd62849d70f9e679369", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677561818, "uuid": "70f13c02-b846-4131-b135-47c7fe4cf6a2", "comment": "Malware payload (Chaos)", "value": "e7deceee97a09d539d81eb91f988ece5e2a2ff51", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677561818, "uuid": "27bf048c-a6f3-4bc6-aadc-07e3ff8ca1b6", "comment": "Malware payload (Chaos)", "value": "68a7f00e706d3d01f067ca638a524dd2095f14ea0d1e0e7faa418cc286a07d72b332c06881aa32a07e9636d84aeaa0cc", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677561818, "uuid": "ff1d9b93-57ac-4639-b7f1-b67357d3c4f5", "value": "T14324B053705423B0F4B94C71A41A0CC30B767C6B9F647EE97888B27B09B75A5C626F2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677561818, "uuid": "a8d25910-4e9b-42f2-a5e1-ee3077bb435c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677561818, "uuid": "96bbd986-fe0b-402c-a7fd-33e0151ff34a", "value": "6144:+B4mr9NzqHW7V5V9w/UIRZizI1aqebq/lsyp:+B40qHW7nU/pZmiXqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677561818, "uuid": "84ee8c5c-4fcc-4f62-9a87-f67321f640fd", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677561818, "uuid": "f79b4487-77d2-4d1d-b1c5-fe6e15e00781", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677561818, "uuid": "41c7b191-c5d9-486c-93e8-de286de1e2ec", "value": "okok.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a92651e-b797-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677609647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677609647, "uuid": "10469b9d-e755-4e77-b674-e4889874f437", "comment": "Malware payload (DCRat)", "value": "0da2bd04ef96ecfa453960316425f9ef", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677609647, "uuid": "5b4a2f84-7ae3-4730-810f-fd889e649f8f", "comment": "Malware payload (DCRat)", "value": "bb626e98f2d6d3cc01ada71d7365e10f04a0af3019f3a6e1c3a622553f7938bc", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677609647, "uuid": "f89f2ebc-6bf8-433e-b8d8-890028f85de5", "comment": "Malware payload (DCRat)", "value": "6bfc8fbfa555bcf107364e5e41f0bab1ac84391f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677609647, "uuid": "3b6e97a0-9cd3-4400-838c-391cca95fa26", "comment": "Malware payload (DCRat)", "value": "d5a6acc43fa0cb73df6963efd02ea2887fd4030981b555ca7efd07862346981dc953a1135f539df64ce8d7d0309f9011", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677609647, "uuid": "4c0f4096-093b-46b5-982f-566967b206dd", "value": "T19C727C6387B85C26ED578F70B8E49231AB70F7829D91C3DB6009C0055B447C26BE93BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677609647, "uuid": "7cdebd85-ec42-437b-b863-c0f1e179bdac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677609647, "uuid": "fb3cb224-f18d-4c8d-8ed9-591153561431", "value": "384:817z/OGiboJfHIIYi6yDi6Pxh8E9VF0Ny3Mo0gO:8dL/xYi6y+6PxWEBDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677609647, "uuid": "9130adcf-a1fe-442a-a928-fa21198e580f", "value": 16664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677609647, "uuid": "b1843c72-cdf6-4430-ac30-22fe42366fb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677609647, "uuid": "2c7a6378-2376-4317-8433-721c2a2cccac", "value": "0da2bd04ef96ecfa453960316425f9ef.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99cd4395-b755-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677581379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581379, "uuid": "001d65be-bc6c-4498-a4aa-d2b5fd090fce", "comment": "Malware payload (Mirai)", "value": "5076651118f6db73c246b80ff124441c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581379, "uuid": "a0956403-75eb-4c8f-ad53-96a63f860e51", "comment": "Malware payload (Mirai)", "value": "bc0c40f7f5e85dbbe91d16d56f7a7ca26200d79faebb37fb41a28c3176071f14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581379, "uuid": "f8fdd65d-4696-459c-8591-cb8407b24fd0", "comment": "Malware payload (Mirai)", "value": "546ee1b0db117c66080d98ae174eb546d538962d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581379, "uuid": "b354ba3c-2787-459b-b682-5b04bbdfe8b1", "comment": "Malware payload (Mirai)", "value": "a87e84d5d4e420b6beae9abcf0fc80fd0e9699bd8619400ba3ba524bf27ac8baafeaadd4a7e48c8dcf34c857a6aca944", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581379, "uuid": "147d335a-8a65-40f1-b940-d7f869a10d73", "value": "T19FB2D0655609F8B0C2708839E9BA87C72ADF09EED1BA363339D44A993B455437C392C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581379, "uuid": "21d16b42-4ee8-4062-b302-cc85440f2149", "value": "384:qrR5Z6gtWkY+iTULFUycBswe573K9VAa/SM7OYIjPmMJ4yGZycSNmAhymdGUop5X:DoWkq0FUEwelR7M7Ajt4Mvls3Uoz9G8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677581379, "uuid": "44f99c87-8e17-4113-bad8-37d15058318d", "value": 24184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677581379, "uuid": "fa564b00-4b60-447e-bc6f-e73012afd8f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581379, "uuid": "9c2195cf-4bf1-4efc-b916-cd9f8f3efad0", "value": "5076651118f6db73c246b80ff124441c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9e40c7-b74d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677577946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677577946, "uuid": "164a3779-7e34-429c-b7b2-efac36aedc9f", "comment": "Malware payload (RedLineStealer)", "value": "1a58ada54de94f5b348098dfcaf428c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677577946, "uuid": "04918176-c14d-4acd-a0a0-dd68d116cbbf", "comment": "Malware payload (RedLineStealer)", "value": "bc0ccd0507d1c3fd9cce4e031a8e9a06eb3c578b0def3151885326c7569a6b67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677577946, "uuid": "ac7ddb55-37d5-4c49-9b1c-e5bc2af7af73", "comment": "Malware payload (RedLineStealer)", "value": "683131a89dcbac2a44411ca0e17d4f26dacb10fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677577946, "uuid": "c8e8cf75-9295-45fd-9a1b-34b632b73f46", "comment": "Malware payload (RedLineStealer)", "value": "f11b50a62170438fd9890f96abd346397289708d2193065c4fc7252e7b5d57e6b37036135151d5bf3ad0cf46734a5924", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677577946, "uuid": "3ee7aec2-c324-4a76-8465-0c4dc3d69253", "value": "T18964F0D27640C077D8560071D824DAF96AFF7CB38A59869B32683B2F3E703C266B6355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677577946, "uuid": "9d80751f-81f0-4c35-b14b-77b94dc9a780", "value": "8b8924b9f5a673fd70977d21932a217f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677577946, "uuid": "95ebd006-fa5b-4da1-bf9d-03b48cdabd78", "value": "6144:IAVVLOyNnT75QaIRfeuwn1VqH7SDQ26zAk5EN1j:IeSyN5QPfrwyH7Hvqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677577946, "uuid": "bb4a4dd9-be8b-45e1-941f-82a58b9d9a43", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677577946, "uuid": "1ce320a6-b0d0-4dee-a80e-35b36b7d33ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677577946, "uuid": "d98e9752-d9e2-4116-a167-5942625a00cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a22d162-b7ad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677619149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677619149, "uuid": "74cc9e2e-33e0-4359-a628-ec8e7e878807", "comment": "Malware payload", "value": "2d25d9ffc0365e692186095c2220d77b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677619149, "uuid": "11edab49-f901-4f18-8f2a-3d238d9ff518", "comment": "Malware payload", "value": "c04bf5723e62ae7de0b7df71a3d7cc864fb35d53c74b7c999527d75bd9e5238f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677619149, "uuid": "f98d1d30-5059-4905-87fc-8f8f24a895bc", "comment": "Malware payload", "value": "f4f9a7115bf275e7c186a91246bcf142d2895432", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677619149, "uuid": "d0381406-63a6-4189-8c87-bb5604ec5eca", "comment": "Malware payload", "value": "883aea47216021155c16bdc1c3976c83078386b0f6a09f174e913b69c010d6161bc9631a3b2c78479c4470ceec71cd02", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677619149, "uuid": "e80f2281-2d93-4726-b460-40046b9c6a34", "value": "T1B6C6F1357D2E69CE43403568C907EE3A974E9489D848FDEBD8C7DCA26683D1E03C7A25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677619149, "uuid": "d9070738-2d9a-4f03-80d7-d832f1807992", "value": "49152:MOn//ZTqmKm953b9vhoTrxqcWth1yvmgT8sB6CkqWQWNN0yNmUnIbb8bPVj465B9:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677619149, "uuid": "dab72066-6abe-4065-b9a4-2148be39b732", "value": 12332051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677619149, "uuid": "d0146833-9118-40f0-b8fb-7246a60adca0", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677619149, "uuid": "f6281092-5a9f-4ff1-b55a-35dd1353f6ed", "value": "loder.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0713161-b781-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677600315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600315, "uuid": "17d03677-99ce-40ea-ad3f-8c72fbbcb096", "comment": "Malware payload (SnakeKeylogger)", "value": "5a21f48c8b943ca4e3032338f9b35657", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600315, "uuid": "6790bea3-9156-4e83-98ad-538368f85dcf", "comment": "Malware payload (SnakeKeylogger)", "value": "c08b5752c52a82173d3342011730b79837d6e4c4eb659c1badb96c57cd4c997a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600315, "uuid": "a6a10673-f84a-4d9c-956c-da89202554c4", "comment": "Malware payload (SnakeKeylogger)", "value": "4935a16dfb6261842f3e52a17d135d849a3c9101", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600315, "uuid": "8c531f6e-e48f-43f0-9e7c-000ed8eae041", "comment": "Malware payload (SnakeKeylogger)", "value": "2c2b6f3868f5fce4f8c1f8f78be00f435cca896f653ad1310aed9b618f250b8f1b6648037aa22d3e230a39a05971236f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600315, "uuid": "73d3c00d-9a4d-4d44-bcaa-b48e27dc9c10", "value": "T1C5459D4D63708C73E9CB01B2448512DC4EB4F4CBA516F25A5BA737429A8ABFFB54E243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600315, "uuid": "191015a3-3385-415d-855a-c241b975ba63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600315, "uuid": "c490b5ae-05f1-4cf3-a918-9cf330de6958", "value": "24576:sDG7WD7SzY6JdckUkvoiHP1IAcZTGODORhRFxbCA6/+otqc7:sqW3SzYAdck9BP1InTGODOXha+3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677600315, "uuid": "eec69689-9c63-4707-b0e7-54ae3f3e5bba", "value": 1255936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677600315, "uuid": "39fa51e1-1d43-4c9b-a8db-d460798f4ab6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600315, "uuid": "e3ed94db-eb42-46fd-9531-ed2d4eb0be35", "value": "Scan002............PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3a45e4-b779-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677596743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596743, "uuid": "484ec57c-72ba-4b1c-a895-f701e42dda0c", "comment": "Malware payload (Mirai)", "value": "eb8237e7d6f970f9772375f6731fc193", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596743, "uuid": "07487381-86e8-4504-993b-ad88cfabb574", "comment": "Malware payload (Mirai)", "value": "c17372c35eca5b849829a45fe472b5f438e168c1791ac017185987a693394ea7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596743, "uuid": "8deb5be8-87f7-49ba-a98f-a03f5d1f2272", "comment": "Malware payload (Mirai)", "value": "82f158766c327559cb33fda7444a3e4c209f5024", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596743, "uuid": "fdf17bfe-04d9-4d50-8a3d-64aaa7d55084", "comment": "Malware payload (Mirai)", "value": "abf7024045321815c4e672ceb9ed55ff92f1ab8223fbffc7a8180352995cdbd5107f02f4953c8fc28e22b805a824e499", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596743, "uuid": "46531a70-2f43-4707-999b-4f4cdb661488", "value": "T1AC31FE91A3D05FBCC8E491BFAE56431473749F84E0C772629218A758BD2AEBC9D36046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596743, "uuid": "457852d3-b051-4e7f-b4dc-ee94efdc4573", "value": "24:CCKGpa7Urz/jlfamXK1hUVev3gRGaJ9iMjBBuEtlxrR+zDS+ZA:vKGpa7UrLZaV/+JdBuWlxrsDS+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677596743, "uuid": "b4ecb1ff-7b88-4aff-b3e3-8b78dbde66ba", "value": 1444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677596743, "uuid": "9f1e80cc-2075-4c74-acfb-e6a6bdc03408", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596743, "uuid": "6ebf8762-190b-4a2c-b02e-8ca1b52dbc82", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e681cb8-b76e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677592071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592071, "uuid": "5ce5db29-8a05-4735-b811-4b29c7cbec91", "comment": "Malware payload (Formbook)", "value": "1eb6f92a0411a5ab536f96634f67043f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592071, "uuid": "f4f55e07-0fbc-4749-9102-26a79a66ef56", "comment": "Malware payload (Formbook)", "value": "c1b6263682ff4c894af9df16a4f6c63bcd49248f2a580b3a3c86012d44388437", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592071, "uuid": "4c925349-fdfb-4f8f-84e7-0589554d3b6e", "comment": "Malware payload (Formbook)", "value": "94fc3b0ffff20bc3a77f0ffe9ca29e8335b2979d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677592071, "uuid": "a84a96f5-35a3-4985-83a4-2eb7fee7a9bb", "comment": "Malware payload (Formbook)", "value": "232ef357935d2a75f74abf05816a130e986b1abc330c1f3b8cb37c92b99c123017bc9c8c8e575bac62b2103a1e40fa65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592071, "uuid": "236c15ff-2117-431d-9e09-72d959601e3d", "value": "T171459D4C63705873E9DB00A5185422DC4EF4F4CB6505F3AA5FA77A42AECAAFBB64D103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592071, "uuid": "3f62ed0c-4f8a-4fda-be95-e44164f31d37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592071, "uuid": "bb803813-958f-40bc-9587-c6a2dc463d0c", "value": "24576:hVfVJfDD7qSe/7Bj8wBcI6FKO3axHeDEZGKtBBCA6/+o9x/6qW+7:hVfVJfD3qSe/798PI8KPxHe6hJa+W1B/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677592071, "uuid": "cf22ba72-eea3-40b7-b67e-e155346c40b8", "value": 1232896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677592071, "uuid": "5f3d33e4-3da1-448c-970e-dcb26d1cc37b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677592071, "uuid": "bab483b1-d74c-4a89-9d69-38c5ae7c5e37", "value": "Banka odemesi havale bilgileri TL9985000080_28022023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138f3509-b745-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677574282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574282, "uuid": "958eb684-a910-457c-8a63-e2f7b4e65f2e", "comment": "Malware payload", "value": "a25eb0f10782007983490d4ee252bc1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574282, "uuid": "36e376c0-1be3-4153-b346-04bf4f46e869", "comment": "Malware payload", "value": "c1d9c1b93de05134e25a25b3ac103a132643b7f1de0a728eba6829d9a659d708", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574282, "uuid": "42a409cb-c4bd-491b-9401-e0ed817b46dd", "comment": "Malware payload", "value": "bab54880ddc17934f29f5a8583d1f8e1fe5b8d13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574282, "uuid": "46e5b4a3-9619-4d5b-8f92-f8e724effdf1", "comment": "Malware payload", "value": "510524882805cb924daa89dd892f16f2bed6182010e4ead7c88d92624e806853c7c2fa9e59bf307ccce844eda4588fbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574282, "uuid": "075fc8ff-8963-469e-a94f-0ff8c919b922", "value": "T192763394675A18F8FD36A23EC863C064D671BC6243E4C69713E88B571EAB7A13C7A344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574282, "uuid": "4e68c17e-0486-45e5-b3f1-c68cabc63234", "value": "ba5546933531fafa869b1f86a4e2a959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574282, "uuid": "b12ea139-144e-4892-ba17-a34bfb74c1f3", "value": "196608:8w9CQu78K/NvmzkMdQmRJ8dA6lguVaycBIGpEXZo6hTON:zu7L/JmkMdQuslgl9gZoWON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677574282, "uuid": "667e1c0c-4d36-4db1-8501-057c7ce68e50", "value": 7149085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677574282, "uuid": "d8f7dd98-3c02-404e-b8cb-b32ebf53d150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574282, "uuid": "3a31a645-3163-46ae-81fb-00e44db6504f", "value": "a25eb0f10782007983490d4ee252bc1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7be9ee-b71b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677556582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677556582, "uuid": "ae87c9b3-cbd7-424f-b5fc-77d145a48531", "comment": "Malware payload (Amadey)", "value": "ff67c446244d462226285e0f12f18086", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677556582, "uuid": "985982fa-9c21-49d0-ac97-4785a651f7c4", "comment": "Malware payload (Amadey)", "value": "c247e41b9e80d1cf4aac8f540c0c297c6e015e5b7b2346b32426457783e90837", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677556582, "uuid": "27bb76c7-7f9c-4cef-b01e-c5938d535755", "comment": "Malware payload (Amadey)", "value": "5f2aae840f77179e0fb2c29dd130769601103276", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677556582, "uuid": "195cd690-c6f1-4ce4-a52f-94e8fc723b22", "comment": "Malware payload (Amadey)", "value": "6fb0236dc77e5ac1603096b07dab0b4231b1ddfb386d1afc4687db5cca39676284d93c1eb2fef681d11ecf2dcd298c55", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677556582, "uuid": "9d982414-020d-4dfe-97b8-ece339e63f60", "value": "T13565230BA7DCD5B2D9B05B746CF213C316357E748E28926B328DAD8E09B3560E935327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677556582, "uuid": "b57c85fb-c452-41e3-b2a5-81e74a7969e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677556582, "uuid": "2a03eeaf-8fbe-44c7-b965-f4bec327c395", "value": "24576:EyLGJL44vkxX1yRhM0/ofONSAAznobdQBPweQvHj+mmtuExsBQafv1:TLWMxlKM010NcOBwhAQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677556582, "uuid": "50a59b51-93c7-40b1-9a6d-d017b26fcf62", "value": 1420800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677556582, "uuid": "ccba30a9-ddb8-4100-89da-05e42183c471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677556582, "uuid": "2decb6e6-717c-41e9-a510-ce386736e452", "value": "ff67c446244d462226285e0f12f18086.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761ca046-b735-11ed-88f6-42010a9c006e", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1677567576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677567576, "uuid": "16a202ee-c612-47cb-ad89-47fe97fbf313", "comment": "Malware payload (Adware.Neoreklami)", "value": "62a9c5ce0cefd8c47b0306e3a7439d2b", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677567576, "uuid": "55ff77e7-dbb9-4b04-9e09-28d0d5b0523f", "comment": "Malware payload (Adware.Neoreklami)", "value": "c3fb70951bf300c0e5487c2fd304ae1195cbd063e4d9f277681ff61f5dbccd78", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677567576, "uuid": "7ed95e9a-7119-41f7-9320-d91db1b90081", "comment": "Malware payload (Adware.Neoreklami)", "value": "cf38fa9160363e6e544ffb90ef862f807e508669", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677567576, "uuid": "85d1d8dc-edfb-4063-90f5-1deda6656b58", "comment": "Malware payload (Adware.Neoreklami)", "value": "e601ec89a66b260e7db2ba07b7e769073455d612cac96b9be3b9650de7d52ca67f92f015de3a7cb531da20fad3503885", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677567576, "uuid": "311639ed-a13e-4189-a371-6bec57842d75", "value": "T1B1763345BEDCEAB1C6545832DC602FF99068D35B0730DA47A3558E3CBE3E950E92339A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677567576, "uuid": "d3a992e6-dc75-4595-8bd7-f355c14c9fd8", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677567576, "uuid": "6cf847db-513d-46f0-835e-a11c4af692a1", "value": "196608:91OppT3P7rfNzKB1PyLhZMRUF46mKUmeoBB8bko:3Opp/BqPazMRUCKLNBQko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677567576, "uuid": "4e1f345b-8977-44cb-b526-713f900d0367", "value": 7589671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677567576, "uuid": "f7de086e-b4a6-4f17-bb1b-975fce53fc01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677567576, "uuid": "79413fb9-67c6-4aa5-bcbf-ff219501d962", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c77986b-b765-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677588148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588148, "uuid": "db89ba0e-e32e-43d8-b245-6ef87c35f1d9", "comment": "Malware payload (AgentTesla)", "value": "c026d63fce9dfc3b4dfe81d97411247f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588148, "uuid": "a0078e5b-2b5c-4ac0-9f6b-864c6c06387e", "comment": "Malware payload (AgentTesla)", "value": "c483822c18ffb41285aa1278f5fe5c7bdbe77e868b08fb118c979f95f9287f03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588148, "uuid": "23d4d8dd-13a9-4619-a7bb-87edf1c04633", "comment": "Malware payload (AgentTesla)", "value": "ee342b62186b49a7c7e43d712c8226b6e08cfe89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588148, "uuid": "daa188bb-546c-4cc8-8a21-11c204fa1d49", "comment": "Malware payload (AgentTesla)", "value": "408c75a787cab794f4dbf719d0843103fbd91de138d1df3e30a57c47e5fbce67974b44ade24f1831f350cd06d4021eb3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677588148, "uuid": "58edf3f3-1abb-429b-b6a8-177eaf80938f", "value": "T1886423E4C0677090DC6FB9D3E5890FA4BDF752A67DE8A1CF96978763C90084877A9023", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677588148, "uuid": "79a7e84a-3dbb-4f7a-82e2-3b6bfd08953b", "value": "6144:7/jUb7Z0E1EQtWjPbsJ5pvMuLsNMCKruCgxKu/9WmECTCekj8Zt6i:7rUbF18WHDgVSpu/9KEPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677588148, "uuid": "fd464a92-1c1e-44b3-a56c-b42402b9e211", "value": 320878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677588148, "uuid": "2a8667a2-3242-4240-a141-4fdacb2c3f24", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677588148, "uuid": "17ed10e6-c4b9-469f-8f08-51f6b212e630", "value": "cargo details PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e60f4de-b741-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677572609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572609, "uuid": "b76cbbcd-ffd6-445f-8e7b-a15d903d5bfd", "comment": "Malware payload (Formbook)", "value": "1a4004e99bf2d45d4ee2915aa6685121", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572609, "uuid": "7e4406a5-f55e-4437-ac1f-3588d1f51129", "comment": "Malware payload (Formbook)", "value": "c57df6bbf40e8ce1f684d8af98b00887139acafb1a2b63215b0d13162fb1dcd1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572609, "uuid": "e1d5df8e-e4f9-4a7b-8f58-46646c6ae998", "comment": "Malware payload (Formbook)", "value": "82ea7a5c17ac8f8185553cd22e15bcb311846d65", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572609, "uuid": "847219ac-4dc0-4981-98a9-dcb31e78c999", "comment": "Malware payload (Formbook)", "value": "04fd105e09443c7d9ee79eb3f659defc9e755374b836795bb00cd911c59594a8d35e1c7ae783d52fbb3fe6e0608f2ee3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572609, "uuid": "350071c8-fa16-49f2-8514-1f432f62c486", "value": "T1E3356CA1DA961619494F1BABEC430E724DB9C02D63270A39FFAD538E610355CC3BFB58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572609, "uuid": "fd121834-fc12-4d6c-9a04-de74dad8a49d", "value": "12288:R6R72J7Hr3cBjfPqSyDR+DZHcVAhasZLtHo/00kXZvye8MWEM:U729r3cBjfPqpV7VA4ULtHojk5ye8vEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572609, "uuid": "f43fc417-c4cb-4221-b50f-c68cc4cd4e6c", "value": 1066658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572609, "uuid": "5a40f908-7470-4dfa-a7c9-4b867e792ed7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572609, "uuid": "b2bec91a-91ff-4306-b749-3b9ca99283e1", "value": "SETT_PYMT_AGN _INV_QM2021251_009.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3b6c89-b739-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677569198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569198, "uuid": "6e0f6020-08ea-4617-a7a2-0b5b29c65942", "comment": "Malware payload (Formbook)", "value": "8fcd57b72144dd06291af140390e9579", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569198, "uuid": "e7add6a0-4852-4fa2-b22f-78c06f65525c", "comment": "Malware payload (Formbook)", "value": "c5973940f1f529a71a4729cf5f4a0c7467d5b9b59bd27346c3d1a16309fc0060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569198, "uuid": "9b7160ef-3dea-45b2-80ed-1b2d77dea361", "comment": "Malware payload (Formbook)", "value": "19bfc5f39e0f56ab104484ef771232d0d727cede", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569198, "uuid": "4e04d494-23cb-48f5-bcd6-26232bbde893", "comment": "Malware payload (Formbook)", "value": "dd5aad2da4eeb16f20c8af6bf817c11af27d869d5e94f9b2638435a99164eeac4a7abd9b5309fb81d785df97eb3fe43b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569198, "uuid": "93b09c3b-fba2-4072-a196-5fc79e2b4263", "value": "T18AC1A600F3D84337DDB34B7AA83743611278F3416C9B9F6EA894511B9C163898A73BB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569198, "uuid": "fd1eacb4-b849-4bc5-8c18-f8cf4da92f7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569198, "uuid": "b894b54e-f070-4e1f-adf6-5b3bca0491e9", "value": "96:HXrVY8dxZQGLL5ccmAGaEAtUlwQ81lCkbFetBzNt:ba8zLNccmMTtUwQ+vbAtD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677569198, "uuid": "709c7559-983d-42e6-82e6-70bb73e7cd11", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677569198, "uuid": "87988f22-8254-4e13-9a8e-8fba3b96c5ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569198, "uuid": "d3263e90-6442-489f-9d6a-3a52f76fc42d", "value": "food.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d39856-b74c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1677577594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677577594, "uuid": "d47aa510-30f2-4f40-a225-1f557f82b1a1", "comment": "Malware payload (RemcosRAT)", "value": "77a000040794e39fa8a64c459fbd0a80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677577594, "uuid": "f4474a59-105e-46ee-88d2-ef1c9d30907f", "comment": "Malware payload (RemcosRAT)", "value": "c5b83cba12fc69072661e0c8d473ed6d4263580764f0ac0476e4306df3f71e64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677577594, "uuid": "8662a9e8-7c47-481a-85d8-199062fb6306", "comment": "Malware payload (RemcosRAT)", "value": "2f9969dbb0ed681a09f63617d33d05a0eef48549", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677577594, "uuid": "31efe398-b8e2-43b9-8785-c6ebab24f7fb", "comment": "Malware payload (RemcosRAT)", "value": "5a207bbc32b7f98e0e87ccadc9daa957c32d940bc21d9077333f950d2b647ff3191933a5aab10e47ebac50dbc566f260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677577594, "uuid": "9d678556-299b-4e59-a42d-649dcde8b3f8", "value": "T19EC4226056F8D553F7A16873CF3826A5ABB8A6A11C68DB6707D0C3307FE21810E1BB71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677577594, "uuid": "ebe794a3-61c7-40ee-9b9b-2450483d6269", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677577594, "uuid": "223062a2-481f-4a22-9955-9334c464ff33", "value": "12288:qYX/Rm9sbIey56fDEiYay4N21ArUhkX5FUzAmjNagGaIzAYdP:qYX/Rm9eIeTJoKi0UhkzOQgFIzAYdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677577594, "uuid": "78155af4-1d07-4372-8668-b84b2c1fd23d", "value": 557946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677577594, "uuid": "f11dcdd1-71ce-4123-b237-c8df00f46239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677577594, "uuid": "c028a8d0-631c-44c7-b341-afe181ebd4e9", "value": "roominglist.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7309f4-b7a7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677616358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677616358, "uuid": "7553e2aa-5116-4d07-b541-848c115e5504", "comment": "Malware payload", "value": "eb6dc856d1b93c13c045766dcb3a1bdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677616358, "uuid": "6e9bc34d-474c-45e6-8935-3dc2add0ed1b", "comment": "Malware payload", "value": "c5f55cbe14f7240b125ef2389705e49c4d5693b69f95292581a7e4d8e11a54e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677616358, "uuid": "6927dea3-9ffa-4b9a-82ab-5c7937099997", "comment": "Malware payload", "value": "9f17804422fc6079d3ff5c7dd0b30c474d405a90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677616358, "uuid": "fa994c67-da68-43b5-ba18-b6018753e525", "comment": "Malware payload", "value": "d2cd37def5906f5a1ad832f10d5225f1cd208ac094c96549b50c81f561b7d552e08776c3e7450426dcff7e2e1949e7ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677616358, "uuid": "efb0b975-2916-42c2-b46a-b82f7338419b", "value": "T18784F19171808073E91617B02474DBF99D7F6CAE7964F60B3B58327A6FB22E12639307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677616358, "uuid": "7114e887-09ae-4de2-9dee-94e184d4d027", "value": "1b4776cba51be1c4a57ae3dee975e7f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677616358, "uuid": "81ec0d2e-e0d8-47b6-aeb5-9ca1328b50b8", "value": "6144:Mh6cLICAIIWFCnjXxoRNkOq4iRbbxb7G5MLY3TtS9CPYHJlu7m2L:M4cUCAIIICnjGkOnqbbVZ9CPYHJluq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677616358, "uuid": "48a53992-c39f-46b0-843e-72d51ea41162", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677616358, "uuid": "50867b07-f7b7-444c-8423-2366e2dda8fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677616358, "uuid": "1f450b19-ba20-4524-8276-6f5b6a956556", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d75fd9-b760-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677585879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677585879, "uuid": "7d616a11-4d80-46f1-a78f-1a8501a312c0", "comment": "Malware payload (AgentTesla)", "value": "a4c7de7e3fb01b44f6d980961444ac07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677585879, "uuid": "89b0da5d-4c60-4e4a-b409-2339772f0bfa", "comment": "Malware payload (AgentTesla)", "value": "c64e816686cc06a37e310436359bf20fe1ca84d4daf75045fa569c4753ff98bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677585879, "uuid": "c700642c-5002-4eba-919a-18d4afc73398", "comment": "Malware payload (AgentTesla)", "value": "a1538840aa02bfc32dc4093bfa478e5a852df039", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677585879, "uuid": "a8f6ba05-41c2-46d0-b4dc-718800392f8c", "comment": "Malware payload (AgentTesla)", "value": "6085300af2f3bd6660b6ccf8c1aefda04e1ec360aa1543b8f672d9f824bae1730dbf8808235f43f441c2a1f4141ca190", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677585879, "uuid": "5cff45a5-8745-4532-919c-2b65b3c2edda", "value": "T1E845AE48637644B3EBDB10B11875228C4EF472CB258AF21B5F6B7751A522AFFB25F102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677585879, "uuid": "5b17bbcb-8533-4313-8cf9-724924c7210b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677585879, "uuid": "c4300949-07fb-4cbc-ba08-fb375d4cf07e", "value": "24576:HgGeCuCA6/+o9xfzzuoGOuuQ5/fq31S+3xRf0CcaK6qWd:HgGeCua+WV3RGOu55S13x900KB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677585879, "uuid": "b9c06990-3e5d-459e-93e8-7333932c0a82", "value": 1201664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677585879, "uuid": "048539f5-94c5-40bd-89dc-9c81e906f51c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677585879, "uuid": "bce91f85-6acb-44e6-a65f-92ca0b92ae9a", "value": "Zaplata,jpeg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1895b526-b7a1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677613804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677613804, "uuid": "ca053799-f984-4c26-97b1-1607c081a368", "comment": "Malware payload (Mirai)", "value": "a3a4f5c8b10d84cac35acfec0d08bdad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677613804, "uuid": "da21b764-7845-408f-b3a0-7917eb9f2238", "comment": "Malware payload (Mirai)", "value": "c7067e8e43c3971aceb127eee4e29492dbcf5aaf093850741b984fb38215a540", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677613804, "uuid": "54428b8a-6d36-4306-a6e4-329edd9c2aca", "comment": "Malware payload (Mirai)", "value": "d1df989bf8b3061c107365b2f73e9be2376a1ae2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677613804, "uuid": "e34b78ec-f9e7-4589-bf51-f6ee5ee3e2a3", "comment": "Malware payload (Mirai)", "value": "7e0fc4ebdd14f5871d5fa2da36be654c1ce67eb67ba93f1980f1ba79dc4139094fda4fef86baaea3d99a4e7e3d20f371", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677613804, "uuid": "0aa6e7fa-575b-4131-a63e-c924e6613c63", "value": "T14AC32B46E6818B13C4D61775B6EF42453323A79593DB73069928AFF43F827AF0E23906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677613804, "uuid": "4edac092-78ac-46a5-93da-8d84a706aa29", "value": "3072:AQO3WqAbOKMoMuPGYlqqiaoX+EuNM/9cE:AQO3gXMoMuPzQqYX+E4M/9cE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677613804, "uuid": "cfa174f7-02ef-4215-bb27-d21cf0af9e19", "value": 120446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677613804, "uuid": "c9853841-2d56-4884-a728-94be3b5412df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677613804, "uuid": "99b9832c-1c5e-43d1-81a1-aba6165b863b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba318385-b709-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1677548792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677548792, "uuid": "b2c31e8d-4cb7-492d-9e29-28f2caef7c38", "comment": "Malware payload (Vidar)", "value": "8c73969c52e4f970113808954656181e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677548792, "uuid": "c5e22f54-38be-4756-8344-d2abe0b4a564", "comment": "Malware payload (Vidar)", "value": "c751b386ba177fa63844bee350b500cd85b6c745266646f49955b8f5925ff637", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677548792, "uuid": "94330d5d-860d-47f4-ac62-fea3d6c2ffe1", "comment": "Malware payload (Vidar)", "value": "de20cb8994d8e6274214380d34628d2c246c6446", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677548792, "uuid": "c8417ae4-1a32-4f04-b680-eeb686e471cd", "comment": "Malware payload (Vidar)", "value": "1283ef7a02922f8e4449bf196b8d6fd710809403a0a713953d5b31ebef5f29270ba06e83c6df86f98c5310c9832e0511", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677548792, "uuid": "1dac576c-055d-4a63-8e85-7189eada4e65", "value": "T10255AE23B0C067B7F825153246B579C01D19ED3C07B669A7770A4BA84F2DC41AB2FA7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677548792, "uuid": "e655c481-3955-400a-a09d-793defd80f5b", "value": "0c09b077bbc4941fe51c751209f46580", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677548792, "uuid": "5d6118f6-7d4b-43c1-9da2-d43a5562b5ff", "value": "12288:CAmyvDyb2t6/XzV7rmKgAU7U4NfX5CXUcn:AyLI2I/XRrmOU7U650", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677548792, "uuid": "73915465-1625-42a0-8f38-1a05ba09f38b", "value": 1308160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677548792, "uuid": "277675a0-64ab-41bf-ac51-87114b23732a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677548792, "uuid": "555b471c-a97f-4187-b1b4-68b65045515f", "value": "Setup_x64_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0b834a-b703-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677546084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677546084, "uuid": "1a34b301-d043-4756-8c9a-692a2513c21d", "comment": "Malware payload (RedLineStealer)", "value": "63a74fce6a95b41fac4b062e53e53286", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677546084, "uuid": "a877484b-48c2-49db-a8cc-6951db632faf", "comment": "Malware payload (RedLineStealer)", "value": "c76a060145ef67247240f79101614a872006fbfe361a6272a2a45c52640ef2c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677546084, "uuid": "81f06223-d9a5-4772-8900-d71490600d74", "comment": "Malware payload (RedLineStealer)", "value": "9f9493e3d145de7446c489ab5b0510f0a0fa87d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677546084, "uuid": "a230ce71-6366-4d2e-81d8-f80db5352319", "comment": "Malware payload (RedLineStealer)", "value": "451428f9ab6ee67971b96d8258504b5932d4601d76fac0710215b26752c4da02fe3aa36932fa29a20e614a695a4c776a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677546084, "uuid": "8ea1277f-0c09-40d6-a085-3bab4e18b1ac", "value": "T187552307BAACC862EE35477449F642D30E367CA14B3CC35B13CA6C9919739B5A4793B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677546084, "uuid": "2dd5f694-c3af-4ddd-9d42-a9d93b41dac9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677546084, "uuid": "ab0d8c63-cfff-4037-ad0c-d624a5257990", "value": "24576:SyGzLViT9AaRQvpY4vYSfyExCfYxnDyYgpItMIVvsScLUG2s4FlJ:58L0hAaRQvp7z6bYhDyZpeMIVvgos4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677546084, "uuid": "04648be9-4a0c-4d32-8cf4-da1931c174a8", "value": 1391104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677546084, "uuid": "8e7e8fa3-3517-4aa3-9492-ab5bd50c7cda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677546084, "uuid": "e77fece4-1ff1-4cfa-bd0b-dcab5c324237", "value": "63a74fce6a95b41fac4b062e53e53286.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c90896b-b779-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677596739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596739, "uuid": "ad729a44-c902-4e90-ba3d-f6f0d5cf2451", "comment": "Malware payload (Mirai)", "value": "0c7bea2c8aba3cbe0700edf43db7e511", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596739, "uuid": "7517b1cc-cbf2-4aef-b157-a58507b7563f", "comment": "Malware payload (Mirai)", "value": "c7a0cf534a9f3f8a8b2799ccee65a334a086115f89777667f667e874d8afee53", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596739, "uuid": "d3c989f8-5d70-49ff-a532-d5ed5f8252ff", "comment": "Malware payload (Mirai)", "value": "e23d417e3c601fc674b9c2a479aa73d5e492bae8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596739, "uuid": "a6bb5cf0-c95b-45ec-bd99-1976cb77aecb", "comment": "Malware payload (Mirai)", "value": "4e78e6f3052264e586f1e10ad1b844a6c0e9cec0078aaf99d8ddf7894daf4cd5962cdcf24bac358116672412db9ed913", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596739, "uuid": "04635986-7dec-46b6-8562-d3ff7acdd5fe", "value": "T14021C2A6E2D4E932DB6211FA5286EF4723958A95305AFF0BC9A14502DD3E5D0C133274", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596739, "uuid": "e49a1d1e-b9df-4982-97cc-b827e302b8be", "value": "24:Flp4MWFHxgxEmceZGQleZ3eLjGjHvd1wyGues9OzruQ+0wNKNfPE:fp4h+coGQlo3eLjCHFxqssPH2NKNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677596739, "uuid": "44e5d979-906b-4a57-a71c-d2228cb4dbe6", "value": 1172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677596739, "uuid": "9a0c797a-d561-46b7-a2ef-83adadfa9b59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596739, "uuid": "edd032b3-47c4-4c0f-8fc9-e5aad5a512c2", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ce8fce-b738-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677568963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568963, "uuid": "1a500dc7-d855-4817-ba2e-b058a33d8c29", "comment": "Malware payload (AgentTesla)", "value": "a2266e80cf47d6c34e24d4dec62efb5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568963, "uuid": "125a507d-0b8d-46a3-9db6-c718f4668035", "comment": "Malware payload (AgentTesla)", "value": "c7f0e4ce6d95ce821671196d361bcd2eb1ac9f6837fd4693968fda7b4f926eac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568963, "uuid": "f6c4f946-f5ff-491e-b020-b4edf7d8b7e5", "comment": "Malware payload (AgentTesla)", "value": "e7e8ffa0d53722f3d7b14baaab42449f3359fcde", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677568963, "uuid": "bed1d9e4-0220-4c4a-adea-2c6578832c4b", "comment": "Malware payload (AgentTesla)", "value": "46461e30262c0b41c48077c6b865ba6b95d5addbbada0be4b1b6e9857e9622a7019ff76c451702234e207db9c38540e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568963, "uuid": "26d184fb-6d79-42eb-babe-1200a9d320e2", "value": "T19145BE4853B344B2FBDB11B51875228C4EB872CB3685F21B5F673651A522AFFB29F102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568963, "uuid": "c3a6c5e5-6a9f-44c3-9d60-ed35c965a42a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568963, "uuid": "4a10fceb-96f0-4924-9405-3eaac7ef1cba", "value": "24576:jTgme1uCA6/+o9x+VKi9d0xiDos8DviXOo/9WPlqzVM6qW:vgme1ua+WgVXdJkrDvPolQlGMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677568963, "uuid": "373bdf1c-9ae7-4cd2-8f50-b3988619a812", "value": 1226752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677568963, "uuid": "9f954457-a2e1-4386-a714-f22ed38efc1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677568963, "uuid": "e8653dd3-aa79-40a7-a269-37617cf71c0d", "value": "TEKL\u0130F \u0130STE\u011e\u0130 HURK75BS\u0130l_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cfc40c9-b755-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677581385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581385, "uuid": "455385b6-4b38-49e0-bfcb-267c12e8b222", "comment": "Malware payload (AgentTesla)", "value": "2659618bdcd0c96fd304b3e7f0f27301", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581385, "uuid": "7bde29c9-a23a-446c-8dc3-51027edebf51", "comment": "Malware payload (AgentTesla)", "value": "c83ce1144ccf1268c67facd2b54ea4536f30437a65904750e52b0a06e279947a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581385, "uuid": "7d690616-fb13-40e5-8b10-6e236c6f4bfc", "comment": "Malware payload (AgentTesla)", "value": "be805603db39bcc18775a9a80323c42e24e6236b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581385, "uuid": "e425ae5e-ad8a-42bc-b36f-feb8d668aae4", "comment": "Malware payload (AgentTesla)", "value": "259c3c75769eb257423052e7984286a122154ea204c01bbcb8372766205ae6dede268ccfa358bce34380e5def2cc0a10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581385, "uuid": "18335fce-096c-49a5-95a3-d594a449231c", "value": "T1D72428566714D520CB5F417FC016821831F1DB03A72AD39F5AA6D8FA2F812CEF92B8E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581385, "uuid": "578db6c6-3909-4fc3-8106-e6e1af188aa5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581385, "uuid": "fe4ab513-7d84-4b06-9acf-17ae7eab0d98", "value": "3072:rGWD8Ovve9vWFcjsC/hUstU5+qKIv4HE3Dr3QxUUSoKDM9SA9eptDqtUs6fJv:rkvWFDMUl+rI7DS0JAMp92UsKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677581385, "uuid": "6138ab5c-171d-412a-b7af-9d740358863f", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677581385, "uuid": "33da38ee-8d17-4110-b452-867131ad074e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581385, "uuid": "13ef7ed1-ae37-456f-a30a-43d497b12eca", "value": "2659618bdcd0c96fd304b3e7f0f27301", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0924ada3-b767-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677588868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588868, "uuid": "10de4903-bc57-44c5-865d-9d04d37550b5", "comment": "Malware payload (AgentTesla)", "value": "26c800e6286ef91a75809647c74ee327", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588868, "uuid": "0eef7e89-fbff-4a1c-9b9c-83023f740258", "comment": "Malware payload (AgentTesla)", "value": "c91702882526fbe760e0312bc608a2fc89fbf59258251a19ada7990e48e9f815", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588868, "uuid": "0b95c5e8-eefc-43b6-9fb8-80d28ed37545", "comment": "Malware payload (AgentTesla)", "value": "fe9fc2beeb0f25f47eb3cc6ef72c4455a01d9dd1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677588868, "uuid": "87a0e28e-5d90-414a-b490-aaf4e28fc436", "comment": "Malware payload (AgentTesla)", "value": "01ffc5cab1da32556b879efd4d1067aecbfeca68b7d21c6e3b787a7ae0a2ccfcc6066080d97d634a59644bfa9123757c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677588868, "uuid": "a2e4e33d-69ed-42e8-bd45-07d9040a9808", "value": "T1096423E4C0677090DC6FB9D3E5890FA4BDF352A67DE8A1CF96978763C90084877A9023", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677588868, "uuid": "580aca46-6888-4d8b-acf5-021016305180", "value": "6144:l/jUb7Z0E1EQtWjPbsJ5pvMuLsNMCKruCgxKu/9WmECTCekj8Zt6k:lrUbF18WHDgVSpu/9KEPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677588868, "uuid": "ef31fc7c-547f-47d5-8d1e-c047fc1e6198", "value": 320882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677588868, "uuid": "088396b3-89f4-4545-998c-d524930bbd1e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677588868, "uuid": "a1dd8b24-17eb-4cc7-a574-df290ddfcac2", "value": "OUTSTANDING BALANCE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5bb413-b782-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677600466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600466, "uuid": "32be4981-ef66-4c8b-8c6d-381b73f3640d", "comment": "Malware payload", "value": "6856dda8c64df3104c29c2b06b45022b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600466, "uuid": "47e4ac75-0785-4234-97cf-313f4b848f3b", "comment": "Malware payload", "value": "c9730b45df6c482ceb7781fc48e9bf0cabb40e5f0f97b24bf36e171c75d6b7ea", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600466, "uuid": "d030a8ec-4264-4b73-9e42-c965d2f79400", "comment": "Malware payload", "value": "816456746b0b161fda86a276473a05a892c0326e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600466, "uuid": "39f12458-0431-4fb8-b344-67c2c7d1a33b", "comment": "Malware payload", "value": "1608c7639a26d6ffbe8cdbe1298dc3469d49340230bbfc2eea2af743d5aceea2a81cad0998763ab178e8651a7d0550a5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600466, "uuid": "ce4dd407-4a2e-4686-bb27-9a99afbdcd11", "value": "T183F3D6162A51F65AD378863019A9DFF9B2383E21B54EEB43B0DDF73E5F75E01A602102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600466, "uuid": "fb8cfca1-8ce6-43d0-a78e-b279ba8d7b85", "value": "3072:5qh2Oyoi6jcU0kXEueQ6hffF6EWDLbiPPdqs6ih:5qxi6YnEEuGFfWDvi3dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677600466, "uuid": "7e3d7ec1-f355-4f09-8b39-e23a987b76aa", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677600466, "uuid": "eba97a06-7063-4b30-b479-6eb288e482fa", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600466, "uuid": "83ea9d3c-6cec-4e1f-8bb7-b6fc1066dc0a", "value": "Deborah-Resume.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c11d22-b740-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677572278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572278, "uuid": "a63e1fd2-d464-42e5-8c92-2c28d1493ef9", "comment": "Malware payload", "value": "1393b8f7ae1c2622f19110ec65d04e37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572278, "uuid": "a9e71e55-01cc-4f91-a768-a23a6ee9895b", "comment": "Malware payload", "value": "ca02f40b79c737e396a51754f2da63d05f652ec4ab96ba37bd4aec7523c486de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572278, "uuid": "452cc5ae-7c21-4f9c-98e0-72e2b2182978", "comment": "Malware payload", "value": "a644a45a8a57bbbe5da184197279cd70b7668151", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572278, "uuid": "742b1de9-0bc6-4bd2-8d45-fdccc370b459", "comment": "Malware payload", "value": "0645191d8ee8823070e177aa1bc68f158822dca7a8b5b1b7560a45977df52847e262050535e722f02444598479df77a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572278, "uuid": "b44d9e0e-a7fb-433a-b63b-67ee2b6bfc04", "value": "T174D5B002BBC684B2E48D163555BB6B3E9E39EB000769CAC3DBA4FD684C712D1563F349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572278, "uuid": "f4c60662-943f-42ee-8926-fcfdbb4cfa71", "value": "ab01aaeaea50beb3e1382212d469c2ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572278, "uuid": "8ee6913d-ff5a-4b95-8781-585337248de0", "value": "49152:p58iTMO1IpIKNFmyA13c6d0EMAeoklobHAtM+PNupfJ0TfO7GrVX8:lYO1I+Kchd0A8lkAtM+F+JV6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572278, "uuid": "b1b47368-672e-4d30-ae0d-5ec8cd774c0d", "value": 2904064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572278, "uuid": "957adfb9-6572-48f9-b377-bbd3552d5f8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572278, "uuid": "bebc4e57-6b06-4f34-b0c0-6dd03f1422b4", "value": "1393b8f7ae1c2622f19110ec65d04e37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501cb21b-b741-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677572666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572666, "uuid": "6fe4b5a1-c535-4f95-b572-c8c0bf04308f", "comment": "Malware payload (AgentTesla)", "value": "563fbeee3045043acedf7f58ebb23da2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572666, "uuid": "6a4c35ea-b7b6-490e-ab02-b56d82796add", "comment": "Malware payload (AgentTesla)", "value": "ca4ae8153f345ff67fb3b4adbba7ed2714dcde706bdf9641d312da6b1aca426c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572666, "uuid": "f33024cc-254f-486d-817e-8bf581590796", "comment": "Malware payload (AgentTesla)", "value": "9fb1da711612f13a8e8a54cd8a77db8b5a5c27be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572666, "uuid": "d2bdc9bc-a7b7-4d84-95e9-8adea71156fc", "comment": "Malware payload (AgentTesla)", "value": "1b97e2a3b3de6101183256c40d262bc6ecc56c6c127258fa34fa363cd4fb1a75c2a2f18ebfc6cc31f34bc63d97b3d308", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572666, "uuid": "aa43bed5-b994-4886-8df6-9755c6f7aed5", "value": "T15245AE4853B344B2FBDB11A11865228C4EB472CB3685F22B5F673751A522AFFB29F503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572666, "uuid": "38e2347b-7db9-4e6f-8745-bd4f3ac96ec7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572666, "uuid": "b5d2cab7-dd3d-456c-abc7-05997ad31bae", "value": "24576:O3gmePfI7jVozvDLGQetEATeh0eMMZebpCA6/+o9x/6qW:egmePfIHVozv2BnTG0KZOpa+W1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572666, "uuid": "4225cfb4-118b-4fd6-a542-1d9ca77cdd27", "value": 1197568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572666, "uuid": "2e93c4bc-83c5-4193-970f-916101dc4dcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572666, "uuid": "edc24f18-3697-458a-9954-4b0c26effb13", "value": "563fbeee3045043acedf7f58ebb23da2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93044457-b755-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677581368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581368, "uuid": "9157c6ff-b2c3-4550-9b1d-98c545aba6ed", "comment": "Malware payload (Mirai)", "value": "9694899c3a6a4ab9d6f994b4c2d19bd3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581368, "uuid": "4353b9fe-9378-4ad6-bd05-a37526c8dca3", "comment": "Malware payload (Mirai)", "value": "cab9145c71e675d2003766744db3e9e44e53537a91bb7c6b38ded19753747f2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581368, "uuid": "182d0fe8-e6cb-4398-8d9e-283194d9767a", "comment": "Malware payload (Mirai)", "value": "edac62b308db42c91cec04d98fc6711098c0a02c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581368, "uuid": "afc8ee89-6e94-48df-9771-c68ef65fc5d0", "comment": "Malware payload (Mirai)", "value": "fbb6a23ea913bca45600822a77114839768aee8d30a8e54786a497b904a9d9617cd3aadaacdc8da0df79836b6035b139", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581368, "uuid": "ec11b8e2-9cea-4622-862d-cc37693c260f", "value": "T1EC33A5C2DAE27C79D2C6EBF0E5A3E07453E7880097470EB6A0D94A51882FECD355A35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581368, "uuid": "67be8a7e-604d-4be3-ab38-2811d98663b8", "value": "768:3xh/FSPaWQZd2eJ7yPypdT8xtwEUf3frdwRTs7cCBBiSi:3zsilZdxZM/wEUf3jGd+ti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677581368, "uuid": "ac8ae6ad-43e8-411a-a818-a4c5c8e54afe", "value": 54534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677581368, "uuid": "2a964f25-bdae-4e0d-b551-8268a4bb5423", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581368, "uuid": "beac1391-5c57-48ed-aac6-f465ec6a9d23", "value": "9694899c3a6a4ab9d6f994b4c2d19bd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e357fcf-b703-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677546088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677546088, "uuid": "e8e64120-deda-4285-a880-90d2c6b0e0df", "comment": "Malware payload (RedLineStealer)", "value": "e536afc7f63611d1bbea4305f958661e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677546088, "uuid": "7424df22-a125-4028-a12d-9724f595c7dd", "comment": "Malware payload (RedLineStealer)", "value": "caf00150589120b59ea0145206e2aacad383d3cc18431674fd58cc84f49b0e25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677546088, "uuid": "a6a4048e-9898-48dd-b98c-8e0ab877eb1d", "comment": "Malware payload (RedLineStealer)", "value": "1fafcaae8cf11f389ed5a8efeb777f510d2ba604", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677546088, "uuid": "dd1cbed0-cc97-4603-ab76-eeb5131b7f15", "comment": "Malware payload (RedLineStealer)", "value": "86ea0441fb3120d9f4a760b1f1276d6d28cd7e44f70e92fb2070763cfa047dfcf2dfbf3a6d95cc11317de7a1d21f76b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677546088, "uuid": "e27de41f-98e5-4393-a598-f788d707a1fd", "value": "T105552347F7EC8011C8625B7604F602A316327DB06B25836B2BABA95E1C739F0D275B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677546088, "uuid": "7d63af42-0803-40a3-b940-1b11197c29d0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677546088, "uuid": "904fd7bf-f1ca-4065-9efa-6333fb598150", "value": "24576:byR6TVqTlkeEENYM5JIYWgOawttqT/QvBjpNTqjPJwutvVKTlwIEd:Oi6lk7EyfaGtU4dPaWaYTlfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677546088, "uuid": "a3dac93b-89f6-4cd7-8fd7-788e78093e15", "value": 1403904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677546088, "uuid": "d51d1e60-d994-43b2-9f23-69c5cda054cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677546088, "uuid": "4868be55-c835-4440-9014-8246549f09da", "value": "e536afc7f63611d1bbea4305f958661e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b758fc-b755-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677581341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581341, "uuid": "6a7f2989-4219-40d1-a911-28ac3289f3b8", "comment": "Malware payload (SnakeKeylogger)", "value": "c78b67929075be2f3b5c570bfc9dd81c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581341, "uuid": "2148c6ed-6f4d-4faa-ad81-2ddf8ae47b6f", "comment": "Malware payload (SnakeKeylogger)", "value": "cafec12667fb9a8f6cd10908140a57337f169be589d8deca1530c2a512c0529b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581341, "uuid": "6a9555f9-ad77-4ea2-8ac7-3fdb18081503", "comment": "Malware payload (SnakeKeylogger)", "value": "57b55876c495433558ef87edae01f7af714b69e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581341, "uuid": "800f4fa4-edec-4b7c-8baf-658cbaf42ef8", "comment": "Malware payload (SnakeKeylogger)", "value": "a5292c0e7c8278600167f1ce054a6299f53e1e5371622d5436f5e8ffb8bda59aff52e8b78b0e1dc0f4fd9e3feb258bf3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581341, "uuid": "7de187b7-1bfc-49c8-8882-e26173eeafb9", "value": "T1825412486BC1C4D7FC6386321F7527AABA7BB92714681A0F17C0194578FB981EB0E367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581341, "uuid": "9ec30330-3218-4048-b3d0-108bc4b7dded", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581341, "uuid": "4caf2952-464c-4309-a533-a20cbd1efe39", "value": "6144:/Ya6J7QgoR4zCGOj2bWcAYenEK0QM1n6qogrURdgPZAhcDu:/Yj7QEBOjv6enEK0DDqiAhcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677581341, "uuid": "7d2e0e6f-e64b-4083-9f23-4165665c507a", "value": 285343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677581341, "uuid": "e9ea4762-f9ec-42fd-a27f-112096ff5ff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581341, "uuid": "beeb337a-942e-4b30-87ac-3121da799ddb", "value": "c78b67929075be2f3b5c570bfc9dd81c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2462d1b-b781-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677600426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600426, "uuid": "32592351-2f5c-4d0d-989b-b256a4a945e4", "comment": "Malware payload (RedLineStealer)", "value": "8c453de865d8e5c6af8d9f0ccb13620f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600426, "uuid": "3cf7e683-193e-49a8-9c53-970c1f40ed0e", "comment": "Malware payload (RedLineStealer)", "value": "cb04d5432bc4d8aab459870e3c221d6aebcbd14fad9a797e2a058ddfbd0e2fca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600426, "uuid": "9240ddb6-1be6-4ae1-a9f7-e038a4bfba41", "comment": "Malware payload (RedLineStealer)", "value": "3fa8e8a2b1a586c60a87762619bca431cbfc1466", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600426, "uuid": "edf250d0-b149-4d8c-b89c-859061702a89", "comment": "Malware payload (RedLineStealer)", "value": "7d464be846ba19d8374cde36975730ccac92a228cee785709787ed9efd6527f3847f1247ed62ed6d8a3e97c0dcb14382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600426, "uuid": "0ea64863-de42-4bcb-a2c7-ad8d88e104fa", "value": "T151840111B781DC32C86302785838C7A42AB9FC624696B99B3F58377F2DB02D24BF6355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600426, "uuid": "cca9a843-d334-4f8b-a0b5-15b23c029335", "value": "2ff441a58ff638ca2d2b64ce6ffa9559", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600426, "uuid": "54c19a93-8d02-43cd-b707-2af3c56f315d", "value": "6144:aLvOBgNe4se4terELVcl18YridaCcbISLy1:aLOBIe24tegLVclO0id/c7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677600426, "uuid": "cc52305a-9e34-4102-98a6-d5721d572694", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677600426, "uuid": "2b40af4f-ea6c-466e-8480-01ebc5922118", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600426, "uuid": "b1d45a8b-0ac9-448c-a82a-5142e8540bcd", "value": "8c453de865d8e5c6af8d9f0ccb13620f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f4efd9-b75e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677585004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677585004, "uuid": "1914c8aa-6978-45b2-8374-4d783856bee4", "comment": "Malware payload (Mirai)", "value": "b22ab8012bb6cd6c004524f31aa3ca83", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677585004, "uuid": "71786613-c452-48e0-896f-30d5d6e301ea", "comment": "Malware payload (Mirai)", "value": "cb95f844feb93bda2a011b9667c4808cd602498358d585671cdf4bec9f59686d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677585004, "uuid": "d79aaa45-666f-4813-b43a-af253add454c", "comment": "Malware payload (Mirai)", "value": "eb66934a9358d605579888184650c2f8720d731e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677585004, "uuid": "5edbc481-12fe-4399-82bd-72111e164a09", "comment": "Malware payload (Mirai)", "value": "3edae44deb39d189cc3519d6d2771b6ea067f2fc76f1db3837905f345298439b9e424a494524a80b1b24c443addb0ccc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677585004, "uuid": "1d6dbf48-3554-4c2d-a2e8-f13374a3f8ee", "value": "T1B7F32B46AA418E13C4D6277AF6AF42453323A7A4D3DB33069918AFB43F8765E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677585004, "uuid": "77aae6e4-f88d-469f-baaa-65e69976c72f", "value": "3072:xz6nOWCPxC1+FPR5bsaclCyA9JvKoR8ku+mXT7/lM/9PcbeEhVTmKqjkdV:5SObmKJsaclCyA9hKovmXTDlM/9PAhVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677585004, "uuid": "d9510b3a-03fe-4ea2-9f8a-59d75d06c7f6", "value": 163095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677585004, "uuid": "b8dbc702-2c25-4ed1-acc9-33b65336cb29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677585004, "uuid": "3c0c2935-9191-4dc7-8ec5-458097188caa", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a67439-b73c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677570388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570388, "uuid": "09d67d9a-d62b-4712-b05b-9d6902045579", "comment": "Malware payload (SnakeKeylogger)", "value": "9fb414b6b3646ea85106ffe68e5d113a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570388, "uuid": "936beeca-44bd-4aa3-ac80-84c1fad3c177", "comment": "Malware payload (SnakeKeylogger)", "value": "cc4027113c42cc0e57bbf7da93a8f5f45a4c82e75704a80c13c080a9caa75d21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570388, "uuid": "5b536567-f2eb-483d-9a63-4c78298c3a60", "comment": "Malware payload (SnakeKeylogger)", "value": "ed0c681bcbb9a1d18af8660a9de8c48593f125a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570388, "uuid": "552304f1-f0df-4166-93af-b4d6abc2036f", "comment": "Malware payload (SnakeKeylogger)", "value": "39565351ea6d3fc3cd00d73de8814a5ecbf000a557e2b6a4f91320a4a35d9c0b86f48f101e4d1ad62d2fe234bb999352", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570388, "uuid": "818431ac-f396-4421-b94a-2d96a7f650a1", "value": "T1F335AE4853B344B2FBDB11A12875228C4EB872CB3585F21B5F673751A522AFFB29F502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570388, "uuid": "2c33b116-06d7-43bd-8f11-ef180e421faf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570388, "uuid": "d1e0d8c0-0c42-4c91-9a2b-cfbd70f80bd3", "value": "24576:rkgmeluCA6/+oaw9RGhe+nwFGdpsvY4/thPpVtt1rCNx/6qW:wgmelua+sGldU/tXt1Y1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677570388, "uuid": "0f617074-fd66-4120-ab33-5183a1f78faa", "value": 1155072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677570388, "uuid": "5e15e337-b21f-477d-b068-4482c07089bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570388, "uuid": "89285a5f-76b7-46ba-b4f9-ff6fec640a40", "value": "Payment Remittance Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40152315-b768-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677589389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677589389, "uuid": "93f35d97-9375-451d-8351-2031c6b65275", "comment": "Malware payload (AgentTesla)", "value": "c47be8dab10552297c3f2c13fc070767", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677589389, "uuid": "174b773a-66a1-48af-8c99-33aec58e4fac", "comment": "Malware payload (AgentTesla)", "value": "cc54831caecd5969f6aff49376f0d1e91ad94a20adc6e7119166406fc07a9bbc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677589389, "uuid": "9abed51d-a6a5-49fa-a6ff-a90305dafde3", "comment": "Malware payload (AgentTesla)", "value": "2612610bebd49e24a1479889e22da13b07915195", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677589389, "uuid": "7bfbebf3-577c-40e9-ad16-42468d4756c8", "comment": "Malware payload (AgentTesla)", "value": "24f3c02d022b6009f132eb9f886b64d813f254a9283111398d2f9fe726e7567929282b01dc921b5593174d8899397510", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677589389, "uuid": "494da54b-2e41-4179-b648-05136d22c19b", "value": "T160357B8072F8D115EDCF3239091C568E7D79B107A262B22ADB7676D6A7077F772C8082", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677589389, "uuid": "590f205a-ad6b-4135-813b-d901a1198c92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677589389, "uuid": "dfd400db-c965-445e-a073-c394c342cc89", "value": "24576:8wwk1/y4UeyJAsn9MakWzSFpSXhRfLhKDQrgvErLpGdKvP:8XkZieohvQihRf9hWp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677589389, "uuid": "266a395b-1e74-412f-930d-321056299d7b", "value": 1150976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677589389, "uuid": "317b82c7-3c94-4e31-9f6f-1e255127e634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677589389, "uuid": "321dca1d-7b9f-4587-97af-175e3e8459a8", "value": "rRFQN0\u00ba100400806.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d83a57-b738-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677569023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569023, "uuid": "1f1db5fb-7e83-4341-8fc3-68c2fbd97804", "comment": "Malware payload (SnakeKeylogger)", "value": "c68ab5e9ca50bdd3a6a605abeeb28e47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569023, "uuid": "d17ec82b-bf97-4a2d-9b0a-50f2429c2986", "comment": "Malware payload (SnakeKeylogger)", "value": "d07db65b01e0b86a8e74ecd7cd9b2193d6cb5ecfc39efc28db59b681e2171205", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569023, "uuid": "1b9bab64-d92f-47ab-b493-295bfad7897e", "comment": "Malware payload (SnakeKeylogger)", "value": "bd2eff12e4ccf83d64b7c459b1705073fcceb8c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569023, "uuid": "9e94ad50-bde0-45ae-ad40-a0c4dbde19c1", "comment": "Malware payload (SnakeKeylogger)", "value": "0d8acc0065aa37c9671b13f984a9b3435307efcdf2e3e742a13fb07f78e96d07dde8d22d583f33f5550fd032676250fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569023, "uuid": "a2393e43-9f81-40b1-a47b-f3f9a96d0137", "value": "T161256B8072F9D211EDDF326D091C568E7E79A107A152F22A9B7736C26307BF776C8482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569023, "uuid": "ef0ebe64-7800-4c2c-a8b8-e326302b4d3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569023, "uuid": "9c3e77d5-8a51-427f-b5cb-8c1e46e5f5a1", "value": "24576:bRFy+jFy+eArmyFPuaqoFFVwE2n9BV2mCEmC/Ue:9FrjFreumyFPu4bwx9B1/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677569023, "uuid": "04a808f1-1ad8-4dc0-8659-0fa7edcc48a0", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677569023, "uuid": "ab6f3d9e-96d8-435c-828a-e011c88acd60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569023, "uuid": "8d4829a5-fa0d-4af5-8524-d7ac8ff3a5d6", "value": "factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91be7a3d-b78b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1677604559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677604559, "uuid": "a9fe07a7-eadc-4458-990a-f6b03c80f714", "comment": "Malware payload (Adware.Neoreklami)", "value": "2a41fdeec25191ed2eac6d4c6e8c4881", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677604559, "uuid": "190d91e4-4900-40f5-93d3-48c0d64b31dd", "comment": "Malware payload (Adware.Neoreklami)", "value": "d080f272d1aff8a4aeb7405d6af31cb923bbfc74cd27002a2b0a1ee8285e7325", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677604559, "uuid": "07bfbfb2-33c8-4f0d-8f87-8a3219296854", "comment": "Malware payload (Adware.Neoreklami)", "value": "c0e8da924bc54bb84d48c34043542c2d6338407f", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677604559, "uuid": "6e33193b-a817-411f-aa31-4e9d1a62c4b6", "comment": "Malware payload (Adware.Neoreklami)", "value": "7098f275c33ae47760827263f9ff64385313864aa69bcc503aa3fc68c6016d01a114cbe9d75c742a28735b99193d34b6", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677604559, "uuid": "cdd4f4ea-e0bf-4981-9c0a-46a3b665191e", "value": "T1087633727AE0CDF5D32764738D28BF917060C5AE033889A327FA957F9C1C19A2526B5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677604559, "uuid": "ca837423-a3a6-4f2a-aee4-fda2201686f6", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677604559, "uuid": "8390c50b-048a-494d-8d03-49566a5ed64e", "value": "196608:91Ov0gk1K8GgU8BpwKZCDtkTfJARxGWbzjd18aJ7t:3OvbkvGgUCKKZYghet518aX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677604559, "uuid": "f755664e-044e-449c-8026-dd3394dacbc6", "value": 7640372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677604559, "uuid": "059ac48b-1f3e-432f-b047-c42422377259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677604559, "uuid": "921a5cfc-2b03-4f79-ae0e-a37714aa1358", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e76a88f-b73f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677571831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571831, "uuid": "46a5b5f6-e4e4-4b2f-b3fc-60783e976ab5", "comment": "Malware payload (SnakeKeylogger)", "value": "397bea86396d687fc990911ad0e752ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571831, "uuid": "c61502cd-f84d-4c99-a902-0e0f7fdffe0d", "comment": "Malware payload (SnakeKeylogger)", "value": "d15727d88e4001a3086b19a94a3d1b944e434d989ba913e1ad915305c39aaa17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571831, "uuid": "24e1bccf-e0de-414a-9b1c-ebb17c393744", "comment": "Malware payload (SnakeKeylogger)", "value": "4b0046d66a54d5fa3874ed5040eedd0c86d4f59c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571831, "uuid": "0ef2c46b-a06d-4b4c-80c6-59935175e3f2", "comment": "Malware payload (SnakeKeylogger)", "value": "cdb0329840daa87fcfe0959ce394ac2d25870bb7c6571b483a4bbfe26d6ca4cc91c96373b5dcb79d983f929dad53561c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571831, "uuid": "e8cff9a0-b9f4-413e-ae74-70473693f4a7", "value": "T1C4A4F3467ECEED15DCE286BE0D958FBADD1E78EE146001F932C8B26E64317605FC814A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571831, "uuid": "6a5f18a6-6c61-4c4a-82de-3940741e3471", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571831, "uuid": "aeadb231-cc09-4e5b-9410-de81ee182afa", "value": "12288:8Y5/tJJEVE1Pm50u9ufspvq20BUPD/Ej0UTuwt:8Y5//JEP0u0CP4J5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677571831, "uuid": "51b3fff9-966a-4cf0-b8f2-d3e047e6b9b7", "value": 456408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677571831, "uuid": "d0a5a3e2-d305-4911-9bbf-dd9cdf747623", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571831, "uuid": "c316702c-b388-479f-b7b0-95011041a489", "value": "FT 108 DD 28 02 23,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751724c1-b7bd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677625985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677625985, "uuid": "74c7a5b1-82be-4b5c-874d-ddaa752fa7a3", "comment": "Malware payload", "value": "54d5f91956ea8c6ea58a4917977e3186", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677625985, "uuid": "bebd7796-b653-4aad-b779-2476cbeec0c8", "comment": "Malware payload", "value": "d462eb9334417cb33132a253cc5a14e353fdfbb9c017206d4245dcb0adba1286", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677625985, "uuid": "04061cc6-6967-4287-bf88-fcc938cebba3", "comment": "Malware payload", "value": "7d63525612a972eaf7c3230e2ccec579e935ac27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677625985, "uuid": "6c15dc0a-a916-4de8-b0ab-14cfd3a4f25c", "comment": "Malware payload", "value": "7c1ccdb8f641d1888451152a2d151b40a319ab594306a71013ccaec96e8e003174bd07def8d2075446286f9025be8d07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677625985, "uuid": "059174a8-18bc-4bd0-8687-352448dce165", "value": "T1788633DC7250B2DFC85BD4729EA82C68FBA174BB831F4207902716AD9A4D897DF540F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677625985, "uuid": "fbbb3a98-bd83-433a-8b23-89e7326991ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677625985, "uuid": "f1a71b05-52b7-431e-b022-53c92991c3a1", "value": "49152:OmO1QqY03mUsKn7vWYI0JVRd/9HUXP83kOIpEnAO:tqTmUsK7vnJbd/O03XICA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677625985, "uuid": "f39277b2-965b-40b7-90c1-261d71f45ef8", "value": 8339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677625985, "uuid": "6fb4c8fa-d861-4048-a921-6742663671c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677625985, "uuid": "af5430b5-2a1c-47f4-ba58-0396c6b3484b", "value": "Installer2_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6f5605-b740-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677572450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572450, "uuid": "59acbda5-e616-4bff-83b4-fcd279ffb2d4", "comment": "Malware payload", "value": "f1603f05bd5f40f03fe562209bfcc0b6", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572450, "uuid": "aea9e4d3-53ef-4abe-8377-56f83991724c", "comment": "Malware payload", "value": "d503346bc1aef8cfc0d98ac421a6f9edaaa11c64522c0bf45690293c9917efa5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572450, "uuid": "a2c8f906-3bd5-4e2c-9d62-c4b22c89d8f3", "comment": "Malware payload", "value": "755472a170bca6d5e9e1e5b21a9d512e6f74aedc", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572450, "uuid": "33658651-b0fc-4645-a5d0-94982521c3d4", "comment": "Malware payload", "value": "5694bf508fc5a793ebe00d66262a97346c088b8af4caca75b76ccf8292b468cd174cae57011a35c5c09844d136555598", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572450, "uuid": "efdd2870-e991-4e2a-9980-372a583f0b42", "value": "T11F050119E756A83BF4231038E4886097911C6C766A45EA0F31C6772F5733FB28EBBD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572450, "uuid": "8b7bf819-0fb0-468b-b9ea-b08840b981a6", "value": "24576:7MmwmkKnFeEkmtmWmaFxFVmFU6ZewV7SDbLU:7AKFBvfEewVO/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572450, "uuid": "81ddb0e9-d047-4327-8fb4-04ebab479541", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572450, "uuid": "eedf8136-27d7-444e-9930-54740e18ba86", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572450, "uuid": "19099838-7884-43e4-b8ea-bbb92591fdce", "value": "swift_draft34785002345.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4889038a-b733-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loda)", "timestamp": 1677566640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677566640, "uuid": "65ee9747-63dd-4bc5-ae8c-688f069ed83a", "comment": "Malware payload (Loda)", "value": "780e2eb727a2a278795471059f4d6b33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677566640, "uuid": "fbb43614-49a4-4e72-a0d8-f6a562b4243f", "comment": "Malware payload (Loda)", "value": "d5a0c28c1b0198033e57c75f95c921244071ce7e2eebec74e66f384627900824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677566640, "uuid": "4839353e-4ce9-4300-9bdb-14fb63c16776", "comment": "Malware payload (Loda)", "value": "2911c5de51eaf1ae82e96fc26c1505cbfa7f0641", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677566640, "uuid": "ccdefa12-14d0-43b5-a4a1-bd13b0c4f86d", "comment": "Malware payload (Loda)", "value": "8aac56b4e44d01c01d6e3a21764f345663a605b5bff452603e4460add2c83201a4d5692c1bb642566bb4a7691cc31685", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677566640, "uuid": "8aa89b9e-0299-4041-8661-c7e5e73848e9", "value": "T11EF5335B7A80ECCAC22642F29755268FB8D0923154E855D1F52FF33A5C0BAED5BF00B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677566640, "uuid": "c785bdd1-c229-4000-982c-cddf18b11d5b", "value": "0df92f59b17ff0c45cd25748e8895808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677566640, "uuid": "8c3192b1-fc8d-496c-b33d-5f5e19ddce78", "value": "98304:OWYHz9DAMmWXxVkYIs0xQIk5Zq7IvQEJ/lnvf0xSOS:KHz9MP1s0LkTqUvbhNvfdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677566640, "uuid": "1146276e-ba6e-446f-991c-b5987638ef91", "value": 3532304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677566640, "uuid": "54a58afe-6947-464a-a0a4-257fd0974261", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677566640, "uuid": "6387b0d6-35bc-47de-bda2-4662856c9ed0", "value": "maloda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4350b1-b779-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677596741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596741, "uuid": "3391675f-2cab-4ade-9d82-c93230e7688d", "comment": "Malware payload (Mirai)", "value": "ce6c3da664dd31ef993936dfac389714", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596741, "uuid": "d8e3bbcd-f372-4d35-ad30-9812913aeeb4", "comment": "Malware payload (Mirai)", "value": "d5b120b5a20b2433ea8ed1eb6db0d0c812f383077039641025a8807f3501182c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596741, "uuid": "6c5af4ca-58fd-44b1-8bd9-6f2d35e593a1", "comment": "Malware payload (Mirai)", "value": "b2894c77c2cf9040d7deeb434d9c386d4e73dc21", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596741, "uuid": "a30935d8-f504-4071-ab6c-e7c16a3bbcb5", "comment": "Malware payload (Mirai)", "value": "706c7410ec2f6974969077c1e166c7ed75a1955f6842d78ead7694507eb5f7483006ddcfe5dbd11cd7e23de492782f9f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596741, "uuid": "6fde817e-cd2d-4e7f-90da-7bc3191905cb", "value": "T12031FEE5A7D08EBDC4F451BE9E4B0310B3799F44E0CA7222830C63696C1AE3C6D27446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596741, "uuid": "39860cbc-7275-49e1-9c49-3737ec53e2c1", "value": "24:uTcRKGpa7Urz/jlfamXK1hUVev3gRGaJ9ixBBuLlBP9gjSq:uARKGpa7UrLZaV/+JCBuzZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677596741, "uuid": "e1adc906-aa33-4bcd-81a8-5f646576e058", "value": 1488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677596741, "uuid": "860df377-782f-488e-9b9e-ab186e7fcf61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596741, "uuid": "3937f571-f1b5-40e8-89f9-df79043694f4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa88cb6c-b77a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677597299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677597299, "uuid": "4b091f62-d101-4ffd-af2e-118aee02e8e0", "comment": "Malware payload (AgentTesla)", "value": "a29e1f18b568200a46c3c8e44c534566", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677597299, "uuid": "67ebff07-ca79-4afc-b9b7-a102f7cc0577", "comment": "Malware payload (AgentTesla)", "value": "d5f9fb5cd5cfe9a7e84b147ab8819f0a6a6b5330b9b86c76a6031d47bdf2262c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677597299, "uuid": "8f63f728-3c5e-4e5f-89a2-1a616e6942c7", "comment": "Malware payload (AgentTesla)", "value": "84fcad9dde79b7b3447f0ca2fa43b5740a592d52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677597299, "uuid": "97ad9bc7-4485-4106-918a-2a8eb0b81ccc", "comment": "Malware payload (AgentTesla)", "value": "76980d26becf09df504619208419540948ee475c175d894a9ea4922571adc01f07601f7fd296457531163f751c59d391", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677597299, "uuid": "2c4a46ab-9af9-4c0a-adbd-c6118c01afcf", "value": "T1B605D43939735AC6D278F63386D3E520F6FD84923303D95AAEE60AC50F41642ADCE64D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677597299, "uuid": "f4b79bae-9d84-4e23-983f-82a717d89d0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677597299, "uuid": "258552bc-8839-4f9d-aeaf-9263ac9535bf", "value": "24576:husNLTsIBMNjnNNOhAe/S0Xi4RixZ4W1S8Q:hTN3jRAof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677597299, "uuid": "e628bc48-fa53-4603-a248-6bf864d4c180", "value": 817152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677597299, "uuid": "0420e0cf-8d44-450f-9e89-ce6cf8453d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677597299, "uuid": "fc72df62-1275-43e8-8bb2-67c1f0478406", "value": "SEAWAY BILL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eab438a-b6ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677544263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544263, "uuid": "5d13fb77-d2dd-4b5f-8887-289368e792c2", "comment": "Malware payload (Mirai)", "value": "e0a67c01e8f2c81f1c37cae370afe707", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544263, "uuid": "3902591f-132f-4ebe-b316-57c2a8234567", "comment": "Malware payload (Mirai)", "value": "d60a16d3da3792c4c8007ff672f97b18678ac6b99e56cd734c77710c4207c9ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544263, "uuid": "36b029ee-0128-4c23-8cd2-8113fdf483c2", "comment": "Malware payload (Mirai)", "value": "30b3110c65d8dc3b7b0e5848379fb3360b12fd2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544263, "uuid": "5ba3ed5e-a1cd-4bdb-93da-053c0e55d352", "comment": "Malware payload (Mirai)", "value": "67c209ab5bd4df38e8f5e94733cc3ff4942906c64ddb0bfde16c3cf18dd0b53fe4b6d06fd0cf6407b10b2d1db8b7c75e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544263, "uuid": "04684abe-8ba9-47f2-b8b7-08e20f8e61bf", "value": "T1F1531A85B8819A25C6D113BBFE1F018E3316975CE2DE73128D145F647BCBD5F0E2AA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544263, "uuid": "33557249-1d9f-4a5d-b983-8e389f6ddade", "value": "1536:YdnWpBh3cLDNoATqrjjK5yAMQ1fwnWmLdI8niD7noKWp:lH3+po+qra4XQtwm7noKWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677544263, "uuid": "266bf826-9918-43cd-ab70-836d8d1d4588", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677544263, "uuid": "ac731908-ef5b-4cbb-8c76-525d1be55065", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544263, "uuid": "db23ca16-d426-4fe2-b5d4-e0253cb453f2", "value": "e0a67c01e8f2c81f1c37cae370afe707", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a55064-b771-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677593417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593417, "uuid": "9958fdfc-d116-4882-af98-ea32a3d161d3", "comment": "Malware payload (SnakeKeylogger)", "value": "5e8da54575b07db1314d01344a29728b", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593417, "uuid": "242ad0ca-f062-4f65-ac59-c5858a16ccf0", "comment": "Malware payload (SnakeKeylogger)", "value": "d61e74300bca4b1c6cc3e69eb03ff9db684eb58ffa0495fa6049ac8a9e91369b", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593417, "uuid": "50760c4d-7b03-4d91-aca9-4be82b69f5aa", "comment": "Malware payload (SnakeKeylogger)", "value": "a27f8fc84548d4393e093966eef708342a6dce28", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593417, "uuid": "2e8e3500-21d5-45d5-b36a-f36fe3979e2c", "comment": "Malware payload (SnakeKeylogger)", "value": "11d1427c61ecb620c787f29216abf64ed748a32815f867b36c23e8e181073f37a0ffb710e857743f92a0ef57c0227c67", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593417, "uuid": "bd8333a5-f2b9-4c9a-9d97-df649a0d5a43", "value": "T183936C1C3BD84911E6FE1D3704714510C73AFD121D17DB2E2AC5BCAA1E7AB858E0AFA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593417, "uuid": "a0a9e680-9ea6-4441-9ccd-e475ade537f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593417, "uuid": "ef054570-cba3-467b-97dd-cedbfe3118f0", "value": "1536:pAgzEJRCRjTZ1j4BPsNlHvMFvoo+BTI4SbZJjIkCpiOWB2TZzF0Kcl:pAgAE/8sNlWak4SbZdIkkwBUlFbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677593417, "uuid": "38014b7d-2593-4fcb-93c7-00a920e72070", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677593417, "uuid": "41f5fb0f-b5b1-4a86-9ad2-a193ba762d98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593417, "uuid": "6df72482-d18e-478c-b1b9-8cb48070be9b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03586637-b73c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677570390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570390, "uuid": "1df63427-caf8-4eb3-a488-aaceaabb6564", "comment": "Malware payload (AgentTesla)", "value": "c146bd4b23c8fbd8d1888aabc0dcdbf8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570390, "uuid": "15b11397-86a3-4975-be69-f6b6564c5a9a", "comment": "Malware payload (AgentTesla)", "value": "d6571f062d5171a70f5750fa082728fe3407c7ed8e8562913c1ff66437b569ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570390, "uuid": "6e44cd19-0b63-4872-99d4-ac28e6b2b903", "comment": "Malware payload (AgentTesla)", "value": "77513cf59d1df7f151c5aa3aefbbb2ee11e0151c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570390, "uuid": "005f9eb2-a18f-4f35-abe2-45f3aed0b810", "comment": "Malware payload (AgentTesla)", "value": "27d09c16f7a3f7c77e3ffbe16751d790fbef3c15884f2401ce5986cd080c8592390e5d762bf5d66d2397ba8ec6047ed9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570390, "uuid": "b606f1d4-c3a6-45a4-8f6b-acafb12be68a", "value": "T1FA357B8032F9C155EDCF323D091C56CE7D79B207A252B22AAA7676D6A3077F772C8091", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570390, "uuid": "c7027935-62fd-44b5-8987-06f5a8120f82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570390, "uuid": "98042c68-e810-4428-9417-2a3ea2bc562f", "value": "24576:owk16dKvPklMS5iC0NA2wLXTe32CLu9I/Fsq4:Pkc40lP0NAPXT7CLu9yO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677570390, "uuid": "c465f9a9-bbd8-4fbd-977a-1db41ed648d8", "value": 1108480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677570390, "uuid": "2bad8c09-1b81-4a5a-91c7-99c943062896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570390, "uuid": "90746105-2748-45d1-82d3-92739dc0584d", "value": "EITA Contact List - February 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d140724-b703-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677546086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677546086, "uuid": "1dd0b920-5b9d-4bd2-919d-458cd0ab87c6", "comment": "Malware payload (RedLineStealer)", "value": "636282c41edb5dc3584e5a973dcfbdaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677546086, "uuid": "5c815d38-91ab-4ffa-93cb-ba116c7e1620", "comment": "Malware payload (RedLineStealer)", "value": "d6c20e9186bd8d19fad18f571a06c5f9e5a4ce69f58ad0779b25e35e583dcb5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677546086, "uuid": "bc9445e4-493f-46db-9fbd-ab4f7d249323", "comment": "Malware payload (RedLineStealer)", "value": "0c4fadbb5497c5b972f3e6fbbaaad72cc4ab44ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677546086, "uuid": "44d598ee-f903-4545-9a32-91346ecf8f15", "comment": "Malware payload (RedLineStealer)", "value": "2ca67b6ac658b02b0d9c17fb0ff935db1b2ba18545d64bd28b768a38e101cbb51ca17ab0ef8bcea795e2675fd528eb5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677546086, "uuid": "2dce39af-c5f3-41b8-a3c6-5f5a8ec7433e", "value": "T169C40217AAEC9022E8B11BB058F703C317367E616634835B778EAD5A0C735B0A27577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677546086, "uuid": "05cd08f4-79aa-4932-bbd4-a06c5b98fe40", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677546086, "uuid": "154b0f07-af4d-47ab-a1d3-464fe6e1a4c4", "value": "12288:MMrqy90EJptwElLiC90q7vN7VdOLjgbtQ0uJM7rtLk0F:GyrptwIR90wvNcj4OK75fF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677546086, "uuid": "42a0963c-610f-4706-bd9e-3863dcfc55b4", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677546086, "uuid": "56f1f3e2-a021-488a-a0bc-d8ee048da87b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677546086, "uuid": "fdc14c87-139c-4e8f-803c-10891b2d802f", "value": "636282c41edb5dc3584e5a973dcfbdaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f8de0b-b747-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1677575259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677575259, "uuid": "da0ab252-e084-47ea-9b54-513df04bd4cc", "comment": "Malware payload (Socelars)", "value": "bbd74fe84f0cd1c6a490d33ccd2d5588", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677575259, "uuid": "f9dc9be5-2bc7-42ca-9abe-a7658febd78c", "comment": "Malware payload (Socelars)", "value": "d6c7416582172b48537000e0f604ad4836c2298130ce61ee64187d2e5659bdf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677575259, "uuid": "b2965941-da99-4e41-bfda-b84f58848aef", "comment": "Malware payload (Socelars)", "value": "7232328b8e24ec0d5ce5e29ad446a5150534b771", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677575259, "uuid": "2e560b34-0172-487c-a6da-f89a5882a07f", "comment": "Malware payload (Socelars)", "value": "da93cc3d703beaa345bf4c1ccab221740f1171640cf7a2fb2086e2b60b5e9e541f4b253e9819ea15b27e1e42f90d5898", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677575259, "uuid": "fb0adf9c-30ae-448d-b8e4-c69671e75bd3", "value": "T119841201AAEB4436D051AA700EA1E1924A27B62F1DFD7C5D7ADCDD8E0F7B2C096097D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677575259, "uuid": "c544bfdd-37f4-4de5-aa1f-fad10c30beb7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677575259, "uuid": "1c189bce-61ad-46a8-a389-238f9c6c7be4", "value": "6144:K/QiQXCA6m+ksmpk3U9jW1U4P9bBiQtCsZ/+/imJIGh7bc92xa+5o1WUK0h06PYA:yQi3Ap6m6URA3PhBtthtE/E9y5uVPYgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677575259, "uuid": "5733a823-a26c-44b5-975b-ba16cf862b4a", "value": 390025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677575259, "uuid": "c6e3b065-1670-4e86-94d3-07623fc50edc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677575259, "uuid": "e5e067d0-a4cd-42c3-8b54-be26232d6a89", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ca6f66-b740-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677572459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572459, "uuid": "0a27f50e-42a2-4abc-bbff-41947ddcd875", "comment": "Malware payload (SnakeKeylogger)", "value": "f629266dc24158f90a26c008526cf49d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572459, "uuid": "637355c4-49b2-4676-a12c-6afd2655cfff", "comment": "Malware payload (SnakeKeylogger)", "value": "d7218866b1b27bdc3894b27099db7706318eb61408f178e0ca6ebd123d430ebe", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572459, "uuid": "a8d9e5c2-0d12-4161-87cf-378bcb91291e", "comment": "Malware payload (SnakeKeylogger)", "value": "98da6d62d34165b43aae37659f845a46a73943b6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572459, "uuid": "f63692a7-be6e-4caa-b1bb-5155bde0e3f1", "comment": "Malware payload (SnakeKeylogger)", "value": "3980c0e81221f1a0135855611afb4777d46c9ad9fc9c550627a2824741768264d33d244e02e7487e24df38e0b13ea8fd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572459, "uuid": "7ae6c079-7f5c-45ce-a57c-436d6df67dc8", "value": "T1E115021AE3519C7BE4134438E04A60D791186CB77A00EA4F32C6B75F4736BB38EBAD59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572459, "uuid": "f18813d0-f126-4172-b921-d903ed14e43c", "value": "24576:aVm+m+iuReFeyLLFRZ+mQmtIAivGm3b+7vHiY1:Qv+FsAI2viY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572459, "uuid": "10b204f9-283f-4ec9-b8b3-1839b975abd4", "value": 881664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572459, "uuid": "ac25a45f-1927-4bd9-9815-bfd928afc65c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572459, "uuid": "5bc1f8c2-3c1d-4c50-bced-d052d0a44429", "value": "Swift Copy.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73adf0e9-b73f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677571866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571866, "uuid": "ca260ebd-27a8-4e35-9a61-4d4b1543dae2", "comment": "Malware payload (SnakeKeylogger)", "value": "41ab74d0e6fcd73ffa5a9955f4eee26b", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571866, "uuid": "3f2df1ad-7e92-44ba-b096-b6a84673c795", "comment": "Malware payload (SnakeKeylogger)", "value": "d7a50438e01b6e0fb421de5fb8701b9a87d4b64f5ce10cd73db294258c3d47c9", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571866, "uuid": "d49876bc-80df-415e-8310-58792ede762c", "comment": "Malware payload (SnakeKeylogger)", "value": "ff0404002877e06629cdb9bddd08a94a9987f3e3", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571866, "uuid": "fb8ab27a-a416-4e3f-88d3-629b1c2f39c4", "comment": "Malware payload (SnakeKeylogger)", "value": "ddd740f15c65ab0056e3cc6be0a5184d8edf72560659540b091230acb47030e1a19d042f50eb74da2424d71dc42262fb", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571866, "uuid": "6fb218a3-d4b9-4ec9-bad2-87f68e4465ad", "value": "T10B356A8032F5D155EDCF323D091C468E7979A107A262F22AEB7676C6A70B7F772D8081", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571866, "uuid": "5fcedd94-6c0a-4fe0-927b-0866c3a8f549", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571866, "uuid": "1a5350a5-b59e-447a-b5d1-6de443e34cc4", "value": "12288:LewEx2iNPh/yE1mI3T5KT5/RO5s+uPUx56JVJOGzIb+w2ATjH82oizgusEDZ8hO8:qwk1rdsIj5KpRguSMDOZS8TD814lMvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677571866, "uuid": "1c917e99-c68a-4b04-b073-ba77df2e687d", "value": 1066496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677571866, "uuid": "067d5400-0652-4c24-8ba7-6aa3218211c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571866, "uuid": "da104902-ab59-433c-bacb-bdc9336cb1d5", "value": "DHL-AWB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93fe64a-b781-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677600330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600330, "uuid": "258d65dc-8192-4006-97fe-1ae1b24b450a", "comment": "Malware payload (SnakeKeylogger)", "value": "6455be8daeba261b531c5365822dd160", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600330, "uuid": "38447974-086e-44c8-85bb-866267da371d", "comment": "Malware payload (SnakeKeylogger)", "value": "d7a7671434f14c1301598f8ce0ead55af04277ed40c15ceecefe9d1976d20a81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600330, "uuid": "5f6e12a0-7245-4fde-bc3d-31ea0c433793", "comment": "Malware payload (SnakeKeylogger)", "value": "7a4d48ac8bffa269cd59d0f08cc3d62717e9603c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600330, "uuid": "b6ba2bde-be5e-4430-b75d-9df22372039b", "comment": "Malware payload (SnakeKeylogger)", "value": "c41ffe8db27490e18e060de4cae414cfc5c730add4390cd0808bd51620c53dea88daeada5b955743a93aa63e49647237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600330, "uuid": "42e30e21-94b4-4efe-a794-e239759e516b", "value": "T141656D84B3708CB7E8DB01B15C5661681DB2BDCE6454F20D57AB77066AB33E7708EA0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600330, "uuid": "50201414-0ea0-4a5d-8abd-c412589bced7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600330, "uuid": "3db1200e-7ba8-4871-b8d2-df45c9028855", "value": "24576:zD7SzY+JdUPt3GXENXoplmJKK3odSxbCA6/+otq:z3SzYkdckXHQJKNSha+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677600330, "uuid": "a4ae9842-5fee-4f41-aa10-a8762c9650ad", "value": 1545216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677600330, "uuid": "db1e2eaf-e979-4693-8d4b-aca239e1beff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600330, "uuid": "0a256c97-7187-4ef0-a333-2b6c1d7de7fe", "value": "SATIN ALMA EMR\u0130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44254f6-b781-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677600295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600295, "uuid": "701fc6ec-9c25-4b93-80c9-9e5fe75a2198", "comment": "Malware payload (SnakeKeylogger)", "value": "c56b5b10c23152f310b7b8cebcefc4be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600295, "uuid": "0e47fc69-8ccd-4ef1-98e4-a00fc8fc1f08", "comment": "Malware payload (SnakeKeylogger)", "value": "d7bb804007c926e7514fd6e780773de7a80e30e38c7df0dcc61fc529b40b9d51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600295, "uuid": "4c32cb76-df15-4e82-8823-bbb5ef649768", "comment": "Malware payload (SnakeKeylogger)", "value": "549fcb80f79430595c1002ba383f93361b86a377", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600295, "uuid": "d0274782-5c27-484c-a860-1aa02068a652", "comment": "Malware payload (SnakeKeylogger)", "value": "be68803fdb9b381c5df0a69e7ae78e0a06f1158208d3a470980b9e46aee5d15b31e0e9309e582285fe01778f9acdf7d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600295, "uuid": "c6669488-bfd3-4938-ae13-50c2a11000ef", "value": "T129459D4C63718C73E9DB01B2448522CC0EB4F5CB6616F25A5BA737429E8ABFBB54E143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600295, "uuid": "67d85815-2e85-46ae-a3bc-d2b90fae39f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600295, "uuid": "462c9919-66bd-497b-af71-c115d6871f32", "value": "24576:p9L2DDD7SzYpJd2GaRQcuIu2tiXavn/ReDLMlF/xbCA6/+otqM7:S33SzYPd27RgIu2tiPDw/ha+32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677600295, "uuid": "9f01a5bc-1ade-4b10-aa52-95548cb31a70", "value": 1257984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677600295, "uuid": "1c32b59f-f126-4517-bf5c-df46d9577929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600295, "uuid": "888a3fdd-fce5-496c-9c49-f38ef721c6c4", "value": "bill of lading with the counter number.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01526a57-b763-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677587137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587137, "uuid": "a0f2fc72-90d2-439d-b7c2-2ed4822ce2bb", "comment": "Malware payload (AgentTesla)", "value": "a4ec3b547e1e03c49cb60fa76f8c2935", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587137, "uuid": "f28f677c-6075-4b8a-817d-feaf9f73b862", "comment": "Malware payload (AgentTesla)", "value": "d7ea087df6c4c70925ed7a251405e8c1133654ad5ad5e3e3c8033a5f0c8f492a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587137, "uuid": "47318e82-58dd-417d-981c-512781e1c2cd", "comment": "Malware payload (AgentTesla)", "value": "8f1f3cfa393480e732d127f1cf39a8219a26e357", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587137, "uuid": "0a84311f-1a11-48d8-a7bb-698f0b4c5c20", "comment": "Malware payload (AgentTesla)", "value": "120c44f33786aa7955ddc81c1e558ff5895918ed91cfacbb0fb85cddb6fd6ee3b412aa2617b78ae4b922300dce8b6ecc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587137, "uuid": "50afb72f-ca58-4c7c-96ab-c2fa39cdd979", "value": "T10B45AE4893B34472FBDB12A51875228C4EB872CB3585F21B4F673751A522AFFB29F502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587137, "uuid": "ed55e952-84d5-4292-bed2-8a76c459248d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587137, "uuid": "4c81e3fb-4426-4a51-8ba0-f157f578190a", "value": "24576:hxgme9HkGUIUigvyWdVvkCVi1CA6/+o9x/6qW:3gme93URPd6xa+W1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677587137, "uuid": "53ce50dc-8835-46a8-b2b7-fd591b3d45f2", "value": 1198080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677587137, "uuid": "7280f5b6-ed85-4d56-8146-6141fbb9ee55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587137, "uuid": "e47ecea4-9f4f-4c62-9f84-52bdaed7e0a3", "value": "PO#JB2210-0005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bacc34e-b7c3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677628520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677628520, "uuid": "64a9d29c-8778-4cd4-bd11-ab590d3102ea", "comment": "Malware payload", "value": "42d23b699c6dfbca209876a0f9a92bf9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677628520, "uuid": "515520ab-26c4-4e8c-be5e-2d0d86dfbc09", "comment": "Malware payload", "value": "d844fae5cdc61338bf5ec8f08804c844b50446dbaebf996643227e2c2967283f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677628520, "uuid": "af4be3d6-6ea7-4fc6-b812-1725c4422224", "comment": "Malware payload", "value": "df5f64e32bdc861bf3799dd679356e167fec48fb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677628520, "uuid": "ad811c55-c4eb-481a-8e5b-4e73d179c296", "comment": "Malware payload", "value": "e800709d81a1ad14b17c6948d61ba38e3ecd0a9f415ed13ce181e10511de7668881508789116ce555cffc9e79c3b727b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677628520, "uuid": "ef49d301-a7b3-48ff-937c-5c0515a08aac", "value": "T161A3A4FCF1051F22D392615C89DE0A1873B2D361F1E9DF05666C7A09C1EE92B538AEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677628520, "uuid": "75cfb518-0eaa-448f-bf41-63a8674eae6c", "value": "192:nluzi75WbAZvu1hdh12cB5kw94tMa3dZYkVdPrv1kHWuuIVLk5/lWWWnazp6Lzj7:cz5KIy24jHuHWZqWWdLHKSq5dWBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677628520, "uuid": "228795b6-a22c-4b7e-8654-3c3e7d2d1cf2", "value": 99986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677628520, "uuid": "98ba0bc2-9542-459a-8729-fc07db0936b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677628520, "uuid": "82ccd620-e529-4a27-88d9-d8b03410bdc4", "value": "insurance.es.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04798179-b73c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677570391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570391, "uuid": "4af269c8-0319-4b79-8be0-f284f55eeaeb", "comment": "Malware payload", "value": "1e73d9e5eb513b7449d66359bac44b6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570391, "uuid": "6689c25b-7ca4-47dd-8795-efa170165206", "comment": "Malware payload", "value": "d971e1835a0c3f3ae26782e13b1ab34c6b373a0edadab92a092c81f0ea998860", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570391, "uuid": "36dc3dbb-d450-40c0-9b72-5ebca13169c5", "comment": "Malware payload", "value": "1be903d55f92c7a58d39ddcd64f7c9aa240629a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677570391, "uuid": "be97d203-6746-4209-9431-5cacd2b5093d", "comment": "Malware payload", "value": "a349142fe7702ae30f029d511b7708fd816a33e0115ecec651463e48f81bed221e847cd1c1eacaa24f70d4b2875172ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570391, "uuid": "8daaada3-9ae0-4b91-b380-ee766318ebe9", "value": "T113E42810AEC7C8FBC16B353F516999A208AED7110B1356DBCB450E34BB604E3AE355EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570391, "uuid": "fbcf9b44-4b8f-4200-9f34-82747d4aea41", "value": "f2013e99656ffaf909bb875cbcc50a1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570391, "uuid": "03fdbfe3-e4db-4bcf-a57a-05ad4e7fa960", "value": "12288:UwwDgdIvFfkLe5j35cki0irlyv/cM6lUYBrmUkL+94VVw3ZUjilV0RGeZwNNzB+Y:M0IvEaMdrl6UmUY+94VwCil2/wNNB+/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677570391, "uuid": "77f15926-d829-4fdb-91d6-5ee5dbfbf3a0", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677570391, "uuid": "50eb0687-86ec-4e43-ba2b-926c6e610a8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677570391, "uuid": "70fa6d25-8c07-4e41-92e8-de674021873a", "value": "249416680.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a3614c-b6fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677543714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543714, "uuid": "8b96b931-90d3-4c6f-8e05-61ef091971cf", "comment": "Malware payload (DCRat)", "value": "7f1953e1299fea6da273272c371db07e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543714, "uuid": "74c852d0-b364-42af-b3bb-a998255a5f67", "comment": "Malware payload (DCRat)", "value": "da3d1039e1bdf64d04667415ed0bd80e10dd58401bced1a2eae0b16d7fd80dd9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543714, "uuid": "01939123-1258-4829-a0ea-acb89d22ce62", "comment": "Malware payload (DCRat)", "value": "b76acb9df5b471721fa88b2f47645fb5c5326f69", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543714, "uuid": "8b962eb8-bccd-463e-b5bf-c5030c08b42a", "comment": "Malware payload (DCRat)", "value": "4dc6327eb3b148d688bd881c670f481b6197e4365ed7853ef73e981e679358397514ddaef076b0aebc42ace2b3c2ee4c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543714, "uuid": "e1348922-f6c4-4b85-9abc-2dda056841e1", "value": "T1C8757B117E54CE12F0191673C2FF450847B4AD502BA6E32BBAB9367E65223937C1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543714, "uuid": "3cafc556-0fa1-4704-a443-7bb6c5aa4414", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543714, "uuid": "820dcf81-9c84-46dc-9711-8ec067b2094a", "value": "24576:P2G/nvxW3WxrF0l1q/cTF7akh2zBL65uB7OHprpK28b7nX1Vl+:PbA3Gel1q0x7ngW5uZylUrnlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677543714, "uuid": "1c28365b-f764-4782-a3d7-155713c86b56", "value": 1554562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677543714, "uuid": "4afabaea-eca2-4884-89c2-958dbdd98d2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543714, "uuid": "42ae5fa2-e958-4de4-8728-2037d7f30254", "value": "7f1953e1299fea6da273272c371db07e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98080b9b-b778-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677596409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596409, "uuid": "d827e2a4-9369-446a-b80c-e56115d67fa7", "comment": "Malware payload (Mirai)", "value": "dd947890560a6afb2ab799059e1db42d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596409, "uuid": "f18ea6b0-ed92-4f84-bc85-95ed43755a08", "comment": "Malware payload (Mirai)", "value": "da5065ce89e1c08fa34ebaa5c9a43644cf6cf9f7f2dbb9ab32436f2d3bd36ff7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596409, "uuid": "73af344f-cdc9-4c35-b938-9e8e68d5b8e5", "comment": "Malware payload (Mirai)", "value": "99ec691be595804c427a7cfad5fb247ab13dcd4b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596409, "uuid": "6e658152-c255-4821-aa6a-320d9a93debc", "comment": "Malware payload (Mirai)", "value": "69fdc2f579a7e46e31bada52a6c2ec74f8ecf80197ab3e0fe9c741fe355e5f1fab58df2f63c817be4f92b9289f629d8a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596409, "uuid": "aa6ec95d-76ed-493d-bb22-caca856851c0", "value": "T190632985BCD1CA22C6D423BBFA6E118D332553A8E2DF32039D246F6437CA91B1E77645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596409, "uuid": "705dff4b-90f1-4aea-b377-9bcee8b8a47f", "value": "1536:oG8bFNtiONFYGkqM+scfs1aq/+5+aD3p52ZleeeTTkWKlT4fXCNFiP:GRNtdXsGsck1ADp+l3e0WF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677596409, "uuid": "00bbedd2-599a-4176-9424-e8c3c6e7ae06", "value": 71856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677596409, "uuid": "b6a1b99d-1ecc-47ef-984a-43ebaa6c2dc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596409, "uuid": "ae31f1ab-7f43-4599-b078-ac4a4610aa93", "value": "amen.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71511eea-b726-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677561125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677561125, "uuid": "b760b8d7-5716-470f-b61b-2140b9dc8b3d", "comment": "Malware payload (RedLineStealer)", "value": "591e1d9042cb647c75539f42371a0327", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677561125, "uuid": "daaa7020-b744-4374-ae76-053e78d7d802", "comment": "Malware payload (RedLineStealer)", "value": "daf576a4e5b3bab87f02f9a7b05afa403999bc000bb98346d47dfca514ae5dfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677561125, "uuid": "4419b3ff-e57a-44e5-bcff-cc709c4430c5", "comment": "Malware payload (RedLineStealer)", "value": "4bf929c2eee9bc462ecc71bc1535c81cde701761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677561125, "uuid": "cdeda8d5-ccce-4c14-9fe9-f2b868875fb5", "comment": "Malware payload (RedLineStealer)", "value": "6ec39898616879b39f3d4a30e76822d8b416644b2c020768396843d0beb41d5bc80c8b9b36fec7a1c7ca65875e487b96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677561125, "uuid": "5990be8e-07b5-4afc-8cd5-7f930b734c22", "value": "T119366B228BD85939DE638B7174F893149E7073C0AAA1C7DF719981218B417826BF13FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677561125, "uuid": "27eda476-31db-4419-8ebd-408eeb45a87c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677561125, "uuid": "c0a64688-3aaf-4b8d-bd15-3fc83bad82e2", "value": "384:jwtL9i4+wQ8E9VF6IYia4iOQUDIy6DCX:eUk3EpYiaAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677561125, "uuid": "c1c46d34-52f0-4ad2-8376-39ddeddbf3a2", "value": 5136032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677561125, "uuid": "2d58e01a-79c6-46b4-a564-e7727ef08cf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677561125, "uuid": "7c1d97e4-ed9e-4044-86fe-62b2c72f424a", "value": "daf576a4e5b3bab87f02f9a7b05afa403999bc000bb98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d0cfec-b739-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677569110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569110, "uuid": "ef9ebb8b-9e18-4361-a463-cf5854e116ae", "comment": "Malware payload (Formbook)", "value": "aa404f0b2a979dce24a611bf4c769789", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569110, "uuid": "e69a6fb1-2e02-461a-b780-b86b31b98d19", "comment": "Malware payload (Formbook)", "value": "dbf036eec0251880e04a69d6b2497a2736967ab8af0ca04f4e3cbbae2557fab1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569110, "uuid": "a3567942-57bb-4acd-ab63-7384c8f76eb0", "comment": "Malware payload (Formbook)", "value": "73a30978539938af9770806028816af07c67421a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569110, "uuid": "0e5080d0-6538-4eb5-ad2e-ea7e9e5e3044", "comment": "Malware payload (Formbook)", "value": "fa787052cae7d64b9a4a5586908d0ac4356e2619dc2bb2ef32e85fa0c9dd678d2ab543c26fceb97062bce63056444db3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569110, "uuid": "0b9ccc9f-d561-44f1-b6af-e3fe1cf95279", "value": "T1AE04623872F0A352C939427367E2D1389AE05FACDDD5C306E2B42A95B341DE93E8945F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569110, "uuid": "83060777-abc9-4c6e-a676-58e7cec87f68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569110, "uuid": "a9c2fce4-ac1f-418f-95a8-a70f1ca39b50", "value": "1536:EwEI1s+WIyEReIiB0TJoSssssssswksck9b0zlku:EwEIvyTIiB0TJoSssssssswkshMku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677569110, "uuid": "b76ceb8a-2541-48e1-b2da-95c20afce3fe", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677569110, "uuid": "af872b6f-5cfb-4ee7-84e3-22bb83f3c4a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569110, "uuid": "1a901e40-14cc-4c33-aed4-e09aa902ff12", "value": "Biil Of Lading 20230227.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157226c8-b6ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677544221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544221, "uuid": "4653450c-fa68-49dd-a9c8-958aaa725da7", "comment": "Malware payload (Mirai)", "value": "bc916174be661770f524c904794e7484", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544221, "uuid": "f54d8be5-1161-4941-bbf1-81e904c06241", "comment": "Malware payload (Mirai)", "value": "dce27baaf5ae2ded47bc2f79b48f1bf3e09b25e4c4462d95a1ec0b7ef217c82d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544221, "uuid": "aed6b7e9-e934-43c4-9a9b-6aef2b43fb74", "comment": "Malware payload (Mirai)", "value": "269d6fb29d0f654b6f4cb3aa48bd9d9d0d3851ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677544221, "uuid": "ce078a5b-0a0c-4566-a10d-0cf2b8ff4572", "comment": "Malware payload (Mirai)", "value": "f338b5322a0c060edf73f72225b9de5c736f4a0c817df71cd40d7c8bfcffa451547837b5dafdc5a29260fa6656531da5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544221, "uuid": "6fe2d953-1374-4801-9253-418a85bb79f7", "value": "T1AB334AD6B701AD3EF99BEA7F84130609F23073911193073A63BAFD935D322945D26E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544221, "uuid": "794d5a6f-ec7d-4eb4-8bb4-f95ae908ade9", "value": "768:DxeLFd7nIlK+mhDuhBRBO9voBadb+Gx9UuqQfXx5jBwLOvEr8UDP6:F2FelKR6O4Kv99qQ55jB0Ovu8sC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677544221, "uuid": "78922ee7-8b1e-4ca8-910c-c7069b8a2f72", "value": 53188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677544221, "uuid": "ea767c87-6c9a-43cf-98ee-7fb5c5009282", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677544221, "uuid": "6b06bf37-d5ab-403c-901c-4b5f3adf1909", "value": "bc916174be661770f524c904794e7484", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6411e222-b779-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677596751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596751, "uuid": "55fb39b3-d004-4f8b-a77a-d0fdadbf694e", "comment": "Malware payload (Mirai)", "value": "25882b805ca8016d074790d8c30c6f05", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596751, "uuid": "bae56ab8-928f-4254-8757-d849d65ae20a", "comment": "Malware payload (Mirai)", "value": "deaefdfe01dd430671f4ed14911ce5e55e32ea86e0cb04570f84f4647024c159", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596751, "uuid": "96d03add-85cd-4b81-beab-90a17af48e9a", "comment": "Malware payload (Mirai)", "value": "d4e76352c6a0c8d9173cc679b363a2a4f47f741b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596751, "uuid": "588e250a-6434-46c1-88dd-99d7e567f2d2", "comment": "Malware payload (Mirai)", "value": "1d9fe74e83413e54fa7d9c0ceec5a99bebf4b6a3951da6d2f0cfa138f92bee213a463380f3b82febe57fbef3884c48e4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596751, "uuid": "fe2145f1-2e29-4b8f-9dcc-7cd318f3ef05", "value": "T1B521EDEAA7D39E27CC580377DC9F5710F322AE858A9EF113E35216250D3F20A1F21199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596751, "uuid": "0a750664-792d-4c5d-b401-71c0606269ff", "value": "24:J6KFpV0gP9qD0at6EocGwrrUlFSy4PzLCkIddgH9Ik55Nfm:J6KjFqDPtFrrkFSy4PzLT9IkvNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677596751, "uuid": "e65b6759-d10a-441f-aca0-a5888349ac0a", "value": 1152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677596751, "uuid": "e45a3a28-2623-4b91-a9f7-8e7192c1007e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596751, "uuid": "af5e74ad-d050-4cd8-9df4-ded5154d6b38", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5db26b-b745-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677574270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574270, "uuid": "567f2f8a-7bcc-460a-a857-018094f162ec", "comment": "Malware payload (AgentTesla)", "value": "3a0574d9952a885dd6af7716b68623eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574270, "uuid": "1ba7bfda-62ec-4321-824c-3cce07b1335c", "comment": "Malware payload (AgentTesla)", "value": "deca2549d1849cf35a4c1a924db6fe95438cde05bd470de9aab41d74167e9dde", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574270, "uuid": "a3d49a96-1382-422f-87e2-498cfaa3fb68", "comment": "Malware payload (AgentTesla)", "value": "00606f9b9fcac7e9856322aeedfa52e44cc735b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574270, "uuid": "28c2f784-2e94-4482-bec6-8e59e0d324dc", "comment": "Malware payload (AgentTesla)", "value": "422c481a657134f80d618ed333c304633c5d937a092a81775e52e9d97eba960294e802dc508c75572a0c0c491e1cfa44", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574270, "uuid": "ac2469da-e5ea-4772-a87b-12ff1a1a0b7f", "value": "T14945AE4853B34472FBDB11A51875228C4EB872CB3585F21B4F673791A922AFFB29F502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574270, "uuid": "79225e48-d7cb-47b5-8b8d-78f8732e7e13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574270, "uuid": "41ae7149-4929-4964-ad30-9afde9bf71cd", "value": "24576:FLgmeUuCA6/+oR8KzHMYBT+ipYriMMXfdUKLCUqaNwx/6qW:5gmeUua+Y8KDMCKip4zCdhny1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677574270, "uuid": "eb9c3844-02a5-4dec-85be-d787c3f3316a", "value": 1198080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677574270, "uuid": "19cb203a-5ab0-4eec-a6e3-9f2654ea7222", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574270, "uuid": "672e2438-d411-4f61-ac0a-3e05c5b0c4e7", "value": "3a0574d9952a885dd6af7716b68623eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3cbf1f-b755-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677581362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581362, "uuid": "26ed9cf7-a240-430f-a62c-89f6f7f92378", "comment": "Malware payload (Mirai)", "value": "523b72cc590f8ce63d2ce71af7571bc2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581362, "uuid": "36ebcd85-36da-4b34-bc99-143ba3006fd4", "comment": "Malware payload (Mirai)", "value": "df0bfeffbb42c64ec981360ad7a506c4cdaa37ff8218efebdddc6290ac40f397", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581362, "uuid": "c0df0b67-9c32-4d11-aa71-4d7c7a294f4d", "comment": "Malware payload (Mirai)", "value": "8c802a272c4bc7a13b3d52e430bf6941362224ed", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677581362, "uuid": "a5a97b84-385d-40f3-b509-9f1c07f72c73", "comment": "Malware payload (Mirai)", "value": "6a33ede4939b0065e55737331d12e8e62a7c7641ee46d474c496b7328f2783601382c1551ffa4c02fa8343dda2e42969", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581362, "uuid": "c30cfe6b-524a-48e1-bd43-7ed046caaacd", "value": "T1264394C69E973C7AC3C5FAF8DAE6D13414E7E824A3A34246A4C9CE61513EEC8154E34D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581362, "uuid": "26331833-4035-4b22-b6f2-968424cacfc6", "value": "768:J5dNzL+rhC+e8dv1A5DxxO3dBCPSneEzrup4/e6dXDo6:J1PUpT2xYdBAMuem6dXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677581362, "uuid": "63ab8a18-1ce6-4131-a6a7-ca98ec2717fd", "value": 55237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677581362, "uuid": "1d33a1b2-7dbd-4c75-ade3-2220a2f3ef9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677581362, "uuid": "cb4bb64b-1611-4294-92e3-ee9d10df604f", "value": "523b72cc590f8ce63d2ce71af7571bc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259c93ad-b729-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677562287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562287, "uuid": "f99828c8-aa5c-4b4b-9299-1b9870550ad2", "comment": "Malware payload (Amadey)", "value": "fbc24ad7dad216d0f2efed0b8d35f991", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562287, "uuid": "129fa028-68b1-4c8f-9713-ce2874b07331", "comment": "Malware payload (Amadey)", "value": "e0e878de57d1574a996af35a5ccb448d0fa21ba95117504175c076bcdc655d39", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562287, "uuid": "a8b89a11-cf0a-4ee9-9f5c-69ba71ccdab4", "comment": "Malware payload (Amadey)", "value": "ab53667b54f81f10cccc5658c4d11ab0cb30f8ac", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562287, "uuid": "5330496a-fb85-45ee-aba6-ea99aa731182", "comment": "Malware payload (Amadey)", "value": "05253a695c2986bb3dabd1713151c8a0bbadc2c8cecc82627a4e736c715f1149fc082f48793fdc19ea0bb8cd72d25756", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562287, "uuid": "47185abf-8ce0-4382-b1c4-60966eb11566", "value": "T1E555234BE3CD4163E9E43B715AFF4293193B7E618670539B532BA85D0CB2935A23037A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562287, "uuid": "b78a84e8-6120-4289-aaef-6a49624ef758", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562287, "uuid": "38bba24a-993e-465a-9552-97ca0227ac9f", "value": "24576:+yLeS1siEc6Bc+mPH7vanUs8fFlRME7kv1fe/iIoEc:NCg1EHBc+mDiUsqD97kNf4QE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677562287, "uuid": "c4db43bd-58a0-43aa-bc13-b8d8fc86a0a3", "value": 1374208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677562287, "uuid": "d378bf72-823a-4523-9e35-3e1955f69e8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562287, "uuid": "51ff3fae-d0e9-4c2f-a1be-fe7376b919cc", "value": "fbc24ad7dad216d0f2efed0b8d35f991.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ecaa19-b757-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1677582207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677582207, "uuid": "90a285d1-4858-4eb1-884a-9a56576370cb", "comment": "Malware payload (AveMariaRAT)", "value": "205b7ece70a889f37c1bbf44cd79461a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677582207, "uuid": "6031b5b0-9063-4663-ac24-e6e52d6d724d", "comment": "Malware payload (AveMariaRAT)", "value": "e2260c68631c4c1be8b873c859e84a2c9737cb348414b1fb2860a139d781a8b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677582207, "uuid": "118d68a1-9965-4cbf-9a18-d382bce9e7d7", "comment": "Malware payload (AveMariaRAT)", "value": "1cb79cf6908f6248189f0c5a850cb2962f096f20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677582207, "uuid": "b6a8de54-95c2-4c45-9bfd-51e6ba009a12", "comment": "Malware payload (AveMariaRAT)", "value": "89951de42f730db8407a11029e444dce947dea4e0a0427abd78f987ba59631236b11f672fffeafd00264045ecf74413e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677582207, "uuid": "92c6fe1d-0541-434d-8e1e-d22ea2919d78", "value": "T13E45AE4853B344B2FBDB12A51875228C0EB472CB3585F21B5F673751A922AFFB29F502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677582207, "uuid": "7c853d57-92f4-44d5-91c0-63b7e028ef13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677582207, "uuid": "17e65c5f-bd4e-4085-84ce-11b00ae437a3", "value": "24576:x3gmeVuCA6/+o77dK+NQoUQDx87xgAb/DAfRBUx/6qW:5gmeVua+w7PQc8uADDAfjU1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677582207, "uuid": "c6420a56-3292-4e16-9440-80a0da1989a6", "value": 1178624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677582207, "uuid": "1501b9bd-d331-4085-93e9-24e99d752b47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677582207, "uuid": "86964c3f-0190-421c-b6ab-22c2d3023957", "value": "205b7ece70a889f37c1bbf44cd79461a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21b98f0-b7b1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677620934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677620934, "uuid": "a8ed229d-6313-429b-9fcd-46b71348f470", "comment": "Malware payload", "value": "7fbfd99f2917c9b8d4fc25ca873c9268", "object_relation": "md5", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677620934, "uuid": "fa7f783a-efa3-4eab-88cc-b09d00b56211", "comment": "Malware payload", "value": "e62a7453020148080614f7bd81ae3c316b1655b60845606120a6d671c5aaac43", "object_relation": "sha256", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677620934, "uuid": "ddc66e2c-0e3c-4614-8ffc-1f7f9d0ab97b", "comment": "Malware payload", "value": "139cd866212c22969c94b87b93387d3bdda022ec", "object_relation": "sha1", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677620934, "uuid": "def6e8f9-eced-4b5d-9775-c30d41762f96", "comment": "Malware payload", "value": "a175ffc3e9815c45b498f1f2e635238da40cdf3d0f124ac83942172679f2ad486ab13c9889817954012a0c2a2731e03c", "object_relation": "sha3-384", "Tag": [ { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677620934, "uuid": "42f0a1e5-21f0-4cb3-87c2-4b7c01be1116", "value": "T11305AEA8A75809B6DD63637ED802C651C6357820431312DBB2EC9A7F7B439D8633DF29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677620934, "uuid": "17b0a1e7-2b53-4874-bf33-97038173f7dc", "value": "12288:nlt0Seoid4jxZKlpKkPnMMiNWk11BhkWvSqY4zvmjOwJIT2:ltNe5kxZKl8QigiPk0hmOhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677620934, "uuid": "a26c37a0-b2ae-4690-a324-96c6a40f8d76", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677620934, "uuid": "5abc9b73-6fd1-4fbd-a031-a64762ce1123", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677620934, "uuid": "bd17b94c-7b85-4c61-9b50-f3103a018369", "value": "clamouring.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd18221-b78a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677603962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603962, "uuid": "b84791c0-d950-4f03-bf05-9d986250857c", "comment": "Malware payload (AgentTesla)", "value": "6c8d53db08bbbe82de5e38959ad9001c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603962, "uuid": "890f1ee1-c12e-421c-8149-b62009559c7f", "comment": "Malware payload (AgentTesla)", "value": "e79e0b0bafbdf9ccc36dea9447a6ed64f83deaf9eb93f05d0b31d24d9b8ba7c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603962, "uuid": "ca85a9e5-877d-4657-b74e-1a1b959f0f56", "comment": "Malware payload (AgentTesla)", "value": "7e950607acc16f1bc065a1d190e1becd4f8cb3a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603962, "uuid": "4c317ae3-1b51-4d1e-bf5e-9aa16561d9bc", "comment": "Malware payload (AgentTesla)", "value": "2b5d9cff154455404ca000b0a64f080fc44de4f497fa3c94049f5b585aeeac0d5c984433ced8b1d3aa87506264bb4d20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603962, "uuid": "39d4a543-89d4-427f-ae68-869adf7b3380", "value": "T1BEA40143FA2BC9A3D55542B7FEF3BF111F2589A498D36613059EACE0670A32A3C064DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603962, "uuid": "6ec4e7fe-520a-464d-a420-200c9baa3aa5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603962, "uuid": "6e0b1c2d-c4cc-4160-bf05-eac78f35fce3", "value": "6144:JfCRt2Jpk4voeWOJF9f8Y7APrWMxmaF2Wumx1zuGkYcvpOKWb+zr4MYIMxmmukRK:JW2HfrWOLG3AaF6mrICKqMYNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677603962, "uuid": "9fa3367e-9616-4e9f-b7e2-96f0e70f965b", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677603962, "uuid": "10a162fb-154f-4edc-bc00-982326e72ed7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603962, "uuid": "1fbbf914-ad75-48b4-839e-44ef6831d654", "value": "6c8d53db08bbbe82de5e38959ad9001c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93ce29f-b73d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677571205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571205, "uuid": "2316ad75-e734-423a-8b6a-4f92aeb6a2b4", "comment": "Malware payload (Mirai)", "value": "7e5efd4f65c84ad7029483dd0d629840", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571205, "uuid": "9ab5bc9c-4f1a-46c7-a721-300de7434aff", "comment": "Malware payload (Mirai)", "value": "e8b8093d5b5a9b27fdeb9ff67052943a94e476204ec4b8dc3144bab7fbd8f170", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571205, "uuid": "2972483d-5893-4bde-b4d6-0202605edb90", "comment": "Malware payload (Mirai)", "value": "b0f402664fc546ae769ef133ed434ad87a7acb6d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571205, "uuid": "8b2bfda9-b330-4d83-adda-e4a902116868", "comment": "Malware payload (Mirai)", "value": "a5d86a71fe94cbffe033cb4f34becbda81d15bdd2d5c3c23fafe868e8f7a5a9263eb3b0628abb456057a8cc7578b465d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571205, "uuid": "20ca859f-9173-48f9-99a5-59e6f6a3cdeb", "value": "T17B33F132AE084D068871BC73E5B946A755FBC37EE01E59F5F6074CFDB940902E9A2543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571205, "uuid": "0f25fef6-467b-4c1f-8107-8f1b4e3c34e5", "value": "1536:FBd49Pl29hwd14wElc8y/T7bsL4LAN/fBZ/q2lk:YPlRdFd8yr74L4+JJq2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677571205, "uuid": "dc2f1412-4df0-47a1-8cd3-9b5d3cb72f65", "value": 51692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677571205, "uuid": "0510fd22-6a6d-4e27-944d-35feba84e892", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571205, "uuid": "5d348549-3f6a-45bf-a57c-9b77856ca321", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "357e2f88-b779-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677596673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596673, "uuid": "02ca087d-2f92-4a6e-b1a8-ffacb79ccc4a", "comment": "Malware payload (Formbook)", "value": "00e1ea33573aaf261127e027303cde3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596673, "uuid": "3567438d-7a60-4a25-9c56-ae0686b65b05", "comment": "Malware payload (Formbook)", "value": "e8bc95bd3989e65c252e733adab5c16d51b18c19bccdab299d914cf6df922826", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596673, "uuid": "61b9181b-dd15-49c3-a23b-de31e1ef4c23", "comment": "Malware payload (Formbook)", "value": "9c9cf899d55e8018fab80bb6a132504b328a138a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596673, "uuid": "1fe8b594-2552-401d-b500-bcc8f923ce38", "comment": "Malware payload (Formbook)", "value": "b1784d04891ddb832ad79e98116716c2edf765fae8980a5fdc57b956da4a0a930098c31bec720482ed1f441250812190", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596673, "uuid": "9de275a2-ad89-42a8-a72f-4f07f2fba817", "value": "T1A6659D8C337068BFE8CB4971085419DC5EB4B4DB6206F2175B273686AE8D9FBBA0D153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596673, "uuid": "d7a543b5-2588-43be-92aa-e87a0a3b426a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596673, "uuid": "52015902-23ed-4b13-ac46-aa85df015a94", "value": "24576:B94mJSD7qyefuCAwWK2FcnjNCBGcXkbvnrEW/+o9x/6qWhsQ7:wyS3qyefuUDGKekboK+W1BaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677596673, "uuid": "176c2b8d-ec97-42b1-84c3-2ad88b546b22", "value": 1422848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677596673, "uuid": "536e4be3-b741-4170-b4b8-f6dca3a42c8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596673, "uuid": "58e18bb7-d8ea-4bbe-814b-1b4934fdeca2", "value": "Banka odemesi havale bilgileri TL9985000080_28022023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe09416-b778-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677596583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596583, "uuid": "1bf61241-904c-44f2-aa82-ca992e942256", "comment": "Malware payload (AgentTesla)", "value": "daad5651e1e2ac397fd844744f9c306b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596583, "uuid": "6febf1c6-07c0-4c44-b163-813517d8640d", "comment": "Malware payload (AgentTesla)", "value": "e980e95e1a7d0e5c4eb933fe6cb8b33b0819b3b559aeb761cce8852247cc3947", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596583, "uuid": "743cf692-001f-4351-89b9-6b5b7a78c87c", "comment": "Malware payload (AgentTesla)", "value": "b934623f0a984e994f6e177af8b790251dae16fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596583, "uuid": "78115bee-137f-4cd7-9aa3-fc4a377becc1", "comment": "Malware payload (AgentTesla)", "value": "ef3cfdf0df813652160f54a427b5aa883a1183207a558339789103d8aca1ea13105db20c84f8b5ec05f9abf8d681c866", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596583, "uuid": "517cdbfc-95e2-498c-903c-1665230062ae", "value": "T1872533D2D40579C3A3C569FFB708803E6E96CC07AAA27636F9460DA0C69FF35641960F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596583, "uuid": "9e668f27-b2d0-4ab0-a46e-1f93b17d4f6f", "value": "24576:iLmhDNWHZV29yurGXeKjD/63rsmG3erHqsfTkZfRvHhcXx6SspwW:iLmhpq09yurGXeKX/671Gu7u2x6Sspf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677596583, "uuid": "6c48676e-892f-4892-9f5e-bfc27a762f8a", "value": 1023467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677596583, "uuid": "868eb673-8acf-42c2-897e-5a19e8a6463c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596583, "uuid": "ff002989-405d-488e-bd1a-f89037d3849f", "value": "SHIPMENT DOCUMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd10aa38-b740-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677572446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572446, "uuid": "f1267550-cdf6-41de-b096-e0846ab7bb78", "comment": "Malware payload (Loki)", "value": "017389c4e5de04e8edc690506b7f713f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572446, "uuid": "92bcadbf-bb6c-42fe-991a-b8273bc578b4", "comment": "Malware payload (Loki)", "value": "ea026f69a0ea34043c51c57546dd3b5817bf7631a82fffc5ad618cb5c155d306", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572446, "uuid": "bb0fac8c-6df4-419e-a38d-64f281598fb1", "comment": "Malware payload (Loki)", "value": "a783d883578fc7e74d1224fcfd330dd54445486a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572446, "uuid": "2f615e59-6d98-4cd2-8bfb-5ca4e22463fa", "comment": "Malware payload (Loki)", "value": "709226d99e5e9dc382277ffe330d55369367f2791b875458f662ff4e5732302744c81745a72c3c9f5f97dc29cc7e3d14", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572446, "uuid": "632b0577-fede-44c3-88c4-bd68d45b34f0", "value": "T12A05121EF696EC1BC853583CC4C8A0D6A22D7C698E45E64F35C4B74D4A74AE3436BB8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572446, "uuid": "84cd532a-2099-439e-8a7f-0ad2b1ad0be8", "value": "24576:FmVmbmY5GFexLwKhmQmLLWlj9NU94XdaM/Czl:vtmmLwTqvNS4oM/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572446, "uuid": "1c7466c3-84d6-47b7-9a40-695522781479", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572446, "uuid": "edcb30b5-4634-4fed-b346-9da25e0813fa", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572446, "uuid": "206e2ee3-127f-40f8-9d5c-786691a2a988", "value": "Bank Payment Slip.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93fd155-b773-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677594424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594424, "uuid": "b3565a17-b96a-4e9e-80d2-7cea56fbc2ce", "comment": "Malware payload", "value": "8f5f8ee04dfd775bd7b5d7b2b5a311e5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594424, "uuid": "7f11728d-acf0-4a4e-a884-33801c0d45f1", "comment": "Malware payload", "value": "eaa6755323aa979b19c116ab783b87e01cc62578145b6b6b148f080044dcc151", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594424, "uuid": "a8ca22d7-c509-4751-bc81-7b7552977a99", "comment": "Malware payload", "value": "a56b87869cfed8cef3d82eb33fc86e5cf43d28f9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677594424, "uuid": "0628b0d2-fe2e-43a8-99fc-d86f05e35b8e", "comment": "Malware payload", "value": "7b57508191c5b5e088b6f1c2de757e15c045864b4a0d78a0629257352bc5896923deadea22517d0cc28b5872025c1fe5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677594424, "uuid": "aed8d53b-abef-427a-9b11-d0721f810e39", "value": "T11842C1C686102955E9DF18B7D8B80912D0A79D91F3B83499CCF99D578E0D03CDC23B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677594424, "uuid": "92cb97bc-96c9-4826-b093-25d99bbcba3a", "value": "192:gyKa0euYZ4zvdJfsVtZIMHGmVkDDW0oLizgeg/SyTv0kQCxlPgG2VRX7GhValn4b:gyiWGzvL0VzIxikfWIEd/SWvUJG2b70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677594424, "uuid": "80244221-e9a0-4c8f-8e79-c22651991061", "value": 12534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677594424, "uuid": "45af1055-fac6-40b1-9035-ee2b195a6606", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677594424, "uuid": "1f51b0e0-43e9-4f15-9b07-2a084ebcbec7", "value": "9280248134.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa1c989-b70b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677549687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677549687, "uuid": "5dede32a-c420-463b-bb49-c29b15c330a5", "comment": "Malware payload (Amadey)", "value": "d6978870e0518d8b50b1805d1b09a4ee", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677549687, "uuid": "5959e43f-df6f-442c-b06f-714aa0d8107e", "comment": "Malware payload (Amadey)", "value": "eb2b9cdf39851fc1289f4c80f7cd46e1c79966212774d9f13f9f5ec7fcdce38a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677549687, "uuid": "8b73108a-d9e5-43e5-bcf4-756885af4c08", "comment": "Malware payload (Amadey)", "value": "de42789b77819d7ccd905dae03ef7fe65239c9cd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677549687, "uuid": "55895adf-640e-4037-801e-42791745814f", "comment": "Malware payload (Amadey)", "value": "f00030e198c017f2d503ed4983e410c69fb3ed581a0d2e86e831bec6da434633d89298feff13e01b47f96541d51ed60d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677549687, "uuid": "e53e3fe3-819d-4d50-acdf-2b1fe426657c", "value": "T14055234BA2D8D036DAB117301EF253D31D3EBE511A348797129AFC5A1CB79A0A23537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677549687, "uuid": "29d688c3-b750-413a-ad8d-d3b6ac766b3b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677549687, "uuid": "52f4dfbd-7c99-4a3c-b11a-2f82fa5309ed", "value": "24576:Vydz28ICLdaIBhwFpJizq29l0AHMixgJwIFYM8Lgs1DXgoH:wdi89dHgJizq29ltxgJbF/8UUXgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677549687, "uuid": "7ccb3734-9aed-4925-b6bd-4e5fa09fda0f", "value": 1362432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677549687, "uuid": "77cdef3e-625e-4c84-a856-b3f2c54cca78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677549687, "uuid": "6a9d2777-a3c8-4160-bbc8-66abf50a7df5", "value": "d6978870e0518d8b50b1805d1b09a4ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc9730d-b788-11ed-88f6-42010a9c006e", "comment": "Malware payload (AcidBox)", "timestamp": 1677603235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603235, "uuid": "39dd811e-4872-4a4f-be89-9dbbd65770c4", "comment": "Malware payload (AcidBox)", "value": "8e2a899d404d33e0789ee0fdbbb340af", "object_relation": "md5", "Tag": [ { "name": "AcidBox", "colour": "#A5DA54", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603235, "uuid": "349fe842-09a0-4481-88fa-22666f03f388", "comment": "Malware payload (AcidBox)", "value": "eb30a1822bd6f503f8151cb04bfd315a62fa67dbfe1f573e6fcfd74636ecedd5", "object_relation": "sha256", "Tag": [ { "name": "AcidBox", "colour": "#A5DA54", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603235, "uuid": "d0e30eae-7ba1-42e8-b378-16c523e201c9", "comment": "Malware payload (AcidBox)", "value": "aa1b4ff80863fdf388e9673d2d7eacb35dcccca2", "object_relation": "sha1", "Tag": [ { "name": "AcidBox", "colour": "#A5DA54", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677603235, "uuid": "18088026-5ddf-4a20-9026-cc9d777fcc59", "comment": "Malware payload (AcidBox)", "value": "36c7e46e8e1905b2eb8ef0c0063493e268e07506c91a91b3de1542a11d831cc6005d194592bb217163a43deb201f6eff", "object_relation": "sha3-384", "Tag": [ { "name": "AcidBox", "colour": "#A5DA54", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603235, "uuid": "c0c78cff-6d22-4cd5-bdf1-20131094b0d3", "value": "T14444D03AF7A410F9C9B6E170D6868737EAF2746B2320AB9793D08E652F12761371C345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603235, "uuid": "45fb52a4-1cec-4426-be7b-2113b1c88b2e", "value": "4c9ff1cc80347cae980bce6cb49d9c29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603235, "uuid": "fd5c9902-b3dc-4ddc-8b25-6ee891c76d0a", "value": "6144:GaTBq2y8jpBNMmjqR1rNins5qU7nYo/dnl7+nqI52jbHq82Trd:GaTA2y8jzv2HrEns5qUvVtUYjbK8AB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677603235, "uuid": "d7aa2f6a-dbbf-44b0-a973-ce408eefb54b", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677603235, "uuid": "0778e00d-1dbe-4a53-bde1-0d14607180b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677603235, "uuid": "d5c83893-6324-40d2-86f6-f32f532f6cbf", "value": "acidbox.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c8de260-b73f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677571828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571828, "uuid": "2904729f-2da2-4de2-b083-71b6705040ab", "comment": "Malware payload (SnakeKeylogger)", "value": "39f01c3d7e6991b3c32ad5b231f4a0bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571828, "uuid": "392da65d-898f-474a-bb71-9e98bf882032", "comment": "Malware payload (SnakeKeylogger)", "value": "ecbabefc35b4504815ec14b5efc94cd6e8df5d69b015505b4231814933fad14b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571828, "uuid": "df69a9c9-18ec-44b0-89dd-1d9e1ca37ff5", "comment": "Malware payload (SnakeKeylogger)", "value": "75da3dcf031792d34f5c210bad8ce9f5604fbe35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571828, "uuid": "a3edafac-e772-431c-a109-46f593558fa4", "comment": "Malware payload (SnakeKeylogger)", "value": "fbb4ce745e4396412c1193a20783a9b0fa5362e231f8dcf3a992a4e613d4be68a8495c6df35b25776b0256bb2e2e2b9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571828, "uuid": "2b1588b6-963c-4e3b-b538-9a136011fe3d", "value": "T1A735AE4893B34472FBEB11A11875228C4EB872CB3585F21B5F673751A522AFFB29F502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571828, "uuid": "97ebb3b8-8c1b-4bd4-ac3c-60c61ab3e36f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571828, "uuid": "f21b954b-391c-4f53-b9fe-ada06ff70071", "value": "24576:yogmeiKD7VBy1f4cf0WHemJlj2njlCA6/+o9x/6qW:FgmeiKDBYf4cf7HrXinxa+W1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677571828, "uuid": "a0c0c591-f892-4783-b11c-17537cbfa3d4", "value": 1156608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677571828, "uuid": "65b81bc2-00e6-4d7c-af33-62f6131ba50b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571828, "uuid": "69405fae-6fb1-49d0-b261-37e0ec2dc26a", "value": "39f01c3d7e6991b3c32ad5b231f4a0bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e65afb-b711-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1677552031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677552031, "uuid": "13709b06-da82-4c92-9549-bdf1d9a300be", "comment": "Malware payload (CoinMiner)", "value": "f28f84e2525601986c94ae1af10f8357", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677552031, "uuid": "c32393c0-e677-4c4b-b573-8d3d8bfd40eb", "comment": "Malware payload (CoinMiner)", "value": "ecd7d8b810f64cfb3f333d62cb01550e40dc7b0e6148a5fbbd020b4c5ad4519d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677552031, "uuid": "9e875826-bae9-43f0-97b0-8bc7ccaddcfa", "comment": "Malware payload (CoinMiner)", "value": "adcea7bbc5b1a2d31e58cbacc079f6b5ce2fe508", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677552031, "uuid": "a40507a4-d397-4c9f-bec5-d2c92661de1e", "comment": "Malware payload (CoinMiner)", "value": "49017c04c0644060839bb6e1607f1184e7914b14dea56ddb6527e8859f2204f9276557048e88acfab8b2875f2c9b8ce3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677552031, "uuid": "973c97c7-3510-4f50-97d9-6dd32853faff", "value": "T17C14BF827290AC31D4325A32DD25C2F42B6DFCA18A796AEB73183B2F0D76191D633743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677552031, "uuid": "4f53285f-eb74-4ca0-9dc4-3668e8fc623d", "value": "42540a9ca466c55bb4a1cb282423a3c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677552031, "uuid": "22ef0989-b7b5-4edf-afe6-e916764b20c3", "value": "3072:1o0X8eWY0hy2MbPPbbIFqBITMbY7cXoix6sVOI/6PBTp0zDj/AdeZ:a0sFnYbPjbIFyIQU7cXTBVZipoYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677552031, "uuid": "41ffa71a-e728-40a4-a49d-c962d41cb2ae", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677552031, "uuid": "b3fc5726-f8b7-4269-8777-dbcacd149e13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677552031, "uuid": "39576723-8493-42e1-aad7-d89c941de6e8", "value": "f28f84e2525601986c94ae1af10f8357.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6471b3c-b79c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677612029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677612029, "uuid": "15d947f8-cee8-4cfa-aaae-f564a3f5434b", "comment": "Malware payload (Formbook)", "value": "4a7aab8f4285b00870594319a36a7426", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677612029, "uuid": "90ff6715-7bb9-4993-ae4c-3644480e744e", "comment": "Malware payload (Formbook)", "value": "ee62bac96fdf6c8fa0bf931f53a9858584cbe77e814f3e0a08a9a0fcb1fe55f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677612029, "uuid": "c90870cb-712c-4484-a04b-efd681be84d0", "comment": "Malware payload (Formbook)", "value": "a4331309a71b9f87eab79e9596d62af931d3b026", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677612029, "uuid": "fd507080-d94b-4e5e-8e78-3fbc7dec7baa", "comment": "Malware payload (Formbook)", "value": "bee4e39a8d5be26c41f3e3aa935c0b8a69b49b8525dcb1f394674254233bfbbf4845384e4803a8b82d784224fab758a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677612029, "uuid": "0713e335-6deb-4a20-a5c1-2c7d8eaac259", "value": "T1A4559D5C63708C72E9DB01B2488522DC0EB4F5CB6516F36A5BA73742AE8A7FFB54D102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677612029, "uuid": "279468fc-ae7b-4498-8235-40f5e8636123", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677612029, "uuid": "86cee3a3-1b74-4bb8-8a5e-7ce349dd9463", "value": "24576:qlpUJKD7SzYPJ+Z2LGNvd9pFwPRwb+35fDiyBHbuGxbCA6/+otqJ7:ZK3SzYxC2LGBYZwypLicSGha+35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677612029, "uuid": "b338db10-1770-4376-bad5-8bbe4878c065", "value": 1319936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677612029, "uuid": "7b35301e-789e-4e82-abd4-5e5817e84a26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677612029, "uuid": "ea5c62a0-ee86-42aa-858d-a9e8fe65cc1d", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18099e72-b740-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677572142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572142, "uuid": "8050c81d-5cd0-427e-949b-7df38efe5a0c", "comment": "Malware payload (Smoke Loader)", "value": "dcedede13bbd63a9854884ad11acb89c", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572142, "uuid": "07217ae5-bd74-40c4-a285-d07a780d6151", "comment": "Malware payload (Smoke Loader)", "value": "ef0384f195f7550887ab50c82f606b259a6722de97053138db67896da26d93d8", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572142, "uuid": "a7c58249-81fc-4ba5-ab94-81121a37012a", "comment": "Malware payload (Smoke Loader)", "value": "d1d5bb5f07fafa3fb9c367ee8329ede82a960da0", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572142, "uuid": "7aa42055-555b-4380-9dae-c7a040f1c69c", "comment": "Malware payload (Smoke Loader)", "value": "a77807cd9ba70d2a788bc95d5a1b0db3b1dff45a35ef2a28fb7c27492aed0cb48bc10b8a8fda42237312ecdd4c25e915", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572142, "uuid": "23f7e1d6-1edb-49d4-8034-80385a136960", "value": "T13A14AF82FB90AC31D5760A31DD29C6B46B2EBC514AB956DB73143B2F0E741A18673B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572142, "uuid": "0dc3ff94-d87c-4e33-b304-77cecfd3aa47", "value": "42540a9ca466c55bb4a1cb282423a3c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572142, "uuid": "ee25d5e9-d04b-4c8b-9507-10142f711e77", "value": "3072:iu0X+x4mfhAeivUMXcUrSiNTP/5xjdvtZMd0xR144CiWZ:l0uqK8U8rSi9P/DjdvtZMd0r1/Ci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572142, "uuid": "598c0461-d8f7-468f-890d-982ba8366aeb", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572142, "uuid": "9b88c04c-f249-4c80-8ce0-57575b94ca47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572142, "uuid": "ca00a9b9-01cd-45da-92bd-1858f8e702e4", "value": "dcedede13bbd63a9854884ad11acb89c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f352d76c-b764-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677587972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587972, "uuid": "2443314b-840c-45b4-aff0-27fe887c8085", "comment": "Malware payload (AgentTesla)", "value": "a88a66904edd6b77b2c48ebb505fca04", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587972, "uuid": "57d80a50-6534-4510-9631-760d35775e13", "comment": "Malware payload (AgentTesla)", "value": "efd8079e25294fc84c6a0d6cb29cb0e619dae02a7e0b720de9cc7213a4b90b42", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587972, "uuid": "be53ede5-81cd-4d4f-a87a-c1e1c45b586b", "comment": "Malware payload (AgentTesla)", "value": "8dce07bf0d5f09f8e241a4f9ed3c301ef0e7aba1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587972, "uuid": "e2b6de22-9d78-48bc-97e0-867b50b67d80", "comment": "Malware payload (AgentTesla)", "value": "28fa64e91318e06656bd67183613582f35a1ea507d4f0b2e5591816a2772d525a88a03c4162f393858782dc4ec69a93c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587972, "uuid": "bcf6e7a8-9847-454e-a7ef-8ebe3f469a89", "value": "T13A64238635EEB777109871130F78641FA743A294FE46DAB5CC164D0F60BAE36BE48362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587972, "uuid": "8f861ae9-aa9c-4113-8a1f-4547ae35f3e5", "value": "6144:/cqfGLCx/WZOnxmTq13zwIbYzsKO+QiJPiMIyiuRvKNVKtwZ:/cql/+km+FwIbYgKeYnientW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677587972, "uuid": "80de7719-66b5-4dee-afd3-70ac7f23576b", "value": 309530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677587972, "uuid": "1392c047-a4e9-41cf-9d43-d3aa2c219aab", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587972, "uuid": "6fb90030-9162-469c-926b-755e1d6bed92", "value": "Shipping_notification28022023.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6c38ff-b754-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677580738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677580738, "uuid": "f011b93f-c250-43af-b100-3a2202f2ad8a", "comment": "Malware payload (Mirai)", "value": "b638a59007abad75fe7e3af7d222bc90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677580738, "uuid": "b2f6ff9a-ebbf-4e24-8599-384af043360a", "comment": "Malware payload (Mirai)", "value": "f0ca3bfa11bed56cc063527f4e4b72cc34993093f3079d1d3cf4017b280812ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677580738, "uuid": "ddcdc554-10d3-41c2-ada6-1ef369cb05eb", "comment": "Malware payload (Mirai)", "value": "44f9287b14586675fc075efeb15c05d1c97bbda9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677580738, "uuid": "f036eb53-d57d-4d22-966d-8c1f3e065f1d", "comment": "Malware payload (Mirai)", "value": "4fa75a8698ba5339fd3cadd55a435376daa6883ee5f9fcfb362316bd3d7f9fa763ae86d889345cb236da10ea9305e1e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677580738, "uuid": "2f9108d3-3e83-4be1-8d39-74dee7732a73", "value": "T1835361CA9E613FBEF3D9EBB8DAB3D61055E6129153E18184E0DCCD414A2D7C9A81E31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677580738, "uuid": "da543a71-cdb1-416e-9827-b5c9edd5db46", "value": "768:iGgRmSEKsx3js05TSFsVxovG/WoEovFLeql40MF/4kvZDEMIE/Et1+2U8ly87RS6:erEKSVP/17lWvvvOxJjqCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677580738, "uuid": "b7aa532c-184b-4946-b057-b210c58a0da9", "value": 63230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677580738, "uuid": "ff1088e5-70e9-4ac1-8f78-edd1d0020924", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677580738, "uuid": "fda38bd5-4fb6-4e2a-a24c-de25e1f41769", "value": "b638a59007abad75fe7e3af7d222bc90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35755f3f-b6fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677543415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543415, "uuid": "b7205523-d96e-488b-b7a7-d8c0d0f75f98", "comment": "Malware payload (Mirai)", "value": "7d176781b6f032d053016bf2a2397a41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543415, "uuid": "587799c9-8118-46e6-b11e-1a5dc987a1f9", "comment": "Malware payload (Mirai)", "value": "f2f3fc959a957283e8bfbe6b33491ddd06a2539b0ba927708bb004dff6a6db85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543415, "uuid": "e1065d60-4a05-49fd-b5a3-6ff8c37125b7", "comment": "Malware payload (Mirai)", "value": "e88e457cf909b975a04f8d9b123b6f6c4693ceae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677543415, "uuid": "185ba992-1332-4b9b-a928-b7c8e1a4b779", "comment": "Malware payload (Mirai)", "value": "9b9724b4b30956bf6289de19ba2376f73925c2854e606704c874e43fec67a71f5319b65e61c8a40915f040362ed9c7ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543415, "uuid": "77b8f9e7-2bca-47a3-aa49-e8c9155d5e27", "value": "T1DC337CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543415, "uuid": "d488e0bb-9db1-4960-bf96-a258f60e2382", "value": "768:jaixFwtLSYAagMo0ebfEL9v0X3pyWfs3I9ICJUU/qMCqKomQRCvU:jaQFwtOGNv0XJfs3kICJt/qMF/RCvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677543415, "uuid": "d7c7f020-6005-4bfc-92b9-8c063d3399d5", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677543415, "uuid": "9379987f-f184-4416-bcf2-a55ae078e793", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677543415, "uuid": "77b2710d-0d55-4e43-98b1-6199fa7d8c64", "value": "7d176781b6f032d053016bf2a2397a41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3135de-b762-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677587130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587130, "uuid": "d378330c-adb5-4ae1-b119-79cdf39b779a", "comment": "Malware payload (AgentTesla)", "value": "1ac4e7173df35795797d89d7e84ceb66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587130, "uuid": "dfb7e90d-1b8d-42b2-bd60-9343b1bc3a5a", "comment": "Malware payload (AgentTesla)", "value": "f38eaec9d780ac2c6167aa0a069b150010e1be1c889495873e8ff724054a36f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587130, "uuid": "d77ea1f8-4ed0-4cec-bd16-00a9ce2c51e5", "comment": "Malware payload (AgentTesla)", "value": "bb2dd0366fcf8e97234e61a53fc18a581b4fd6ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587130, "uuid": "b8260b79-843c-4323-a821-3a319cfdc856", "comment": "Malware payload (AgentTesla)", "value": "c0d8325a62cc9fd9482d67fdb43670d5f2900f005821f88af9938da36f68778641b58042f57bfdaa665deca6bfcff18b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587130, "uuid": "1061db5c-5b20-404f-a2a0-143989c1e8eb", "value": "T1AA15339EDC88D2787EBFA12356F31877E8F1A891C1E802B39D547E913386715813E136", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587130, "uuid": "e2bb34b6-11b2-45c6-88d2-2ec549f3dd42", "value": "24576:hUeLSBizMQ79mv4CxFH2/ht0McVC17YOXeZ0aLJu9+falirv:lLSQzM29mRpg0M8CNeZ0+yli7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677587130, "uuid": "66328932-12bc-4ee6-9ecc-652cb819a84c", "value": 944751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677587130, "uuid": "30098220-7c06-4d68-a07e-f4e056ff7bc0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587130, "uuid": "4af5f7e0-1d08-4882-a7c4-582bd9edfc00", "value": "PO#JB2210-0005.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb73ca4-b7bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677625221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677625221, "uuid": "4167c20a-a014-458d-b9ef-32c6c4717167", "comment": "Malware payload (DCRat)", "value": "d2eb997e7cb0d999320d7aa4166775b9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677625221, "uuid": "0e1e5de8-fee0-499f-9eec-2e140e9ea4c8", "comment": "Malware payload (DCRat)", "value": "f3b95f3a8b5241a2adfd82baae1ae4b98967149bdf95a57d770039f3a295a515", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677625221, "uuid": "df3e7b06-0123-4138-9819-30f134138271", "comment": "Malware payload (DCRat)", "value": "e94f3aedc6f6fcdea64f018e35472383ee339f11", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677625221, "uuid": "3afbb4c9-c851-4683-ae1c-f0f65c9cec7f", "comment": "Malware payload (DCRat)", "value": "8fee986131aa62e87d9871ba90d2b6b9d50d4148882002469e5f1694efcabc736f5e55facc671f4df4fb98875ece0a8b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677625221, "uuid": "4db2681e-f243-4ac3-8eb3-a63e104860a2", "value": "T1C1454A017E44CE11F0191633C2FF498857B4AC512AA6E71B7EB9376E95223A37C1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677625221, "uuid": "2b0621b0-e7b3-43aa-b61d-bbc03e34f873", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677625221, "uuid": "5505a837-e9b4-4be9-98f3-fa93d783557a", "value": "24576:u2G/nvxW3WieCw34snZkaRvUaQ0WkXZSlPESys:ubA3jw3NnZkwveOANR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677625221, "uuid": "903cccde-a034-4229-9850-062cb2c3e774", "value": 1165460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677625221, "uuid": "d3e9f5a0-ca75-48dd-bdef-20f7f381b9ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677625221, "uuid": "da630d41-38a0-40aa-b7d7-e672bb1a2b79", "value": "d2eb997e7cb0d999320d7aa4166775b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5e94c5-b741-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1677572656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572656, "uuid": "c66d78b3-6a10-4a2a-97eb-ce59a8fbf050", "comment": "Malware payload (Fabookie)", "value": "4f4b4c9d7e54d7c8618104b4b6b01c45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572656, "uuid": "4598c368-44ab-4d82-8b92-672db6d05bd7", "comment": "Malware payload (Fabookie)", "value": "f475036583912df6509241b5ae205801e521ef08f8cf16a9af207cfbcc9470cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572656, "uuid": "9a88e49e-fc15-469f-a424-9e1fe7e93ccd", "comment": "Malware payload (Fabookie)", "value": "6a8b99f41c4191b196314167583943d78a073fbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572656, "uuid": "a9dd65ca-b0c0-411a-99aa-a95fc92931d0", "comment": "Malware payload (Fabookie)", "value": "f9db0c0b19e5a206d583578535110723cb40c838b26aebce1b44073a6831ffba1750da776fcea0332f6ee9720bd00a3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572656, "uuid": "3d8d20e7-465c-4644-9553-93723ff8a624", "value": "T140F502BD9288379CC42EC9305127EC4976B6162F4EF986FBB1DB36C17B97500AA02F45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572656, "uuid": "e10f469e-4d6c-49a3-b97e-f45ada98ec35", "value": "ac639288a9537d81bbe3cfbc1135d815", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572656, "uuid": "acd20922-eafc-4857-9148-e13e66da2937", "value": "49152:Qvn2LvYIMs5nzr7MRAXoytWHANSZRMuiwjfNm/+lc3MttQ6sSb4LPSuvraqUbguF:wnDIPnFXo/LfN9lw2g5Ut3y4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572656, "uuid": "810f5fe0-0c4c-499c-9e3c-36efa9d51f5a", "value": 3645952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572656, "uuid": "5cd57fa1-d4b1-4d5d-a210-fc7863b82d93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572656, "uuid": "15755bcb-a94f-4dd5-9a45-13b52445991f", "value": "4f4b4c9d7e54d7c8618104b4b6b01c45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a25f417-b741-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677572629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572629, "uuid": "e0b34a24-711a-4655-abb0-6ceda22b8f52", "comment": "Malware payload (SnakeKeylogger)", "value": "381af18f36024bf25d7586dd6ff6cb4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572629, "uuid": "0263a1d1-01bf-4845-9f6a-d1d79c2d6969", "comment": "Malware payload (SnakeKeylogger)", "value": "f4cd4df9815a2c3902f07a5389fa171f3fd6b27ae1e9af262d19d6bd286ae9cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572629, "uuid": "a6c0eb7a-65c1-4950-9b2e-f240c7a66589", "comment": "Malware payload (SnakeKeylogger)", "value": "43f8e8b22a75f8e307c0437b71b7815f00a74b64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677572629, "uuid": "cbb62916-2c18-44b2-9f1e-3e34220cceec", "comment": "Malware payload (SnakeKeylogger)", "value": "a1d3682bcb30679521a0b60fcf3e4cb66c676e9385d163d4d73d329c347b745df61ba7d4d117a0a81c31e3f219eb0144", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572629, "uuid": "b8c8ff3f-6c4a-4103-ba75-95eede9c04b4", "value": "T1E5A40891B1555883F82771F1AC5FDA20210D6FDE522DC71E3253BB1A9AE335620ABF0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572629, "uuid": "5b8db731-2280-4e10-b36f-fe871fbff099", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572629, "uuid": "4c9425ef-968f-4128-9f6c-367a60b3ace5", "value": "6144:oYa6SvmeB6N7e9tzGDNbly5yrfpr1nCyAfhiwTaVRB38++6JhbC6M4lRq:oY4Dqxbly5yrxBnTe8ZRBM+lJEufq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677572629, "uuid": "3253b2e2-8151-4a35-9467-cc91d97df526", "value": 456165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677572629, "uuid": "90e4e75d-3bad-4769-bb98-37d89913499f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677572629, "uuid": "0fe3bfce-f3b7-4312-a298-ccee25a48761", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6d18fe-b73d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677571207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571207, "uuid": "6bc3d97f-bedd-4b7d-84f5-e127f5bda3d6", "comment": "Malware payload (Mirai)", "value": "b3b0bfac2bc0928979b793ace092776b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571207, "uuid": "24b3703e-8f4e-46a6-a5d3-97d0df989fbd", "comment": "Malware payload (Mirai)", "value": "f5cb9c3f1629b2a62a9c58692bc28023a5931e9c8b204b1d99abae310ac8710b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571207, "uuid": "f2c319c9-245c-4a3f-9fd6-fd049848f401", "comment": "Malware payload (Mirai)", "value": "2c0ebd6957b7cd82b82a28e94f05cd6420181171", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677571207, "uuid": "c02062a7-1db4-412d-804c-19491f7e6cfe", "comment": "Malware payload (Mirai)", "value": "83d7740b9a50c2283e509ada73ef27df7bc990acac24f4e487dfeed4436702bc7dd869286040de16360992348bc7ecdf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571207, "uuid": "d049281d-fd74-4208-a1a2-69fd8f8e9d7d", "value": "T155C2E076506D9450CD7E403B042FBF8D5C31B8A5E28492F5EC9A26BEE0C4DB13E382A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571207, "uuid": "59418f55-913a-4af3-85bc-1e853e7457d7", "value": "768:DC/su/qOJvAnCopibTd8a9lrInbcuyD7UHQRjZ:DC/suBvAnCopMTC0lknouy8Hy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677571207, "uuid": "9f693516-430a-457d-b5a1-5a7e9ba6cc8b", "value": 27948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677571207, "uuid": "97ff04e6-aecb-4a53-97de-17165552dbf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677571207, "uuid": "3dc32e9c-3be7-4d74-a41e-a160c17cdea1", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e01c55-b779-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677596591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596591, "uuid": "d2846403-9700-4545-9c9b-c54ed67756e0", "comment": "Malware payload (AgentTesla)", "value": "c2dd8ea121dbfe0ecc36f7008419b135", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596591, "uuid": "04152db6-5643-44ff-b5c1-b0bedb0dc8a3", "comment": "Malware payload (AgentTesla)", "value": "f5f4515d071a9ef0fcaf8e3bb1d9f7f473f48082dfa5c25f63edb1be22e7a8ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596591, "uuid": "9ecc4f5d-2d5c-417a-98e3-4f5b1d58daba", "comment": "Malware payload (AgentTesla)", "value": "7f0a951b3fd1fb07e6873d0248f7ffb785e5a587", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677596591, "uuid": "71ebcc0b-7b2f-4502-8775-0dfa8945baa1", "comment": "Malware payload (AgentTesla)", "value": "72b208cd747b0b988463b2d0f4f89f3650602fb45fd89249bcb5c27840ee0c4290f6cc001de84936d5a95f9024af285c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596591, "uuid": "94e1662d-8583-4e0e-90eb-f6d14059df5d", "value": "T17A559D4C63709C73EADB01B2448512DC0EB4F5CB6516F25A5BA73B429A8ABFFB54E103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596591, "uuid": "c8dda685-d160-4c0a-b339-4c24724339b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596591, "uuid": "109adfba-4cde-4fe3-aecb-94e2fedab283", "value": "24576:f+D7SzYPJdzGTIKrD/E3nsQG3yrHqqfTkvbVvt7gXLePB8xbCA6/+otqC7:W3SzYxdzGTIKf/EXdGyji6LePB8ha+3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677596591, "uuid": "1ba25463-71fb-415b-b322-12c2fc6392db", "value": 1298944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677596591, "uuid": "3594f3a7-7389-46a3-a517-082c39b59b3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677596591, "uuid": "706a709c-425e-45d1-be8a-106e17f664e1", "value": "SHIPMENT DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1d518c-b782-11ed-88f6-42010a9c006e", "comment": "Malware payload (jRAT)", "timestamp": 1677600608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600608, "uuid": "ab9f751c-e8c7-4d15-a085-31fa47884b81", "comment": "Malware payload (jRAT)", "value": "fe956ee9174ff6dc7d80ba0537994f19", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600608, "uuid": "f219d902-43cc-46b2-b569-43bdbf30f6c5", "comment": "Malware payload (jRAT)", "value": "f85d507c5b1e993da532a1f23d83153db39b3f2b681417ee06cd180617afe01b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600608, "uuid": "9af4529c-5b8e-4ba2-bec4-1e28ace09d4f", "comment": "Malware payload (jRAT)", "value": "2048408c74f3df3e313f04037dbfa9add09bde51", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600608, "uuid": "2bd6aedb-f185-4096-b10c-3a4d66d3051b", "comment": "Malware payload (jRAT)", "value": "a21c447d713e4f09056ae3398207c18e36a0ff27699bdff9c77316f40d46a891f410a7f4356f56a2123604fbeb1e7a7a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600608, "uuid": "2da9ff08-f682-4b4c-bd68-009928108613", "value": "T14E04BF2EFD94E83BE7AB4030CB91C412785C468DD392976F25A41399AA71D894F03FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600608, "uuid": "4c2434cb-ffc1-4c21-89d5-f66f1919841c", "value": "3072:X9fQi09XVV8E00D/qQ4SLDBkZnjmzBUcTCD16AQYfUtoOJAqqhGxZo:x96XVGEVqLSB8i9UYCD1nTfKSh2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677600608, "uuid": "bdf65f81-3483-4b5e-86f1-8a34c7a8162b", "value": 176865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677600608, "uuid": "a50b0e0a-abbd-4b33-aa4f-67d6d355cc28", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600608, "uuid": "3c18bf36-b967-4330-99b9-b41985479fa4", "value": "Request for quote.pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50a76d1-b701-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677545321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677545321, "uuid": "fae2132d-8e75-424e-8eac-78b664f6eb53", "comment": "Malware payload (Smoke Loader)", "value": "9ac7ffa251800cc332434f24cd533b44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677545321, "uuid": "101390da-7a03-4b04-b08e-f3960ef5d59c", "comment": "Malware payload (Smoke Loader)", "value": "f85f087cd4c5e653e539f5431e00200bada72e73099aa996b5477d1dec2d6cd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677545321, "uuid": "837c505b-497e-4789-b38e-70caec826771", "comment": "Malware payload (Smoke Loader)", "value": "09df17f48a6051b0e4cb9e30ed99dbe06e35d767", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677545321, "uuid": "2842343a-2b0c-4555-ab0a-ed543e83deb7", "comment": "Malware payload (Smoke Loader)", "value": "84e484c90a5ced069d5bbd6d60bc4f8a38173b6e4ce4774c142e1d38e918204485f82915fadd19a636377fe01a96f044", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677545321, "uuid": "1973e363-0ab2-4186-be55-14944590744c", "value": "T15294239F1150C4A7EFBA4C7117BA8557AAE0F2E20C62604B67207ED8BD41BE5CD0E727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677545321, "uuid": "cb8e4790-a6a7-4287-9509-c62d3bd44cbf", "value": "7c2c71dfce9a27650634dc8b1ca03bf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677545321, "uuid": "084e2336-187d-429c-97d0-3c436985ae0c", "value": "12288:wFvn9iYgBpri2ZaRDBlW9tRWWm0mHqvGrE84dvaigD:O9Dsr1ZeDCpmVHOGrE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677545321, "uuid": "1f215684-a410-4713-be2a-146d237c641d", "value": 413664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677545321, "uuid": "a8ba56bb-4156-4ca0-ba2b-90abaf7bc462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677545321, "uuid": "525126aa-ecf8-447f-9855-f946e866d5f5", "value": "BVP0189638.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9428e36-b734-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677567259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677567259, "uuid": "7988d0c3-bb9c-407d-8201-c18c1fd55001", "comment": "Malware payload (Smoke Loader)", "value": "34964b779efd59e2ebe52d417b4c109f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677567259, "uuid": "7aa7b754-80f5-42cf-935f-3b4d66f524b1", "comment": "Malware payload (Smoke Loader)", "value": "f90430acede96f3eaaafbb6b0e56b758e5fc2c3db41a674956bc15e80dce0426", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677567259, "uuid": "c044c37d-c2eb-45a9-8530-70b74e7f66d5", "comment": "Malware payload (Smoke Loader)", "value": "f5ee81d61b2d7d8be3e33d36212ec6ec5903d0fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677567259, "uuid": "d14f01c8-0d0b-4a02-9333-e8e9b8a93d7b", "comment": "Malware payload (Smoke Loader)", "value": "a14b06ecba840361232ca5d603700e34ea6d1b20d20f43d9996c5e3c0777a67d10f1dafbb929471e4b3b3684b822b871", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677567259, "uuid": "7e7e0df7-2e51-46bf-9a8f-5a7920248b4f", "value": "T1DE54D0D17980C431C81605B7DC25DFE92A7ABCB28A58C99B33183BAF2E702E15B77355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677567259, "uuid": "31b905a5-f9b6-4bb0-90b6-76b23ddd52f4", "value": "f192690a5206debc62d28b9f6b6694b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677567259, "uuid": "0edf2fc7-3ca2-48fc-8b17-8a00ce094fc1", "value": "3072:gByfULqsV8Fj9LvAtHj6JQEAr/04jHsdUkJpHEiWKdIuqIA2/WkC:qJLaFxqHj6RUeq/GIZn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677567259, "uuid": "348006e0-8b94-4d69-ac03-23865902490f", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677567259, "uuid": "e2173325-a2dc-49e9-9acd-4545ebbb8eea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677567259, "uuid": "ccedaf0d-fd4a-4f5f-9d5e-2ec995c8d03c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76afc1c3-b7af-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677619975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677619975, "uuid": "f75365ae-4f07-41f3-80fc-0ae3755d0650", "comment": "Malware payload", "value": "4d93662383a5a4ede5adaa924360b7fc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677619975, "uuid": "40f485c3-baf5-4d5e-a4b2-0bb01d49894e", "comment": "Malware payload", "value": "f94cfe3d53b9bfe642318f051d195ab1e443a97301d17e143eb3e19e2744959d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677619975, "uuid": "95d4b063-caed-48c9-b741-d9b3cdd4d37d", "comment": "Malware payload", "value": "2156d10195ad7402fba5821886abb12b2f326203", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677619975, "uuid": "1854e872-f01c-4324-878e-7842e47fb899", "comment": "Malware payload", "value": "b1b4060958d6a79d747eeed0b2e04a301ef5a4f67cfbf0f113b1a7e61a2731637bfae7d69454f652cd849061c7c1976e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677619975, "uuid": "59b94f87-fab4-41b4-a14a-121ba7557d7b", "value": "T1D9742326ED43F0A4E0B2B9FECD769238DC99CB47256C5DAC440FE6E14B86505262CDD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677619975, "uuid": "b6bfada0-018c-4f0f-b67e-7d50268257df", "value": "6144:V8Cyjf3ktT/T0+RN718HFRdHnwlUhsm6uxPTUqhHB4NhpwqQ3P:OJj8A+RB18HFg6hp6u9TD2vQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677619975, "uuid": "fcbc7a3e-bc19-4619-abc9-329210d51007", "value": 359807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677619975, "uuid": "7a0b6ff7-ad4c-4b52-9c32-1248a5255d5e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677619975, "uuid": "6743a3a5-d17b-41cf-a23e-cb52697785cf", "value": "Document authorization.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33106887-b745-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677574335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574335, "uuid": "a87ae1a6-47c8-442d-833e-d643fa585aa1", "comment": "Malware payload (SnakeKeylogger)", "value": "b681b0e0e7deaeed98637f9febc60474", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574335, "uuid": "4f01aaea-894c-45f1-9348-fcb74e57b0df", "comment": "Malware payload (SnakeKeylogger)", "value": "faad2c66c89bdb9f36653c0068f3fe34c03e88b7ea0cdadbc5f14005612e409b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574335, "uuid": "9c42a96e-bb56-4b9a-a2bc-b2ae626d5839", "comment": "Malware payload (SnakeKeylogger)", "value": "93ef046a134d25b668e5c23ac0af76c4ed39c9f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574335, "uuid": "aae62a0a-fc9b-404f-8c51-28260325806a", "comment": "Malware payload (SnakeKeylogger)", "value": "7a8a5856cefb46b96bde5f7aab4a6e092567ec401e7ec01c185b819a2224a0bf3148c8ee270bdefe1a0ca729be648988", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574335, "uuid": "f03ee405-181d-421d-8c68-ff411b602546", "value": "T152256B8076F9D211EDCF3269091C558E7E79A107A152F22ADB7736C2630BBF776C8482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574335, "uuid": "78d45923-39d3-4e1c-9a61-b33a2b10f82b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574335, "uuid": "dec3fc7a-e0ff-4d11-998e-a0f432d2fb5e", "value": "24576:BgFy+jFy+4AvS5SYulZ6Yjg+jbsj/5rib1yisndTA:CFrjFr494eYjPjyxr2LsnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677574335, "uuid": "c6d7a910-9d47-4746-b4b9-60ce77019553", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677574335, "uuid": "52120231-cf1c-4950-8f67-b89a16ddb6cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574335, "uuid": "7e8525b7-2a63-4942-8556-df0d1a3dcc05", "value": "b681b0e0e7deaeed98637f9febc60474.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698a4e6f-b772-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677593754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593754, "uuid": "2fcb3da6-f608-40a8-8372-d8786884bdba", "comment": "Malware payload (Smoke Loader)", "value": "c6475ff89e948c828d044d826e2ca793", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593754, "uuid": "281d69a4-c674-4649-94f8-fba9dc06a75c", "comment": "Malware payload (Smoke Loader)", "value": "fad5f630fa566477e695b43504052a4226e292104ff88c3527a1a1e857d6dd47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593754, "uuid": "a97f29cc-a7a0-4b38-8cbc-b6012f87346c", "comment": "Malware payload (Smoke Loader)", "value": "00f74562bf8f425a074e66017f810f454f8da019", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677593754, "uuid": "26cf8a4e-a493-4eb4-9395-c7e2d2c8a65a", "comment": "Malware payload (Smoke Loader)", "value": "503782e569137979cc6faffc7f3f8f43dc7d9bb0f5e09ce7fda862f8f6e5d3c31f4af4ca4282536a42992da39b523904", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593754, "uuid": "bd627da8-70dc-46b6-a34d-51afd7fd67e4", "value": "T145462223D30214C6CCE184758C2B7FD473F6C6268591DB7B11A6F8C93D7F4AAAD22866", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593754, "uuid": "280d1c05-0862-41be-88cd-52614440cedf", "value": "f540b6d6dcfc33b21d0deb0ccba24751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593754, "uuid": "4ae0d9a3-fdc6-441c-b025-d3381f78ba72", "value": "98304:IMhEqYnPhrisRYrS80aavRIvEphFooqIUTIzMgB8PWFnVLuaiypdnStB50iOS/:p/URi50PhjRKMDWOFVitBiU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677593754, "uuid": "6c6508a6-a92b-4a60-9420-4d3cc2775140", "value": 5719040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677593754, "uuid": "b35ee638-1918-46fd-8ec1-017c57fa6c07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677593754, "uuid": "991dea08-c492-4a36-9459-84e93763a156", "value": "c6475ff89e948c828d044d826e2ca793.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700b7e4f-b726-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677561123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677561123, "uuid": "4fc2bfca-b52a-46ab-96cc-732b2e49ac1d", "comment": "Malware payload (RedLineStealer)", "value": "1893f4bf7cf36708d972c7b7e705b774", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677561123, "uuid": "b7ab2fc9-2517-414f-92c2-530b0603e9f2", "comment": "Malware payload (RedLineStealer)", "value": "fae6162b4e70c2dfda2bc89d93f1eff42cefcc0b5222959413dee0dd0d7d830f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677561123, "uuid": "4ef74364-aa2d-4e29-a607-71cd2f268ecb", "comment": "Malware payload (RedLineStealer)", "value": "ec1d27c8d1ae364622e4d145b7ada72f527f5dec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677561123, "uuid": "a2a65e40-b508-4fb4-a0b5-25bdf5922f6e", "comment": "Malware payload (RedLineStealer)", "value": "e7b6bdeef20ee89a74440c6ea1599cc1894cf43ab74c56d3f689f497e2a1972ae7068272f855b4fb54171bd6fc0817c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677561123, "uuid": "a8458293-f857-489b-bbde-1a0076f9b6ed", "value": "T11954D0117581D072C84A36709823C6FC5DBABCB2CA95F99B33193BAF2D302D25BB6355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677561123, "uuid": "6670bf9b-a1e1-47f1-9536-9b895f3e9dba", "value": "1e96cb5984683b7e47e14770412e3c53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677561123, "uuid": "faa2e30d-2526-4d78-86da-c21e7c7870b5", "value": "3072:38emsLHsJ42K/ZEmZ/+Wz+TinJX+3jglwW32XYuOtGVJwIIjQ69HE5uh/XKE:sFsLZ2qx+u5XAjIGYdG8S61EEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677561123, "uuid": "6f1c1b55-0110-4f19-bda4-431035c1e597", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677561123, "uuid": "688a3585-0294-477c-921e-b7d92539d764", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677561123, "uuid": "c76abf0b-c6e7-4ee6-8d9c-de9f7f037a8f", "value": "1893f4bf7cf36708d972c7b7e705b774.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f30f2d-b77b-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677597672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677597672, "uuid": "e21944d2-7ecb-4898-a672-bba64b7e9f7a", "comment": "Malware payload (DCRat)", "value": "c7f303a15d03033cb865eb4252506b74", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677597672, "uuid": "fd41b4c6-2879-4058-aecd-09d43f1e94e0", "comment": "Malware payload (DCRat)", "value": "fb67dd5d2f6d635c25ea0eb8cfa2128986814c00235c231901b848f96c880267", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677597672, "uuid": "c21328b2-60c1-42a3-9fe2-07e02db34d81", "comment": "Malware payload (DCRat)", "value": "c6bc2f0047e12175939e570b2944c455d6a29eed", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677597672, "uuid": "a633b75f-a59c-4851-bc5a-6451fb5318a8", "comment": "Malware payload (DCRat)", "value": "901ee22e888d3e02c57bd7d509b0ee992728e7efe65241118ac5663cb5f7ac3dc19f88e19f205b6fdaf3a00fc59ca4ad", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677597672, "uuid": "88a78100-eaac-4830-b6b7-3ca62386df93", "value": "T16C05F7017E44CE12F0091633C2EF498857B4AD516AA6E32B7DBA377E95123A77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677597672, "uuid": "7a445547-e27e-4825-b39c-0d08d5dcb430", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677597672, "uuid": "74bde944-c0c9-45ea-82d6-97eb799636e4", "value": "12288:ERS34snZkBIRvUaQPjyzWkkEZog+ldxEgNy:T34snZkaRvUaQ0WkXZSlPESy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677597672, "uuid": "f6fb4829-efde-4c12-8f66-f178e6f098c2", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677597672, "uuid": "01d87285-e64a-42cf-8881-9ce1719f82d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677597672, "uuid": "bbaa73f1-28c8-4787-8846-4414e578b587", "value": "c7f303a15d03033cb865eb4252506b74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e149fda-b739-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677569307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569307, "uuid": "a1226fd8-b9b3-4504-8513-236a7bca77c4", "comment": "Malware payload (SnakeKeylogger)", "value": "81751cb451693acf22a24f5fc68bc2c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569307, "uuid": "93df11b4-88ac-4cdb-9f82-fb61e5b3fb62", "comment": "Malware payload (SnakeKeylogger)", "value": "fcb1853719821211d0a89b9e70cbf499eceab8d2138116b14553c61a74aae6d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569307, "uuid": "e8f7c3b7-f8de-49c7-a6ee-a570f3be0fe1", "comment": "Malware payload (SnakeKeylogger)", "value": "4c9bebb22f09b63dc58c742a11c3b118108d3952", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677569307, "uuid": "47c3997b-80d0-449a-8a46-4908fd0bc885", "comment": "Malware payload (SnakeKeylogger)", "value": "b43f66d7900e9cb939fd10108374f6109b6ba3ef92671e87bb072ed5bc6d76e960b0994d8cc541655e42c11aff4cda5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569307, "uuid": "5b5bc0d0-6447-4d52-b402-2869366ab955", "value": "T16E555B80B2B4C556ECDF12B51D2D556438B6BE4EA0A1F10D9ABA778623733E331CDD0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569307, "uuid": "d3a5196e-13e5-4415-8c0a-dc74a12c9cd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569307, "uuid": "e8de0955-5e9c-41e0-a3e7-02546ec98cb7", "value": "24576:JpFy+jFy+FWt0IpMZP1P+VYyvHN3SrUIHYCqvo:bFrjFrFWBpwxofN3SHYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677569307, "uuid": "0a64d796-20ca-40f1-b824-0e2b5efde792", "value": 1347072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677569307, "uuid": "49bd215f-6e35-4838-8613-3fa605ed9b98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677569307, "uuid": "2460d57e-586b-43b7-adb8-a559126be9f3", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4abef8c-b781-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677600322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600322, "uuid": "7b456d1a-5ed9-4e05-bc7a-6fd91ebc6ea4", "comment": "Malware payload (SnakeKeylogger)", "value": "ff55bf6131e55371e4f2eaf23cfb1b47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600322, "uuid": "d0017677-8596-4965-834a-d64a18cd54b7", "comment": "Malware payload (SnakeKeylogger)", "value": "fde971f3c35d3955e58bbad12e7f55ec37a1655afed1af842d4eb5d32a6b4cc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600322, "uuid": "bfe14a68-acfc-49a2-b7fe-b4f3d2b0275b", "comment": "Malware payload (SnakeKeylogger)", "value": "a86b984ae1a83ee405ebba898981c839d3651406", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677600322, "uuid": "71a99eed-6ee3-46d8-a18f-9b4d8d241634", "comment": "Malware payload (SnakeKeylogger)", "value": "35247fa4fd69868432717a42bb37378e2beb9bbd5358b7db1776a81b24f44ea516161f038348b5e46b94badc2750e9f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600322, "uuid": "47e6069a-9d14-431b-a8f5-6fe3ecddee8d", "value": "T18B656D85B3708CB7E9DB01B1585A21681DF2BDCE6454F10D5BAB77026AB33E7708EA07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600322, "uuid": "d45a8504-afe0-4be4-bca1-4f52e33c4562", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600322, "uuid": "4acf9b2c-2a7e-456f-98c0-5127beb5c5c7", "value": "24576:t/EH+v/D7SzY2JdDpPTFaPoBwMDWLMduTNFxbCA6/+otq:L/3SzYcdDphaPoBLSLxTNFha+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677600322, "uuid": "52eef9eb-12e1-47ef-b45d-43cbe870a5d2", "value": 1541120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677600322, "uuid": "ed7291ce-1b2d-45e1-a060-eaaeb6cc44af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677600322, "uuid": "3487cd42-a870-40b6-84e4-5eb56e1f3059", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427dc6db-b71d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677557181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677557181, "uuid": "f6a6bd3d-ff60-4ac9-923b-dadb45f1d5ea", "comment": "Malware payload (Amadey)", "value": "adbe107de63c4f1a75c2041a5a811a48", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677557181, "uuid": "0fd23ebd-e5b0-4219-a123-fc25304a126b", "comment": "Malware payload (Amadey)", "value": "fee98e19e2d08bccf5215f0882ff9025f3632b45b8c9b06273c029c421958fa0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677557181, "uuid": "e6427d14-2add-4827-ab46-d698a40ac6ce", "comment": "Malware payload (Amadey)", "value": "315422aa6cb27087ea8bae9bcbcda542dd93eaf8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677557181, "uuid": "676ff38d-beaf-4fcf-a9f2-1ea89b961174", "comment": "Malware payload (Amadey)", "value": "04a43168785d245b852ce7142f3beae2e1b032e839df2e1c763c110088f669585f3e06ffded02be4f797ddac199d7f83", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677557181, "uuid": "99ab1a69-5961-4673-b6da-6191f2785dd0", "value": "T10065234BA3E96421DCA1577109B30BD30B327A61EB78975A170EBC5C08F3965B6343BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677557181, "uuid": "ee27161e-1c7d-4cc1-b422-8e0d24b12515", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677557181, "uuid": "4157687f-53d1-4c24-b0ee-cd7a17280f7d", "value": "24576:1yb48XOAZUKUPWmc3vPk+8t6XMf6IY0BUYcara6/55win8yRY4nCOP7qv:QjBZU1PWPj8tk466BUyFfNMpOjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677557181, "uuid": "d37ca757-95e9-48da-bb11-f326b5a80b8c", "value": 1413632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677557181, "uuid": "a0965bb4-4037-409e-8b9f-6d4772a61499", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677557181, "uuid": "e1fa1ab9-3d8f-4892-9541-2c5c3b6e679d", "value": "adbe107de63c4f1a75c2041a5a811a48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498fefc7-b702-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677545597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677545597, "uuid": "bf3bb11c-1506-42cc-b819-8ebd042dfb20", "comment": "Malware payload", "value": "aed7110a64e1a7be0cda22a92c43bab3", "object_relation": "md5", "Tag": [ { "name": "1677490643", "colour": "#D42C4B", "exportable": true, "hide_tag": false }, { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677545597, "uuid": "e4f9bcbf-bd44-4b25-8d70-0cab4913154b", "comment": "Malware payload", "value": "ff0730a8693c2dea990402e8f5ba3f9a9c61df76602bc6d076ddbc3034d473c0", "object_relation": "sha256", "Tag": [ { "name": "1677490643", "colour": "#D42C4B", "exportable": true, "hide_tag": false }, { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677545597, "uuid": "853ba93c-a507-41c7-badf-d020924064e8", "comment": "Malware payload", "value": "6ea4805f92a9c2a8205977c774649522a7f7e00a", "object_relation": "sha1", "Tag": [ { "name": "1677490643", "colour": "#D42C4B", "exportable": true, "hide_tag": false }, { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677545597, "uuid": "c6d22c5a-ef51-4cc0-8307-bbe7e1dd2d18", "comment": "Malware payload", "value": "544774efeb986034609ddd2adb4be849609059c92e5305ca0cf73ed6c852cc115a0821a0912061e14f45c7ddb5746cc8", "object_relation": "sha3-384", "Tag": [ { "name": "1677490643", "colour": "#D42C4B", "exportable": true, "hide_tag": false }, { "name": "BB17", "colour": "#730F37", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677545597, "uuid": "bbea0525-82eb-46cd-abdd-b285bc0642cd", "value": "T1D7D47D1176DCBC75F27A023479B9A27955B9FDB15C39810E739C2A1F2E30682BD24B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677545597, "uuid": "1f5fa488-ec19-4cb1-b0c5-93d51a59a5a1", "value": "001b26f64621bf924e8e5fcf57e6ac98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677545597, "uuid": "d1408f4b-d15b-41ae-a48e-0cf50c53c5e4", "value": "12288:dt1VOakzj7hpQynG+6g1zJACP406bvcgW+oYfu+3:dt/xk37hyyzl1BP4fto6u+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677545597, "uuid": "af88e398-3bab-473c-b856-0a207507813c", "value": 609338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677545597, "uuid": "ddca7b38-b706-4d7c-bf9a-b632c663e738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677545597, "uuid": "5a476e9c-4670-4f53-830a-dfa5025dd845", "value": "boris_is_back_in_town.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f165eb0a-b744-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677574225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574225, "uuid": "9593a603-3a33-4b63-b07e-2b259d52e5ab", "comment": "Malware payload (AgentTesla)", "value": "9cec909963deed08f252e5d1baa13908", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574225, "uuid": "0cf08ab9-590d-4332-b54b-a214bd5e692b", "comment": "Malware payload (AgentTesla)", "value": "ff6721bb19c4960cb936ec5825c666964ba12a43cb900beb3dee291aa0842b98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574225, "uuid": "82cd51d0-c915-4ca0-838d-fc4a52a32b92", "comment": "Malware payload (AgentTesla)", "value": "1697afee87bc0ff027076a393bc9b154c312b35a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677574225, "uuid": "9a69e49d-e5c8-4605-a820-eff9e021e0d7", "comment": "Malware payload (AgentTesla)", "value": "91bdb2d4b074ec56998e1a6414b3274b4e505b4a518f7f28a32776dd715cca52e672411ed0fa518ab239db2867754287", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574225, "uuid": "32a4aa0c-6bc9-4010-bd27-5dba367f414a", "value": "T17025273939735AC2D175F63386D3E520F6FD84923303D94A9EF60AC50F42682ADCA65D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574225, "uuid": "c39d92eb-2ac3-4d1b-899c-f23bf55cf7f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574225, "uuid": "dba442fb-6096-4a4d-92a2-e36b9e687440", "value": "24576:BBOcp/TSpOPl8220eTsIBMNjnNNOhAe/S02IiwMwDvqeEQXKW0Ps2bKX4RixZ4:F/TSpOPl8Z+uDwQb0k2bKIRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677574225, "uuid": "6fa256af-0c2d-4e33-a2c5-a0e43f2de77f", "value": 1013248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677574225, "uuid": "cbbc9dd5-0d56-4f1a-a14a-e3e4ed980b3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677574225, "uuid": "41267ba4-64cf-454c-aad1-233628f60424", "value": "9cec909963deed08f252e5d1baa13908.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7508a465-b764-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677587760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587760, "uuid": "860f3dcd-7d0c-49cc-a366-4fe46800365b", "comment": "Malware payload", "value": "daa3b929b3fc8cf485744cb5e70f0d05", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587760, "uuid": "5e2654ca-6dcc-40ee-b86e-89c9a11a25a9", "comment": "Malware payload", "value": "ff70a6a5d9a60f015940770b84ba2dc03aabde4e6643002879ac9d2cc0beee28", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587760, "uuid": "bda43fd6-3838-4598-b7cf-ef3ac6ab3bec", "comment": "Malware payload", "value": "e28a558ae488476b67c5c9dec6af9438bcc82958", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677587760, "uuid": "37ce9161-773e-4cb0-9bb3-30ffee6fd644", "comment": "Malware payload", "value": "c9a905384290a14ab4a692ccf6183433ebc4766a5d14c0fd296fc238bfec4e325e32380ad15de0b2a0a88dc9ec46c5db", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587760, "uuid": "c913b3b9-2481-49c9-8db1-f500acec947c", "value": "T1A752CFC3B81EED7F96F3A09C52AB7A6358C15EF36E2143D8459EB030140A8C447CA2F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587760, "uuid": "a0e0adab-eb7c-42b2-a014-2de24d0f92dc", "value": "384:r6WKQqJSSbHaoPVQxB5KG3MMPvtuMTrwzfTSFi2E4FP:r458SjaoqB5T8M8OEzffsFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677587760, "uuid": "c9044ede-8356-4fa8-9709-119cc0a7c897", "value": 14371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677587760, "uuid": "8ea372ab-016f-46f3-a655-8ee59d32ae7c", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677587760, "uuid": "984cfa3e-c278-42ab-94c9-738cf858a30f", "value": "bf8c7848-1685-4bbf-6901-08db1956713f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93892a14-b77d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677598549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677598549, "uuid": "1e13f004-46c4-4b9a-8b8d-09173ea0024e", "comment": "Malware payload (Mirai)", "value": "ddaedf9cf6c2b69f337d229e4f02173f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677598549, "uuid": "5cd93097-8265-4649-90d0-566396782fec", "comment": "Malware payload (Mirai)", "value": "ff8432b0abb46090d6b75e3dd76050344fd6681e6f5252dd5a5fc51227cac1ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677598549, "uuid": "08e3f704-2b04-4f5f-9dae-545bf5649c16", "comment": "Malware payload (Mirai)", "value": "9d425f3997fd7f0a62d704ff500b58fc15a9b61a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677598549, "uuid": "6ed00069-350a-4b15-b03c-d59621f39bde", "comment": "Malware payload (Mirai)", "value": "ccc626b536ead5c5c4ffb7cba140950d6d885757e60a6ebf794c064c72166b93d3acc487869f135d71e6c5da18416afb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677598549, "uuid": "ed82d29d-5bed-4ab0-accc-e9bc84141f6d", "value": "T1C021FC09F645294EDEA710BC541B422B34307A5AE4135013F7668E3F7E7B1D4121E2CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677598549, "uuid": "e56c3df9-6e84-4df8-8786-899eab105b4e", "value": "24:3VAa8DzSWPpbP78Pwy74+CiUTHfvhHCeD8ECAfGE6iox/jnCVNT1SWQ:FApP3hb/mSTfvhiK8DAfHF2gNhSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677598549, "uuid": "8a16d171-1b6c-45cb-92ea-6369184eb235", "value": 1236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677598549, "uuid": "85f67f22-176c-4d97-9b2d-392e167fb1c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677598549, "uuid": "d315f135-dd98-44d6-9345-500ddd6c2828", "value": "ddaedf9cf6c2b69f337d229e4f02173f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d422db5f-b7b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677621850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621850, "uuid": "c9f71d0b-1a77-406f-9687-f36cfc11c7f3", "comment": "Malware payload (Formbook)", "value": "5d7af334812811e24e911aa5e7468184", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621850, "uuid": "895f265b-adcd-406c-b618-48dccd5feb09", "comment": "Malware payload (Formbook)", "value": "ffb63b1c0f03e57910b1f9b67f89bfe69768e5121ed5a0ecfc3af93dd6bc4c1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621850, "uuid": "d1b460eb-a67c-4695-835a-582f63c817f6", "comment": "Malware payload (Formbook)", "value": "e0b1d2b8236917892e9bfa5b5262d118a08dd5ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677621850, "uuid": "35211ab3-784d-4fe7-a0cb-77811f420d83", "comment": "Malware payload (Formbook)", "value": "40de19077e228b6eb93266d6be160bbcdbbc4e73ad1ec8094256dd4c85c7b7dc3b4be6190d00512990f4623edc31a6fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621850, "uuid": "ddebe0af-5487-409f-9496-4b6987880f5f", "value": "T1C0541220A264E626D4F34B712C39235A6BFA94222D5597571B603F5F7E323E2CB1F321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621850, "uuid": "1c7b8bbe-5df5-4564-b815-27ded182a4c0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621850, "uuid": "b90eae74-f64e-4f4f-b697-3109f528095b", "value": "6144:PYa6fzrO3bOJZB/sEAMgNpD5Z3dyFY7MHMxuh3AWdKifUT2iKv7A:PYVHDJZB//AMgr3dymYsxU3AWdfUTfcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677621850, "uuid": "370ae1d6-82bf-4bdc-af25-9bd3cfc2cf99", "value": 293422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677621850, "uuid": "4b055e98-8d12-4678-aacd-4692d7c92b75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677621850, "uuid": "e86ba9a9-0580-4fbb-a52a-b46796518dbf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a9cbb4-b729-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677562288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562288, "uuid": "a2c64355-28ec-4586-8f4a-8280dddffa22", "comment": "Malware payload (Amadey)", "value": "2a728e51482a5849a2151831b07f26c9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562288, "uuid": "0210221f-061b-4cec-b744-8062af344d48", "comment": "Malware payload (Amadey)", "value": "fff7b44bbbff05a76b64a542e6bf83464e861806ddee6d869b96e235b816e948", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562288, "uuid": "573ccea9-29a4-417a-92c6-122d13eaf531", "comment": "Malware payload (Amadey)", "value": "8f1b321156911e69bd4b5989c187b5eea25cbd16", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677562288, "uuid": "eb0f2e7f-fcf8-49b0-bf4d-14f99d58139f", "comment": "Malware payload (Amadey)", "value": "ada0fa31039796a38d69c54e197ed307fbbc2d108bc39d0b8b6ed6f3639fb62f8cf908d2e50a27d8611f28a1375940f4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562288, "uuid": "ac853981-974f-457b-b77d-b454b45df9e4", "value": "T12B552317B3EC8463FCA45B7008F603C30A36FD725A6C57CB229E5D6D1972660A8B5B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562288, "uuid": "56e80fe7-5d7d-4e32-9c06-d84213f23e92", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562288, "uuid": "13cffa34-77a2-4d6b-bc74-1c59555ff77a", "value": "24576:ny5+wUArBFZLUbzpfqfMTPS1YHo1tbLMpLVER+b6RGZsTHvFff:yVnBHWzpfqfMW1YIfGaR+Qlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677562288, "uuid": "52e0be6c-a891-450b-88e3-218340debe62", "value": 1363456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677562288, "uuid": "5766fb71-ba9a-4fb2-889a-16bc1e14ffaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677562288, "uuid": "ed464a60-8cc7-4058-ad36-a2d9c4de4896", "value": "2a728e51482a5849a2151831b07f26c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }