{ "Event": { "published": true, "date": "2021-12-10", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-12-10", "timestamp": 1639180982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "87b8bd3a-e04f-4a35-b5b7-b901003f03f9", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d67610c-5997-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639126664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126664, "uuid": "cb666d95-e504-4487-b313-1f6b032a20ce", "comment": "Malware payload (Formbook)", "value": "b04468eb8d182030bc9fc2214af98557", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126664, "uuid": "960c06fc-53dd-4a9d-a2e2-b1bce5558248", "comment": "Malware payload (Formbook)", "value": "012eff64f6abf73ec29746d53df859f4f856688484b780ebc73ff32e5f67edcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126664, "uuid": "c0a67545-2774-48dc-ad21-30774ea32709", "comment": "Malware payload (Formbook)", "value": "20780a9dd398eb8893f8b9deb1e1dec40cc65d69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126664, "uuid": "ce7ccdb2-cf1e-4f28-ac4a-17ab6c9d116b", "comment": "Malware payload (Formbook)", "value": "585e0757704f9870101162fe7d4e7ce6477ccc0a843ce8f33e24feeda970a9c657b743f364fd116ec80eb0fa851cf428", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126664, "uuid": "c27d4d83-96ac-409c-b431-be0e43605a2b", "value": "T10DA4CFD1228257CFEEE91F384AF1DC75C7A53D0868E04A9FB6E53D5B3676243098381A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126664, "uuid": "fbc99898-4f4d-4127-821c-c9171e1547c9", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126664, "uuid": "91ff95f2-3136-48ce-bc82-7a456ceede41", "value": "6144:EGiUCFLBxbsS6ED0DDDDGDDDrp+0G+KaWvFuXFs633nwT2hrajNVD:wZ6AJ5jFsK5hGjNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639126664, "uuid": "ff2dbe76-ba25-4995-90ac-4704efacacdc", "value": 466986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639126664, "uuid": "1524d423-a593-4616-8fcf-715408fefd03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126664, "uuid": "8fd12137-90f2-48ed-a103-16b51fdc14a5", "value": "b04468eb8d182030bc9fc2214af98557.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1700246e-59a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639132183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132183, "uuid": "2720c7da-0e89-47a6-b5eb-64fd5a54b8fb", "comment": "Malware payload (Loki)", "value": "7e869a139ca11821e6fcfb7fb9287725", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132183, "uuid": "29098301-611e-4de0-9f68-a96caa6ac370", "comment": "Malware payload (Loki)", "value": "0240cbfb7e4f0137dc5568461330e0a06097efa5935389d85a2f54f70ec40279", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132183, "uuid": "03404628-7bd7-4792-80f3-73e14ed98a61", "comment": "Malware payload (Loki)", "value": "279f30ccf2fdf3cc51d7542894ac8ca6ecdaedd2", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132183, "uuid": "eb45cfe1-9a23-4b6e-9ef4-0ea2b661f39a", "comment": "Malware payload (Loki)", "value": "8e429356763cc28d867907ddbdb3ea5bace92341cf2c3f2a303c630db198962985d765ff2c4f7a77d1d6166a38a8c734", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132183, "uuid": "a51ad381-0616-4543-ac9c-3eae0245cae4", "value": "T168341375B01A77D0FBE02D78B013B5394BD9EF02DC21DCAD246C7B6E40B25829A51FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132183, "uuid": "87477266-7097-4ab3-bcd8-e763f5ec28a1", "value": "6144:vqNiH15qkbroP9dxni1skR6wS0CPOCkYC:yUekbq9dxAEtOCLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639132183, "uuid": "e5423e89-e59a-4594-9ebc-33eda7bf4dbb", "value": 234264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639132183, "uuid": "2c108cf7-6e9f-4a72-8da9-66bc07b6e8b9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132183, "uuid": "4f32c79e-6ab2-488d-935e-a800377d7406", "value": "PO TM-3851 ,BT-4792 & RS-70100.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c601584-5984-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639118502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118502, "uuid": "b992b4c7-a5c6-4d2b-99d2-1af999dd8984", "comment": "Malware payload", "value": "e3daec8f78f15366ada7d89c99af91e4", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118502, "uuid": "918edea1-47fc-423f-98f1-76b418d84682", "comment": "Malware payload", "value": "043a7fef1ce0e6a983fbefa8ada9c18cb5941a212c5082ab9a94acb01b604d45", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118502, "uuid": "35035df8-c63d-49b9-9cc4-8a029f05f752", "comment": "Malware payload", "value": "f11d0c11c73faa1ea16a9db6c1adb10ab5e9750a", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118502, "uuid": "53cb4605-0526-4d9a-94e5-1e79ebd09d1f", "comment": "Malware payload", "value": "e33186f2d8b9d708301eb8630f34d9887c887d3a0c2cf3dea1e679b8e588d8b1396467f46274db897c06893893605ffb", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639118502, "uuid": "12cd6118-cdd7-4519-a43a-44c0046edfb2", "value": "T16B753B3B9B288617C6A8B271163F03159270DD959F34B75B6980E01F7FEACE21F0674A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639118502, "uuid": "06e215c7-7c88-4aa8-9331-de0b83e47189", "value": "12288:eplG9xc2uJRe6BRTL0lCxzqK5kZELIdTKDyA/pKrgP6D593Jk:eKxc2uG6BVAlCdqK5kpdTKD7KrmYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639118502, "uuid": "0851123c-f66c-43a8-9d63-ee8a0f6a956c", "value": 1623728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639118502, "uuid": "dd773835-182a-44d9-bd92-ed44f71e9d77", "value": "application/x-mach-binary", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639118502, "uuid": "77312784-70f3-459f-a472-986bb6f97680", "value": "SogouServicesBackGround", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca977606-597c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639115305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639115305, "uuid": "b0a3e123-17c8-4a24-a307-c291584807f8", "comment": "Malware payload (Heodo)", "value": "e34c29abda5a456a7c63f49b246a0483", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639115305, "uuid": "0b6d27ca-bb64-4134-a13e-d98223e0f82f", "comment": "Malware payload (Heodo)", "value": "04e87569d7e40f8458e824e4eb6b8a4b9217065172380c445a3ec8a46d059d19", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639115305, "uuid": "cf3f9e02-b335-4c87-bf36-edf70cbabefe", "comment": "Malware payload (Heodo)", "value": "93060c53d0cfcd4722c89749c05a542d02d3970b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639115305, "uuid": "dae4314d-1b14-4667-ade6-19bde55ea7ce", "comment": "Malware payload (Heodo)", "value": "b9bb56e8afa86fe5a05fdb8ff781267538fea7fabf78c41747e665050842767f264fb432e1126fe91ea43aea0ca5a13e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639115305, "uuid": "ca13ac41-5b19-439c-9804-8ad180a36cf6", "value": "T13B244A00F551D139FDE611FBCAFB49BC89AC5B00134824DBC3C968A5E7568E93932A6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639115305, "uuid": "c0f0a40d-6a24-499d-816e-5c34b8c5e026", "value": "6144:m09MHnGC7LRzxzVZYsuOa31UvQV8yMcSWUMuEpE:me+n9DJGtOal5V8yMcztuEpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639115305, "uuid": "b1b43c61-59d7-45c3-98a0-cc68dbfad112", "value": 222048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639115305, "uuid": "55a3435b-9e71-4032-b820-4b0fe4c25af8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639115305, "uuid": "3da77d36-ca7f-4bda-b524-2be68b8a0392", "value": "emotet_exe_e5_04e87569d7e40f8458e824e4eb6b8a4b9217065172380c445a3ec8a46d059d19_2021-12-10__054820.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74926abb-5991-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639124180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124180, "uuid": "4d254381-535a-4638-b876-a216af570801", "comment": "Malware payload (SnakeKeylogger)", "value": "0f6df7e857cfc002a3aa4fb907351132", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124180, "uuid": "e45a4d87-d959-4319-b807-e05aa3147408", "comment": "Malware payload (SnakeKeylogger)", "value": "04f68c0d286f79cd5f824071f13a5f9b3d94524555d630e0f7a947512bd5f49a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124180, "uuid": "26c24659-57c4-4685-80ae-6039ac5bc41f", "comment": "Malware payload (SnakeKeylogger)", "value": "ff4cd6ea95b091ac8bd03e123bd12f058ca7810a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124180, "uuid": "9cdf5d74-65be-4585-9f3a-f468f900fe0d", "comment": "Malware payload (SnakeKeylogger)", "value": "a435ad2e88269da5906413e786f94f6c66cb5066773d560dbc5a8d4dc9744bf58e09b14b3ea5853e90cdde17e4045b51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124180, "uuid": "f4c004d4-980f-4d6e-ada2-ee7af1e4d9b7", "value": "T17BB4E0C26597DF2BCA16C4F8C06715F3A98A4F94EF339CE3B8917DB970796149A0B108", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124180, "uuid": "ae1acddf-5e70-44a6-9418-4fee001c5d6c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124180, "uuid": "d54afee5-f1dd-408a-b514-2ebe2d7a5f46", "value": "6144:IGiXqs0n2+P8ZZFCfocnQg7BWEej67Pkecm4Trj96/zXUWkOO+yQKPIQvaP/ABsS:dNIcnv78EFKm4vjobUWjFQvaXAC+ez92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124180, "uuid": "ab591a5b-f36e-47c1-a5c3-2965137a6547", "value": 515838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124180, "uuid": "91073631-52b5-4d4e-a11a-9bfcd9ed9e27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124180, "uuid": "b688ca6f-1db9-4ed8-8fab-d8eaf4cb642e", "value": "45670987654349009876543456-0987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e157f048-5963-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639104605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104605, "uuid": "5695bc1b-dac8-45e1-b68f-78d8f8befd7e", "comment": "Malware payload (Mirai)", "value": "9b6aa64143ce9fbbaa59285646d7c461", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104605, "uuid": "11d3c5f4-1a5a-4579-86a0-64a2c6e11a35", "comment": "Malware payload (Mirai)", "value": "057605f5c71212f7e64906b1359d24de423ef9afd30c075bbc876f90024ec089", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104605, "uuid": "8ffe2e05-3f15-42a1-a147-d99adbfe5293", "comment": "Malware payload (Mirai)", "value": "22eb830c5709f74617a5d47b85d945c9c367fee5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104605, "uuid": "30c2f672-0e70-486a-90e7-e6d9fd9c4221", "comment": "Malware payload (Mirai)", "value": "0c02526775a821111a9fd04125eca9a601cff30a9e27d215db37cada1f12155990f139caa1d167bcdb1f318ac5953ff8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639104605, "uuid": "1c94bb34-be9f-48b8-b98a-6a1ad4bf2a92", "value": "T1D6D2D032A3E6E38DC0AD263A25BF3A0D0851472CEDCA15767E9CB0768E96F1D2914691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639104605, "uuid": "59a3d91a-d0f5-48a0-8f85-970d975062bf", "value": "768:afi6wkT0T+yChj0wxaacNHhJQRL2lQlonbcuyD7Uryqe:af/TQ+yCjtUhhOSlqonouy8mqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639104605, "uuid": "b5aa3f66-2edb-47f4-867d-0c43c8708983", "value": 29616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639104605, "uuid": "faec5aba-28c7-4bb7-be9e-8648a0c41f81", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639104605, "uuid": "419e6b73-2565-44b1-9de2-e7ef76b93f3c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed341eb-59cc-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1639149484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639149484, "uuid": "f928fe5e-aab7-4249-ae1f-9c0d76a0eea2", "comment": "Malware payload (IcedID)", "value": "6af09695ebe31594d476a22b592853c6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639149484, "uuid": "38100da3-a89c-4e51-b503-a8a8460dfed9", "comment": "Malware payload (IcedID)", "value": "05cf7321eee4e03c6ac560a3b39ef2405d2ffba436e6011969529b5379a4378f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639149484, "uuid": "66066957-866d-49ed-9a0b-bf30b4c4afb6", "comment": "Malware payload (IcedID)", "value": "17975e84e7305e8a3cfb21edf6b61687c7871df6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639149484, "uuid": "3d86bd8b-f5e3-492e-9921-2dbc9af6867e", "comment": "Malware payload (IcedID)", "value": "bb1af0abeb8b3601bb115bb4c51c31bcf39b58fc38a38e6e2fde07264100de1064b38f69c3241f72a2a6df04b346249f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639149484, "uuid": "9c845cec-e33c-40fe-9ce0-0f06ca8fdf7e", "value": "T18BB407BB75976244FFB14C34AFE875F5CB93283AC96FEAF08691B0302A64091EC46517", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639149484, "uuid": "9a7987aa-528e-40cc-b326-e0f7770aa403", "value": "12288:1s+jzJ3Wav5kdFcImyeVCKjnBpHMuoznN+Tl:1fjzBgSVCKjBSNYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639149484, "uuid": "18ada474-8050-4246-b3d5-1a079227bae2", "value": 531584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639149484, "uuid": "6c1c3113-f68f-41c5-9d64-09c1770c3bd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639149484, "uuid": "4c63a1bd-cb0d-47b9-bfe6-d9f0b4805e97", "value": "6af09695ebe31594d476a22b592853c6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35b11b6-5a01-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639172389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639172389, "uuid": "b8c70bcf-21a9-43a2-8a6d-435845a70924", "comment": "Malware payload", "value": "07b7746b922cf7d7fa821123a226ed36", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639172389, "uuid": "9ec6e2b6-c217-4331-a884-ac156e940aa7", "comment": "Malware payload", "value": "063ccf736c2c19ca5db70b8d8a7cf00377899c16023c63fee836bdefadd336c1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639172389, "uuid": "1115ff18-02c4-482b-9e5f-f50fba709339", "comment": "Malware payload", "value": "bf2df8f2813ef4e2cf61ea193e091b808aa854c7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639172389, "uuid": "8a370322-01b7-48b9-97f9-1305ff84dbac", "comment": "Malware payload", "value": "09008059a978eafac3bde23e652336c97c881a588246467583c1c4ef5a1b026b65a712e9bc77856273a055196fa36899", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639172389, "uuid": "556323fc-1b78-4e14-aee0-cbc1e13ede38", "value": "T12A32638EB010AD7425AEC4B49DE32DBD6037900A4C723F10E4546E78B69DA05A7B9FFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639172389, "uuid": "8f96f634-de99-4070-9920-3ba443aad159", "value": "192:Xws08k5tkd5DFPSV3n7/e867jNKvSbRXA8kWmk4lkCIkvUgoaES8DSWOlA+1esP:XQwL4/e867USbRXA8kWT4yCtvUgDjdWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639172389, "uuid": "ba9abd80-1445-417d-b1f4-cb7a16a1c341", "value": 11309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639172389, "uuid": "f0466f5b-cd44-4d63-8fd3-685db927e360", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639172389, "uuid": "d86d0a04-fb1b-447a-8ce0-6a2164843318", "value": "1h.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d55348a-59b4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639139254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139254, "uuid": "335e2acf-bed3-41cb-85dd-35c3a5504373", "comment": "Malware payload (Formbook)", "value": "5cf09a63583247bf1cc6f72cb84a9b21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139254, "uuid": "8332b7c2-19e2-45e3-8f11-cde2be2dadb7", "comment": "Malware payload (Formbook)", "value": "069fc710224b67cc7432806fad5994edaf8270a4283e256b30f74cdf139e17b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139254, "uuid": "0039d8d3-3a9d-4876-94ab-6336cfd73eee", "comment": "Malware payload (Formbook)", "value": "d02dfdac429163d41f6f6fb4c8ae7b5c2d8f7ff7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139254, "uuid": "ca3f888b-5e1e-4a03-9d33-46ed6c68e27f", "comment": "Malware payload (Formbook)", "value": "1437eddf5e02d9d8c015bcfe555503491142ac0b5f406367f5e8e5c12ad5af45ec7e6dea55e2ba562cba7a9868921f6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139254, "uuid": "a44a78bf-4404-4c41-b2b1-454e368beaad", "value": "T1C064125E35E1AE27F4E44E355237FB26E77DA3652261EA230F440F3A8EC141BCE28455", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139254, "uuid": "7667a6c9-d37d-4e7a-9eda-ab2f5186593f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139254, "uuid": "bfb815f3-2988-4f5f-9a14-08920017d7e7", "value": "6144:rGi6z6qpiSFVmpp1USNH6ZXnt5eDHdNjhfYYW/P9Sq2M:Oz6qsSXIzUS5UPeD9pCH8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139254, "uuid": "03936551-b0b9-4deb-ad84-8260f7de855b", "value": 314385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139254, "uuid": "45064984-2fc0-49f0-83ec-18bc2df82fda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139254, "uuid": "8f1eeb67-e0e3-477a-81b4-73af2295b6fe", "value": "invoice copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996a8ae9-59ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639141851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141851, "uuid": "da283bd1-b08b-4e64-b0bc-23433a621e1c", "comment": "Malware payload (njrat)", "value": "b67877753da5f71beaf34d615e62eb64", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141851, "uuid": "deac3e22-7af3-48ab-b86f-103cd892a638", "comment": "Malware payload (njrat)", "value": "06bfee44b0f11ee2da20d9c957821c0fd50a9c6da4bf074a543f99a3de372a5d", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141851, "uuid": "a610ccab-08f0-4691-8b80-15a0ff658df6", "comment": "Malware payload (njrat)", "value": "ed2f04df466fb864485812ce9ab852eab9b98ed6", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141851, "uuid": "5ac09909-f90b-49f8-97f0-762a4a3afb3b", "comment": "Malware payload (njrat)", "value": "1027108846386bdf37eaa61ac3826f3aac2a874b796f75b266fb463db147da21c18160eb5d99f0092ed158bc657229c4", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141851, "uuid": "c2934523-7876-4b81-826a-3b8c2abbd786", "value": "T1B401F00EE517FFDB022B3BB3EC93902C68F240E449A8896D62114A588A944BB61649B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141851, "uuid": "07df32cc-9529-4d32-b4f2-42a7edd3e51c", "value": "12:TaVLMUVb9wCPayBmxVDTiL955LkiPVEi6n0DLIFnyR0CdwfTZnmVEiYNp5o7H0TC:mV4UvXCKaVPzSuv0X+nmdw7JmuxN47Hz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639141851, "uuid": "3e43516f-689d-4051-b54f-9b94c2031109", "value": 678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639141851, "uuid": "2afb3f31-bda3-41f6-9da5-2be905836ab0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141851, "uuid": "d981255b-6a61-43c4-a90b-c16b6449459d", "value": "J2M39FDF6S4Payment-Receipt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277042ef-59c3-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639145525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639145525, "uuid": "49ba9caf-ec9c-4ab4-8137-c5387abc215f", "comment": "Malware payload (RedLineStealer)", "value": "3dbfef542a0ef76eea55ac67553ddd68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639145525, "uuid": "13d6994e-01bb-4ab2-bfb4-49a99b0e4d91", "comment": "Malware payload (RedLineStealer)", "value": "08f10636e4db028e556b19c7049d628888b356850513670a1f901d502a713236", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639145525, "uuid": "c06d3560-af22-4858-9ac7-45bd82e5d19f", "comment": "Malware payload (RedLineStealer)", "value": "16d4a216f1284ce172875c8bebba071a7bf8369d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639145525, "uuid": "dc590a84-d744-4bcb-a937-2e50175d02a0", "comment": "Malware payload (RedLineStealer)", "value": "9e4be4c30ce9b0d124a4e533c0d2c737f72cb16ac62158b15b47b83d071e3a9b96ebf02c51321f56eb2073d9bcc61702", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639145525, "uuid": "d644f294-0a29-4e44-8af3-05e5f385268c", "value": "T1B036336279D44032E5735E315DD8E2316E7DF2342AA3774ABB050B2F3B903928B69B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639145525, "uuid": "c97aa960-54be-45e1-be14-f96068a3cf72", "value": "4cfda23baf1e2e983ddfeca47a5c755a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639145525, "uuid": "e4176a9c-f424-4269-8874-c18efca2b12b", "value": "98304:KFXqZP8Yp2qbOflLMQXchg7tPseE5hIBQlWuCW5YuKAwLlvkoCrXit:wqKYgOOfl4ocapEBIGsHWPQlvkooA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639145525, "uuid": "3ae5c1b4-e2bf-466f-b55f-b5736a5874ec", "value": 5163770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639145525, "uuid": "466a4e64-7cd8-4253-93c6-fa7fe0ad3293", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639145525, "uuid": "040e82eb-2f57-48d9-a44f-878c97de6ea8", "value": "08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f8dd962-59ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639141700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141700, "uuid": "7d2336d4-6bb8-462a-b7b7-62d5447458fd", "comment": "Malware payload (SnakeKeylogger)", "value": "42b23043cf0ceae521eab7a369695380", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141700, "uuid": "e57eb5d2-dcfe-4087-baec-0a8ae9171b35", "comment": "Malware payload (SnakeKeylogger)", "value": "095cdeb7bd340bb366c724205cae13c044b5d80018a753bc57de7ca85dafb926", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141700, "uuid": "e9f8bf27-cf3a-4c10-8575-160db779685c", "comment": "Malware payload (SnakeKeylogger)", "value": "5110ef7cbfbbc0976a9c880b33d9610a4526470f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141700, "uuid": "44375aca-4cbd-4f11-b8d0-ff37b07359f6", "comment": "Malware payload (SnakeKeylogger)", "value": "39d1a53d2c2d3e6c891474dbdd04a18d84246193f62b08b1c24ceff78ecf6a33cfd54175330e61f30636e5f7bd34182c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141700, "uuid": "2a835daa-1b74-4540-9df7-5eb9b050afae", "value": "T11C0502A26184520BDD172BB44072437CE375DD45EBF24B3F1B543A0E377A6E26C1AE8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141700, "uuid": "bede03f8-7c02-44ea-9c56-4c13c633e9e4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141700, "uuid": "468a8af5-32f4-47c5-b9b3-6bc5539103f4", "value": "24576:0eyiafLf/ZFcOTr20ihMe/8am6dK142c/R8HzdSnB:CchB5K14UT4nB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639141700, "uuid": "cdcc7df8-f517-4655-b35d-e10dd9309fb2", "value": 798124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639141700, "uuid": "07b6752c-116e-4ee9-8842-e57351acf49d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141700, "uuid": "289357f2-3d26-4bdc-b065-1c43b9fc4547", "value": "234567898765432345678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6ff1f2-5993-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639124894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124894, "uuid": "7d8fe257-5fc1-4797-bc1b-79858f9d269d", "comment": "Malware payload (Vjw0rm)", "value": "efe7b98b685c2f180c40198cc93550a6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124894, "uuid": "c3831703-7cbf-4c62-a97b-188a7b587bbe", "comment": "Malware payload (Vjw0rm)", "value": "0960069e6f40570d52fcc5293d08cf6c75f01c04f11d35551858a587dc78a856", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124894, "uuid": "56d0d13b-f685-4fa0-b4f9-b4087ac495af", "comment": "Malware payload (Vjw0rm)", "value": "6990454c9d338a50fbb443990a766d211e76e2f2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124894, "uuid": "0d151a53-4fc1-4db8-bf2c-9efd76181856", "comment": "Malware payload (Vjw0rm)", "value": "b10bd7894300a8ec88a5122786f684545af41292f06dbb61e050747259750ba10a14ccd8a20be6f7ad56cf6bb62a34d1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124894, "uuid": "abc26de3-c396-41b9-b8b1-4cb55c575c54", "value": "T1A2129EC8D784BAB3D341725A0E4C0E67DFAB6979C59B539C3D8A8B74B551A11F010BC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124894, "uuid": "47d0a56b-233b-40bc-aa18-151f65117694", "value": "192:ruql+s64D54Q32mKDwd/BJOY0Ym7G4LygxTnqqbzOHutClxLpa:HPzDgwlTz0s8qqbqvlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124894, "uuid": "3cd810e1-fe9e-40b9-af08-380445a6e761", "value": 9603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124894, "uuid": "b8d37f66-6c8c-4008-8cc9-103d8a9b9200", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124894, "uuid": "893b6c34-12db-4c24-9612-7caa0239697c", "value": "QROSLK40MKSD.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0dfa34-59df-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639157505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639157505, "uuid": "26f5fc80-18b7-4b6c-a230-2192a600d672", "comment": "Malware payload (ArkeiStealer)", "value": "0f584671295bd312cf31fa8e938fd8b9", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639157505, "uuid": "582165b5-8ca4-4cf7-b1ca-24ec1b2e51c2", "comment": "Malware payload (ArkeiStealer)", "value": "0ab9cd8d5f1da2d03ab76db5be55dbbcb575ec0d8785db3677366fab2eafd48e", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639157505, "uuid": "e9867c62-c8d3-4007-8af3-becf3673240f", "comment": "Malware payload (ArkeiStealer)", "value": "9d4874a26c587c3501324702ac609325c1b7087c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639157505, "uuid": "b67e5310-e4c1-4194-b45c-3feba99862d1", "comment": "Malware payload (ArkeiStealer)", "value": "2c05d26d8086aeef77d4654c6285eec7fbc7d1549e733027fae66cc9ad1eba3fee110d39081bda78ebcf4e97f2115efa", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639157505, "uuid": "53572ca1-e442-4820-b89e-eb926ecce5cf", "value": "T1BD45120269258563F10109B14BA695F40B3AFD32D441DE0FB745BE1D3EB2A8B6DE1B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639157505, "uuid": "0c1d838a-005e-4439-875f-46e7d9cbfba7", "value": "ca357d1c9b605d95e9d31e67e1c53033", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639157505, "uuid": "1ff096ea-baa3-4377-b73e-8432de781ddd", "value": "24576:4As0+vRQPeCXD7luaw2F0dkTW2ipbteq12WGzCeq:4As1y7lJp5ipbteq128r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639157505, "uuid": "260b76fd-371e-498c-9e69-bccadae97c70", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639157505, "uuid": "21e1bcb1-1d1f-445b-9971-c5618aefa168", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639157505, "uuid": "4f923f52-6672-41c4-9ee0-969784f0a051", "value": "0AB9CD8D5F1DA2D03AB76DB5BE55DBBCB575EC0D8785D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c075eb-5991-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639124282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124282, "uuid": "241fbbb9-45e3-4c25-a8a7-8ab3d3c26f7a", "comment": "Malware payload (Formbook)", "value": "1026a44a21abd155aaa31cf41dce2e49", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124282, "uuid": "0c65d6bf-91b5-48ef-9100-0da4fbfc55b4", "comment": "Malware payload (Formbook)", "value": "0b2a2fde35c75554477dc7ab7156423e251778db955aecb77aa95e5acdd0c2a2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124282, "uuid": "6976b5b3-6bc9-4f7b-a541-960b42e6898e", "comment": "Malware payload (Formbook)", "value": "98e01c50f0c58c093aa22b0a6ba398c5aa0e71d2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124282, "uuid": "4f36e2b9-2b7d-420c-9108-54c4404cc90f", "comment": "Malware payload (Formbook)", "value": "a0bd986f97c7274674e1b23fd0057ccb9734bb636cfda02db2d9699dbf54f8792dd7f528385c33d10caa3c38d284bd1f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124282, "uuid": "8521218c-baa4-47df-bc2f-c831eceb479c", "value": "T14834126EB2226640F277EE3A7790B77557B8FE58C6530083A0D2F0282979E6453F642D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124282, "uuid": "7e53a9fd-974d-49e8-9608-e1416e994a60", "value": "6144:1fyPm9kG5hwZHGBW3C4QcafwUwrQrcP2KHdfFUFjcVuSx:5yKkKMmw3g7fwUlcP24fFoZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124282, "uuid": "46d35426-19a1-44e7-bebd-a1de6a4a53e1", "value": 234776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124282, "uuid": "e8cd301d-e53c-4d75-bd90-40e1c722ce9e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124282, "uuid": "05eda73a-db80-4cf2-a229-13e752aabd1c", "value": "2009.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58f0440-59b5-11ec-96a4-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1639139778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139778, "uuid": "73f6cccd-3750-4127-a080-998e31dcfedb", "comment": "Malware payload (BitRAT)", "value": "246358731c6f96d318a5f6b6ba60ef7d", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139778, "uuid": "abc78c5f-14d4-4a45-9077-0808df762d11", "comment": "Malware payload (BitRAT)", "value": "0bff04505ca79f054fe406fd08cc7289462df2e3a16cd878e4bea7b7b1fdc670", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139778, "uuid": "f107c6d9-54ab-4b83-bc50-369dadd811e3", "comment": "Malware payload (BitRAT)", "value": "2804836fd73f477863d411df7915e22ad20d5e6d", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139778, "uuid": "21aefdbc-df0d-4af6-8efa-53ade487594f", "comment": "Malware payload (BitRAT)", "value": "aa7aeedcd7f8f179f4429536a43ab32e081189a50b5f4d439a2cc9a1effe7bf03f45469583dc6611dda5e11297f1bb76", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139778, "uuid": "080dc87e-fac8-471c-96a3-fc1d5c483fb9", "value": "T1BFA5232173E96756D17E93730868A09413FEB11AD732E22C7CEA50FB4D72F0886B1B65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139778, "uuid": "d4d6db5d-6b2e-4db6-a5e1-eb202406daf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139778, "uuid": "371206a7-eedc-4825-bff8-f360963962c5", "value": "49152:amQYxdjblx29i17+JGhBrY3GIPlIZEIELphexAG2Df:aIfl4iHh1Y3NNzD4x+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139778, "uuid": "35822a31-7176-4197-b8c9-c8f21d7a8a56", "value": 2221056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139778, "uuid": "12c3de1d-6dce-48e9-bfea-19f4d1dab536", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139778, "uuid": "b37c7744-7692-420c-91b4-237298ae6745", "value": "SecuriteInfo.com.Trojan.PackedNET.680.23816.17591", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b36698a2-59c6-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639147048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639147048, "uuid": "c119ceac-def8-47dd-acd6-e2185cbe5678", "comment": "Malware payload (RaccoonStealer)", "value": "420d8eb15cf219dac5df1ea74aef9705", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639147048, "uuid": "261d2dc5-4b72-4c25-b586-c40d70c95d6c", "comment": "Malware payload (RaccoonStealer)", "value": "0c26c4bc2912317d4e104beae3e4315f7042531fa1f044ebd3da11dea4f6d974", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639147048, "uuid": "1fc3cd7b-d221-4022-96b5-ccd73736834c", "comment": "Malware payload (RaccoonStealer)", "value": "a25f017611c802a7c1ea0f2a3b1ec6a3cc64e8af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639147048, "uuid": "c2fa7582-ff96-4149-ab4f-2596ac052693", "comment": "Malware payload (RaccoonStealer)", "value": "1c0238a0668c62cdc9365e369ec75fd5aee96fe10dfe7fc7113b0328018a65c6e28c4a5757bda9292699afaadb0a8637", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639147048, "uuid": "75eb1988-970e-4708-aadf-1dd99929fa81", "value": "T17B45F10EA311C602FC58D7346EBB6FA012B4BAB2AD92C397FB5D1A3C446B3795C41356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639147048, "uuid": "20b566d6-9533-4e9f-9e5d-17a8ababe5f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639147048, "uuid": "e109778c-6de7-4078-94b9-91e1565fac79", "value": "24576:AioqKsUvUBs1bucO2SJ/NYF2nnohmP1+W2g2Fl4NPuvT:AioDMW1bu2iO+p2g2Fl4NGvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639147048, "uuid": "06d2fd43-d4b9-4f3c-abfb-9f429a2cfed3", "value": 1272320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639147048, "uuid": "da043afd-df1e-4073-8af2-6bedbc82f890", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639147048, "uuid": "8d5122db-dc4b-4410-9872-5ab899870719", "value": "420d8eb15cf219dac5df1ea74aef9705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e785ec-59b5-11ec-96a4-42010a9c0029", "comment": "Malware payload (BlackShades)", "timestamp": 1639139770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139770, "uuid": "fdc6d004-ea1f-4a6e-89e9-2162a2cd8bc4", "comment": "Malware payload (BlackShades)", "value": "ccc71ce6944397811a58348f0909e635", "object_relation": "md5", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139770, "uuid": "39b66f9a-ed86-402a-8dac-d240b4858c27", "comment": "Malware payload (BlackShades)", "value": "0c33c5f48dd45753304e0c525d0e0f26d59a2d47088fdbbd0652f355c3d573e8", "object_relation": "sha256", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139770, "uuid": "f15dbf81-89c0-4470-9adf-775f87e84f76", "comment": "Malware payload (BlackShades)", "value": "c32c7b97b118292f9ec396ffa5503c6a60b4f088", "object_relation": "sha1", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139770, "uuid": "fde303e4-9bf5-41b0-ab6a-c961695fe2a7", "comment": "Malware payload (BlackShades)", "value": "c01a2525f1beab7f6b88d74b607b627efad9ef9a924c4e11cad660d18dda4e444b520d387357c1e02a78ba50f4b68944", "object_relation": "sha3-384", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139770, "uuid": "aed428d6-0207-415e-a138-371604b2f9bd", "value": "T1B885C10362A18237EBDA9D73DE15A20D16ADED55F123453A728C3BEB6FB0161123B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139770, "uuid": "ecc92f83-1fdf-4781-b4ba-f5d85cbe9dc8", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139770, "uuid": "bec274b8-3497-4a87-8040-999631949492", "value": "24576:uAHnh+eWsN3skA4RV1Hom2KXMmHai8rET5MvT+WVcH/395:Zh+ZkldoPK8Yai8rC5MvTfMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139770, "uuid": "2cd8cd8f-4082-4267-a90e-2f655483d214", "value": 1818624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139770, "uuid": "1fc8b7d1-eb2a-4289-a13c-2994b3379f6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139770, "uuid": "93d5ad64-a156-4fa0-afb4-5cc712963235", "value": "SecuriteInfo.com.Trojan.DownLoader30.578.6653.24096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec710b2-59a3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639131901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639131901, "uuid": "cdd4c034-fbd0-4b7c-ade3-5f3ad58c87d9", "comment": "Malware payload", "value": "ea64d82cad81002823c8bd18399b33a4", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639131901, "uuid": "474b1ba5-b5f2-40e6-abc4-f2559d359499", "comment": "Malware payload", "value": "0c52a09df90708a4b4f5f6e82f113801b143a67e8dac26da2d9db74a9e5bb5ea", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639131901, "uuid": "1eb203e2-30b1-4dd0-800f-43928f12fa99", "comment": "Malware payload", "value": "d299e90072d172ce19c33e1a838f2ece36e5bd03", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639131901, "uuid": "da394e23-6bb9-4584-8e05-3349df502409", "comment": "Malware payload", "value": "11f005a25205db72f91c97afb49e68fe9b373d7a75201069845cd49e877d0d9771cf05e3517f2c825acb66d0d8f8279d", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639131901, "uuid": "91cc3caa-1be9-4f5a-a898-3a3d7f07af44", "value": "T18992D1738B24DE553EBC1C68711399363A6C731A329DF5B696D42C176107F84041B7BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639131901, "uuid": "0dbeaff9-92a7-49ad-a31e-98dab0a7a9b0", "value": "384:k6ul2mcUKGDsxM9L53b+wgqeKWW+ghh7c0PVr6Nb297VoJdw68gCY6MviVGwoEIb:B22mWGDsxMXLzgTbnw7FVr6xQ+J8rY6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639131901, "uuid": "00c9356b-8b28-4aa1-bfc4-3f3019f4ec55", "value": 21235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639131901, "uuid": "4925255f-996a-4697-bb1b-f720658d6b8b", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639131901, "uuid": "80dba06c-c67c-4000-9365-c602454ffe96", "value": "ProformaXInvoiceX10.12.2021.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb0af53-5991-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639124011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124011, "uuid": "4bac039d-8c2f-4c01-8cec-48e09cdec593", "comment": "Malware payload (RedLineStealer)", "value": "a34cab5cffba1d5b84e935cf275681a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124011, "uuid": "646dce44-83b2-43e5-b423-a608e698297c", "comment": "Malware payload (RedLineStealer)", "value": "0c987c8fe2921c128530d7019f68c1baf36b8bb78a468649acb546f98246f7f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124011, "uuid": "9a01511e-d6b4-4cf1-9f05-95bdd5e1d75c", "comment": "Malware payload (RedLineStealer)", "value": "424004e132fa355bd403f103f89484c0964ea915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124011, "uuid": "2a188afd-b508-4e13-bdbe-c7b0918630a2", "comment": "Malware payload (RedLineStealer)", "value": "37ed8ef314a568971e438d15d1d7d0af41ae08f35d550be3c4e773336fc15d594838e201462cdae47332a18da2a687d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124011, "uuid": "acf647d8-8a04-46be-81a1-d27d105dcf7c", "value": "T18694CF04B7A0C035F1B702F44D79D3A9A93E7EB1A72494CF62D12AEA5A756E0DC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124011, "uuid": "c235267c-160d-4e63-bffd-f91de4471623", "value": "c50981c3cb3d1a5776b7d51392f3f197", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124011, "uuid": "e8c9a92a-08fb-4d23-98a5-063fa1817e17", "value": "6144:KoNw0nNbsvhCpWyjtOPGDbagBLCd5g1TOaRcjfeWnLlDP9Z395e:pw44vIcyjt9/xBed5g1iaRWfe8RP9Pg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124011, "uuid": "141cda81-2783-47bb-8c6d-244b0bed87dd", "value": 417280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124011, "uuid": "f8d3d56d-bedb-418e-b43d-d60c224a3b39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124011, "uuid": "bd556f58-6b3b-4f1f-a0a9-9acc223e97f3", "value": "a34cab5cffba1d5b84e935cf275681a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf99ba5-59b4-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639139251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139251, "uuid": "c70c38dc-9057-47c8-8aac-4e6c56509020", "comment": "Malware payload (AgentTesla)", "value": "958565adbdf53dff0da12561cb8908c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139251, "uuid": "600567d5-39f8-470b-bb59-228edbea854e", "comment": "Malware payload (AgentTesla)", "value": "0d09ef33aefe4d73b673e30c1473d72e29c5938078b33c3e6e8952727a1b4a98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139251, "uuid": "cc5978f6-b23d-4908-a9cf-082785979d55", "comment": "Malware payload (AgentTesla)", "value": "9e9f37a2643ef63ae54c59f752d824ba94f50764", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139251, "uuid": "11c20e46-3fcc-42d6-9334-468567c81583", "comment": "Malware payload (AgentTesla)", "value": "15898d52d1a66208f10e4cc0953ce2ca24b6ea4c6c757a74ecfc39097392fbb6562f083e24f405a74065acf5bcca45f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139251, "uuid": "bdc84f1a-5307-4dbd-bb09-121eb5ba5bd3", "value": "T1B7A4E0937690D0F2D63C5933BD87A81D57A62DF4EE20C1193AA3F36A25723B10E506B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139251, "uuid": "ef97cabb-a897-43db-bc49-3ef403f7f2bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139251, "uuid": "ed95ad46-ec24-45f7-9e7b-d1990e897633", "value": "6144:G/2kQqvZRHlbBCZ/Kt8vR06bWsKr4z58jvMsD28ryQpTlCVLiwBuPOtBFcJoLVS+:ObE/NRvKr4O4sLpMLiCuPyFMoEQWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139251, "uuid": "b8e2fe64-3116-4094-8156-9909da236460", "value": 486912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139251, "uuid": "15c07e1f-a61a-41aa-bc26-c4fdf6816b3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139251, "uuid": "7b32895a-a7bc-449b-ac63-202f12d87c99", "value": "DHL Delivery Invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c16c6ff-59e1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639158606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639158606, "uuid": "702e0058-88ff-4b98-8dde-8873479cc76f", "comment": "Malware payload (Mirai)", "value": "7ddde43d1ee7d4a53dc0312826b8921f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639158606, "uuid": "650f5777-8109-4362-851a-15edf8872714", "comment": "Malware payload (Mirai)", "value": "0d8b1e3946924e29ae4b4a5059b27031b12e11aac80c521bb368479d024d23c9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639158606, "uuid": "e57af157-1d0e-423f-be5b-1818ec617c76", "comment": "Malware payload (Mirai)", "value": "7d7ca712aacea2df472383bea1f5145984c0bed4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639158606, "uuid": "97bdb973-c00f-4b12-ab08-c854562055a1", "comment": "Malware payload (Mirai)", "value": "efdf980c87b409da2179f545d08e9cbed7d7cbe1cd6f280742f50d3f74c161e4cc01bc0eb1d5f3633b04c28611d0f019", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639158606, "uuid": "9784ebb6-f165-4295-9004-02048add626e", "value": "T1B7E2D042D5D55182C01E617E3C9FB8C20D3CF6088AB86BF1AB4836699C51F2CAB587DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639158606, "uuid": "d4459ad7-217e-4f20-b827-7d8ce3eacac4", "value": "768:3UIGEhXNgP3aB4dlTANTeS1NnQUE20T9YAsnbcuyD7UryqE:OEhXNgIfmUEjT9Inouy8mqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639158606, "uuid": "aeb5d83c-3da5-4288-8643-dbe534b8c858", "value": 31740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639158606, "uuid": "118a406d-aead-4dcf-bec5-518280d01fe8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639158606, "uuid": "94fb743d-d1ec-422e-b42d-20dcf4b2a765", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c982395f-59a3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Matiex)", "timestamp": 1639132053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132053, "uuid": "d48b1ab6-f45e-4ab8-840a-c071289c8817", "comment": "Malware payload (Matiex)", "value": "adc9a988c81ba23d83d3b7d81e73e72d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132053, "uuid": "0e3173ce-faea-4726-a690-0c60a86feba8", "comment": "Malware payload (Matiex)", "value": "0ed581af922ee6b46560a356e22c2f663faaa456fa8d77ddc486a72fac96cf46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132053, "uuid": "7ec240bd-ab26-4c58-a1e2-785bd93ac8be", "comment": "Malware payload (Matiex)", "value": "7fa09dbf29a52ad77b397c74d78f01476952259c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132053, "uuid": "5487e366-fd76-4f8c-957a-22c7079fe57e", "comment": "Malware payload (Matiex)", "value": "7fe93f5394185309645cbc6859afeb70edddde5d8659de015a9f85772f4777b15df129d4f658c4b0a938eb32fea015aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132053, "uuid": "9555f89d-e126-457e-9b64-ff913e64fef9", "value": "T185C4E9379FCBA51CF5F4C5BCE0A14EEDE5BE4869DCB23685BA925B03D406244AF34482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132053, "uuid": "f137ef4f-16bd-4278-998f-9dae2f5704fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132053, "uuid": "8e3a4f16-703d-4a4a-ba12-d2ad1c2f5e3b", "value": "6144:uHUmGW8sUhhhoijQHWJzsWpMKDH96pBm5M6:ul8sUhsrIzvpMBbz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639132053, "uuid": "897a1925-0b47-4a0c-ad74-742a82b13571", "value": 574976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639132053, "uuid": "4d53243b-7a19-4016-b83a-7cef32b696da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132053, "uuid": "ec37cd12-6389-4310-baa6-0c568bae289c", "value": "adc9a988c81ba23d83d3b7d81e73e72d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78329e1-599e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639129956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639129956, "uuid": "bcb1c506-90b1-4c9b-a92e-61b7f28042e9", "comment": "Malware payload (Loki)", "value": "f5c69a67bb4b5ed0330cb10606922931", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639129956, "uuid": "88fe68ae-c123-468a-9ecc-742dd3d1f102", "comment": "Malware payload (Loki)", "value": "0ed8c9fc44e5ec6ebed7f608b9e035b7e75c765abca07f66203b30b74a36dc4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639129956, "uuid": "01d7ddca-22e7-4b7e-88f8-41d759d6196d", "comment": "Malware payload (Loki)", "value": "72cef237814ea7a203857a91aaf1ece1e708ed44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639129956, "uuid": "4b66e854-a1d8-4640-8785-45125c8a7ce0", "comment": "Malware payload (Loki)", "value": "3407366d7339fb182dc4a3250b7b5450920f4596854c9a2ca0030f01e55d88a98cef26502c10cd28d9b9c1cbed6be563", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639129956, "uuid": "c1c79a27-e31f-4dde-b4c7-46b159d4dd32", "value": "T11B3512093AB1E467C1295772C6ABC1508FBDF40B3EF2D77279D212BE6A747C94602287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639129956, "uuid": "0ec16ca3-516c-4bea-ae18-842fc09ec576", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639129956, "uuid": "89339364-3c3e-4ebb-936e-795fd5b118f5", "value": "24576:MIKjy/SYCpF7MSZCSgcqZ68K35vcREJDpdyIhw3xPeok7ZqC:KjASN79STZogEJDfyIhw3xPedA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639129956, "uuid": "b3b85ba4-dbc1-4afc-a031-f8ea9e84b409", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639129956, "uuid": "d3145dc7-2dca-4c0d-9ef9-e96c4a38224a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639129956, "uuid": "a440b689-6763-4123-b708-db53f1559ba9", "value": "seb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a084e841-59b4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639139286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139286, "uuid": "6c866eb1-5418-4fc3-a048-06fb1af504b2", "comment": "Malware payload (Formbook)", "value": "dbcab1ed6eb04c5ef36141584a5127d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139286, "uuid": "2bc432d9-5107-48bf-89bd-ec470b70291c", "comment": "Malware payload (Formbook)", "value": "0f1a0489b84ed6f3a910d6dfe2ece22fed9527038bf1260f95846273210b5dd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139286, "uuid": "1c087861-e52a-4ed0-a97b-5e00ad525769", "comment": "Malware payload (Formbook)", "value": "5c5f66b8e091afa9bf8478b29bd34cf5ad89985f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139286, "uuid": "f394d51b-49c7-49ea-b259-571b213cc364", "comment": "Malware payload (Formbook)", "value": "bfb334cb91cdca17a02160ef476198986a4171513b8961e5f575c39c02a07b1254cb1be84c4c1a670f025f4d10bc985c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139286, "uuid": "edaee20a-eb71-4aeb-aad1-5602ba9b9c31", "value": "T1CD556B5C317025AFE83A853149541F379EF12C7D866B93CE7317309B8ABE9468F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139286, "uuid": "ce9b0ba2-271b-4ac7-adf9-ecf9e9e57cad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139286, "uuid": "9ec5e8d8-4a62-4320-a3d0-f24371872ec3", "value": "24576:BoLQl5QGvA6Ck7d7+jjgu8LczNzQ1EwK0mRQ6o:BoL2vokpU0u8YzNQ1VKHK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139286, "uuid": "50ee77e4-6ab7-484d-8174-c11f8f3cac26", "value": 1346560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139286, "uuid": "e6039723-b0fe-43e2-a927-d70eee7f8a9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139286, "uuid": "ac1a464e-0e02-4587-9725-68b3087fa685", "value": "Quotation2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d192f36e-599b-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639128631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128631, "uuid": "29dbe413-0a63-4a5a-92a8-d6696a6a59d3", "comment": "Malware payload", "value": "8e343598ba830d20ffc22d2a9c82ad5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128631, "uuid": "5e95b6bf-ec9a-48e3-8ccf-d7434d22ceec", "comment": "Malware payload", "value": "0f2c35b80a36f70ab923b56c495ea6fe9ebdd48b3d5a4ff404fec3b99ff010d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128631, "uuid": "af4e8416-d9a2-45c6-a1e5-c0bc2565c162", "comment": "Malware payload", "value": "8954ee48bb9eb6d7462961c6fd5757227fdf429e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128631, "uuid": "8adc1544-216c-4aa8-878f-70bfa3605ad5", "comment": "Malware payload", "value": "a33a05c3dafa57b520e03ed2a94d02f4f189d172f91f1a7786c8b52621175d470dd13c8a58b40927fb7022656779cf95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128631, "uuid": "29926583-87a1-42d4-bf1e-e03312676d6c", "value": "T17451B7A7A5114EA3C9CD133C4E890B40EB7714628B7342716BA134DE97D862D657CE18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128631, "uuid": "a2a7c858-1b02-448f-a629-2d28d620e8b4", "value": "d6b3016bb468188798a509dbca70f316", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128631, "uuid": "5508ed5f-1d15-4950-99af-40e126c6954f", "value": "48:60wZj1hs9n1Dfehog6os5MPU1zl63+DB:kjQDfen6WUtl63A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639128631, "uuid": "73c0b243-784b-4b1a-bebd-d44a6e88ee93", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639128631, "uuid": "95ebca5a-bae9-49ab-8c77-2adb96e0d55f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128631, "uuid": "f55bec53-aa19-4df7-9a10-1573d594f805", "value": "eufive_20211210-034355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1878f1d-59fa-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639169406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639169406, "uuid": "72c9db53-5ed7-4de8-903e-665c047b0825", "comment": "Malware payload (Mirai)", "value": "764a42fa09b0afac3915cde1d3c40686", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639169406, "uuid": "017d3aad-ed08-4942-a6dc-535c23bd3537", "comment": "Malware payload (Mirai)", "value": "0fefc4addeaa62ba13636f481081e60e160c48ee822546348657cd572c1002bd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639169406, "uuid": "66293c7e-08a0-44d6-b75c-e497f9c6fa7a", "comment": "Malware payload (Mirai)", "value": "edc62b61205ea5852a8e7c77bcf3a6b784a7cff9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639169406, "uuid": "55261d56-1c74-4297-a76d-d957f07201d0", "comment": "Malware payload (Mirai)", "value": "638d4846101e388c2fe2c7d2ffe112563988b2aedf74814188eae1a70613d2ec317a93de98dabe162773c7a69f8eaeb5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639169406, "uuid": "a8b79ef1-c0ee-40bc-b1c1-4028bc9c0e13", "value": "T117D2E0B8289B9972E5B15770DAE5DEC132030B2ED47BFA32250507D1CE8234E6B7E1A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639169406, "uuid": "d842d670-7449-403e-9e46-13dd2b177e52", "value": "768:VXQD3WV1wjry5HfJVih/y79gBS4zzs3Uoza:GD381bHfWJyZgBSCeza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639169406, "uuid": "c3d63a07-4a08-4751-8fb9-7ae0664db5b4", "value": 29852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639169406, "uuid": "9ce4dff0-41c5-49a0-a59f-70c1c08f083b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639169406, "uuid": "fa04124a-395b-47f8-bd90-df949c78e315", "value": "trynagetmybinsufucker98575.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6722eee6-595b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639100964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639100964, "uuid": "84f1a6f1-7067-4b91-aaf9-ee5d7cf60f91", "comment": "Malware payload (Heodo)", "value": "e1f5d91c6a7179887ef04517f508271e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639100964, "uuid": "b69e612a-ebc1-462a-a6b4-76c89a0dbdb5", "comment": "Malware payload (Heodo)", "value": "1063f17c451bbf6e390632e48e242f713bad7e23fa97b743d871f426c1259258", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639100964, "uuid": "0aec3413-4741-4194-8995-2f148de7f6f2", "comment": "Malware payload (Heodo)", "value": "3e8664a9f2e1454cfac150bc6a3ac162b666e4c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639100964, "uuid": "1c41121e-9840-4ba8-862d-9b1bb8ef9994", "comment": "Malware payload (Heodo)", "value": "047321a448efcd3e5338cf0290d965a951bf8bbc2ef7e1af0326d2874b3eaaf56ed3a1bc47e33cc86cb7a5dafbe65c50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639100964, "uuid": "7acc68ab-ff85-4071-94a4-02906757911c", "value": "T14D44BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639100964, "uuid": "dae21f05-29b9-4797-acd1-43cb163f6b9b", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639100964, "uuid": "c09f11c7-98c6-46e0-b298-d6ab4dc02441", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTB52ypv:6jIG/pjjuLbJLmGshoCUnWTLpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639100964, "uuid": "fd8b4ebe-4c1b-497c-94a5-22c1f76bc284", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639100964, "uuid": "1549c1d2-86bc-4ff0-992b-27aba4fa8e8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639100964, "uuid": "35eef0e6-4038-4310-8e09-52c62ab8aec7", "value": "e1f5d91c6a7179887ef04517f508271e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041693d1-59a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639132151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132151, "uuid": "a664b2ab-ddec-4be6-9a01-36188b288f12", "comment": "Malware payload (Formbook)", "value": "ebc500d04ca591a37b983f0d80a2adc4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132151, "uuid": "a558c22a-84da-485c-a4ab-9ddabd24e5ae", "comment": "Malware payload (Formbook)", "value": "1148d0e5cbe365bec3ffc50e55c16fc857367c10b31657beaeb8a747258e5147", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132151, "uuid": "ec716713-64e4-4f43-89de-3ca529050fcd", "comment": "Malware payload (Formbook)", "value": "e6bd53bd852860e9bfd678cca673452f9f775f47", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132151, "uuid": "6630a854-4e20-437b-b157-d4ec1d74d07a", "comment": "Malware payload (Formbook)", "value": "fb367617a722e2edd7b2e2eea6c19aead627a14c41ee1b5df7b57fb0f8a76371b69d962d7bbad4d83fc140afba0ed07d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132151, "uuid": "b1d7174d-8951-46b2-99a6-5a8eeac5c0f8", "value": "T15391B23242682C92DE13C9EAD4F1FF6B15D2F22A81CB16A5376CEE720B477114A22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132151, "uuid": "959befd1-7ec7-4ed2-a56d-9f5bed320fd4", "value": "96:hmLvPlNAY78YqSbybiXJK/jtg9+Dxll6IGHjItTkCwy0:hmPlv8YqSbfJqt6+DwnH8GCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639132151, "uuid": "6dd6b8f5-c588-4449-a8eb-241b2cfb4cb3", "value": 4613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639132151, "uuid": "4e1e1acc-d184-4d0d-ab6a-f61e5c434c96", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132151, "uuid": "7cc65317-044f-4aca-a12b-4cd462c8fad3", "value": "PO 212RC048.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccdf7430-599b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639128623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128623, "uuid": "5a1da275-1cca-46d6-bdba-e548426944ec", "comment": "Malware payload (Formbook)", "value": "915b50267cf80486654da87f91523f27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128623, "uuid": "057af604-8e64-4b64-9457-6ee886b861b2", "comment": "Malware payload (Formbook)", "value": "11b9bbc9097d7b715e177ab57fd8669891dcc9241441036418a5f254d36f2edd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128623, "uuid": "2096174b-bd3b-49ef-b57f-8373085787e8", "comment": "Malware payload (Formbook)", "value": "d522c963208031cb5425807f0c70b952fe6c1996", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128623, "uuid": "e4736048-2741-498b-9911-ccfb85a8c26d", "comment": "Malware payload (Formbook)", "value": "704a7aa3800eef1a0ef7ec454d637af295c1c6ae0c68a6b0f4e296459e03a2046ee0bde05eba33e6417cb09b25796312", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128623, "uuid": "59e2cafb-bc18-4a2d-8979-ce8cc54c2322", "value": "T126641395A0C2BBB7FF911532917B53F4F3B99A6400051E4F9B302F3F3DA6543466A291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128623, "uuid": "5c9159db-ad40-46eb-9c71-74b951626f8a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128623, "uuid": "f32db055-0216-46a5-a051-bca9071aa557", "value": "6144:rGi1H9W2dfLoZGf7JAOrlVaVG8nNl92a6uqeSL0CgLcAEY6FVY:Fw2dfj7trbaw8l2laSvgLbEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639128623, "uuid": "ed74f8b2-42b4-4bcf-aba1-74d1029eedb0", "value": 315138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639128623, "uuid": "8d5a1935-287e-4e0d-bbbf-996732ea375e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128623, "uuid": "019df063-75ec-41dd-9c99-0cc55b13cb9e", "value": "loader1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa036843-5964-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639105076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639105076, "uuid": "bf6aba02-72d1-49dc-8828-7f042e5f99e0", "comment": "Malware payload (RedLineStealer)", "value": "6a6a8a71fc1fe5ea5e6ddcba08a07fa3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639105076, "uuid": "8d31fd9f-4ed5-4a20-a6b5-8e421b3e9399", "comment": "Malware payload (RedLineStealer)", "value": "11ee21b8f3d2bd8ad3deec621781fb051abffa3de5cdd74800ca622b162b53b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639105076, "uuid": "fa3480a3-5502-48ad-87fb-e1ca146d4335", "comment": "Malware payload (RedLineStealer)", "value": "5c28fc0b46088312a42f647f07550876a01fe2a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639105076, "uuid": "409f1146-955d-430d-82fc-871b5073ad92", "comment": "Malware payload (RedLineStealer)", "value": "e4e77b918888f9024d5cb2cfb0448663cddc217333209de9e31cbd11a95ae0c3b99cd9d7121cde91d115f9239dd20908", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639105076, "uuid": "8c3f7cee-0860-4394-8d78-3cfbb85958aa", "value": "T1C2D402F17599EA73C1A31E3198259AB40D3BBC63D9214047E3D4635E2F72E9C49E232E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639105076, "uuid": "a3d5ae1b-be05-432f-b4fc-9256b30b1f86", "value": "784912eb6940550282ff4b089d7e66e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639105076, "uuid": "9659b4f1-69df-4959-9aa1-16837efc7aeb", "value": "12288:JokbG3nJaAXBnYFVxbJUQnrTm7y09xhoArtq3fu5+OOFQgunnXm:KkonJZS/Fnr6v9z9rc3fu5GwXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639105076, "uuid": "65c6d5c0-3688-4aeb-a584-06570878a087", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639105076, "uuid": "8cb51ccd-d3d8-41f9-87ee-35d5bfcbd6bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639105076, "uuid": "9c5200e4-d378-4c4c-90b9-e27178cd7a9a", "value": "6a6a8a71fc1fe5ea5e6ddcba08a07fa3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec1f4ee-5971-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639110426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639110426, "uuid": "0108df1b-018b-4535-95ac-e62ac7072fdb", "comment": "Malware payload", "value": "0a5b765dcb1e36e5d6819e383556c410", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639110426, "uuid": "3d600287-f7c6-45d3-a1e5-81cbc34b62f7", "comment": "Malware payload", "value": "1231c3731463907d2a48d67dc7ad19f6e2475b75ec0b206eaf51459acf3ccc27", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639110426, "uuid": "6a349c57-14fe-4239-a41f-bb6604ae182c", "comment": "Malware payload", "value": "296520076340fdedae9b1f9d9a4575c7ce01f188", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639110426, "uuid": "9282a9df-2e49-4d04-b190-2916b8ae7a04", "comment": "Malware payload", "value": "126e9c312525fa7f22af16672fbf40ffa10a6f760cf310af20c3acb9574d0f41ef6c4c4fbc676f2d1b6cf7f29586209c", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639110426, "uuid": "751dc250-b5d2-4433-9efc-f93de452d149", "value": "T1F0B5330ABC20F421CFD0B16981CBBABB9951F8F13592B1317B86886F9BEA4511B5C5DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639110426, "uuid": "f475bbc7-08d7-480c-910a-09fee3394928", "value": "49152:Y8w2XCKU33vipGRd3WoCauWYadonR5SKgMb5cKmJ:Y32XpUvpdDAVe/O+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639110426, "uuid": "9074a7b5-01df-446a-b16a-c5af2098a7be", "value": 2283056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639110426, "uuid": "85e0f5e4-28d3-4054-b42f-d220d035a20a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639110426, "uuid": "8fe0468d-ceb8-4533-aeda-9b9083fe3d3b", "value": "Packing\ufffdList\ufffdAst2111-111.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ebacb0-598e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639122701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122701, "uuid": "2e98dbf5-be4e-408e-9c98-ef7e43026a93", "comment": "Malware payload (Formbook)", "value": "f87c8959a883c6e27fded9eb90e0f978", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122701, "uuid": "a7088d36-37d6-46be-9e10-65a4739c33c9", "comment": "Malware payload (Formbook)", "value": "128565d8c69c668f3cea8d494acef71023f775d4008272791ad147abe49e6842", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122701, "uuid": "dbde20a6-25b2-4cec-aec3-c6ca483a9b88", "comment": "Malware payload (Formbook)", "value": "331b62dae1c72356b440a5642fbc5546dae7dcc7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122701, "uuid": "99e1969d-dbc6-41f5-ad99-ea87be9c902f", "comment": "Malware payload (Formbook)", "value": "c71d9e75d053595e99314c21eab187307d1163a30181afabc2c29f8eda279ab19b7ee5f1c5dee46166163b24a923fbb8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122701, "uuid": "502e11dd-f3ae-4c97-9f49-187504ff0fc7", "value": "T13E84FB51912E3C6FF62FE81C1593E1C8386EA57AA4F0056C939EF014DE259EAED8C17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122701, "uuid": "63b04b0c-9de5-4bac-963f-a143f60aed49", "value": "1536:iTfAogDDDDDDDDQ6SjE6chyDXEaoczydR07U8QV7hKfedzFz76mAg5eeVhMDw5wY:ikdDDDDDDDDPjdzFtr5RDAw5wfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639122701, "uuid": "e5faec52-8051-4d4e-9eeb-3cbfec2d2ff9", "value": 392699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639122701, "uuid": "6599158c-f91e-437c-8a56-f0273205cf4a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122701, "uuid": "4cd66c32-ebd0-484f-9a3e-87c0779de08e", "value": "Detailed Check Remittance Information from Henry Schein, Inc.eml.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b24d6f-59be-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639143428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143428, "uuid": "c63efb57-027e-478e-9321-fa11907a8a51", "comment": "Malware payload (Formbook)", "value": "88acc00ceb6a2ebb43384559aef3eeda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143428, "uuid": "08bcba17-caf0-4e81-aa7e-a364ad702513", "comment": "Malware payload (Formbook)", "value": "12d25165f4043c9fac5dc9088a4d3451e7ba0cabc3e46f9a21c9063ad1e71c0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143428, "uuid": "ddea34ef-0fa5-4947-85ae-a47e18fe612d", "comment": "Malware payload (Formbook)", "value": "0d0255c4606fa82bcd429ab17da0f17577b6b6e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143428, "uuid": "25be46cd-6b47-4df5-ab9d-47c5559321a4", "comment": "Malware payload (Formbook)", "value": "e6177bfe007b65853d359a65071ad5fafabda0fc7717b4866b5cd7947bb38d9d2fef0e7cbe004b445cf2cf0884047ca4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143428, "uuid": "0bd4bf6f-8795-4dbb-8604-161f69629298", "value": "T161541293DBD4C9F7CAE24DB059BAEB76DBF9439809011C875F64DE652CA02432E14F82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143428, "uuid": "52c03eb1-2b53-4e8e-b685-c31af1170b29", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143428, "uuid": "b4ed2549-fdac-4d73-92ab-187ab6f48d85", "value": "6144:rGie6jySs20l/vtOH5wRX2XYeOKhg/bPkqtB4yYPCWhmOMrO:S6uqsdOH5s1KirkqtqyYPXIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639143428, "uuid": "7429aaf4-5683-412a-b9cc-8c3f6f80afbf", "value": 281071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639143428, "uuid": "f3efc154-1236-454e-991d-5cd49d956e6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143428, "uuid": "3481effd-12fd-42e9-be20-254c88a6a077", "value": "88acc00ceb6a2ebb43384559aef3eeda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772b7e21-595c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1639101421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639101421, "uuid": "67c1a2ef-9b4f-4759-b3b1-0e337a0ad441", "comment": "Malware payload (Gh0stRAT)", "value": "0856364e16bd3d86e02cd6b225898789", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639101421, "uuid": "eabb4249-71e0-4ebe-b9ae-13e9bffe045d", "comment": "Malware payload (Gh0stRAT)", "value": "1367ecca54ac27ce18179d6bfcc0ff93bb7cfb2882dc60c21ddf64726ba19936", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639101421, "uuid": "145c7bf6-2d2a-4f48-ba44-ce97888b70f7", "comment": "Malware payload (Gh0stRAT)", "value": "38f2c492da0754645cda211ff124b4b25cb86e38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639101421, "uuid": "26fd45ed-aa7b-4afe-8f7b-64bb28023b9f", "comment": "Malware payload (Gh0stRAT)", "value": "97271995199ef94ef5569701b55a84b7b40c2940868341745f9742cd1a213a9d9831a791394ffd24d76a9b107449875c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639101421, "uuid": "f18af30a-edb5-434f-840c-5c3143050dcb", "value": "T10693E127A3D0C8BBE557053101725B39F7BBE3002A51565F77740F9BAE260C3DA6A2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639101421, "uuid": "5c9bfbad-fc8c-41d0-bdbf-0cc92f45a40c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639101421, "uuid": "04505f99-0f55-4b9b-be08-31917936ad5e", "value": "1536:ALXB65939tY6HBg4sXJGKDsLG1C/DsAaE2n73P4Qjky2f/:ALk395hYXJvsLGyDv2n7wby23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639101421, "uuid": "0ac5ec10-c6a1-4d5d-b608-431762688619", "value": 91990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639101421, "uuid": "1fc1d0b7-30ed-4273-8463-0b2060e23526", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639101421, "uuid": "91e86e4a-66f5-443b-ae3f-be6817d0d701", "value": "0856364e16bd3d86e02cd6b225898789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37b62f4-59b5-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639139774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139774, "uuid": "282fbc8a-9e81-4ed9-9143-8a7ca1ebc863", "comment": "Malware payload (AgentTesla)", "value": "12bc5df277c95246f1e0c503da2edbc3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139774, "uuid": "8cbe23b4-3b4d-4734-b558-c9054a48ee53", "comment": "Malware payload (AgentTesla)", "value": "143cbbaf24e3f5bfca06511816bbcc7bf0845cacfd0fd168c87b877c2237fb6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139774, "uuid": "636122ad-966d-4eaf-a22b-14045119327b", "comment": "Malware payload (AgentTesla)", "value": "78020177e4d1f8533ac4f7d4748bc1cdfb982c26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139774, "uuid": "9ea073c6-c81c-45e8-809e-d43db3c9f7c3", "comment": "Malware payload (AgentTesla)", "value": "2cc10bf92883c6a2d3e37c1666b2809322eaa81eb75423bf0020bd3b99368003c72ec2da642f89bb2d3ae12f058d4005", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139774, "uuid": "805125b4-fe8a-4d18-a95f-fb997b792e52", "value": "T1ED9533C17C7D24E8C8DBE1F097D9BA92F70426584AC36CC6691AC16A48C6F2D137FD62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139774, "uuid": "5f323669-55fa-409e-8e3d-5220af773e9c", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139774, "uuid": "a738b637-f268-463f-a6a8-d8d6adf60d40", "value": "49152:OBvxHxhPSN4HudFdazjud166NWEa18SDIgG/9+SWzQo:exH3aqqTazjonWxeSnG/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139774, "uuid": "f8445393-9f3c-4996-a36f-2b78fbe2956b", "value": 1955456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139774, "uuid": "9f93dcd4-3f50-4e3e-9b2f-592d550b07ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139774, "uuid": "a95fd65c-d141-487b-a8cb-21b888e9bd43", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.25933.19037.24004", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0628a66-59bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1639142346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639142346, "uuid": "1c98cc5b-47c9-468f-bed7-fb3ba0272e4b", "comment": "Malware payload (TrickBot)", "value": "5386bd033e077a1cdde00d2618e764f7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639142346, "uuid": "30d2f7f1-bdd1-40ad-af51-e6dac956935f", "comment": "Malware payload (TrickBot)", "value": "193ed2a28bfc15b141dc76ba5861397991673ce6a33e8221783d312a41ab1253", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639142346, "uuid": "874254b9-9bdd-4fce-8b07-2a9669292fea", "comment": "Malware payload (TrickBot)", "value": "5980aaa4d9a431b93cc830e1e1e562671d3ac23b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639142346, "uuid": "9a82393e-1ffa-4193-aed0-6eec5328d651", "comment": "Malware payload (TrickBot)", "value": "36f33f71eb98d88681b11411e059bdbed62e45fe2be02d276da14d713f56b66b4932bf36af16631a897fde560c25b1bc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639142346, "uuid": "73ae7bcc-b7ca-40a1-b2a6-4fbd2b7220de", "value": "T1FA85335277BF50417956D9EC88D80ED7AD0FF3692A021E3747625C1072A5BFABEC802E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639142346, "uuid": "3f28b12a-2436-49ec-9c68-239562d5f3c1", "value": "42dd9e2a645d4de89a554a12e88f192d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639142346, "uuid": "57a43e34-d74e-40c2-96e6-7396dbcf0b89", "value": "1536:tAv0EU2r1DNDK28Zjv41cpBSf3VuS6eEhYX9/uBtRkD6ym8iX4a2A:GU2rvu28SmjmuS6eEhYXJu7RkD6A+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639142346, "uuid": "f84c01e1-360d-4617-9c90-d6bf420e7318", "value": 1771520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639142346, "uuid": "fd156681-2a24-44ad-a3ba-99f09acb80cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639142346, "uuid": "1ceec394-54a3-4c09-86d9-660957336f04", "value": "193ed2a28bfc15b141dc76ba5861397991673ce6a33e8221783d312a41ab1253.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499eabd7-5991-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639124108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124108, "uuid": "68f8f4a7-6d9e-4335-9a5f-8b02d033a648", "comment": "Malware payload (RedLineStealer)", "value": "51059f0b8dea23a1d153ae103abd2e50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124108, "uuid": "e5513517-694a-4687-a0f8-06ed866abcff", "comment": "Malware payload (RedLineStealer)", "value": "19b8025cf8a5ddc24a7b75b5f4ca52132aa6659c277d9d78e4d91989e9408999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124108, "uuid": "1dcbbb52-53c1-4a2f-b7ab-81eaeef37974", "comment": "Malware payload (RedLineStealer)", "value": "4747f2fef8721a247c2c756636255eab845a907c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124108, "uuid": "2a3b2a03-7969-42b2-94f3-56e4ce2914c9", "comment": "Malware payload (RedLineStealer)", "value": "a21150a95c07842c71e55cc12d82a59e89f6f90bc20383d45ba2067ba32a45606e9c9d70c1cb9cad0d0aeeae24c81185", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124108, "uuid": "8a6cd566-194b-42bb-9e17-857300ef3a55", "value": "T1935533FA3FD8B245C15E37F49320B9EFC022D93CB5D98166F24FCA610C8A0BAD945256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124108, "uuid": "d34f3322-dd11-44a4-b05b-93aea8994408", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124108, "uuid": "662f7d88-ead7-48b1-aa87-ace9729532ea", "value": "24576:hIxd+0lhP9V0SsqvFNrYkQ53vJoOLW21V10tsPoxO7f2fkEaHNYK3ICP3M:6asP9V4qvzrhQxGOLzABx/fNarP3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124108, "uuid": "c1ab07f6-2856-4f02-a559-c87a47574c14", "value": 1374424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124108, "uuid": "e2949382-ea8d-461f-8461-325a4a1269c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124108, "uuid": "0be3fcae-173c-42a1-a60b-fb5d61f6b81f", "value": "51059f0b8dea23a1d153ae103abd2e50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adce2882-594c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639094640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094640, "uuid": "9e8df55f-f767-4b58-9cb8-5dffaa604e9f", "comment": "Malware payload (Heodo)", "value": "ef47f446b79d70ceaa58c8b6ad406129", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094640, "uuid": "2e3d9a27-6d9e-4bfe-b2c9-766a4451ba22", "comment": "Malware payload (Heodo)", "value": "19fa823a51ed2530dac82694d750fddf73d0413275c2a995f15e8868c1edbc89", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094640, "uuid": "7dde5244-9ad8-4aab-a411-0fe808144b54", "comment": "Malware payload (Heodo)", "value": "a72f8d420a01b18d49d40d98e54ae610287cc8cc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094640, "uuid": "cd103878-f7a9-429a-a2c3-e056e1138c62", "comment": "Malware payload (Heodo)", "value": "167f36dff32916dda4dbd2588fa7f41aeb4fd33a65362a10e06edd4da6b4a23ee1391ee328de599935fcf20c5bb7eaa3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094640, "uuid": "cb8b98b5-84a8-45ec-8e78-3dbdc336c75c", "value": "T1D544BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094640, "uuid": "bd98680a-99d9-425e-b34e-75e7563c26ff", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094640, "uuid": "39df4349-2b16-4f71-b3bb-65545e3b20f8", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTB22ypv:6jIG/pjjuLbJLmGshoCUnWTCpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639094640, "uuid": "b5030102-972f-4f24-b0f6-7d75b56eab12", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639094640, "uuid": "958700d7-d01f-41b2-8631-af23e9553402", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094640, "uuid": "4933f343-c08e-4e97-8255-314e71072a5f", "value": "emotet_exe_e5_19fa823a51ed2530dac82694d750fddf73d0413275c2a995f15e8868c1edbc89_2021-12-10__000356.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a02b7ad-59c1-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639144617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639144617, "uuid": "f44f2649-e7ab-49f7-8880-03257fa313a8", "comment": "Malware payload (RedLineStealer)", "value": "95bdaa8d30e4f7b0bc2b832bd5fc023f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639144617, "uuid": "2ea078c4-d931-42e7-8777-1afb7ea60bd9", "comment": "Malware payload (RedLineStealer)", "value": "1a096256a38f154de22847fb249e8f73bb2c2457c0d818737af7a41264d14cac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639144617, "uuid": "ede9ae6e-613d-49d1-99b8-1eb5cd0d2595", "comment": "Malware payload (RedLineStealer)", "value": "8f42aae6486621293cf3408de2e2413f044b6e67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639144617, "uuid": "6d1337ab-45e3-461f-be1b-9e5b54fb2415", "comment": "Malware payload (RedLineStealer)", "value": "ad94ec5e865b3b9ca1db7aa9ba82e32f0cbd8c5bfc5ebae4773ac93a5d50fef109c90628c2e042425b9a545f6626f7f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639144617, "uuid": "83dbdbb8-52ed-430c-b124-32375d559d59", "value": "T15F74D032B6ADD871C0634D33B8249AA40D3BB8516920504BE7646F9E6FB2F9C47E531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639144617, "uuid": "fa9a4131-36b0-40aa-abf7-478601abefcf", "value": "fe609548539ae8502df3cf294274ad9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639144617, "uuid": "f34b61d7-c73d-4ed1-905f-22dbf30e8998", "value": "6144:cHILz7jP7iHUYio4X9VR2es89+uEFaJ0RBfEcDm3pwM7N8bEnT7GJuzbgwu6Qigk:cHIf7j6e9VQeJ+uEFK4FEcqy7oKJunn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639144617, "uuid": "10baaf63-c934-4909-8fd3-5c7649e162f4", "value": 366080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639144617, "uuid": "4e3c12e9-58b2-4bcf-b15a-03162320bb8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639144617, "uuid": "ff0fcd15-e295-4918-8f57-45609306a546", "value": "ferrari.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee4e11c-5991-11ec-96a4-42010a9c0029", "comment": "Malware payload (LimeRAT)", "timestamp": 1639124090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124090, "uuid": "5bc12031-2710-4f46-81ea-aa83c3b95ab0", "comment": "Malware payload (LimeRAT)", "value": "908e383094b1c4f2d4366851083bc6cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124090, "uuid": "21203821-bc90-47a2-8f1c-0e78c04a79da", "comment": "Malware payload (LimeRAT)", "value": "1a4fe1e452261295b2fa88f08e2ebfdcf608aa17aa34edfbd8a652b9e8e21407", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124090, "uuid": "4b008cab-d68c-48f8-b4d9-ea824269714b", "comment": "Malware payload (LimeRAT)", "value": "8f6546bc684c9b2c6a706a1dffce5c70c497c74a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124090, "uuid": "a3e15e74-e6d1-48ba-8dbe-38d87e837691", "comment": "Malware payload (LimeRAT)", "value": "bdf60f2a86795b681dfac445e75e08781587c51fdc6bca31d1bbaf41decb70412ae0072d153b5daecd789ae519b185d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124090, "uuid": "33f361e2-f625-4c68-aca9-9505e0b2066c", "value": "T165945A2D25C7E6DCF93ED7B43AA4619803F5BCF5E603E1DEF895309B5933A406A22121", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124090, "uuid": "35da564b-b745-4afb-bb22-f33d3b59528d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124090, "uuid": "89388a7f-7a4b-4b51-9853-4d72231df265", "value": "6144:wkA5pXOGsGZLjKmWFRSRtebkTlJ0cV1BDlUjVyDxA7LcyGsfyi2Kq/bLq:1A5pXOGsGZLnP/BRUjVyNAhXfv2FTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124090, "uuid": "07bc29f4-5f00-461f-ba05-ac617df7f9b4", "value": 423424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124090, "uuid": "cd1fb99b-8559-462b-928b-e2177c390b32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124090, "uuid": "bf35b421-cb14-4716-ae98-6c296e470e72", "value": "908e383094b1c4f2d4366851083bc6cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9d7bbed-597a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639114471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639114471, "uuid": "96215190-f03b-4b93-8ebc-d69317be1e4c", "comment": "Malware payload (Heodo)", "value": "2f836b3e4c6a2cab2b2fb0187f85a282", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639114471, "uuid": "bb90d657-29bd-4084-b7f8-4c59fb4373ab", "comment": "Malware payload (Heodo)", "value": "1b2bbf00b65ae95a3b9330e72cce39b1179bcb3f25374c56b5eb18f5ae6f72b9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639114471, "uuid": "5fe0cf54-ed4d-4be9-b927-552f2f314947", "comment": "Malware payload (Heodo)", "value": "e47819d7ef3e3e58c5977aaed1bbd92bf74bd1ae", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639114471, "uuid": "e913c093-48af-4869-bd3e-57a5b0e11e97", "comment": "Malware payload (Heodo)", "value": "f7bd49357b20fb18e2f3bc59be74c9de0743adce9b9fe0610ee81150599b7259fc8068ef6fd7060b08245589d08c229a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639114471, "uuid": "e460d3cf-95fa-4412-9fea-850c3f7ce8fd", "value": "T14F14D010A440B036E9E324BB86FFD57A8A7C6B50078465DF83D85CB99FB55D1BA3018F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639114471, "uuid": "6c1cdac0-7e4a-4187-b220-ea314ce962c4", "value": "6144:GPMd2FdFQ+PMRm/Z8ezVSbpz6LcZ5Fl9EppXxqJV2:WQ2d86q0VSN6LcZ5Fl9ET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639114471, "uuid": "1b13b05b-58cb-48e5-9959-f373950d738d", "value": 205094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639114471, "uuid": "0860498c-5d24-4e69-bdc4-da7f271f9c51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639114471, "uuid": "09593ee3-24eb-470a-aaf7-3e061d3ae7d4", "value": "emotet_exe_e5_1b2bbf00b65ae95a3b9330e72cce39b1179bcb3f25374c56b5eb18f5ae6f72b9_2021-12-10__053353.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007f531e-59e3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639159204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159204, "uuid": "58183e14-936a-4071-9277-23e599855067", "comment": "Malware payload (Mirai)", "value": "01c8ebcf1d13dfc7afb6aa7ac5968d91", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159204, "uuid": "dec98f57-d421-429a-a072-e5b0daf29e52", "comment": "Malware payload (Mirai)", "value": "1c052282ca21eabbcbb8582e16c89f679afcd5c9c3ec8e9c96a933044936a1bf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159204, "uuid": "36f28190-628a-4b3e-8fdb-14051c8b3984", "comment": "Malware payload (Mirai)", "value": "645a2720d1ecff7c7ffe894519ee7b14c870e62c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159204, "uuid": "8f526a5d-94b7-446d-bb44-429d7bb44334", "comment": "Malware payload (Mirai)", "value": "9940f5687e64f4ae25d6c3dfbcc6c4a567f882f05cfd7f9cbad9067974189311f45f709bd902c69de097cb53bbf84013", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159204, "uuid": "329bcd87-3dcd-411f-9079-f47426ed300d", "value": "T1AAE2E010DFFAE600D507AA351CFB3E8F2882F55D55C98A52EEDC312264A5BAC2E245E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159204, "uuid": "bec7dbd1-452b-41ef-9934-448c6a975a68", "value": "768:c+pImhrlMyFVHqkCa6D1R8bOB7yBmBUHwaS6FnbcuyD7UoQRjq+:NpHBMuBV6DzAOABmuHwatnouy8oyu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639159204, "uuid": "5d46f4a4-21cd-4a9b-9889-e53e50b6dca7", "value": 31580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639159204, "uuid": "699fe94e-9e62-4bbf-b791-d1a30de77d71", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159204, "uuid": "ec5a5cc2-fe11-4776-91a9-fd949ca73eb2", "value": "Tsunami.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99147a48-5995-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639125959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125959, "uuid": "46572831-0ab7-4edd-a908-e1228e085ec5", "comment": "Malware payload (Formbook)", "value": "5312eefc48e70f8833f1c8496acdc258", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125959, "uuid": "d82a0562-5153-4f95-b4b6-43602615374c", "comment": "Malware payload (Formbook)", "value": "1c2416570a4c0f3af0612d19b93141c2b78a941bcc7b6789d5d9eb67ada0d9d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125959, "uuid": "91c3f530-431e-44f1-8e02-1fb13d23dc63", "comment": "Malware payload (Formbook)", "value": "8e25ace67b358635a4c912feb09ec25bad224747", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125959, "uuid": "946a1a8e-a481-4602-ad65-1bd3a21b9aed", "comment": "Malware payload (Formbook)", "value": "410a279693ae4524c5263e79f43c2d5e46803ce6ca9db23c2173ddb3d821c8765e1e9712047e053f2deab33adedb7817", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125959, "uuid": "edaa1fbc-ac78-41f0-9b04-7634f88fd6ef", "value": "T1F044224B62D09E6FC8674DB85436B777E3BB440003E556274FACAF7AEDE1083065A392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125959, "uuid": "3607bcc3-c94a-4028-a7db-0762e02c448c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125959, "uuid": "6183e0e8-80bb-46bb-9290-c3359912499e", "value": "6144:rGidDPv3uoYwEA8TCZPOgKJ/4oaz1SHNyVnnzU7aMS19:RTvuYRZGfjVY19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639125959, "uuid": "299d3917-b4d8-418d-aabc-999680242932", "value": 267723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639125959, "uuid": "01eac083-d650-4274-92b9-206ec656d55d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125959, "uuid": "0f2d60b1-0cdb-4805-a33f-bfffe98ab46a", "value": "5312eefc48e70f8833f1c8496acdc258.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50015373-59bf-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639143875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143875, "uuid": "cca13999-26da-4f0d-8293-f8596a30a511", "comment": "Malware payload (Loki)", "value": "227b81ccaf9798b0d5b15756a9fab2d2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143875, "uuid": "293db513-7aac-4177-91bd-92d1652965d9", "comment": "Malware payload (Loki)", "value": "1f7f0e807662dea1f41db59b70e82b89dee30c7f08a920ee2004273a5de977e3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143875, "uuid": "312fad74-036e-40ca-9672-72f40ae3b315", "comment": "Malware payload (Loki)", "value": "ad677e3605710f247d61aaa81cbf46a482afb60f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143875, "uuid": "aa4fae06-197a-4727-bd06-8a4ea332c280", "comment": "Malware payload (Loki)", "value": "ee98b14d6d873dc24e21bf59408af2aa4ea16fba61d672774036fbcc7b970df5279f03ca65cbb17474760409d0e8c734", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143875, "uuid": "2d0f06d7-20bf-4cff-a278-f9285dd06dec", "value": "T13C241285C90BEC29CD7F257CC56B34F6E452500611A0F27CAAF4707FDA1AB871A29E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143875, "uuid": "ba0b8215-ad21-41df-95f6-248272c9c5c9", "value": "6144:ETb5QVQXeM31uTKdaV1KWRKGfDtbtpktEV:ETVcitumc7KwDtBpJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639143875, "uuid": "484c6a4b-27fe-4578-a5b4-76e1e24a6c2e", "value": 228087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639143875, "uuid": "82cfecd8-a2b0-4a5f-b1b0-68836476d08e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143875, "uuid": "9fb2e7de-0d44-42e2-8b46-4bbf48b0a9d3", "value": "TT_copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eeecde4-5980-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639116842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639116842, "uuid": "4d20465a-48c8-45af-bc3e-b858b7edf5f9", "comment": "Malware payload (Heodo)", "value": "5225f5e8f0d38d4a496124d14fd6ef28", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639116842, "uuid": "c69a1747-ce13-4827-a828-bf1d67595943", "comment": "Malware payload (Heodo)", "value": "2106edd3f67227cfc48955401bde2bcaba20efb60bb74064e81833a2cb20f0f5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639116842, "uuid": "699c476d-f812-49f0-b113-7cc2837202c3", "comment": "Malware payload (Heodo)", "value": "63496b8eb221d707ce92202e176b1ab8ef11473d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639116842, "uuid": "1f1f8f49-d6bb-4742-b132-b480ea9bed58", "comment": "Malware payload (Heodo)", "value": "934f053fcb5d2a808f6d7f90d68944c11a50c98b0ef6ffbe3030a34bd7bd294825ce355ca6b1d746cf421db5465c4bea", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639116842, "uuid": "368a35b1-e11d-4821-a61a-937acf6b605b", "value": "T1C4D43A00E711F036EAD710FB8AFB88BD9569AB10139519CF56D86DE6DB290D03D3261F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639116842, "uuid": "405349b2-b626-4272-b166-8b6b546ab866", "value": "12288:me+n9DJGtOal5V8yMcztuEpzZ4GbOX8+DbiuD+jv6DEiih0:m5MtOK5VXNzZ4GbOX8/Bth0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639116842, "uuid": "db54894f-541a-46bc-9118-f03f095659ed", "value": 601424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639116842, "uuid": "d28fd0da-4d44-4d83-bc60-9225a184ec49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639116842, "uuid": "d3666d88-a46d-4f09-b9b6-05977e883258", "value": "emotet_exe_e5_2106edd3f67227cfc48955401bde2bcaba20efb60bb74064e81833a2cb20f0f5_2021-12-10__061356.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788e7336-59e9-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639161982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639161982, "uuid": "042c8c12-5c78-4948-abbb-81097dae0055", "comment": "Malware payload (RedLineStealer)", "value": "7c0a44d8807c6b2290c0d66bbbe8777c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639161982, "uuid": "a2a478a6-0e19-4221-b2df-8e73f709f681", "comment": "Malware payload (RedLineStealer)", "value": "2246c25ec97114ce31a3366169b54b719f9afa7c01b0d82b1231dffc8abb88b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639161982, "uuid": "5dd92882-fb35-4aee-917d-6132012a01b7", "comment": "Malware payload (RedLineStealer)", "value": "1ec2617cb7899cfad8b1ee74b0d4d1f56805844f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639161982, "uuid": "14f10bce-4cd5-49be-976b-ed6d881ed178", "comment": "Malware payload (RedLineStealer)", "value": "ca51b6faf374eec33170a5e0a959bcb617c93714acd30419d8d2dbc4f1d1797b769d76d47c49375b5e5a51b13d24d1b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639161982, "uuid": "d92a171e-2111-48b6-9333-40a86b22a6d9", "value": "T1E1249DD176E2C571C6A36D305860DBE11E3BB862E630593BF374A7AE1F723D05A62312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639161982, "uuid": "dcde844b-4f26-4c07-a4c5-e35116fedbd7", "value": "b2616be51073ac1efb3a25b718df0d5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639161982, "uuid": "96b3502f-e15b-406f-a7e6-fa031fadb919", "value": "3072:sZLYrLCqLlkIsKnrvCvyXU5eN7g9jAJhsZVggjcGkNIVqI/sxkgaBChCt2:cLELDkdCjN7mUcb7ITsqXiga0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639161982, "uuid": "5c0ec099-b18c-4437-8471-61cbd3942392", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639161982, "uuid": "952f9de4-1d8d-4501-ad14-eb91c4107f71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639161982, "uuid": "70d99f18-6b25-4e19-8c8e-3c1265b1a41b", "value": "7c0a44d8807c6b2290c0d66bbbe8777c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abdb28ec-594c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639094637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094637, "uuid": "4c8c3a68-bb36-4b21-9407-d4833aa29875", "comment": "Malware payload (Heodo)", "value": "13b78e68519e96b72345e4ee828bf086", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094637, "uuid": "00061964-ac8a-4bf2-81f4-49bbb19b704f", "comment": "Malware payload (Heodo)", "value": "22fa6a822947d7e850350e55d75ac1757910c03ab7505bbc352d9762dce6bf78", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094637, "uuid": "34231bab-4fbc-480a-adcd-bb93ed59381f", "comment": "Malware payload (Heodo)", "value": "9e0f8f4d81dd9deb4cb7bfafeef91ccf373db6e5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094637, "uuid": "27e3654f-efeb-46ee-abc6-c5d0e3f511b6", "comment": "Malware payload (Heodo)", "value": "44a9af83dff9b3bd2f30541fbf6f2896040126c0248d0c8ccc2d37a922be9fad7de8f40f34ede1570c86a436fa2f0344", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094637, "uuid": "6d4844c5-1e98-4dcb-ad8a-613cb042af80", "value": "T18144BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094637, "uuid": "d2ec4bf4-d47a-4831-b91f-f5745be1dd33", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094637, "uuid": "d245e85f-18fb-4b84-906a-e2cf118fbdfd", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBV2ypv:6jIG/pjjuLbJLmGshoCUnWTHpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639094637, "uuid": "13103509-0097-4b0e-ad5e-5db24b85c6ef", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639094637, "uuid": "9aea0ffc-b393-47bc-9a9c-c155bd31c117", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094637, "uuid": "99f6cb79-d4ba-4f93-9f71-5ba612885fa9", "value": "emotet_exe_e5_22fa6a822947d7e850350e55d75ac1757910c03ab7505bbc352d9762dce6bf78_2021-12-10__000352.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87aeab10-59b4-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639139244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139244, "uuid": "c2b79623-614c-47f5-b19c-d5672a7a6ec7", "comment": "Malware payload (AgentTesla)", "value": "a9f083c2bd6a761e3b79f06d4b514163", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139244, "uuid": "49ab59c1-56d3-4430-b0f3-8e544c8fc7f8", "comment": "Malware payload (AgentTesla)", "value": "24bd6805de897d0628ded476c52d286d322779429d2192b9caeba186b47a041d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139244, "uuid": "c625b7a0-d790-498d-9c68-c78c0a369559", "comment": "Malware payload (AgentTesla)", "value": "71dad4b85d6e22d8d2ce104168cb2389aeb7594b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139244, "uuid": "cdbaa78e-11ef-4f99-83e8-ddff5921815c", "comment": "Malware payload (AgentTesla)", "value": "70840c97f9c67d149c0d14ae5bef92d4d5e4f8721f598f168f47013117a141655efa18e25a69546df6a9ae27b95b519e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139244, "uuid": "fefe7931-2ac3-4590-be32-554564d8114f", "value": "T1605523192AB4646BC5BD87F5C29780608FB5F0066D23F7FA4DA212FE6A349CDC503B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139244, "uuid": "ecc95b7e-ed2b-4173-ab76-a888a7977c12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139244, "uuid": "5d4656f2-e883-4b02-bd51-b39706be3490", "value": "24576:+IKjy/SYCpo3WaocRyhdfonAYGaIg8hlM36uxzHSg6/MRVkTYqT:sjASg3WrccIAsIZhlM36u8f2T+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139244, "uuid": "be1ce11a-1214-4ca3-8a60-126788241878", "value": 1299456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139244, "uuid": "559e1623-1e43-46c3-ab1e-1b8c239aa8d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139244, "uuid": "7586fdd0-4186-46c2-858b-d97e92a24b97", "value": "Bank ransfer Swift Copy #09012021#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443c04f8-59ce-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639150298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150298, "uuid": "3f961968-e092-468b-86a0-e72b3ef048ac", "comment": "Malware payload", "value": "16844eb4cbb8f176dcf8975b505d8a6f", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150298, "uuid": "b3140609-8308-4fc1-9cea-e3b24993557b", "comment": "Malware payload", "value": "26d57ec6a7ce3ab7ac951fe3b452420de47dcff58aeffbea79d67a0c21f7bbf6", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150298, "uuid": "ec873779-5774-4469-81d7-5ffc7b374774", "comment": "Malware payload", "value": "10f6c7b4a4a8216ec14d8e808d9c6cb04df731f6", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150298, "uuid": "68922a28-ca78-46c0-bdb1-f7c2188fc916", "comment": "Malware payload", "value": "6e1f3ec2b2306cf27628439723621385ec623d21a6266b60018f26a314883702889735aec7991bf4a564db8f06a1491d", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639150298, "uuid": "d0909dcc-baed-483b-af85-10c6f5a56f09", "value": "T1DF21CE022BEC0224E6B78E72287BF3108B31B555AC27D66D0188D29C1CB0A08FE76722", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639150298, "uuid": "31aafb18-2a29-4164-98aa-e9b81eb8fb0f", "value": "24:8MJVbzLWesDA3OZ1+/6Cpk+/Clk3kwOo0aPfkWBpAXD/zusmv:8sb9sk3YCpkNlkROo9BqXjzus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639150298, "uuid": "f11d0c39-dc23-485b-8648-5a50925bac75", "value": 1382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639150298, "uuid": "e7edc40b-0264-4278-ad66-a1ff1c7248a3", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639150298, "uuid": "727b84f1-db84-4700-9eee-ddda6c236546", "value": "Documents.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f70936-5991-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639124212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124212, "uuid": "4459a2f4-fe22-4b09-95eb-4505ac3c5cad", "comment": "Malware payload (AgentTesla)", "value": "d679c7f17c251ab88ff42f0c287cde71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124212, "uuid": "7ce35ba3-5ab0-4a1d-b644-aeedc25168f9", "comment": "Malware payload (AgentTesla)", "value": "27135982cfaced133fec6e13846ca6f0f68226e79eb8246b778f3e8422be879d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124212, "uuid": "74e0d588-dfb6-4985-a709-c90d6a2f872e", "comment": "Malware payload (AgentTesla)", "value": "9e7d3c3d16664a37c1d83a69ae81d0b3f34d2b78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124212, "uuid": "1510bc44-4f5b-4dc5-9866-f1d0bfbd0630", "comment": "Malware payload (AgentTesla)", "value": "d969d22b6af96ed3f3eb9095feddd737708e52345321534af82bcbe6183d7c1b1cc770acb9cd7acb4427bd4a1fa53452", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124212, "uuid": "953ce736-6f22-4473-91be-f18a6187f3b9", "value": "T13E35089C3251B1DEE877C5729EA81C64EA507CF6831B8247E05731AE9E2E897DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124212, "uuid": "56ff1b75-e3e4-4d51-83d4-e7157071e54d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124212, "uuid": "d7b6e358-fa12-4ce8-bda5-fe92bea93605", "value": "12288:fOZKp6PJqgUBUOU1OWd3AW8VwnhHYnjeQPpQ/1FjKDVFxAKxaVK7Y4wR7hg0LmWP:isw2oN1X8ViSy2OzKDVTWuDS+rta2M5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124212, "uuid": "2955c8d7-f9b8-40d1-9330-8d13284cb1fa", "value": 1144832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124212, "uuid": "caf068c4-be71-4046-86ed-c03c1c4ec18a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124212, "uuid": "db52f7eb-c769-41b1-a728-4d676ff3af02", "value": "TT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac88991a-594c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639094638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094638, "uuid": "b73c3ce8-3477-441e-b3ae-c4fe263a2ab9", "comment": "Malware payload (Heodo)", "value": "566c1cfdb9a0767dbfb6c56f48257f2f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094638, "uuid": "3fe1f5cb-19e3-4bed-a788-5bd3aa3b0029", "comment": "Malware payload (Heodo)", "value": "27fa2f13609fb0c9e510f2d831f60edca3961584352c77a5b25d8486f96875b2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094638, "uuid": "051fd0f5-e756-435d-9785-e819449f5b6f", "comment": "Malware payload (Heodo)", "value": "3eb17748b3c3d3baf0a0075db44b137f93a75fed", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094638, "uuid": "46707847-25ad-4c98-8dc1-e9053785afba", "comment": "Malware payload (Heodo)", "value": "b1062929b1d2b5136827a43ab47e842358a6289dd1761e7d60750f2061041d5bd7892782bc0c0494d8f613bd7df671e4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094638, "uuid": "d37c6346-7b87-4aa9-b107-ff1f68ed4c83", "value": "T1C044BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094638, "uuid": "b0d7c858-e596-4233-a64a-fcbbb22cbe20", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094638, "uuid": "15b07561-6909-4748-bcb7-75bf8575e044", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTB/2ypv:6jIG/pjjuLbJLmGshoCUnWTZpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639094638, "uuid": "1e773c65-e9c9-41b9-931e-d1714d2dcce6", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639094638, "uuid": "1e7b6aa5-388e-4486-b1a2-bb9db6adc5b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094638, "uuid": "3db72eb8-90b4-43b3-9458-9102aac37b17", "value": "emotet_exe_e5_27fa2f13609fb0c9e510f2d831f60edca3961584352c77a5b25d8486f96875b2_2021-12-10__000353.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec97710-59a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639132465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132465, "uuid": "822fcecb-fae8-45c3-951b-ea5590dd6587", "comment": "Malware payload (Formbook)", "value": "4aa7f9a70f95d6cef80d73e523bdbbac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132465, "uuid": "35c6c010-7f7e-4516-9d80-777a8236e7b2", "comment": "Malware payload (Formbook)", "value": "27fc31505dbc8da778775ca436aba118b32f405fc5927251bde8e675f6d86c21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132465, "uuid": "71aaea50-b6bb-4d46-8402-8d5582e80878", "comment": "Malware payload (Formbook)", "value": "a81fde5171c09dcf918f2ba23ad884b49e6aa819", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132465, "uuid": "721cc83f-c955-4c52-8a1c-0b72e48a872d", "comment": "Malware payload (Formbook)", "value": "982bc0167403af13e1b12cedcca6ed114e4d1ad73c23e2d626b539e3e7814e1c59a2851b3d6682fd6e6f231e8256ad4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132465, "uuid": "3c8bca9c-f23d-4900-8634-0575d03dce27", "value": "T159442216BFA0D1BBDE521E302AB667ECC3FCA8E016A611131F557FBA68316431E468D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132465, "uuid": "2da29ee4-d63b-44bf-818d-34c5bc2bcba3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132465, "uuid": "4106fb09-1eb5-4c4e-9bc2-b400a50c4dcd", "value": "6144:rGicH8nE5YaNyCEYyZrei2dfOmDwKytSqsUnT7faUI7BJ5ipfGI:oH8OYaN8/Qdqnn2VXihx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639132465, "uuid": "f7664de8-a78d-4849-8521-6ad815aaa01a", "value": 278301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639132465, "uuid": "9684852b-03cb-46a4-a4db-afdac4ec1e3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132465, "uuid": "2325d8f0-cb77-485a-837e-a9f019cda026", "value": "4aa7f9a70f95d6cef80d73e523bdbbac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d258ee5-59e1-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639158608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639158608, "uuid": "cc086199-6449-4cb2-9131-ff4f496b9d16", "comment": "Malware payload", "value": "bbaefc92af441cad53e7026a63372569", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639158608, "uuid": "8d0b3b2f-44d9-4dcd-b2fb-2021faac3a06", "comment": "Malware payload", "value": "280c887d3002ad898f6decfcc58c41ec4be644b62e28a3b0353a402721ae28fb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639158608, "uuid": "e52c3706-76fd-45de-9f94-64fd99fb0407", "comment": "Malware payload", "value": "458e9f1491e272c9e11a27e044afc2d64f87f81a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639158608, "uuid": "0a47cc85-d3de-498f-ad07-bedd61d438da", "comment": "Malware payload", "value": "19e4980952d9ca073242bfca6790596c433d2e5ceaf5771699fb102626ca92e17abdf0641abd0a9c666752d2cc832178", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639158608, "uuid": "b77fd812-863d-4acd-bdd7-892b21a372bb", "value": "T1C1F2E00493BB98A04FF03873DC7E0E4C26E7946ED70D356AA724E96468C3597E8BCB45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639158608, "uuid": "de8759bc-4cf9-4309-af87-586f516e3521", "value": "768:2ioSMe0hu25XMNg0OqAlKxDhgnfR8CqzbVvUJd3Uu:2iiDs258NvOqAoxC4JUJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639158608, "uuid": "397e3c17-52d6-4dab-8a62-d544eb9391df", "value": 34392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639158608, "uuid": "524b6106-cf91-4515-8a63-62ef70d040ae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639158608, "uuid": "90d1d959-1bff-4069-b9d7-53698ee79b38", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd42439-5982-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639117723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117723, "uuid": "6dd13bcc-f51a-482b-8ff3-00f6f84764fa", "comment": "Malware payload (SnakeKeylogger)", "value": "46495c5ef7c87be61725e0bbe0144832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117723, "uuid": "ebf80c50-027e-4c6f-9bb8-cecd08096b42", "comment": "Malware payload (SnakeKeylogger)", "value": "28fcfb4ee1f1056cb8fc607636849cd8604e114b1a457956fe05df339b0dddfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117723, "uuid": "d66067fd-ea67-490f-856a-989b1e4a4386", "comment": "Malware payload (SnakeKeylogger)", "value": "f790291fa8b76a046a5342e865b7f4d639d57ee0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117723, "uuid": "0bb61619-9f86-4ef4-9b55-a20cf9b2553b", "comment": "Malware payload (SnakeKeylogger)", "value": "662dab94208fa5b58c43a32a0848e8b9e17d7a86bae7b78d52fb5bc65a22b4adddbf21558945df8e2b5027783828c684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117723, "uuid": "f8fcec9a-2364-4054-8dd9-c526a0908b52", "value": "T1C1035B12B7618855DE984EFFD8D7EB4037E1A61B5413DA0FF09F0F1A29533A66B4220B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117723, "uuid": "b8342e22-1c26-493a-88de-9b8d0864e4e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117723, "uuid": "9ccbd819-e273-41fb-9553-dacf53d8c974", "value": "768:lqNKKy0aeqfKGaLA7dbkToE2koNXCzubyxP:8byf7dbkSkoNXwueZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639117723, "uuid": "f59bcd66-073c-4738-8c5e-4e8c97ae27c6", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639117723, "uuid": "14e7830c-de90-4aa5-b539-4f04bead4d6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117723, "uuid": "f031bb35-91d7-4898-a273-1ae0c6b846c4", "value": "K\u00fc\u00e7\u00fck \u00d6l\u00e7ekli Krediler ve \u0130\u015ftirakler Kanuni Takip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88dec13-5980-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639117019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117019, "uuid": "47e70025-ff8f-4100-9aa2-5387614cd774", "comment": "Malware payload (AgentTesla)", "value": "3db74aeecea5e01159e5c38482e7f928", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117019, "uuid": "7a5a5775-4cd8-40f7-906a-a08c96740f46", "comment": "Malware payload (AgentTesla)", "value": "29c6dd292196d0feabb7a995914a68f00970edfeff6ca872d1d5a9c58365b0cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117019, "uuid": "63bdba1d-3b54-4486-8166-6ed7ac5b5e74", "comment": "Malware payload (AgentTesla)", "value": "bccf5c88a968dccf72c8b4d83881d85b65a7fe1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117019, "uuid": "3d9384f9-bd6f-4654-996c-f7e4c931bf44", "comment": "Malware payload (AgentTesla)", "value": "d412dc7b394ffb84abc8f27236812f3514ee407dd3688d9903b8f3dfe139bb98eeb3241997a480cfe80a7a9ae4da445b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117019, "uuid": "da948b07-62dd-4205-bcf5-219afa85b9ee", "value": "T14D3523A437FA1BF9E6B86BFA506560040775B4137E36DF0C5E8A64CE48F2B408E90767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117019, "uuid": "d1efbfca-68e3-41d8-8c16-9a7470abdc0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117019, "uuid": "87494673-0f65-4a20-baa2-8e4525513f2d", "value": "24576:U6u1xCTnxzPA6m4KrIgjU0wRMwz/AIRxYEBg6KxXo:U6kx0VPwdIcUjPROY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639117019, "uuid": "f689df42-1d20-4e7e-98bd-d37480be7807", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639117019, "uuid": "9cebb713-5d66-4c52-b179-85bd8482c04f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117019, "uuid": "97fee8f3-4726-45bb-8286-d72d1c3eeff9", "value": "Swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "532f3915-59a9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Adwind)", "timestamp": 1639134432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639134432, "uuid": "7b4d94df-e247-4b2c-a71f-f0c4e2f4e9c2", "comment": "Malware payload (Adwind)", "value": "df587d6cc0436686657c92c81e471a65", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639134432, "uuid": "83422e78-34f2-4496-99f9-592317281260", "comment": "Malware payload (Adwind)", "value": "29ee5689a07b8c720e7d31d3607bba48a25eb484bf019809fecaf7b5ba58db20", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639134432, "uuid": "0a20426d-b53f-4b04-a67a-3e68c54cf3e9", "comment": "Malware payload (Adwind)", "value": "6ef740be19175d591a6b8e47c731f43307494046", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639134432, "uuid": "58cc9cf0-0b5a-462e-85ae-7493a3814881", "comment": "Malware payload (Adwind)", "value": "eb9f4d1b1eb6ae51106dcc9e9079651dae4c33b7e923d27483a0dad017cbea0bacad6305ddc8b4102256edbc3b5fbe76", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639134432, "uuid": "911730e6-47d8-4759-abba-efbbfc715637", "value": "T12FD423A2C3B8979C7F2973491E5A0A175CC1EF36DC3B494192B1320E6A4C78E8579CE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639134432, "uuid": "d8a14d52-c432-4e9d-938f-babadf99998c", "value": "12288:i2UR/Gp0VBW5N/zleI/bEbd5Vcl9ECz7GS49W8iuMr83yF43MPPOTQWNT+R:i5OSVSzsIwcl9ECzLr8iuM0yF1PPO8EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639134432, "uuid": "504b60d4-4f72-4bc0-a33c-354912abe866", "value": 652178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639134432, "uuid": "a0acd38d-6952-4528-9ff9-727d2cd86594", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639134432, "uuid": "a7dd53e4-d091-4b74-8b84-f841cd4ddf68", "value": "8760946657883.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2fac8f7-59b4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639139290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139290, "uuid": "3b32a3d0-9642-4335-a27c-17c1e52e01f6", "comment": "Malware payload (Formbook)", "value": "a94eea79eca53a23b08165c1c2c1c5e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139290, "uuid": "22e84297-2d2c-4ea7-a7a5-c05d1bac7479", "comment": "Malware payload (Formbook)", "value": "2a40afa0b9c53b9023e58434ee280b3f5ece58b230e04ba3a9c6d779d542a7f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139290, "uuid": "8962591c-d06d-447b-b7b7-81a45a86b43f", "comment": "Malware payload (Formbook)", "value": "e91e1f3faac003734a51e41b7279af342474a3bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139290, "uuid": "9084f503-4494-41cd-bbfd-c0e785aa18f5", "comment": "Malware payload (Formbook)", "value": "dfebbbed3b4abf9ff1b84a8a12c681e8b62d83878354678cccef1bdfde371cc5d8ed163ac35398f58063b9aa3ed9a726", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139290, "uuid": "a3414725-887e-4039-a9b3-164cabdb2aa8", "value": "T1E564235F72D2099BD5D3353226FB1B25FB7AD18407568D078FC03AFE151215F882AEA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139290, "uuid": "c16cfc94-93ee-47be-bbc4-76c91fb87350", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139290, "uuid": "9c92b772-2ed8-479c-8993-bf1a799adf6b", "value": "6144:rGiYt7AmcWelaA1jCTF/GToxWC4hYxBO3bblptic/l2peiTL1RTbCXE:0+asjBT0WCNu3loFT/bC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139290, "uuid": "5e5fcc23-bfda-496e-8a7e-9dea72ecfc0b", "value": 330359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139290, "uuid": "37ea8638-5875-43c6-bd3e-9e0dfe0fa3d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139290, "uuid": "4a904ebc-10d9-490e-8445-e3eefca75d9b", "value": "Scan001.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7833cb-59c5-11ec-96a4-42010a9c0029", "comment": "Malware payload (DBatLoader)", "timestamp": 1639146691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639146691, "uuid": "7f627459-7d81-428a-ae5b-506708b85bcc", "comment": "Malware payload (DBatLoader)", "value": "0f559c7ea254285bab84e60d2a5e8037", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639146691, "uuid": "94b9283a-98a7-4c4b-9c66-accad7deb4a6", "comment": "Malware payload (DBatLoader)", "value": "2cbccb76adf567a82d9d6fcbf7a6c02bce157e1870df149af7391b20b9fdc672", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639146691, "uuid": "8bab7222-56d8-42f8-b480-43cc81b1023a", "comment": "Malware payload (DBatLoader)", "value": "388cfbde34fcc37f5f334ef39d29b5f3e655fed0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639146691, "uuid": "c8cd768b-3c6c-4d5a-b9e2-29c02939aa3f", "comment": "Malware payload (DBatLoader)", "value": "d78378bfd855b03a0d142e0235dd40d5c5b39b76bee4dd044b9a03f0c70ed878a2444c0517c249933a6ec2f8abe2c76d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639146691, "uuid": "f73810ba-233d-409b-bc75-c67914926a75", "value": "T1D7159EA2E2E01D32C16F15B8DD5BBEE465377D103D599C862FE82D8C4E367B0741A0AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639146691, "uuid": "52b9cddd-c25f-4597-9250-bcb386e543b5", "value": "939d8f743f99c748d946de3c81bddd31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639146691, "uuid": "1e1a9fd8-1575-4042-a359-00a0b6e2ae31", "value": "24576:suRQsAJcBdZF0bE25gAUQIC3c13TOqamxypnUXAGe:sL9JO0jUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639146691, "uuid": "a0a50537-fd61-44de-ab51-47daa27ad6d3", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639146691, "uuid": "7c58fae7-8edd-4e4c-bfa1-7c438b8c5d2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639146691, "uuid": "eaa9b732-1884-4956-8927-547190f63444", "value": "0f559c7ea254285bab84e60d2a5e8037", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace256a4-594c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639094639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094639, "uuid": "ffc28a49-7465-4bee-bcf6-d8de968e2a48", "comment": "Malware payload (Heodo)", "value": "075ecc80ecd1c7d61f63cb270237463e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094639, "uuid": "0553305b-56b0-4665-8476-d139b1b07e82", "comment": "Malware payload (Heodo)", "value": "2e16aee1639a172c5892274d34cc90c90e1858de84a4577d7303ef6da2105854", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094639, "uuid": "55ef48b3-c6dc-42a9-a4e1-8b3ae7d2be5b", "comment": "Malware payload (Heodo)", "value": "7277e8fe929b088caaf727ce38a1c7ddb7e8cf98", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094639, "uuid": "7125f2b9-f1da-41da-87d3-daae7ac363b7", "comment": "Malware payload (Heodo)", "value": "1710bc07c43f1e4a23f51f7b90f9b592075f39ed5262581991f88008b5fcb7727718a93175efc1297a4da469d256762e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094639, "uuid": "bb7f1375-3e9d-49ff-9211-c2ae84b4f3b6", "value": "T1D044BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094639, "uuid": "63f65c3a-c18a-45fe-844f-0da38c915aea", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094639, "uuid": "35440125-d069-4251-aa52-8ebee9e5e746", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBn2ypv:6jIG/pjjuLbJLmGshoCUnWTFpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639094639, "uuid": "46a8dffd-505c-4892-bf93-a53d9bed935e", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639094639, "uuid": "8d1c46eb-f4ab-4520-99b9-70e4a1d53aee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094639, "uuid": "cbb1f9e0-df66-4bf5-a785-bf8122072f5e", "value": "emotet_exe_e5_2e16aee1639a172c5892274d34cc90c90e1858de84a4577d7303ef6da2105854_2021-12-10__000354.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db4e263-594c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639094506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094506, "uuid": "61579aef-9b00-4f0f-ae59-93d84c446db5", "comment": "Malware payload (Heodo)", "value": "c24ca5e005655644307b194475b98561", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094506, "uuid": "1f3822e7-8fe7-445e-9d76-86bbde17616d", "comment": "Malware payload (Heodo)", "value": "2e447c5718ac6ca4a74c22fc945dc17e64eb733638b0ffc706f9b79537487494", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094506, "uuid": "1fb6f175-5e39-449e-bad4-9c7013110af4", "comment": "Malware payload (Heodo)", "value": "a15bbf3c21030a5e466a707a3215105e0b8f57f8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094506, "uuid": "c8a0049b-dafe-4619-aaa5-fe8ea413692c", "comment": "Malware payload (Heodo)", "value": "93828fd1383f70bc0158efb2f6c51d4fc0a639b1ae094c4739c27586a2fef42c3735e14c0c68d6a0d71575fcf166d306", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094506, "uuid": "2cc9946e-2fce-4da5-b084-a5a32d432ccd", "value": "T1C644BF10A181D036E5FF087A89FAD9BE466C76600B80DDDFA398187E4F6B5C1763059F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094506, "uuid": "c5feb5f2-fe6d-44ab-a1f6-cac4c2b1c183", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094506, "uuid": "fcdf5710-dc11-46b0-af18-8bb0ee2b45f7", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTBXmgL/S:Wvef8+h61mRcHL+rF6l5EAQWTTL/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639094506, "uuid": "69130ee1-03ac-4c77-b5bc-bc0ae8a0d57b", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639094506, "uuid": "49bd7b9f-60b4-481e-9518-301a1eeadbd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094506, "uuid": "9ae9b430-cff6-4294-9179-9d76774ea6bb", "value": "emotet_exe_e4_2e447c5718ac6ca4a74c22fc945dc17e64eb733638b0ffc706f9b79537487494_2021-12-10__000141.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c95d39a-594c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639094504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094504, "uuid": "5c8bf4ce-bc2b-485a-bbb9-9a44501b7a70", "comment": "Malware payload (Heodo)", "value": "63ff6a8b17bc03a910650e76cba6182c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094504, "uuid": "bd94a67c-898e-4248-a5df-d72e3e5ffbe7", "comment": "Malware payload (Heodo)", "value": "2ed338e09ea3fd36f784345f74b9ac741d654b04a4af1c9193a560a772673a42", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094504, "uuid": "a9645557-8b69-4e58-a988-190c1049716e", "comment": "Malware payload (Heodo)", "value": "b14622497d5f3d782a9f9a18e2c3c2fb5c7ccf27", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094504, "uuid": "3e03e40d-c75c-48a1-87db-3ac512361228", "comment": "Malware payload (Heodo)", "value": "034fad6a86d7ea99a667af75121407c1e5075925330a0f3198b422706b25adf97fa655f38308e0a28710b078b2f5dd41", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094504, "uuid": "57b64f33-2b44-49fc-92cb-678bc976fb8a", "value": "T14044BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094504, "uuid": "fcb9e004-d96b-40be-aa52-534817a56a1d", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094504, "uuid": "9a5ebf2d-c0da-4867-bd46-277b1c65fab4", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBa2ypv:6jIG/pjjuLbJLmGshoCUnWTGpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639094504, "uuid": "08693867-eabc-43eb-a9a7-3545183b8439", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639094504, "uuid": "e5d59501-ee24-475f-b012-326647853d40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094504, "uuid": "f25d9f6b-17ec-403c-9440-c8a15f028631", "value": "emotet_exe_e4_2ed338e09ea3fd36f784345f74b9ac741d654b04a4af1c9193a560a772673a42_2021-12-10__000140.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d218cde-59be-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639143414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143414, "uuid": "bd12b833-835b-41d3-b8fb-2e9c851e7ed9", "comment": "Malware payload (Formbook)", "value": "c2759ae747e0145fc3caff6e008d17bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143414, "uuid": "365fde95-a6bd-4b5c-a616-3ef33497b31b", "comment": "Malware payload (Formbook)", "value": "3027d709761978d8d15f7e131d9885a62c5b60f6764c93ed1fd1678efd8742e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143414, "uuid": "45d4592e-7344-46cc-a52a-ae8e4993da92", "comment": "Malware payload (Formbook)", "value": "6646c819676436646e49c0ec31dc545a1c8cb577", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143414, "uuid": "5a63e606-fd08-4ad3-b515-b4115e37d233", "comment": "Malware payload (Formbook)", "value": "349d3abd8a194697699c38fbfc4c3d2a886e08f9750022c71b490cf6330609a1ada1f67d20589870dea478b975b22b26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143414, "uuid": "bd123f77-f2b4-47b7-b34e-2848664ebb65", "value": "T13144120BB1C98537D2D91A764236AFEDF3F2C90D53129D9F6F3A272AB7286C34615042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143414, "uuid": "50f5bb3f-4bc2-4dba-843a-5e37de287feb", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143414, "uuid": "377099c2-8f26-4bd5-ad08-15e68f9b12a8", "value": "6144:rGiQQ23lPs4G8HdnakYmLesVL7e2JXRbGzagQrL47:b239s4ekYmK6WOXRbgurL47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639143414, "uuid": "876efc39-8ccb-40c4-aba3-64ae9b8766d1", "value": 277910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639143414, "uuid": "9f89af4b-3033-4d23-b974-0918925e7915", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143414, "uuid": "c52040fe-3902-41e8-a541-0a8b9c75716a", "value": "c2759ae747e0145fc3caff6e008d17bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6ce85d-59ff-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639171515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639171515, "uuid": "a0f9f5f1-3342-4ed3-b66a-5a7e54ee9b81", "comment": "Malware payload", "value": "1b193fdc036eb7492aa6bbb46e3e7523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639171515, "uuid": "8b6b9590-ba20-4b5c-af3d-5b1c961bb45f", "comment": "Malware payload", "value": "30771966e27a617dec4499d5917d3fc8d4d3d67798c30c8b76a71238fbcfdfde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639171515, "uuid": "5501ffdc-d240-447f-aac4-fd1e3854edf0", "comment": "Malware payload", "value": "7aed312bb4dba8be005725821d642a38803f9968", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639171515, "uuid": "9dc8b73f-fb31-4924-a8e7-4e9c4684378c", "comment": "Malware payload", "value": "22577f95a4ceede7a0de0e16a334ae65558f2207e292d564d03a1dd1fcc0d1fdd0632c9a6b7d170ab7cc74cb3c5f3eae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639171515, "uuid": "80ad521e-1b0b-4f5b-ad65-a7e017c8778f", "value": "T1D315DD0FEDEE8AAAEA420777C5F3B7004F7550DD0F2B4BD8D725A5E0CA8B1611B02965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639171515, "uuid": "67481a1f-1985-477f-bc68-c58f5f1a3087", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639171515, "uuid": "73463b6f-eeda-48a2-8bf4-431e1b6b7631", "value": "12288:YPniiGGoQlv4MkO+TDj7CQQfP9BhwK42ZoEhDM:YYGo44MkOQa1Znx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639171515, "uuid": "b5e56510-472e-4d60-9a16-7b446a2e1ae2", "value": 960904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639171515, "uuid": "dddeb7d6-e66e-4f96-ba82-cbc0441a3b6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639171515, "uuid": "402ef03c-c642-462d-8880-f45f4c88c390", "value": "Vape Cracked.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e48502e-59ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639141725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141725, "uuid": "b053305f-20e1-4afb-b99d-b0d7a975e204", "comment": "Malware payload (Loki)", "value": "fb507b7af63aa439ee18c41542394023", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141725, "uuid": "e39fda63-9428-4acd-b2bb-2f4b4ee8d120", "comment": "Malware payload (Loki)", "value": "30a180699fc63fc1b19ce303be1f1e3c4c6e08c5b268499ae954074ebe6781a3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141725, "uuid": "2fc58462-5043-42a2-aa32-5f79b08e7211", "comment": "Malware payload (Loki)", "value": "9b84b2a59176b86533991ce6fdb9e63c32775262", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141725, "uuid": "fe139ff7-4b89-43a0-8b66-e04c514f46e6", "comment": "Malware payload (Loki)", "value": "0e02e133010ef708b5f7968e99becf1f52c30fb1493299fd69e14433c1e70e6b5b7d7884805aace8741a7e7ee9e58d23", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141725, "uuid": "2aeb1dd3-c12d-4c2c-9d1a-fbfd733cbb0d", "value": "T1C7341265B850DB57D7927F78E23C9D9356A2CF203C45E3266B897F2199F0BC08480A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141725, "uuid": "cd58886d-acfd-4615-a994-ebb6e2fb571f", "value": "6144:jKO0D85Hm9wkUYeIx1VKRPMfY5u9SEGpYtNGpR9:jKf8lm9dzeIx1KDQ9SEtfMR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639141725, "uuid": "66fe48d0-44eb-40f9-9564-7434c680393d", "value": 234696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639141725, "uuid": "522d39cc-d201-4dd2-b4b4-a593dd777364", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141725, "uuid": "9e14b42e-63b6-4f1d-88a8-820520a3ce8e", "value": "escanear_archivo.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51d8f50-59ab-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639135482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639135482, "uuid": "d6c4b637-e0ce-4fc7-9d27-315686567c1c", "comment": "Malware payload", "value": "83e9a709b70b85eb268c5b62e49ba3c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639135482, "uuid": "8954ae60-96b1-43e5-acac-e46d5171921a", "comment": "Malware payload", "value": "315c3f0177fecc1eaf9337606deec0df96d37c1f8786f1a9f0d23551607be60b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639135482, "uuid": "d73185fa-13a9-435e-84d4-98dfccb1aeed", "comment": "Malware payload", "value": "550a0024a28f585ade096de9019c4e5504a8ae14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639135482, "uuid": "be3d692b-03c8-4fb5-830c-710d16e55447", "comment": "Malware payload", "value": "581cf9fc6ee7616b3cfce1b27a59b77e7f16eb572a7275a19d162e585b851ff21e0acab128d0b14da7bd4b5354c8150a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639135482, "uuid": "95169a63-01da-4cf4-a657-f3c9d2f3ec52", "value": "T1BA0547203DEE9CC5D0726AEF5E98F5C69DAFE1B1291183C82B51CB16B452C538FE0636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639135482, "uuid": "f5052264-054d-4aa5-942f-1df77ce93d87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639135482, "uuid": "0625b05a-d3e8-48c7-aa8b-31c00a44cc87", "value": "6144:H+d5+j7HRMRYt7xzUsrLKWzjk57a8T+g9zG7P5wtXvyU1ULWM:jjtznx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639135482, "uuid": "6e54a64b-8c4a-42f0-90a8-5f4972a2ae33", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639135482, "uuid": "40b41a26-285b-447e-be05-2ea4d3b0ff97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639135482, "uuid": "4f598975-59f5-4940-bb0b-4a09beb75e28", "value": "new.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b4798c-59a1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639130916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639130916, "uuid": "b92cd6de-470d-47af-a06f-223de3d5809b", "comment": "Malware payload (Formbook)", "value": "2e81ceb459073a4988b86572485ce064", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639130916, "uuid": "3b019a36-0143-4a3f-abcf-f9a055a5c26b", "comment": "Malware payload (Formbook)", "value": "32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639130916, "uuid": "d23746d2-1e10-48a5-8242-3011e7ed5457", "comment": "Malware payload (Formbook)", "value": "537788a13b833bbe3993e6ddd3f4c1abf12caf94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639130916, "uuid": "5433f684-c85d-450e-b202-faca9ae4488f", "comment": "Malware payload (Formbook)", "value": "2ffe2539e6adc6f256555508820c397be382ccdb323fc2d8c1f7be564d2e71b1c14e4cbf91311159614caef725d8d517", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639130916, "uuid": "ee51fc2b-9600-4020-a670-a87be177d04b", "value": "T13525231552B8BF24E83C9A3575B7C2121775F9DC1846FB393E8071F92DE2708AB63292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639130916, "uuid": "819c40de-f208-4f78-8dec-cd4654dc0273", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639130916, "uuid": "7bb0a183-81f0-4b6e-b653-fd0ab1faa020", "value": "24576:FtFWEweUxLXEsGmCDx8K+TPbDL76khZt1KcIXZ:76g2zPbDL76kjt1KXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639130916, "uuid": "c5b1f26a-500c-4808-b614-4bb24ed6290d", "value": 1017344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639130916, "uuid": "937684b2-ad6b-4aec-8a44-afec6454ecaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639130916, "uuid": "b7b4a17e-d6ab-4f90-aba8-5646e67ce9e7", "value": "2e81ceb459073a4988b86572485ce064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65624295-5963-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639104397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104397, "uuid": "5790f310-c38d-4a39-9ea2-479c691815a0", "comment": "Malware payload (Quakbot)", "value": "16c057268576e80de1aa00034db220d2", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104397, "uuid": "274a5c5e-6d48-4e68-b686-e94e732afd70", "comment": "Malware payload (Quakbot)", "value": "3421588fe0ca7852b49d2283863b729b7c397a471af18fd082d20ea71fc4b5b2", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104397, "uuid": "d2c47ff3-8562-447e-b3d6-566316939e76", "comment": "Malware payload (Quakbot)", "value": "dc034fdd786e578aa09278f34fa8bc1c0a0ddf7b", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104397, "uuid": "d7b38d1a-79fb-4267-8c2a-7db906d38f2c", "comment": "Malware payload (Quakbot)", "value": "45abcceaa017dd2bb80b5e776ec2b0c3e8c57bceff99df31456941a8e4f830b1877a44ea3ea6986e97c5f1c3f7ec29c4", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639104397, "uuid": "b9fe4603-d698-4b5c-9579-4f0bfd0e3130", "value": "T13D24020DA83CE8CEC72F5432C708BFEB861B5061A9C2B82D55C9784D1955EEB7B8D18D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639104397, "uuid": "6d546354-b5bc-4631-bfff-de0afd3c407b", "value": "6144:1+KcfEw6R9537k5WSOeME6rGj/m/58DDy:1+tErR953gjrnOxR8DG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639104397, "uuid": "8e994066-bbc8-4cc0-b611-97b18f39976e", "value": 214723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639104397, "uuid": "8723d621-275e-43b2-912d-f7d3423e87e8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639104397, "uuid": "811cf3ff-0653-4cbc-ba21-2c03ad3b939c", "value": "val-1604997268.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae30a956-594c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639094641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094641, "uuid": "98b9b993-0fb5-4991-9d1c-1c8a6ccf31cb", "comment": "Malware payload (Heodo)", "value": "b40423da33d7047c4d8b2348eea71139", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094641, "uuid": "ac15edaf-a35c-4a71-be47-f13d6778ef0a", "comment": "Malware payload (Heodo)", "value": "35d71b680a78d95442e61f41497099227f56cf6e4a770c8345a0e7e1411312f9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094641, "uuid": "ab5c4cf0-6225-4741-9c85-da960bfc11f0", "comment": "Malware payload (Heodo)", "value": "62740966b234c10f6babcdceaff255d1987b95cd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094641, "uuid": "2326a31e-29e5-478c-849b-18169dbb5e59", "comment": "Malware payload (Heodo)", "value": "5d5d471c79dde27f46e5b29c41a11c201de02c3057c8f523d186a1ebbfbda18b6d932bdc9eb1277df96079216a6ea87c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094641, "uuid": "2dc35981-6739-45db-8944-2e234008a75c", "value": "T19C44BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094641, "uuid": "a9795d92-d8b5-4749-9b28-53f9d7753074", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094641, "uuid": "57dbe361-c071-4b9a-9ae4-adc420dc7e4a", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTB72ypv:6jIG/pjjuLbJLmGshoCUnWTRpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639094641, "uuid": "3e9a869d-3dd1-4670-99bb-f90a67b1c3dd", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639094641, "uuid": "fce1fb1e-85b4-4d0c-ad1e-ba062b4d1060", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094641, "uuid": "e0e986e1-ebb8-4af8-99c1-8a13373aeaa7", "value": "emotet_exe_e5_35d71b680a78d95442e61f41497099227f56cf6e4a770c8345a0e7e1411312f9_2021-12-10__000356.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ae8540-59b5-11ec-96a4-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1639139749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139749, "uuid": "7cbe676d-ba1d-4808-b6d7-fb497eae1a4b", "comment": "Malware payload (NetWire)", "value": "20f76c8da2f112477ab0b90efd702a2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139749, "uuid": "b1d47ede-4ace-4f3b-ba69-e3165f74337d", "comment": "Malware payload (NetWire)", "value": "38ffc900c1c669750b1f8631fe653fe63d247846d880c29db53479de20723573", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139749, "uuid": "2ad34b3c-573c-4bbe-aea4-8444626649ab", "comment": "Malware payload (NetWire)", "value": "efba60b95da43f2b8c3d685cd760bb223b96adab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139749, "uuid": "e73df5d7-77b7-4654-94a2-e91f46df877d", "comment": "Malware payload (NetWire)", "value": "bedccf67265032f6d58f5c79cf6106f8c0f37f7b3cb9879293fb196fc602fb3484f3f0a62401c7ea1bb82662543216ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139749, "uuid": "d3b3df92-c488-4b25-b0d2-f49fc5e83034", "value": "T17474D0735DFA22F5DBCE177ABBFA46D81DB71CB0E649F82C6806336409393B60106A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139749, "uuid": "3539c1ff-9a55-4e6c-a398-fa7474fbb061", "value": "3c735a917fce3e1beeb6ba9c5e9569e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139749, "uuid": "7113de4d-64c9-4243-a08c-49b082ecff09", "value": "3072:RytfJAzTgTIBu/y7Kt91H/YfdMyHltYwYPIqtNkYd4GAyNrHGxjtIQbHrJ:CG2/y7K9HgfdMAYPIqb4Glaxeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139749, "uuid": "106b8d08-c83c-4e60-97be-ac5438b5fb0e", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139749, "uuid": "73aaad09-e0d3-442e-a42e-f4893b534ebc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139749, "uuid": "9ef50caf-57b2-448c-be79-adf2273d107b", "value": "SecuriteInfo.com.BackDoor.Siggen2.2488.21752.28901", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb3a6d2-59ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639141964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141964, "uuid": "d106dd82-4a75-4cc0-a809-de1c7a913f68", "comment": "Malware payload (Loki)", "value": "7efb4f2ba3a9fdc54539b9b8562de02b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141964, "uuid": "c1ccd251-2463-4638-9f5a-2b7adef13860", "comment": "Malware payload (Loki)", "value": "3b8c6beea26f75eb2bf0df025ffd886e2969c2035a4726dac95fd9ee2c528d45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141964, "uuid": "0dc39608-eaaf-4812-80eb-3419a32f03fe", "comment": "Malware payload (Loki)", "value": "6a4dffa2d8ff4d3b99cf22a1abd03d44b5712d2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141964, "uuid": "78af15b1-416a-4611-a3d0-afd06e4dbc36", "comment": "Malware payload (Loki)", "value": "613dd1216e327664575794c2bbe04baf77ba445d59d84c91d9fb98efadb32d724890ac0acaf2d84840d20bbed63894e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141964, "uuid": "2418cbaf-777d-43ef-b913-a20ca395adac", "value": "T13644128D65C4D967EC9112B108F0F4B3F77AC6C8013CAE4B4FF82EBB59B1186415B162", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141964, "uuid": "d5bed255-41ad-4e14-a770-8532e62e1e4b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141964, "uuid": "09a3b33a-1c51-49ff-b684-e73d7e7d0c42", "value": "6144:rGioDuiitguhzaac5kORa9Pzz2r7oASy4Y:cditgHacWD9PzirspDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639141964, "uuid": "3f2738f6-9c55-4811-94d8-43aad01aebf4", "value": 262128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639141964, "uuid": "a3280747-793f-4536-860b-83a486a1b301", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141964, "uuid": "311ac9a7-6a4c-4eff-8ef5-3cf2bfbdc96d", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3e6d76-59b4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639139304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139304, "uuid": "8006ac60-457b-4aad-9daf-86ba64fdc8c0", "comment": "Malware payload (Formbook)", "value": "cc46dfdf84886a6d8d4abb998329d2ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139304, "uuid": "1d2f5e2d-b44b-457e-8623-d56c4ac23e1c", "comment": "Malware payload (Formbook)", "value": "3c1918e6b82babcd0ad5381e1a7f6778efd2e15f9f78cf49dc4c53bb3b05d304", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139304, "uuid": "4f69cd0d-00b7-44b9-87b7-521f4c5521d9", "comment": "Malware payload (Formbook)", "value": "8dbc681af18843c8cafdd50b12af852045636a8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139304, "uuid": "4603c2b8-10d1-42a6-a3bd-2a49ca7af26d", "comment": "Malware payload (Formbook)", "value": "2be38a51d90ef971a3ffe11beec0a5008cc01260f4c92407b90d79410bcc95f1b4522a2d20094c80788e836856811b3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139304, "uuid": "7c52c4d6-6630-4d2d-9db0-c7cfcf4d288b", "value": "T1E935017CF9835ACDD86957B93B7B9C70116B3D3A1577814DE41E32AB5A332423023A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139304, "uuid": "e7fef87e-7cac-4c20-a288-2f0d7149a7db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139304, "uuid": "1daaee04-cbcb-4110-8d9d-d4a3fa4cc2d5", "value": "24576:MvlsSZjhcw3l7SgDs5pCRwcrpH1Pl7Idp9Hn9:mlsEjhculu4Xt1AH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139304, "uuid": "906fceb6-d7f7-4ad2-8405-48ee2137740b", "value": 1111552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139304, "uuid": "d424e236-51c6-45a1-b8c9-113ab48ac8f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139304, "uuid": "5653363c-3487-4a91-8a76-be783db5d1fc", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ebc75c-59b5-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639139746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139746, "uuid": "777ae668-baea-4e5e-b3e5-98404bce94e8", "comment": "Malware payload", "value": "c8d9634b6c5bf02bf0c99744c91d6770", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139746, "uuid": "3996736d-fdb0-4497-9871-8abd4a0a34f3", "comment": "Malware payload", "value": "3d59e9a182c969d9b5c249b2b08f4a7f50f7975e6843fcef9af60ad005276b87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139746, "uuid": "88fbbe52-29a0-48f8-a3fd-3d1a39a5c6a6", "comment": "Malware payload", "value": "707e9b32ba0f6a3a6a07a6c99589af50a455b130", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139746, "uuid": "2fc146d3-be52-49de-9d4c-49f8060d6209", "comment": "Malware payload", "value": "ff0e4e1421386b3acd2fa3aec9576d156d0a7643b16dc1707da72192cde3024bea718cf3ca2d746c6c55292acbcfcc1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139746, "uuid": "d9075d61-ed9f-41f2-81ef-974b2d725af4", "value": "T11D45BE02B3D2D036FFAB92739B6AF20556BD79250133852F13981DB9B9705B1233E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139746, "uuid": "138681fa-f176-4aa0-b5fd-e2799148ec3a", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139746, "uuid": "7371e048-0c34-4527-aabe-1bfa04912505", "value": "24576:6AHnh+eWsN3skA4RV1Hom2KXMmHaHoXSJUCAhIoYv435:Nh+ZkldoPK8YaHoXuUZqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139746, "uuid": "c52c9a6c-7996-43f3-a5f8-041f2129e690", "value": 1255936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139746, "uuid": "a7cf682e-e800-4fc6-baab-e2b04bbd570a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139746, "uuid": "3fea5884-2abd-4333-9826-a19a44d9cb0c", "value": "SecuriteInfo.com.Trojan.DownLoader26.64477.14848.28971", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7344d548-59c9-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639148229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639148229, "uuid": "98bb617a-2fc9-4af6-bc8f-5ea292be096b", "comment": "Malware payload (RaccoonStealer)", "value": "d90dce4c9b940d6099e1efc55ff514bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639148229, "uuid": "d43d3b82-35b9-4799-adf5-7a4845f63aa6", "comment": "Malware payload (RaccoonStealer)", "value": "3dc57dcb56f96be6067cb54322ec97aea1724c1ec8084ae7f8b1a71d140352a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639148229, "uuid": "c3ae4c6b-e1c0-400c-a5d4-7a1124035165", "comment": "Malware payload (RaccoonStealer)", "value": "80507bd3142ca4e2136b71fd8e45ce872611e467", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639148229, "uuid": "0f182d65-e5aa-4feb-95e2-75c8004d0858", "comment": "Malware payload (RaccoonStealer)", "value": "3f53c7d66bd70631f062be35b463843db67dbf23efbe32d3007445651af55f6291b40025f48a628d262c6d5527378a27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639148229, "uuid": "e76a684d-bdf0-4099-9775-ca23556df0e8", "value": "T1AA45F10EA311C602FC58D7346EBB6FA012B4BAB2AD92C397FB5D1A3C446B3795C41356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639148229, "uuid": "4406cc98-a22e-49c1-b8c1-d9df07d226c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639148229, "uuid": "2d9e308b-4259-4e60-ade2-6614e1ab7492", "value": "24576:1ioqKsUvUBs1bucO2SJ/NYF2nnohmP1+W2g2Fl4NPuvT:1ioDMW1bu2iO+p2g2Fl4NGvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639148229, "uuid": "2561e703-3672-4362-9188-d11766d693c6", "value": 1272320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639148229, "uuid": "44cffd59-03ca-45ef-8d44-27b62b944d87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639148229, "uuid": "cb9c5568-9fce-41ca-844e-82ac84c3797a", "value": "d90dce4c9b940d6099e1efc55ff514bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449cdf22-599e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639129683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639129683, "uuid": "402394e0-a653-4785-872d-44abd7caef61", "comment": "Malware payload (Heodo)", "value": "9198d0316a80cc467a191cb1053ade81", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639129683, "uuid": "f8f6863f-b4d9-405b-8b81-256946558dcb", "comment": "Malware payload (Heodo)", "value": "3e8109803e78bd1d83e880576f4bc16bd2f25c6591dd708d8c00aa9b3cd90f74", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639129683, "uuid": "a89c8d7b-f80e-476a-a2ff-3bcad0259930", "comment": "Malware payload (Heodo)", "value": "a4c4763d8fa6770c4107bcad41718fdbf821bc09", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639129683, "uuid": "818bc21c-1812-4c96-a4f3-53b1e54e34b0", "comment": "Malware payload (Heodo)", "value": "e655f4cd70d2bdfee94db1c114f4082a5eae6405e244eae818b8efd2959b023991d56f00e158ad4fb1f9fa1bebc0c35f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639129683, "uuid": "7f8b0a8a-fe09-4059-9317-857b723c95b2", "value": "T145A38B3C57B6524FC4DF1C3AC2380AEB97374708E21EA469F019E4CA6B676553B2AD1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639129683, "uuid": "5899726f-24f2-40ce-80fc-d3fbceeb0ca0", "value": "1536:A++YB/pKp20B+axURtKckrr9qZGrhD1GW+wZk4lHpuaI4qT:ATixKHHxutKckrpqZGh+wrlJuaIjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639129683, "uuid": "f1f5f947-0e50-449b-9834-53cfb03c6444", "value": 104298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639129683, "uuid": "adf9beb4-4ab1-4ec5-9f3c-5c574a7e74d1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639129683, "uuid": "29882d24-a924-4b12-906e-4ba9f8383f12", "value": "Dettagli_09122021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c83de02-5997-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639126609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126609, "uuid": "f900d9ca-0399-4816-a0fd-1b668d319dbc", "comment": "Malware payload (Loki)", "value": "311c3d274021a1b2e8898d4a9217b301", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126609, "uuid": "3dc4c8b3-2b15-402e-b808-8ced27ee0df3", "comment": "Malware payload (Loki)", "value": "4209c449db78c6c8b0b746724a9c4bbe1740c27a1a92e90d69fbac581b0931f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126609, "uuid": "243cf5dc-6e58-4e63-8a6e-e845ad83de68", "comment": "Malware payload (Loki)", "value": "ef791ee58cffbb256948bbdd34201869956e9de4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126609, "uuid": "e87001c8-f3f0-4bbf-9cfc-1305bf88c2cb", "comment": "Malware payload (Loki)", "value": "7fd72ef36ea68604915e7ffa32631c45331731d43710442005f5dd4521df9649e40c3d2e7be0f9454a7a2c3587eaf3b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126609, "uuid": "718eba72-671f-4cbd-a4dd-449ba346c65a", "value": "T101E34A2477F8AF62C8BD97FC566921144BF0752FA002E79A0EC634C73AA5F931A11D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126609, "uuid": "a0882d05-504b-406d-ab45-d4ffef993f23", "value": "3072:5f0PHiZ8Ca0Njczb1q00tIY3l2w174Uhd:5fUCanzbv0tIO2Q4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639126609, "uuid": "b970b575-6b7c-4aa1-9831-0eee9860b99b", "value": 156054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639126609, "uuid": "08ac652e-1e97-49fe-896b-4db662e441c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126609, "uuid": "f1aed98a-c910-4153-b62b-7d85ba65f46e", "value": "311c3d274021a1b2e8898d4a9217b301.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9240a66-59e2-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639159057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159057, "uuid": "54761d31-ac80-466e-b648-1d7490b5fc77", "comment": "Malware payload", "value": "21931ee41cff7c12209488b35797168a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159057, "uuid": "ca2bcee9-6a4a-41ad-8c61-dafb8df9be20", "comment": "Malware payload", "value": "4327d01b99f7a076879064887de42f3c3ccd551507f3cb7ec2f150ce823cded0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159057, "uuid": "9dcf4625-a676-413c-90a9-617eb7b0d388", "comment": "Malware payload", "value": "89b9bfcfebfa9003618611450e6a4785f3d25f54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159057, "uuid": "3e9874d1-9666-4147-a66f-cb5f2ec4414f", "comment": "Malware payload", "value": "00a88b19479057b20c4f46034f9d37ad987d9adb9844429f735be6fe4bb1937261a77b64df91ac1dab57c488d37da369", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159057, "uuid": "1222f1c9-8374-40ce-8303-0c0409ea3d7d", "value": "T19CE2F1E1F2ADCFA0D9FB5EF144C1BBD133B10A59BF414AE566844F11E228CA2B0365C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159057, "uuid": "d8430a63-8f9d-406e-a5cf-f7b913237496", "value": "768:AgFqmivGqRvxwT2Csl1IZvrAdq/2babOxbSo4uVcqgw02TWXE:AgFqme5ZbHMjAc/QFbSo4u+qgw0cWXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639159057, "uuid": "7b233eb2-fcc2-408f-b7d0-00dd3d614c46", "value": 33700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639159057, "uuid": "6ded4d5f-d544-438b-bd8e-c351bc8bb360", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159057, "uuid": "71e7b6e9-b475-4d5e-9377-2b8ada8e859f", "value": "21931ee41cff7c12209488b35797168a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a4887f-59b5-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639139744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139744, "uuid": "03db656b-f717-4797-8cb2-99d846b8569b", "comment": "Malware payload (AgentTesla)", "value": "a249da2ce5b614356c4fbb3f5c8ea96d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139744, "uuid": "fec6cff0-c628-4099-a6a5-6beb5a6f07f0", "comment": "Malware payload (AgentTesla)", "value": "459a96d9c261c779036f999c0bb2bc01a2e9126a48cdffb01748a639e63da1a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139744, "uuid": "1121447d-4025-4f32-8c6b-d7e1b2e6b7f3", "comment": "Malware payload (AgentTesla)", "value": "bf133dbec4c7be7203face63096a8b9b393f0ef0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139744, "uuid": "273c4d02-f58f-40ba-a581-c506790d1036", "comment": "Malware payload (AgentTesla)", "value": "e0fcd75a15b433f1220abdf0e77220e51b0c57eee3ea216a6d066a3db58d17ea202679102749f0985d15bc5e9cb08046", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139744, "uuid": "152988cf-3f5a-44f7-a458-614500b4e82e", "value": "T10D05E1203BAD9B88E436EF784B98705097FCE512B717E14E3D95A28E1B11F85CDB3522", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139744, "uuid": "6731622a-e176-42d2-bb08-bc706566da6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139744, "uuid": "a9d38bc7-8829-434a-a959-d81e434370be", "value": "12288:X1G6rbE44sB9phJZzSg6XvTxZglk46l408aoHFgoDKE5FJRzKx7XWvfHT0kT0zw:XNzW97XD46l4rlHFgsGNXSHokozw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139744, "uuid": "67af541f-5210-478e-bd53-19a772d4cf29", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139744, "uuid": "7667d0bd-e81b-41cc-a0e1-079839d80102", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139744, "uuid": "c5d2a47a-b961-4408-a8ea-6eda89db68ac", "value": "SecuriteInfo.com.Trojan.PackedNET.560.2941.27000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320901d0-59ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639141677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141677, "uuid": "636efb37-4ff7-4f03-9be0-d99f6b033680", "comment": "Malware payload (AgentTesla)", "value": "edadcccd56c9662ddae6e49be3b18718", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141677, "uuid": "3104043c-3585-4850-9c9e-e8c751f35eb5", "comment": "Malware payload (AgentTesla)", "value": "493ff124a79ea626e8f93f34b225bfdf3b5753549b265fec55bcb2ad560446b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141677, "uuid": "fd24293e-0ed1-41af-8292-abedf3dc4848", "comment": "Malware payload (AgentTesla)", "value": "98a42eb0f5ff82386c573591af516fd22a298b51", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141677, "uuid": "1c01f685-5ac0-436f-85bf-c9e857ef5274", "comment": "Malware payload (AgentTesla)", "value": "236df258e75bb6a513cce376a90a11207e9b219e14ec9ba61469debb589b58173b211d14de1e3c72a3e05f1e132f9e05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141677, "uuid": "7781957d-b8d5-47c1-aa7f-57eb479f7afe", "value": "T12135235933640BA1DAFD4BFEA061301457377D17B8B1D72C6E8A31EA02B3B819962F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141677, "uuid": "6135caef-838b-4109-a351-fb4826674ce7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141677, "uuid": "52c970e1-62be-4367-bcb1-11d3137b1fc3", "value": "24576:3lVZx3Tz3ik823v614AUAJSaSg4oOesgwca4Qqnx2oW1:3txjz782f615D+eymbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639141677, "uuid": "8a35c2f1-e9c5-4e09-a488-caf264570efc", "value": 1121280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639141677, "uuid": "17d8f3bb-9d17-4459-a647-99da65f194db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141677, "uuid": "92a03a30-0d15-4151-95c7-631139903220", "value": "Payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c3cd6a-59be-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639143455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143455, "uuid": "84684ea4-2a97-4a6f-b13d-9cefd37bf2a3", "comment": "Malware payload (Formbook)", "value": "f759647c63fa4ce74304855b834dab0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143455, "uuid": "d03feba3-750f-4a5e-921d-a2bc5a6ba3e7", "comment": "Malware payload (Formbook)", "value": "495c0c7f1577fd44ae441f822bbf761ca3cd4918193e1b476b26d11645c18b04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143455, "uuid": "0a74c705-ff92-4378-bc78-8a414d1061ee", "comment": "Malware payload (Formbook)", "value": "7768be3980f0753450edbf93b0a2a9d4e0db1d3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143455, "uuid": "2b77da2e-dd92-47d5-a93b-f8ac9c662842", "comment": "Malware payload (Formbook)", "value": "179982f5b0418a2fe1af717e6173c5ca3646aaf0caa1a44171c4ad83b4a9e9bf707bcca57c55186f28a38e312b0026e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143455, "uuid": "e8c0e469-a3c5-4a03-a566-314a5e3d3d46", "value": "T1C054131DA2C88F3FD74D9E395173ABBEE7B187D100D4D71F0B851EE5EB64282940898A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143455, "uuid": "300a948c-5563-4132-86a0-d7a20cd84003", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143455, "uuid": "bb40b0a4-ddb1-4c84-801f-86f7bee4487f", "value": "6144:rGiMthPXgoyoWC3tO/fbVYlfqM8LNIOVomf3wsh4:IbooyoWCdObmlirLNhnfBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639143455, "uuid": "3d151756-70d6-4e7c-954e-6a449e735608", "value": 282404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639143455, "uuid": "bf4963b9-26bf-48ba-a8d1-339aafe9892f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143455, "uuid": "905f5103-5f0d-41c8-819a-6dc5574fc517", "value": "f759647c63fa4ce74304855b834dab0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f136473d-59b9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639141569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141569, "uuid": "ac9ad46c-588b-40fb-ba5a-31b4be3d5f9f", "comment": "Malware payload (Formbook)", "value": "e5ab5559b7e42abd00ed6fe57aaf785d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141569, "uuid": "9377bd1e-26dc-4b71-b7f5-07659673022f", "comment": "Malware payload (Formbook)", "value": "49b3ee38714a175e49f3f3c1711bdd6bf32dab460dda33d37de3e418a7d862d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141569, "uuid": "a0f2a6c2-4a52-42b2-8c46-0a3b11ba94bb", "comment": "Malware payload (Formbook)", "value": "eb2df2f506ed6d9bb9ce25c229367eb5e28961c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141569, "uuid": "d1bee3b1-d183-4f85-b469-0a6df3d0ff56", "comment": "Malware payload (Formbook)", "value": "26f798b6b718b3a76799a4081bfc1106a4baccdea65fc66f222846ec559e7ae6f7d8b9bff947375112db0a6a76205b5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141569, "uuid": "192b2353-8640-405c-a0db-ed214267f98a", "value": "T18835121136A8CD10E27A5BB6CDDB900007FCB91AB412DB1D3DE572ED09B3B6A0D15ADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141569, "uuid": "38aaa459-3351-4bb5-8bc5-0b26c8ab1f40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141569, "uuid": "a6f53efd-9876-4d9f-8600-fe9c8fa2c8f2", "value": "24576:jTxgz8LAJXxjox94Gjs2LQr69ZphKx/9JyW:3xgz8LAJXVox9vsNwexF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639141569, "uuid": "4bbcab52-96d2-4952-8b9f-060fdbc96411", "value": 1100288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639141569, "uuid": "73ea5ca1-3fa6-4726-b5f6-31501f3a1947", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141569, "uuid": "be776a6c-d69a-458f-8fcd-0e192ed7e9ed", "value": "Dz1eLQVom0eXnTN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b06246-59b4-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639139273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139273, "uuid": "9e94a21e-ddf3-45a3-abc4-d7bd92e07bd2", "comment": "Malware payload (AgentTesla)", "value": "fae19f0c76d1e59f164e225e2ee808b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139273, "uuid": "32f3833e-4d1e-4cbc-a6aa-3877e1ee0466", "comment": "Malware payload (AgentTesla)", "value": "49ce7db96368873a644856299ae4ffa2448f350c64f5c4de9a55f158e71e9d5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139273, "uuid": "f2fafdba-bb9e-48a6-b42f-066537478685", "comment": "Malware payload (AgentTesla)", "value": "03ae9024c296cd2d23694ca158b8a7f314876571", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139273, "uuid": "2f287f53-4357-4371-a858-2d952cdf548e", "comment": "Malware payload (AgentTesla)", "value": "7f39fe630b094cf07479b262b6dcf71936ea9f19a382ab3f7164e845c1da24dcd6057f7e8f4dd61944bbf57e3e897633", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139273, "uuid": "00e00e33-4a76-4fa4-865c-41dcec3652dc", "value": "T1E335226C3A9363CEC4A157BA376A906802366D76184FC24DE09E725F1E377827973723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139273, "uuid": "59d43c5b-bb65-49af-8659-e7b66d0250f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139273, "uuid": "11662b26-cbfa-4534-b10b-fdd84e5f8683", "value": "24576:npceKeUfd2kS0kN0uQN+67LwUPa5BLGq71/dC2:npcZehrN0uA+67cy0Cq5/dC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139273, "uuid": "28fcbc71-0d15-4354-b29b-5155e0050b9f", "value": 1114624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139273, "uuid": "b87f5e16-be39-4208-9e9c-8e03e39a0aae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139273, "uuid": "7efa9141-6dba-49b7-aba5-b36af2bb0879", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b379ccf-5995-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639125855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125855, "uuid": "fbeca0f8-df23-4daa-aa97-14e827da2803", "comment": "Malware payload (Formbook)", "value": "3648eee3f0f24aa64039a4a50112fe84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125855, "uuid": "2f3cd5ae-c7a8-458a-87fa-fb2bb458e4e1", "comment": "Malware payload (Formbook)", "value": "4b0aaf5604a6ce5862163169095dfd26f4301e47e14c9e133415a924c601e5ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125855, "uuid": "d6eeb44d-97ec-4a3d-b611-07b78100e77f", "comment": "Malware payload (Formbook)", "value": "ba12caa16a976220bed59725d491d5a83ef2fbba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125855, "uuid": "d8e670fd-05e5-4d3c-8e0d-e18362b460b5", "comment": "Malware payload (Formbook)", "value": "2670324ce4fef5d6b532e6270271a5870635a764f4c07d854f194dfced501202b28dcaf99d87018d0af49721cf31fde0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125855, "uuid": "24dc5be2-371d-40bb-96c5-9a8bc15412d8", "value": "T1D825235633B617A1D6384BFE64A0982583B1B13A7C73EB0F2D9124DE25B6F514E80F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125855, "uuid": "3587402b-35e3-4cae-897c-625ad7b81f9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125855, "uuid": "5e352719-e6ba-4662-905e-9cf2368d1698", "value": "24576:OtBdxlTWespmgT5489PR21EW3vGR2DE+gQ82zjim7ZN96tGG:OVxZWedKn5DIvGCyZKim7ZNstGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639125855, "uuid": "aad12876-7900-49f1-af86-58ec45192a6e", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639125855, "uuid": "eedd74dc-bdaa-4ee1-ac34-bc0b57fe1a30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125855, "uuid": "a1b92192-19c1-41ba-93fc-bda850891ff0", "value": "3648eee3f0f24aa64039a4a50112fe84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb14cacf-5978-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639113641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639113641, "uuid": "41c34c28-4186-4ffd-a42a-3506a884c631", "comment": "Malware payload (AgentTesla)", "value": "38f2719aeac649373c130455818db806", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639113641, "uuid": "91e25f7a-b997-4c58-9245-e2c41357e549", "comment": "Malware payload (AgentTesla)", "value": "4c26da982d553358f5650e82d7a6e1cfcfc18ad530d03156c3607b6a7b580c75", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639113641, "uuid": "b4c98a1e-56e4-47a8-a5be-eb55cd278e45", "comment": "Malware payload (AgentTesla)", "value": "9bfcb8af56e9fe423e718eb349484c76fcb8d8f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639113641, "uuid": "8d87e8f5-a68b-4e3a-9d4c-801524b34019", "comment": "Malware payload (AgentTesla)", "value": "383bd63d237beca07ef5cac3b6351c3b2d7171a42c4faea009b7fcf40865314ad146b43733d1af06950b3dcf7256d634", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639113641, "uuid": "4cd3061f-d7f6-43a6-b745-0773dec66468", "value": "T13B3512E13278C67BCF5814BDD08052C1837682AA6166EFDBEDD256FE24C77E82253097", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639113641, "uuid": "553ecf13-d953-4a8c-977a-a7306e9b4525", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639113641, "uuid": "0709ae60-ee68-4f10-819f-d6871ddb3ab0", "value": "24576:PGjW77ukLr37+0lT7V7OV9bjpZS0YzKXtXRbIw97OMr9:ejWvn3v7V7OfbjDx/XRbnlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639113641, "uuid": "e3241048-a234-420a-87f9-7b0a6ce92e1f", "value": 1129984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639113641, "uuid": "6bb7a20c-9730-467b-b61c-2ff554f257d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639113641, "uuid": "ce48e22c-af8c-4afe-a6c0-efe1b8b7fba2", "value": "INVOICE AND BANK DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8781d7b2-5991-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639124212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124212, "uuid": "1c7fc302-1aeb-4628-b1aa-e475119d85f7", "comment": "Malware payload", "value": "ffd6bef217a7c71f065ef9ce3ff15b0e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124212, "uuid": "85b80cc5-8208-419b-a8be-ed7dc96a7782", "comment": "Malware payload", "value": "4c7e312fb67a6416697d476e659b3456156170e993a0dd1371a5be5d49f43fb9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124212, "uuid": "f2efd30c-722d-4fec-a23c-0ec56fb502d3", "comment": "Malware payload", "value": "888d017a8ab14e6061e5c8b9b5016b357e25f642", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124212, "uuid": "61fdb97e-6441-47d8-96f9-6916e382758a", "comment": "Malware payload", "value": "9ed2af8e12a8296a3e78c66b51a2084b976eec8ab08bfa292397588cca837d8830550925efcce8845665237f04d777a8", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124212, "uuid": "a09f7554-71c1-40f2-8025-2e1e5c4772cf", "value": "T1E4A58F22B2C18537D076177C9D5BE7A8A8397D201E28980B3BE43F4C9F397417D6A297", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124212, "uuid": "b256f342-4e68-4b38-bad7-0e7e8e40372d", "value": "24576:6ev7yLn0I++/3VTHW5Afpy4oarFc/ke60vv8xHDN8VJ/oneiImqYzvE+nXQTU+9v:6eTye+iUe60oD4Ronesb8TP9zGYS3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124212, "uuid": "d8ba97d7-6bdc-434b-9d3d-bd42c5243bb4", "value": 2072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124212, "uuid": "f0da5277-be0e-45bf-9b0f-2832de40fd45", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124212, "uuid": "1171bf06-b4aa-403e-b26a-9b4622b2e762", "value": "FX3NKLon@Factura_08122021_(977KB).PDF_office@DalesteFX03.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49b1bea-59c1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639145010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639145010, "uuid": "5185b5cc-18f4-4171-a231-de581cb13b73", "comment": "Malware payload (Formbook)", "value": "ed7087725a782ee4ad8b0301fc48ced1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639145010, "uuid": "f55eea7f-27bd-4c66-952f-53d006767b16", "comment": "Malware payload (Formbook)", "value": "4d3278c0ac823e1811aa3d877de62c48a09bf3914b74b7cec014a052e5dc5124", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639145010, "uuid": "3d9ae3fd-5270-4f4d-95af-8c8127a56f4b", "comment": "Malware payload (Formbook)", "value": "6c0c9308d9c3cf58ae9e9586fa4ac232e8610d30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639145010, "uuid": "14d97a93-af47-4a0a-869d-029e8b5d0794", "comment": "Malware payload (Formbook)", "value": "5d1933b5218774ca5d69c7ab7e013365688cfe34d5b9bd18cf0b0f584b07a0e148423d38cad11e82ceeb1f65cd80015d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639145010, "uuid": "6c93b0aa-3440-4b38-902b-b83daa5114f6", "value": "T10484023FBB2DC421C454A4F8B562D94BACB1D441147EEF43F3B51E3ACA79682AA1D113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639145010, "uuid": "28637461-7a83-4b0d-8778-d60815c2e2a7", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639145010, "uuid": "b32e58a4-5663-49ed-abed-36e45613e119", "value": "6144:wGivGrapHkUkIV4PYE/2UQqY88T/lzarRPOkyV9C1CvBckEdEVz2Uk8CK:GGrapHkPIWPYE+UPOfZUaz2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639145010, "uuid": "1c70c3a1-a6bb-4bbb-bf96-2e26e47d4e5f", "value": 383136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639145010, "uuid": "a613b844-79ed-4274-a423-0fe7e316ffc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639145010, "uuid": "5491e98a-3c9b-408a-a543-3c55970736fc", "value": "PO6766000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4991660a-5982-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639117665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117665, "uuid": "f991cf8a-02d1-41b2-bc9d-40c0e752c7f9", "comment": "Malware payload (Formbook)", "value": "d1402ffe3ddbda62255c399e134c941f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117665, "uuid": "80f29e3e-5058-4c18-ba34-72a2ed3c62fa", "comment": "Malware payload (Formbook)", "value": "4e04beeef47a20fe082783417bdb805d2a1ea3828e9a942e90e184abd7774604", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117665, "uuid": "f181c013-3249-41e8-ba39-50818da3f131", "comment": "Malware payload (Formbook)", "value": "11ad4f823cd02ec1447ea0c4c3f78ee931756306", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117665, "uuid": "5733c8b4-6bba-4c02-8225-d62ebd3b20d4", "comment": "Malware payload (Formbook)", "value": "57f9207bc34d18e228f28f70ccc8b21832eaf0a7fa48f9743269de54b9ec55d07b78030a4b98253e91978003e55a1486", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117665, "uuid": "596f740d-e98a-463e-ab31-331d7a9ae129", "value": "T13944130665C29437EEA997312163B3F6D3FFC36500EA5B9B5BD43F2F6A231036441886", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117665, "uuid": "5585b422-c72b-4444-a02f-4e44075a12aa", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117665, "uuid": "3416adfb-edd2-42ce-9cf0-1e521dd7f442", "value": "6144:rGiJHvgXjMmsZEFv+9gfCOCepetDjM212337:NPgz7siFv2gfE6CDen7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639117665, "uuid": "a0045c20-3933-42d2-8c7a-707f817ed3db", "value": 267390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639117665, "uuid": "8849b0a4-b39e-442f-9389-613657a5cfdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117665, "uuid": "d3fcfc01-c52e-44f9-8f2b-d61ca186e2a0", "value": "scan_009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3895fa6-59bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639142297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639142297, "uuid": "09bc6d36-aa0e-4177-a624-6d3e1b2f66b7", "comment": "Malware payload (CoinMiner)", "value": "92f2da08477e7bb6c83ed58e36df99d4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639142297, "uuid": "45311983-00b9-404a-999a-06f4248d60d2", "comment": "Malware payload (CoinMiner)", "value": "4e93bae3721684f64be01b14cf0d13666b426c29be0804988f34d49a8b2bef36", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639142297, "uuid": "b1fef3d8-070b-4d62-8143-761238828a87", "comment": "Malware payload (CoinMiner)", "value": "a5eb9b5c7f8b21aa76baf2a4db82bb9fbe29e038", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639142297, "uuid": "40a10c4b-5f98-4cf5-8954-8e2abd760934", "comment": "Malware payload (CoinMiner)", "value": "228f197554bb2239fb3ffb4e063c1d97c81ad51a81b55578b537e23bc2cbeae88833a08c73db6f87004151b2761f9ede", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639142297, "uuid": "fe1b16e4-d8c8-4d2f-8a4a-9b68e0aa1d9c", "value": "T17B84239B4C1D9AADED82433394FF08535A67FB9C33324E3D9A618C402DF2A645B864D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639142297, "uuid": "b8262dfa-95d9-450a-8b0e-96b37290a105", "value": "aae73b7675bdc323442f02d62bb383ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639142297, "uuid": "5686c1d2-cada-4988-9a37-62575d203850", "value": "6144:Udg1ItuNpBfTPcPPdpo2iy/kaBPE2EpB9tk1ObAV1D4ltDlY/ZlFgXVlzVxm+Wy:UsxpBbIkhycgXIBhkDWPY/HgVpVg+Wy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639142297, "uuid": "6fa717f7-67fb-487c-972b-b642e8054cbe", "value": 381404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639142297, "uuid": "3424fa6f-d9c1-4222-925c-b8a695e36596", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639142297, "uuid": "e8d57db2-5488-409f-8d04-223176a7a4a8", "value": "92f2da08477e7bb6c83ed58e36df99d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a28da76-59a4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639132350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132350, "uuid": "d4471218-c7ed-4659-ad2f-68258cee6f8e", "comment": "Malware payload", "value": "06203d2785f34053fa419e6d474e00d9", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132350, "uuid": "452ea798-7379-4c4a-a773-af8cf9f344cd", "comment": "Malware payload", "value": "4e94c3da8a885c6550a7121766b0d2a69822253236e2da399db1f6018c26a57f", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132350, "uuid": "a7edee22-d6cb-4163-b430-e8e168f245d9", "comment": "Malware payload", "value": "4e79245fc61bb9b700788199075da1a9acce7f93", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132350, "uuid": "efbb349c-e296-4e5d-8120-628bc9fd65a3", "comment": "Malware payload", "value": "01d68b7e9e7545b9ae3b65053dcf43760b1efd8fb1eb26594d5feb771c9fad48ff5c3b1841903f56a223e59dd3c51512", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132350, "uuid": "efe25fd2-e10b-4221-9f5e-566ea29a5798", "value": "T19722A0CDD8556184CF17B637C7C5008677AA72DC22AA014FE046B0BA5E95B4FEF71EA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132350, "uuid": "7319b6a9-51df-4e84-b793-7fcd945f4086", "value": "192:JSP3B9PvmReEKTjU/uJMreuYCja5dmbPhBgQJKCA:JSPxdvmReD7MreuYCGdmb5GQJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639132350, "uuid": "3e0b813e-aa79-49ee-8186-59fb15a8f663", "value": 10640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639132350, "uuid": "cb5ec078-3b22-42ea-8aea-10e994762e99", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132350, "uuid": "a7e11093-5bba-4c10-b0dd-1e6f7189898d", "value": "Swift Copy.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b823b1dd-59b5-11ec-96a4-42010a9c0029", "comment": "Malware payload (HawkEye)", "timestamp": 1639139755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139755, "uuid": "64eefe2c-e65b-4679-9619-4f675bb7eb29", "comment": "Malware payload (HawkEye)", "value": "61c5dde7b4dbb77058f8aad370e92648", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139755, "uuid": "b99645ab-98d7-4c15-b718-e4c41ac5a627", "comment": "Malware payload (HawkEye)", "value": "4f387257ba2721c27465800f9db3e513ded059ce28b68d593de0f459dfcf95a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139755, "uuid": "3d5f95ea-709d-4257-8cd5-29260f37745b", "comment": "Malware payload (HawkEye)", "value": "753c4913e5bd73a37c04ec4b180f99aa5d15b2f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139755, "uuid": "bee6e98d-27df-4815-89f6-3e79e583c43c", "comment": "Malware payload (HawkEye)", "value": "a5ad9b5b4e2d17b39eeb088ecccb5d15fe7978cdaa92aa4a19f2ba82306d231df8461fe5ecc6fe440b0519f441449f40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139755, "uuid": "8c1e1735-57ed-4427-8851-7b0a5d9abc38", "value": "T1C785BE3E63978066FF5A1676A71422435EBCE8437D6AC06E23B4C8F469F107092FDA71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139755, "uuid": "bfef89f1-8862-416e-8cd9-8768fd92b1fc", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139755, "uuid": "c85f8484-a3e8-42f0-87d8-d59d80875d80", "value": "24576:EAHnh+eWsN3skA4RV1Hom2KXMmHapr1X5pc0zEtdKnY2jDPFT7TVfd5HTfr6sbt5:Th+ZkldoPK8Yapyqu2jDPpNHH5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139755, "uuid": "8d62428f-90e6-4e84-9f93-59cddcaa82ea", "value": 1804800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139755, "uuid": "08984156-31d9-4b3d-a59b-a575ae333fdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139755, "uuid": "dd02fc24-1636-43bc-9f66-b03788e17c0f", "value": "SecuriteInfo.com.Trojan.AutoIt.457.26065.4450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91bd77ef-5982-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639117786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117786, "uuid": "2947661d-73f8-4f63-a579-0c7281b377dc", "comment": "Malware payload (AgentTesla)", "value": "e8db3dd575b7c639209a3e7cfbc2fd2a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117786, "uuid": "443cace0-7aca-4fd0-904f-4247543d5a49", "comment": "Malware payload (AgentTesla)", "value": "4f69e33dc3a447295f277ebe829a2ebfde2aeeafbd1483ae40268cb23bdde603", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117786, "uuid": "7d5481d0-00be-4033-a3ab-e58252523298", "comment": "Malware payload (AgentTesla)", "value": "750b90bc7b45b39b724fca2572ccb8e4be7cd99f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117786, "uuid": "b97f2cb8-eb1b-4321-a890-ac714df41a6d", "comment": "Malware payload (AgentTesla)", "value": "2ceee771dd38503792c94b9319dec02764f4a09a71fb91444f7381d15a29ef6b85a3ee4870c012d5c2e666f8e4a753a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117786, "uuid": "20a88701-a0c6-445d-98b7-467fe60aba2a", "value": "T1CE55120B39E5D812C27947B6C6A792908FFCF8033DF6E67269D1127D6E34BCA5503286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117786, "uuid": "4b6323f6-3da4-47db-814a-823e5e5eba84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117786, "uuid": "29218e0a-f185-4f34-b52f-b0d5e3cc9089", "value": "24576:LIKjy/SYCpXiSJB5X7+ZFMakb9tj8HQEyKnOMltIzhfT2CC3fUB3:LjASvJJnX7+ZFGhtdKnJIVL2UB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639117786, "uuid": "01ae1f32-348b-45b9-8e65-ff3134456cbd", "value": 1296896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639117786, "uuid": "725c1cf6-b912-41a0-ab78-2825f8d2fb5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117786, "uuid": "a2b8f375-0365-48cc-ab47-b4020f9d7616", "value": "Bank Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2221c6-5999-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639127821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639127821, "uuid": "7ffb9f14-916c-4c9f-9834-331ae149dd58", "comment": "Malware payload (Formbook)", "value": "898a401451083da185492a95c8cc19ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639127821, "uuid": "d45f937d-ba1a-4bb2-8a5a-70cbd48d36a4", "comment": "Malware payload (Formbook)", "value": "51145caa09bc826d948172d14c6edf2aba55bd83046950360025efc93306bed4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639127821, "uuid": "5bd10124-c319-40f0-a862-13e2ab7893f6", "comment": "Malware payload (Formbook)", "value": "b42953e32406a32f3e228652a176417318a140f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639127821, "uuid": "e447dfdc-3ac5-4a9e-8874-fc0d3c6301c8", "comment": "Malware payload (Formbook)", "value": "da882a5f641805892358c003d44c69ecbc70d82bb999b0d3d4687d2877d7501cb1b9e18bc9aa1a1edd618492147b5a3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639127821, "uuid": "903a5b93-f53a-4682-af75-41218d1491ce", "value": "T1294412156AC2CABAD1852AF209B2F7FDE7BA851114552D5FDBD40F8B0B23D830D1D0A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639127821, "uuid": "a5743368-7b61-4831-ba28-e8675557dd70", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639127821, "uuid": "0c6060dc-5f33-4841-b64d-789eabb919d3", "value": "6144:rGi2N+pC8qH2j0sMUz2PMt7Z12XZsAK7R1J6B4RKU:aspW42kz1+Zc1cYKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639127821, "uuid": "9f591ed7-5d52-498e-ad36-99c51797a1ec", "value": 277006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639127821, "uuid": "794ab89c-175a-4e67-b0ca-5966a1799578", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639127821, "uuid": "ad1db11f-c3f2-455c-984f-5cd090c4959a", "value": "SWIFT 1O3 For INV 60 FCL346758_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5faefd82-5961-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639103529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639103529, "uuid": "e2ab4057-8add-42e8-b414-8ee385183b87", "comment": "Malware payload (Loki)", "value": "faae9663e245ae98cae8a627e779d028", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639103529, "uuid": "d65a9587-cb3b-47fd-9f90-b4ed8c2be858", "comment": "Malware payload (Loki)", "value": "5339b02ac2c162099ccfa971f5bc531b03c87461388e90c7f86a8d8dc7147609", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639103529, "uuid": "a1e0c28c-d9e1-466c-bdba-619e477c4904", "comment": "Malware payload (Loki)", "value": "9f2d5d9d89adde96f9569e0da2b4106724d48a4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639103529, "uuid": "8fcda3de-b9bb-4bf9-86db-77bf322139ef", "comment": "Malware payload (Loki)", "value": "10fcdbedf698f0c397a8324d3b6fb3a8c975c0151d38dfe002313c146f724564132b5a99cd429e788b93c6d9c485a558", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639103529, "uuid": "00cb8e1d-7ef9-4fa5-8ab4-82e7000c0ea5", "value": "T1DA35131A2AB0E4BBD27897B5C697C0608EBCE0433E77E3B558A251FD2734589DD02B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639103529, "uuid": "2791da31-de04-43e9-98bd-2ee6c6620c89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639103529, "uuid": "a6c56279-7e5c-411d-ad3d-fc6c53982118", "value": "24576:0IKjy/SYCpAXSG7oPQa60BNQaRgyE/H/psXNz7:SjASYC+oPV6la21/HAJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639103529, "uuid": "9d735598-ee3e-49c3-a114-ea6283733965", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639103529, "uuid": "3ee55333-42d0-4ee8-a57a-bd1ea1d2d8f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639103529, "uuid": "1cb80a9b-120f-4dcc-9dca-fc6c298b11ad", "value": "confirmaci\u00f3n de transferencia.pdf-.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc54cd3-5982-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639117887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117887, "uuid": "ac1e8f9d-2b42-4137-b48f-d7c2e93f911e", "comment": "Malware payload (Formbook)", "value": "19a932a11ef99504927a28bc9836451d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117887, "uuid": "92ac7887-b788-469d-8ce8-9e8ceae2b478", "comment": "Malware payload (Formbook)", "value": "549d64bd9bc60269b7536f13659e902bc284f3fe586e5fe2d6e9720be7643505", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117887, "uuid": "56e6fe81-3d37-412b-a711-e82243d100b6", "comment": "Malware payload (Formbook)", "value": "7be96d740256b5e1902b542f8b29386cf314ead0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117887, "uuid": "91698a6a-72b1-471d-b3f5-6344c0b57b36", "comment": "Malware payload (Formbook)", "value": "9a622eb7f02eac418677a923f38c2c2b0d0a9634f9380f870782018f25933e6cbb7afa7e1d776cde65650d88d7fe6c41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117887, "uuid": "c7a938e8-54d7-4020-97f3-9de55e8b322a", "value": "T1BB3512A136A9CD10D2765F76CC9FA44007F8BD16A866D70D2EF872EE64733534902ACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117887, "uuid": "fbcb2d79-18c7-49da-914b-31917651957c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117887, "uuid": "15ad7471-fb8f-4396-bf92-54b1f3303eda", "value": "24576:/YB4iaASorUrvEB7rGgU1QcKkzI2joNAr7oK9Fqjw01E7gkKqJ:/e4iaAl+iGtJ1oNArcKq1E7gkKqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639117887, "uuid": "5bade976-b115-493d-9747-349f494989b3", "value": 1120768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639117887, "uuid": "27af1dc3-66cc-42c5-a31c-9240bf33dd02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117887, "uuid": "d07e4a4b-5f1f-4efa-ba1c-a4359f3624db", "value": "VERG\u0130 \u00d6DEME FATURASI 10 ARALIK 2021 CUMA,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f8b28a-59d5-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639153582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639153582, "uuid": "dd6c567f-eeb3-48de-87be-583df14ab912", "comment": "Malware payload (AgentTesla)", "value": "ca376f60a94a4d31eb176f011703c39c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639153582, "uuid": "c38d1783-1669-4a40-8e0c-72ccda31e639", "comment": "Malware payload (AgentTesla)", "value": "54b9b1e1f10d688f12d8b01f5f85474457dfcc1d486ea5e703cffe4769f30d01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639153582, "uuid": "d1490c2d-9d64-4dcf-826a-64b565fd7ee2", "comment": "Malware payload (AgentTesla)", "value": "be2820d07ff6861db6fd6748f9a1fa704f5aebcf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639153582, "uuid": "e25cc34b-69d0-486b-b1f0-e99dfaa35bd0", "comment": "Malware payload (AgentTesla)", "value": "be4667b951cf699b4bfc90a209d1f7ad05065839eb7e51df9fc035fe6eb620a0b098d00f6ee443a06f0ca45185fbffaf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639153582, "uuid": "7fcf9be4-14c2-4e32-b455-b3590f139f55", "value": "T19E35334E327E9C595BD8C88D50AA413FD1CDBDB2D2233DD9421FD1323CEBA66066B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639153582, "uuid": "f9585b0a-c54e-47e0-abb1-9d1a7dd07b38", "value": "24576:OoSw5HxQ9xLAmyh5U5g6qUyWegHXLKKpKdovxqaep:O7IG9xLch5RUyWegXLdIbBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639153582, "uuid": "ea678437-07eb-4077-9afa-b4c0d57de13e", "value": 1078458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639153582, "uuid": "fc150be7-1044-4938-a4e6-3685d8bb5c78", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639153582, "uuid": "fb4d8c8c-b65d-48d2-90b4-8bf29e4b6c0c", "value": "INVOICE AND BANK DETAILS.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc45a3d-5958-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639099900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639099900, "uuid": "b425bc97-ebbc-40cf-a092-b5e7d00902af", "comment": "Malware payload (Heodo)", "value": "add58a42b65f66c9cc198e56723ebbb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639099900, "uuid": "fe330778-cb2b-4645-9bce-942ddb3787a4", "comment": "Malware payload (Heodo)", "value": "5681e99bb1b3bd41eb593ee3436906edb8a04c386d621cdb87040e5fe8e061e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639099900, "uuid": "ba186950-86f2-4218-83a8-7d10bad0cdba", "comment": "Malware payload (Heodo)", "value": "0e295eba10c1cca6da5d76e17db698e62163a786", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639099900, "uuid": "e2f1660e-3e58-4b59-bcd9-e666ff1e93eb", "comment": "Malware payload (Heodo)", "value": "5f6873e12c118ff215bc3c4c10e48a384341062876edac945e1169c36e680870869608dea52629692e148f66323dd459", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639099900, "uuid": "de97e453-258b-45e1-83bc-133d3c043733", "value": "T17A44BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639099900, "uuid": "730a4d37-2563-4589-b8fe-bb469f6b2a46", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639099900, "uuid": "a8b11722-339b-4e22-a4ba-4b49547e4807", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTB72ypv:6jIG/pjjuLbJLmGshoCUnWTdpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639099900, "uuid": "8e696353-bd3a-475f-ad6e-5b2c4b1dcd23", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639099900, "uuid": "95e8f680-1802-4409-bbe7-1dd6a0cc2429", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639099900, "uuid": "a0cc853b-05db-4861-ab1a-05a7783d0ec5", "value": "add58a42b65f66c9cc198e56723ebbb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850ca43f-59b4-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1639139240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139240, "uuid": "dc2c0278-2e5d-4bb0-b599-7d2bbb39096c", "comment": "Malware payload (GuLoader)", "value": "ea5c4980bb7cde446a070578e0f4978e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139240, "uuid": "60e90237-003e-497d-a3cc-248ec61ab4bd", "comment": "Malware payload (GuLoader)", "value": "56dbd5ea8d6c00b4a3485c783103823374b907e7b0d3394c89e3b00d3ecbcd32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139240, "uuid": "565b8677-65d8-46fe-8804-d9377526bf56", "comment": "Malware payload (GuLoader)", "value": "bfc2f05e21dfe500d39b66b6207f9fba95b694ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139240, "uuid": "7e0551b7-f087-47e6-84d8-d15ad2932bd4", "comment": "Malware payload (GuLoader)", "value": "7e7ab57a7fdff8aa497a9a5b6d214c9198a9fc0854376d502a5b76716d946fa595e70886e39ba140f20e0dabd66c3962", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139240, "uuid": "07e34790-bbe2-4c62-a871-bf258b0d7205", "value": "T16EE34A14A2D0D2E9E156BBB1DD26F1AC1005AC37385041CFDECA7A9E1A35B43D9E33A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139240, "uuid": "c5975959-0dd8-454e-8188-b6979ca6c1a2", "value": "460340e2ce791b610d6d419830ceb88b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139240, "uuid": "29188114-d20f-472b-a6ec-92d4265365aa", "value": "1536:88KvUhxeynGjLtBnt1uTyYBYHandSl5aU5AjRFWX:svURGHntITgHFl4Zk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139240, "uuid": "9370d531-4317-4425-a1e3-c0e46706243a", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139240, "uuid": "d5ed911b-a23f-41e8-94c2-21797929960c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139240, "uuid": "196668a9-430d-42da-969a-a008ffed65f2", "value": "AVISO DE PAGO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d74855-5982-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639117813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117813, "uuid": "f98a6bb3-6bf5-4b98-9ee8-155ace04105f", "comment": "Malware payload (AgentTesla)", "value": "99d5dc4b6b49958411e7949372addc7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117813, "uuid": "895dd554-76d7-48b6-84ba-4f8430a2aab5", "comment": "Malware payload (AgentTesla)", "value": "57cb1ce5d14ff054252845d8a461cd4688a91c3e78706633028e87f357ae03a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117813, "uuid": "9a50f2ec-cfa9-4b12-aa2f-616baa213597", "comment": "Malware payload (AgentTesla)", "value": "851d6050608d80902ae61b709d1f7954656b622c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639117813, "uuid": "b8a67e7a-bddf-47cb-a694-a503270e4836", "comment": "Malware payload (AgentTesla)", "value": "a5615852997fe7af96d73a0c86e30c2b2c5e00ca4ab5bec90418e38462f43de37303234393961a1db0a520aa30e731fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117813, "uuid": "2797458b-bfdb-40a7-9463-1330644e949a", "value": "T1D83523B472EA1BA1D5BD1BFEB02890511732BD6758A3E70D9DE230DD04F2B025B61B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117813, "uuid": "b4e31da4-7324-4f7e-a032-0f989ad95f52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117813, "uuid": "9a0e1d39-7b94-4952-b21d-dd9b804deb41", "value": "24576:nve3xET4zScdc6C6g9SHu+vidNtXt2yOsWFLa9x8KqSsxAZw6xFo0alz0dEp:nexWcSmc2CSHu+6TKsWgnNJs+PFoBo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639117813, "uuid": "dbd65bf5-e43a-460e-9f02-0c8b0167c401", "value": 1116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639117813, "uuid": "99a97cf7-72b8-45e9-bcc9-60aa3e1a5f8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639117813, "uuid": "b727afe0-4e4f-4a6d-8d42-cd38eb451eda", "value": "652988567334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225a3010-59fb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639169568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639169568, "uuid": "9256b80b-a53b-4b8e-a751-1605aa1a53b0", "comment": "Malware payload (Loki)", "value": "7fd0c5e3114b1efaaf6cd2fa6cc879b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639169568, "uuid": "627f6995-032e-4723-9723-e95119305a9f", "comment": "Malware payload (Loki)", "value": "581643535b144a191e9e7670e7d8a98a3e8eafeec7822f4a4b02711df597d0c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639169568, "uuid": "a703a436-37af-4856-a12d-ce76048bfa3a", "comment": "Malware payload (Loki)", "value": "fa25151aa63f2be5640c8a44c7cda92354a132e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639169568, "uuid": "f04e5cc8-6e44-489b-a6ef-82438826b01c", "comment": "Malware payload (Loki)", "value": "0353acba2244e467ed2e65bc3f8db026dd3b22bdc6ce6d54747a817829f673db37081988f9c4dae5f4fa9dd65e9ffdc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639169568, "uuid": "a4280aca-28e7-47b9-a88a-6f2078e2d703", "value": "T14825229536F99F71E8B967FA90201451877974276CB3E32C1DC460ED08B3B228F52E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639169568, "uuid": "e6587385-d930-40c7-b92f-7b9c1fbca5d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639169568, "uuid": "3a3adc5a-ec83-42e3-8a31-a3ce7cd737c4", "value": "24576:dJKGx0TCz2hZDUpCbs5t/A69xEgWMiH6wFucW:dlxGCShNU0bs33pDwQcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639169568, "uuid": "3c24dc9d-85be-4b17-a449-39e58a6670de", "value": 979968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639169568, "uuid": "4dff0064-8543-452a-9364-e478a962847f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639169568, "uuid": "9bb1e5c8-2330-4290-b3f9-d42f61f9c636", "value": "PO 103648599(VN).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669aa62b-59a7-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639133605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639133605, "uuid": "b593e8fc-2995-42f4-95b7-0d2b0562433a", "comment": "Malware payload (CoinMiner)", "value": "7990f0feb5dd2934aef2d546fd782a07", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639133605, "uuid": "f8d0117a-b763-4e3d-9ac2-0e8a185b31e2", "comment": "Malware payload (CoinMiner)", "value": "584453b0ac50b6c6ca75aa0698ff3593c393709ad8b18f2708c6440528e8b7a1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639133605, "uuid": "2dc0b22e-235a-47e8-af97-4d4d70a73d6c", "comment": "Malware payload (CoinMiner)", "value": "7a10b7a22b964bd76effdbdc799098481fa72102", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639133605, "uuid": "ade5bfc1-45d1-452a-a4c7-8327db4bdb15", "comment": "Malware payload (CoinMiner)", "value": "2c19d05c51728900684e0c21eaf7dc4648036826b45761b3c26f9ebbe6b70308d470868ebcf3552ff41ad3389e9bfa9c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639133605, "uuid": "b748dfb9-488d-4101-b9c8-9e234c47310e", "value": "T1BDA5332BEAA86142E04FDFF7B861A7C2727CD04F9E2486061D0E0D16DC5B0F6DD86769", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639133605, "uuid": "35fba416-e81a-412a-bf5b-dd2024559418", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639133605, "uuid": "ae56be3d-0aa2-44d9-b97b-77878410a271", "value": "49152:/UuLvKhiKEDEraYBR0CWmIOynAKkFwJzPrwKXzfsKUrfC:ChHEArlRWmIOy0yPrAK6fC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639133605, "uuid": "285e20d8-ea0b-4745-8d8b-368435b0834f", "value": 2234368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639133605, "uuid": "c1b26add-f094-4004-a040-a02046ccf708", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639133605, "uuid": "dc6ca9bc-fcfc-40e0-a921-10ca1eca2a2e", "value": "7990f0feb5dd2934aef2d546fd782a07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d3ba9f-59ad-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639136362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639136362, "uuid": "6a89e458-4903-497b-9d79-9025b1b98368", "comment": "Malware payload", "value": "fe16fa500584cb241532dc7cb75c1f53", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639136362, "uuid": "77569499-9d0f-4dc2-9fc1-efad64624694", "comment": "Malware payload", "value": "59868f4b346bd401e067380cac69080709c86e06fae219bfb5bc17605a71ab3f", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639136362, "uuid": "232438df-5604-4a4e-9040-3e849924d0cd", "comment": "Malware payload", "value": "e22436386688b5abe6780a462fd07cd12c3f3321", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639136362, "uuid": "95f72621-aa27-48ef-b7c4-eb60e0098fc2", "comment": "Malware payload", "value": "1f89a1c9535d2b4c1564c7995d49dd0c76942219919e379a1f36fae9202aef22a624c77373fbf46823adb8bdd3e36ca3", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639136362, "uuid": "d2821ce4-9b15-49e8-829f-c2e74efd8302", "value": "T1CFE59E46FA4356ADCB971570305EB33AF63A491C602D9FA3E7E89D30FE2E71019C8619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639136362, "uuid": "b0e18569-34c2-4bed-88bc-2d3320313ec4", "value": "55c1bce75ad836c886b7fb6bca398063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639136362, "uuid": "4b4d8b8d-39d1-4ec4-8f63-ee524703ff20", "value": "49152:rAnCsMZjVpVbl4D5GzNMFsl4UROAUc1y32ZxJFi4NS/RgaJ2w1M:rAnCs8pVblGyNM+l4UxUc1BhFovww1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639136362, "uuid": "582378d5-00be-4476-91da-c97c988c70ab", "value": 3068928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639136362, "uuid": "56ec19ad-e225-4a35-9f9d-90d0842000ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639136362, "uuid": "07aa5a81-4b98-4de2-a21f-8fdda5c3fc1f", "value": "blackcat_redacted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0b2455-5960-11ec-96a4-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1639103227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639103227, "uuid": "8903a780-5ea6-49d8-8b55-19e02cf1c235", "comment": "Malware payload (OskiStealer)", "value": "b472b79f63ddbe091346ca5fb95fcf91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639103227, "uuid": "308c6e64-7b55-43c3-ae19-0ef8b8fc3a2d", "comment": "Malware payload (OskiStealer)", "value": "5a629d3ab5c60b1c929ce53198a05b6ab81e98ae7330b193c7a614f2992774b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639103227, "uuid": "fca75c18-7f77-49d0-bead-3daa1ac66350", "comment": "Malware payload (OskiStealer)", "value": "97557a0ed60cd72b46c5989178790adeaaa3d985", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639103227, "uuid": "66274975-a0db-4b16-b346-14b7d6a27092", "comment": "Malware payload (OskiStealer)", "value": "687ca8767e2864ea2fd3e19a822fe1e8cdd345715cfcfcbb3e327d2561560c4910f2da39dcdfd10a4bb16e535f1424eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639103227, "uuid": "40053026-4fc3-4b5a-8d9e-f4c8d25564b9", "value": "T1683522BC3793A3CED48582B43B56906853763C7A16AFD59DD09A338F8D33B0179A3612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639103227, "uuid": "0471ba94-9a47-44d5-b2a6-8e31838c4b88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639103227, "uuid": "bc0e145c-5634-4cce-8567-33483d3730f3", "value": "24576:arjX8ivSUGPb4PYf+5GC/Q+bhBYN7/4e67:S8ESUGPx25FQ+FBYmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639103227, "uuid": "4d5c3ac5-2dd3-4dd9-84f5-a5858ee0a81b", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639103227, "uuid": "f0506da3-f7a7-4984-af07-e8e47ad134fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639103227, "uuid": "89af9841-67a1-4eca-b10e-32c6319a459b", "value": "6A1vXWFsX9HNR1P.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc10ccf-59b5-11ec-96a4-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1639139761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139761, "uuid": "3ff4bfb4-966c-457b-8417-fdd070869e4b", "comment": "Malware payload (NanoCore)", "value": "44164463fc94e1008059e1de05a71a52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139761, "uuid": "0322b866-4eaa-49a0-96bd-1dcecf79c3ac", "comment": "Malware payload (NanoCore)", "value": "5b9b5f88bba852cc262bde8272cec676be6fe00bd761b331f47b5254c70a66af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139761, "uuid": "befd510f-904f-4e0f-bd0d-f18d3b55d75e", "comment": "Malware payload (NanoCore)", "value": "b09d4344ca7962bd906cf7f5f200ab6a55bb0748", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139761, "uuid": "87c7704c-ea5f-4f64-8800-d96b8217ac88", "comment": "Malware payload (NanoCore)", "value": "f96db142b18a6183ab9619d12c1cdddc2562073cde335fc27e472388b8b9a80f4c68955121ac29582006287a2c99b0ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139761, "uuid": "52b06bc1-aca4-4e0b-913e-28c143fd562e", "value": "T11765CF0273D6C036FFAB92739B6AB64156BC7D254123852F13982D79BC701B2273E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139761, "uuid": "d33d2c56-bced-48b8-be32-e9f48cfbb8bb", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139761, "uuid": "d53915d0-f87e-4ab7-a4bd-d7769291ed8b", "value": "24576:zAHnh+eWsN3skA4RV1Hom2KXMmHaMNtXFXSaTKPUmabZY/nVqvnMUTETHk/7bgUy:+h+ZkldoPK8YaMN5JSa+UmSyn0nMUTEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139761, "uuid": "611da2c4-f07d-4075-8bc9-9dbddb5ea50b", "value": 1458688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139761, "uuid": "23863d5f-88dd-4a69-b0ad-a4ce0d85b63d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139761, "uuid": "f438b257-dbc6-4655-b270-e5a5938d4719", "value": "SecuriteInfo.com.Trojan.AutoIt.571.10649.14494", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c053c387-59cc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Adwind)", "timestamp": 1639149647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639149647, "uuid": "3cb34c8d-ef94-41a7-ac61-0f782b498bb2", "comment": "Malware payload (Adwind)", "value": "f3a36dcf1a0bb1809350df37d2d3d700", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639149647, "uuid": "90382847-b811-4444-8a97-b881a3619445", "comment": "Malware payload (Adwind)", "value": "5bc57fcd71a5a038899e86b5d821d34686e8bbf9b87c020df4dd6219d48e9ec4", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639149647, "uuid": "86ef4628-70c9-4003-8ffd-db7176e86b53", "comment": "Malware payload (Adwind)", "value": "f5c8437feae59d6dc957988d11acf091ab66cab6", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639149647, "uuid": "af415310-c162-4424-98b7-01ad1cbda935", "comment": "Malware payload (Adwind)", "value": "a91a8a2e536fa70dbe46d26bdb934d337d97d55459f5219c29f12e676fbe8a7c59afc551a06c7131fb1a784c9cb144c6", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639149647, "uuid": "e8ee7133-66c0-4602-b3c5-b13fcd7a6eb1", "value": "T140D423F0DB3D69769E98230887471B5822043C7C83996DDC18FB691EA6BE47119DAEC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639149647, "uuid": "da14b55e-6577-4e59-aeb1-4d2764f409e0", "value": "12288:IUuINGi+8I5Ogi/AykW/z+snxc5YIf0TOvQ2kxYYr9Ofamqfv0:IrWbS5TeJxxc5YIcqYT9mqfv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639149647, "uuid": "db6d8786-0e70-49cc-8eda-258e52b8b833", "value": 649359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639149647, "uuid": "e002996d-bb46-4a3b-b4ea-d2afa65452fe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639149647, "uuid": "ecb10b16-a3eb-46c0-9e05-2909148e74ba", "value": "82097 PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0f3103-5993-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639124889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124889, "uuid": "f0b966a4-ff89-4285-b896-13c4e206b880", "comment": "Malware payload (Vjw0rm)", "value": "167d3dd10251a2faafa40694507a8e21", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124889, "uuid": "bfb208c6-e878-4f32-820c-ff4ba227b4f3", "comment": "Malware payload (Vjw0rm)", "value": "5bfef138f6cf42e78f2cceb78129ab389f9621e903e651a8ec933aac4268e166", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124889, "uuid": "5e519b00-5fd3-457e-8928-0932370d52cc", "comment": "Malware payload (Vjw0rm)", "value": "efc386cc1855d0ae87b299e43cf2f0500f8f9579", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124889, "uuid": "a1d8df6a-69fb-4e24-9ed8-f27847f131e5", "comment": "Malware payload (Vjw0rm)", "value": "0f673a6fc54b05b91c47b5482562df3864151bb589bd3de1fd7d8186ddd948939fc4d5861789d1359f89050a4e06b8c8", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124889, "uuid": "a963d86f-bd0c-427a-92c0-3baef46ceda7", "value": "T122B4C020ABC05A75DB885457D0AF560F16F65352E412A0CCF7A2B9273EFFF88522BD12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124889, "uuid": "679f32bf-92ce-4822-9e70-4b851dc4a8fa", "value": "6144:pfWBHEwnYoywt7ud3+1Zd7I3q4NTvAHL3MXfup54VA0wT18lNEKaSYjxWnLJymf8:IHI3bNmL3Ufo4VA0S1b7xWn1gzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124889, "uuid": "3e910a94-5929-4e71-968b-45440af8e102", "value": 497696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124889, "uuid": "abdb2778-a802-4f7a-b027-a393c2b37588", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124889, "uuid": "a96a9eb0-6c59-478d-a932-6c2e1f1e9dcd", "value": "DHL_TN5970896914.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6eb03d3-5968-11ec-96a4-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1639106735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639106735, "uuid": "ff884719-06d9-4402-8dd1-37eb22cffc5f", "comment": "Malware payload (OskiStealer)", "value": "dbab23f56fe907a1331afffa304ebeb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639106735, "uuid": "fbed6dcb-e209-4976-9155-27b4ad3beede", "comment": "Malware payload (OskiStealer)", "value": "5e90017c211f7f6fb00a452e7cc887b8da779dc03314c004ef609d37a7dcc8ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639106735, "uuid": "c04ca81f-98c5-47a1-9661-f3ce993f94cc", "comment": "Malware payload (OskiStealer)", "value": "cf077d805094232be37824dcda065e2b46b3a5a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639106735, "uuid": "47674158-86f1-443d-955a-c7ace31cbc38", "comment": "Malware payload (OskiStealer)", "value": "dc2f591b48a5bf8e1a76a23f55fabc3316bdc7fde34b68884c718ba7dd90f511e0a6fbbb1b0c57b97fb8dc41731f0297", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639106735, "uuid": "4f161076-06b6-48c2-a980-207d4c18958b", "value": "T10335235537F92B60DABE8FFD90A4A0688776B55B6862D31D2DC430DF58E1F008A60E37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639106735, "uuid": "479c4827-4133-479e-845f-4e38f3eff495", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639106735, "uuid": "0e9a58f2-a422-4eda-acf5-9764421f0715", "value": "24576:TQvxsT1RZClOfaFu7KqXEX4lVWPEgXY6k8+VQoqmAFznAnwUbT2v3WRgWGG:TsxO1ywfaFjq0IPkY6/+VGmBvTw3cgWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639106735, "uuid": "50c540f8-a81f-44a0-b5e8-6f61c231e457", "value": 1133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639106735, "uuid": "c2fcaf55-146e-4ce7-a4c5-1655b27ebbec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639106735, "uuid": "1a24a98a-2e33-496f-8a26-526694907895", "value": "dbab23f56fe907a1331afffa304ebeb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f49558b-5991-11ec-96a4-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1639124251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124251, "uuid": "3b9c8f8b-9039-4bb6-89be-a275f6e298fe", "comment": "Malware payload (OskiStealer)", "value": "cf95e30ae7ca9cbc2916ee16162c7d4a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124251, "uuid": "9ae2222d-72a6-4d14-b852-4f788b25231d", "comment": "Malware payload (OskiStealer)", "value": "5f37bb3fc842b02d5945229b345878efe39652dd97acd62ff7cd6a50b18535fb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124251, "uuid": "031476cc-cd42-451e-a6b1-08d104301349", "comment": "Malware payload (OskiStealer)", "value": "17e32ec761ebd87995d7d122fba4fc5fb47efdd6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124251, "uuid": "5828544e-4ddc-4bbd-887e-ff6a9a131cb0", "comment": "Malware payload (OskiStealer)", "value": "12dca46abcbb4400f8a57285fcbc24341dbbaf1bd0d7b528517b1723b753270d282607af3b0b23cbc3588903b7824f02", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124251, "uuid": "e42da32e-7a2d-4e1a-a9e3-986e3b6547c5", "value": "T1B37283ACC45306A88F8567B86B1F6F40019CBA6EFB94A973327C973567E1D3A011387C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124251, "uuid": "c622f83b-5462-4b1c-80cd-2ee72697fd3f", "value": "384:+MRNz9AroPGAZEvAgws9CcXEqiHU8XfCkJh8gyVD6v1UQU:3GrSXZgzj9UPftNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124251, "uuid": "01a9470e-0c29-4743-91a5-6550f6a5503a", "value": 17209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124251, "uuid": "8ce499ca-aa17-4762-91d3-138d7b61b218", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124251, "uuid": "ceb8249c-356d-4161-8ced-9d8da163562b", "value": "statement.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de599ef-599b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639128490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128490, "uuid": "b1ca7324-701c-4734-a77a-671f6676e42c", "comment": "Malware payload (Formbook)", "value": "e355d6d94e7769635e0669f8ae54aa95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128490, "uuid": "6b120af2-4a10-435a-b56c-7632f544210b", "comment": "Malware payload (Formbook)", "value": "60798012cf345fdbf68cb858e7fa974884e063a640cd436916457c3d1d028630", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128490, "uuid": "105d82fc-bbc6-41a9-8f77-8770eeaec35e", "comment": "Malware payload (Formbook)", "value": "f2e08357bbed5d03d542be5a5bd417866039ae1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128490, "uuid": "2f1aee88-aedf-4c3f-a7d8-bc84c1705bd1", "comment": "Malware payload (Formbook)", "value": "6fa8901e16e344d390309a06ea8413ee4b379a3cf904026ed0527c94cad5edf1df8d3b0b2e9b593d0b46266d9a9d2e3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128490, "uuid": "c0b9bf6f-920d-413d-9813-941ba821bd25", "value": "T13044124F9DD1EF73E6A2407314F3A3BDD7F281A70225285B17E8ED172D22DD50106AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128490, "uuid": "189c2a8b-cba9-4f43-8a6d-44d67ca2a3d5", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128490, "uuid": "6ffb87f8-54e1-4c4b-a295-89d659847f2e", "value": "6144:rGizyVK8ETGrPQfGArZr2r/EzX/gEi/UU4+EGk7GTXm/Y5fn:vyY8ljNA9r2r/EzXkUOk7oXm4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639128490, "uuid": "f5680b9a-b68b-46cc-b399-acd1ba3b0c41", "value": 277141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639128490, "uuid": "c8333eb7-d675-434b-a01a-54e07300939f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128490, "uuid": "8d08ae1b-6fe5-4bfd-a41f-0549b3ba1661", "value": "vbc (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afaeb02f-59ba-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639141888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141888, "uuid": "759f303c-0be4-421d-8387-fc6515ea9e44", "comment": "Malware payload", "value": "5774e93cebc3008471b7efee81c1bd27", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141888, "uuid": "4413e129-a41e-4217-91e2-8398bf877fb3", "comment": "Malware payload", "value": "61fc7e7da72966279559b01f74244b80cb56f56f4de29f0bcee9ea7c3800f562", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141888, "uuid": "e40111b8-0b85-4177-817b-10f82b3e9a95", "comment": "Malware payload", "value": "4bd9eb980cf7db128ffea6f59f1f077f6412c53d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141888, "uuid": "1601ec11-18fd-4827-b15d-d1ee6fb43a13", "comment": "Malware payload", "value": "6783e196584127e2244f3f5e982424d5e67bc1f8932a0e0c01d33f5096d3cc28aa1e86574fa71c2e74c572e2dfc12c10", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141888, "uuid": "a45238d1-2e52-487e-86e4-e7ef393769ab", "value": "T16E2633B19855F8E7D3E6E6BD9E727803EF883D4A04483318DB9F529D3A46A80F6C4453", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141888, "uuid": "f1c05f30-c66a-439f-be3d-bcdc1704cd28", "value": "98304:8c3FsJuH/hs5qVNV0d3SNmcCNhxFe5SZcdeJuyC9Z1lzK69:TsYH3+dSYckqdMqVKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639141888, "uuid": "bf7b59a1-842d-4415-a3a7-8a215fdf418d", "value": 4824102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639141888, "uuid": "6b913fba-6118-4c56-8103-ad3467ec3ee4", "value": "application/x-chrome-extension", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141888, "uuid": "198a95de-b12d-418d-b786-107dde44fb72", "value": "OneClickTranslater.jpeg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91237726-59b4-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639139260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139260, "uuid": "2d3c381e-665e-48b6-aa86-1185b9c52ee1", "comment": "Malware payload (AgentTesla)", "value": "c1eae6bee9854ff75d0881db74432d6f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139260, "uuid": "5a8a1e27-de02-4a7f-bf62-9519ec1cf413", "comment": "Malware payload (AgentTesla)", "value": "6219818db9b4aa72360f45dab6dcc11de104462f7722c151048295b403db0203", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139260, "uuid": "b6afeac6-e4bf-4de2-8ff5-90c25b6799b4", "comment": "Malware payload (AgentTesla)", "value": "442203097e133ffd8649912bbb0d222d77e4909e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139260, "uuid": "26680e68-5038-4b93-bb3a-bb635c682916", "comment": "Malware payload (AgentTesla)", "value": "e2de582a5027a584c3dafe0f124b2245891a7bf44ec21ea2ddce567cf3fdee1c7688dc6dbe50aa2d13b2ad47cf08d6da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139260, "uuid": "739c55e3-1538-4d80-88e5-d68c370a82ca", "value": "T1E4E43A731E8AAD9CF8BADEF01AA625520DA1DED0FCA0D15ADC41308194FDA50779DCE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139260, "uuid": "bd455f22-6d1e-4f44-9805-3ee7730813ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139260, "uuid": "acc69e2d-4c89-48d3-ab78-dffb9b8d5c64", "value": "6144:fpQCYbNMmWFRSZa2GhNmz2cYDMmoeNKokaJDK4TmaXc3LxrIFRcfgPkjubIrC9zG:fVma2iNmic4/ZLXc3hIPcoPTq8zaO2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139260, "uuid": "a1bc8298-bc44-442f-ab47-993c3fa5d2b0", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139260, "uuid": "8864888b-2045-4c6a-b309-353a1145f857", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139260, "uuid": "ffa16831-51eb-4af6-aea2-adc7df1ebc49", "value": "New_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a211d6-59ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639141796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141796, "uuid": "4d26dcec-3930-4412-994f-67ce29ffdb54", "comment": "Malware payload (njrat)", "value": "fcda4cc1ab0d4176dffbe5e90c7daf9e", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141796, "uuid": "b1621745-4fb6-42f5-ad5b-4e0004774d38", "comment": "Malware payload (njrat)", "value": "63839b989707f31e4faa91996b54b622741e20b87d064d99b93978b554a92b02", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141796, "uuid": "2ad9305a-0496-4a78-8d38-04377a3f9dcc", "comment": "Malware payload (njrat)", "value": "ab26e9c1e1fef3457d6bdb4400dc5eb88470852c", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141796, "uuid": "e1e5249f-d179-45db-8444-f457a7957fd6", "comment": "Malware payload (njrat)", "value": "c975411f7abfe628c17f0606382d62fdcd06600c2ad38c3711c86e968e366d53da1e54eb75abd9730ef37057069827f8", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141796, "uuid": "5923aa39-822e-48ef-8646-33cd0d16e7e6", "value": "T10201F60EE517FBDF062B3B73EC93801C68F640E445A8856D52150A484A904FB61649F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141796, "uuid": "c47d3170-89b4-4fa9-b38d-3f7a3b13cb86", "value": "12:TaVLMUVb9wCPayBmxVDTiL955LkiPVEi6n0DLIFnyR0CdwfTZnmVEiYNXrIWo7Hz:mV4UvXCKaVPzSuv0X+nmdw7JmuxNXMlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639141796, "uuid": "a297ae54-24ac-4ad5-84ca-1a95aa72a407", "value": 677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639141796, "uuid": "274f60e7-5e2f-4540-a0ce-31d291c37841", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141796, "uuid": "33ac47c8-02ed-4fac-bdf0-ef94e09bc62f", "value": "H2M18SDPayment-Receipt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3107258-59ff-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639171583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639171583, "uuid": "1db34f58-b79e-48f8-884f-4e7f9ef89f79", "comment": "Malware payload (RaccoonStealer)", "value": "ab2c74f03454892b8d6dbddaf881341a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639171583, "uuid": "bfc65ebb-e899-4879-a97e-063a27e01493", "comment": "Malware payload (RaccoonStealer)", "value": "6431b9944faf50c12d0eaf216ccb3612ffb08dad37e1d2047a938d6b54d12fdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639171583, "uuid": "f3fe3101-d356-4bf5-82e2-3f93e2fd5e94", "comment": "Malware payload (RaccoonStealer)", "value": "46995e2ebf7c4cd970eeda30c6226bcc371d8e4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639171583, "uuid": "5edf5747-1891-4f8f-9d57-0305aa338797", "comment": "Malware payload (RaccoonStealer)", "value": "ba3188f6a022646adf3de218f91874f76986c29ee26ea73a63e024fc73ae1965f0e66bd2044cc67ed0495dbf502ef79f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639171583, "uuid": "743f8f9c-dc7e-42ed-85b2-07bfacf90f82", "value": "T111D4E010B7A0C035F2B756F8597593A5A93FBDB1A72894CF62D12AEA47346E0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639171583, "uuid": "414fd670-4651-49b5-9e23-7b26e1a3ab67", "value": "55ae6049290b1a231db6697392c2b841", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639171583, "uuid": "c3e4eeb7-5d66-41c4-b142-192930b51c0b", "value": "12288:JmghtnrfwuZW0I7HUVLvEe2ibX7G2FqC/aqqOYCU7ovoW:JmYnrTZW0cUL2m7uD2HJgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639171583, "uuid": "6de7959d-744d-49aa-8094-176363b862a9", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639171583, "uuid": "25e4e026-5d96-4fe1-bf89-c0e84b14756d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639171583, "uuid": "089e7f4e-6aaf-4a95-a166-a1f7876b9771", "value": "ab2c74f03454892b8d6dbddaf881341a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85edf40-5991-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639124374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124374, "uuid": "8432a59e-22fd-4059-925d-b1a9fb6a0300", "comment": "Malware payload (Formbook)", "value": "fc1ab3940336dea04779700dc4214540", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124374, "uuid": "d3be83da-accd-4fcd-9ddf-c9fc2955abb0", "comment": "Malware payload (Formbook)", "value": "64acfa840e0513420810ffa8cad40ea49178eb031ab7912168807b0fe0821496", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124374, "uuid": "d007b32f-4566-4496-8fca-dfc8d066b483", "comment": "Malware payload (Formbook)", "value": "e0af3de78d25b9e02234e1aa3576e248e4bcb8ea", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124374, "uuid": "a3518ffc-767a-412b-bfd8-38fb1e3c314e", "comment": "Malware payload (Formbook)", "value": "3ccb6f5bd30f4a286bc0f419846938fe1dec473f8a32d8215987eb4e083ead83b6681dd0a6d975ee8aeb830e93516d0f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124374, "uuid": "73fc93b0-71db-4a1f-814c-b9f2dafbe670", "value": "T1DD5401B6F5C15BA6E5EB0E35D5BF7E2D93B98EC191920903E30C3F791AF14039989241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124374, "uuid": "c1232a4e-87f5-4e64-8548-60d82a4e377a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124374, "uuid": "d7db363b-6d67-4540-9270-648982c684ea", "value": "6144:LGiIWI08XbSoFNPCeF7hCBlxZunAVOX9YCQCrauXCP:zV8SoFNPZFsBnZmAVOqrC+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124374, "uuid": "78549206-f927-4de5-8940-8a0776900c42", "value": 285007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124374, "uuid": "e8a087e7-9fa8-4d4c-8244-4a4f29311fa5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124374, "uuid": "7ad609e7-e6f5-434d-a92b-c4f5325d655e", "value": "DHL_1190323 \u8d27\u4ef6\u6536\u636e\u6587\u4ef6,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4dd8ffe-5991-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639124261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124261, "uuid": "696218f9-adb2-4a2e-a319-f4dafad6bd2f", "comment": "Malware payload (Loki)", "value": "be5f1f0e54e923bcc73b3bd3bae6c265", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124261, "uuid": "550353e7-9f5f-451d-abd1-b7363a40fb8f", "comment": "Malware payload (Loki)", "value": "663d9579abbd19429c05c5c2c66ed7a83df6d78c91cc4d60069156e27f207391", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124261, "uuid": "19b60245-657c-4563-8765-4cd179ec242a", "comment": "Malware payload (Loki)", "value": "efd01b61e424cde908465599f1c431deea1d54d1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124261, "uuid": "78d8b256-9a61-4ea5-ae83-f7c8c125a3d6", "comment": "Malware payload (Loki)", "value": "966e13f9d10750b0322f713b646da9e450ca8e6c9649ad7b836260b2032a89cd0a551753075a7b3874b35f78fc014bfb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124261, "uuid": "e7579cb4-7086-49c8-be41-ef0fd6e3330e", "value": "T1409557F0AD01D4C1F57E5B6AF2FD3948A1343227EBC94A4A00E7E6551EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124261, "uuid": "a0fc6688-a82b-4894-ac5c-548dfb49c4ec", "value": "12288:e2F5XIAQwP3mhzK/+enAsFRMQTfwJn8x3lgoaRKSl0IjCMzXSQbO:15XIAQwPx/+eAG9fwax1gRdl0IuZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124261, "uuid": "a769cbb2-9a6f-4e8c-98b6-b92b5c72eea9", "value": 1901271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124261, "uuid": "309d9567-a1d6-4428-8f8d-e2340fdffe64", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124261, "uuid": "cd18ade8-d2b5-4bee-a0c4-f689147e7fac", "value": "FDA MV. CHIANG LAAN V.132N.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff92347f-5993-11ec-96a4-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1639125272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125272, "uuid": "1465223b-7f5d-4d7f-bb4d-b847645f980c", "comment": "Malware payload (Socelars)", "value": "a4f2df9ef8e5102c7424f16f803c9602", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125272, "uuid": "4666e3bb-00c4-463c-aa7b-02731f3d5fd9", "comment": "Malware payload (Socelars)", "value": "66f32911a663cc46bc92206fe6c6944675f998c9e73c16603e9f3b5a38f0655f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125272, "uuid": "2d0195fe-917f-4343-a3d3-e44e5a84f30c", "comment": "Malware payload (Socelars)", "value": "eddaeedd250fdab92b60cb64e69f77a767834e3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125272, "uuid": "21491849-1efa-4c29-8716-347dfe7b2c38", "comment": "Malware payload (Socelars)", "value": "4a3f0b55c1874d7f815b930a2ee73e863d92f76fb92032d7c9552c495bf14a5aa12aee5ce584265077035f37f9acb93b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125272, "uuid": "4ea3994f-7f23-4638-983f-3d3a0e557611", "value": "T1A7657D51F7426033E8D313BB89FE36FACE286519030456DBD3845B69BA715E23A32D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125272, "uuid": "e2812b14-72b1-4ba0-b288-5c5e4ec09dac", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125272, "uuid": "ce6dc950-e5ff-4bba-9032-53bf19d69ab7", "value": "24576:EaApxEmUociWVxvX2LfeEyS2ZrU2xbVGUpgrnRiZepdNplj:apLfvjqltirnRiZepfplj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639125272, "uuid": "8c526384-74db-4cf2-afee-4d8dbf0c22db", "value": 1516032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639125272, "uuid": "41cfb8d9-5327-425a-81b0-cb723fab56ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125272, "uuid": "eacd34fe-60d1-494c-9f28-9815604b31f5", "value": "a4f2df9ef8e5102c7424f16f803c9602.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d80e99b-5961-11ec-96a4-42010a9c0029", "comment": "Malware payload (WSHRAT)", "timestamp": 1639103525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639103525, "uuid": "23a57a34-7586-497b-886c-286906eecf06", "comment": "Malware payload (WSHRAT)", "value": "8dce2fac1cdb56ef997f0c4f8065f82e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639103525, "uuid": "bc979146-d726-4362-b207-1af56b3ae0fc", "comment": "Malware payload (WSHRAT)", "value": "6774ae9c26be549fc9096af5859d3e1614b2ce6993fde4ee85b7301134161411", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639103525, "uuid": "d45f64ca-0b6e-49f0-bf50-5bfca15953c9", "comment": "Malware payload (WSHRAT)", "value": "da01f70d7035a8e8421d2296c7b481dc6dcb2b09", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639103525, "uuid": "f5ca239d-a4ad-44db-9af7-567b5c0f99d6", "comment": "Malware payload (WSHRAT)", "value": "9c0898f6c9e4a67c87c8b657373d84c3675b94be5cb7b15973b3eff976637bd695bdca9ccf128c39c7ebb0869ee1aca6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639103525, "uuid": "70f7b742-079e-421b-a378-e9254ba265da", "value": "T1E8152CC625B87A16E7B3E624C311E523AC74EC232DD711D27DC43E4A9EB6C505DBEA20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639103525, "uuid": "23a57e05-affb-4345-84d7-3b54de977cae", "value": "6144:oiNE6jJISp7nCVhSR+UDc8glSJ2e5FP3aYs3S5tu/MO4Wa5FyngID13jPcZP8CPc:+jFwhoPCtwCcYX/e/F7K/4/PAPe7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639103525, "uuid": "4f51b5c1-cb67-4585-9bf5-3eb614b53467", "value": 905622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639103525, "uuid": "185a9f18-c857-4277-9bce-b7b0a3b91e15", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639103525, "uuid": "2d11491c-2ee8-4e22-97bb-cf6570480719", "value": "launcher service.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd374772-5962-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639104223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104223, "uuid": "7f085e70-6d0a-4794-b2a5-724e318591f7", "comment": "Malware payload (RedLineStealer)", "value": "df21b189d06cb4ecca93cca08059bd07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104223, "uuid": "a8fbaa59-b3a9-4377-ac53-f994afea1947", "comment": "Malware payload (RedLineStealer)", "value": "69fc52d8327338a1ab93e025a3093e02af68e24379fada5cb8dc4859fc22fe08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104223, "uuid": "e6399193-0401-472b-bef7-6bdca2bc6697", "comment": "Malware payload (RedLineStealer)", "value": "d1117fcbb6d8ee1554370351d4d2af4e22013724", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104223, "uuid": "62f472d0-5da7-4cee-b561-8e34cd74e05c", "comment": "Malware payload (RedLineStealer)", "value": "7872bd3054f5e8e0fb2b6c389657fa90be9032eb5ee99f6d33d87e98c4d0fa5db0d28506eb886afe6c21c0b013aea375", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639104223, "uuid": "4f441c53-e537-4b38-9335-5bf99027e85f", "value": "T1B6D401307999C621C2A34E70482596E5197BBC225950610BE3543BAF2F72FBD9EF233D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639104223, "uuid": "ea3c1e0a-7792-4b30-b845-27df1ce60641", "value": "784912eb6940550282ff4b089d7e66e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639104223, "uuid": "47e00774-35ff-43b4-b7d2-a73257579218", "value": "12288:EOkbo3gBWMgKHelLOBP8+h/lZSSJzFBZC86DDPnkBA4vsoaunnXm:XkmMWMZHiObhNZSuzdCZD8BVvs8Xm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639104223, "uuid": "fe8cae80-50e5-4366-b7e1-5b365ad0d8c2", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639104223, "uuid": "10658241-40a4-4c1f-b5f2-670beb535f22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639104223, "uuid": "a5c6a7ed-448c-43e7-82a5-f38a301186a4", "value": "df21b189d06cb4ecca93cca08059bd07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8aa077-59b4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639139249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139249, "uuid": "f0a1f742-f779-4b4b-88b6-eef24bd5a6b1", "comment": "Malware payload", "value": "538d866099fba8838da8ddea990640d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139249, "uuid": "a1dc353d-0c93-41bd-8fb9-c06bba1dc9eb", "comment": "Malware payload", "value": "6a3cfb0d27a81961a2a517ba484f4248d1f3f02157810a7e07243f9167d38038", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139249, "uuid": "1b7802d3-bcd6-4d2d-86ad-19706fbe5f81", "comment": "Malware payload", "value": "cc787976585452c681894d75abfcb302dbbbf8a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139249, "uuid": "6e05b9e5-0473-40b6-868e-6e32ed4767c8", "comment": "Malware payload", "value": "23652f3d29d9162424d0c8848ce61263af870812a8939091841fdce206ac047b1bf8726efb86e76f00f879fe0227fced", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139249, "uuid": "762c80d9-6895-4f17-9961-2878b2ab14f4", "value": "T1A974D04B364081F7E1386933BE87A81E22522DF8AD22D719BB93F60B35717E04D62577", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139249, "uuid": "a78504a1-b991-4ed8-a301-df2d572f0042", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139249, "uuid": "1cc58022-a3da-409a-bca0-c3d7b4e57b5f", "value": "6144:sK2kQqvZRHYqIWknWR3fSz0oRmYNXJnhrUx9pCvJuh/0yWE6T4xQUlqcSNWLQ:rI1nWcz0oRmYRVhWpXWEu4nPSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139249, "uuid": "4405ec8f-9d3f-43d0-a726-95cd400cb6c9", "value": 366592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139249, "uuid": "22c3bba5-d4b3-46fb-a9a9-7e2e1ff41709", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139249, "uuid": "7f580d0c-5c3a-4baa-adf1-e0a6e0d7069f", "value": "Demurrage_invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc85fcb9-59f8-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639168539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639168539, "uuid": "057d8d73-b96d-4c02-8e0e-9d74ed3015a6", "comment": "Malware payload", "value": "dbc9125192bd1994cbb764f577ba5dda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639168539, "uuid": "cd4c4e62-ed40-4a46-a7dc-41a93b427e0d", "comment": "Malware payload", "value": "6b9e23cb675be370a18a0c4482dc566be28920d4f1cd8ba6b4527f80acf978d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639168539, "uuid": "89d5b24c-55b7-41a6-995b-09d7cdc8bc83", "comment": "Malware payload", "value": "6feb75ac62120bae1e92ab16184c1eb0b795e4b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639168539, "uuid": "9e7a426d-572c-4978-a34b-7e28f862f349", "comment": "Malware payload", "value": "03297875bdd0ed5a6f6bcb61bc5b2dc38e293d5aa9bd18d32414429dcb550444684ed0778b6b572d6ebb0f26c36217d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639168539, "uuid": "8d5a3bb0-a7a6-4415-b419-92e81d455b38", "value": "T1E0F57D03BAE108BEC896C530C75FD112A939F4C85162B5BF76846B243F67A70AF1EB51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639168539, "uuid": "1f559140-727e-4b19-902d-c07696589379", "value": "49152:4o6QFXZbyTDf3Ef6tBv/lszlIO4HNNnriA8OjCrsKIU6ipJ4jRsQkxMIcgk/ye3f:WKUDf3E2F/xQO+T41sQVIcgk/ywZkqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639168539, "uuid": "c27f875d-dc64-4009-8f97-96f3127e4227", "value": 3402712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639168539, "uuid": "b9110949-cb9c-4030-af24-feef6edea324", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639168539, "uuid": "90c95d74-a47f-4fc1-a153-41c65b02280c", "value": "SecuriteInfo.com.TrojanHorse.21538.14610", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2added2e-59da-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639155409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639155409, "uuid": "a2010e3e-6061-4238-8f4e-a2f597cc8970", "comment": "Malware payload (RedLineStealer)", "value": "6eb21cfba92cbc73c646713ca5e184e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639155409, "uuid": "9bd4950f-1c23-4164-a288-abc2c1679d92", "comment": "Malware payload (RedLineStealer)", "value": "6c1e0be3dd75d71cfbad4980c64ae8a210204c048d265e8e8ba3e13713c6e3dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639155409, "uuid": "7b1a5174-33ce-4954-921c-7b87de4eac5e", "comment": "Malware payload (RedLineStealer)", "value": "f479beaccbc73fdcfba63c1cc6b70b8dce8b872a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639155409, "uuid": "437e05a4-3496-406b-8778-f3ce7ecdeb2d", "comment": "Malware payload (RedLineStealer)", "value": "7db7786a65758829dab12076e27586c1630d318269abd5dbb707c49e1e51a4c57e000268823cfddefe80aac927d0ee45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639155409, "uuid": "95de5aed-8bbf-4296-9a17-7c07cdc96e09", "value": "T1D4B4F6383AFA9019F2B3EF758BE87596DA6FF7633703A55E205003464A13A41DED1239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639155409, "uuid": "a3a04987-3cc6-4807-8012-67352fdfd723", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639155409, "uuid": "431c3d83-c0a7-47ef-ab39-f5f4bb627d67", "value": "12288:lUUtj2IPBwKzoI8ntUcJIeENT+3Q4rOSRt5AFdjw3/:lUqj3tzL8tO7/83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639155409, "uuid": "22fdd4f8-74b9-4c9d-8946-c19e095eb97b", "value": 542720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639155409, "uuid": "fcdc3a8f-6931-4833-bd2b-15e7cf5afb24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639155409, "uuid": "1eac6aa3-c2d0-411a-b73c-023a8b1c6317", "value": "6EB21CFBA92CBC73C646713CA5E184E2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba23bfe-59bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639142123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639142123, "uuid": "cce476c7-063c-40da-bbcd-df45626e5d56", "comment": "Malware payload (RedLineStealer)", "value": "ca61eef4b9c90023071a7cf715bb69cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639142123, "uuid": "d08c16fe-a068-4981-9149-b5ddd13009fd", "comment": "Malware payload (RedLineStealer)", "value": "6cb1c401d93034ef4de4f752738232ffa09cef0cdaa56abd08c6a305a033d61f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639142123, "uuid": "2d88cbf2-fcc6-4bba-bed8-33c87708d258", "comment": "Malware payload (RedLineStealer)", "value": "428404862ad8456eb2db64b64d2d4b82cd8846e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639142123, "uuid": "5d97e540-8b43-4a76-8e4e-0ca9daffe2e1", "comment": "Malware payload (RedLineStealer)", "value": "df3e72a7e06cf778d88eab16000dc7160eaefb2cd79748284a278ac75aa19a82d5e14dcb332f98ba2a832e0174d640b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639142123, "uuid": "27f16b8a-f19d-4653-9a14-d04032c73717", "value": "T12174D03576BDCBF1C1930E30B4249AA4097BB92D69204187E364279E5FBEF1C46E631E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639142123, "uuid": "d99e1093-4eec-4a75-9c93-ae3a7f935968", "value": "05e6c127a979d4c88f42e175bdeddbaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639142123, "uuid": "e9984294-03cc-4013-a7ba-9b7e1c57c537", "value": "6144:MUWLq7Xck0PP3YQjHysZGE+uarP4EBPe/YyY/YfVNhoELuzbgwu6Qigav:MUWu7X6VTyOGE+uarQiPe/fYQ9XXunn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639142123, "uuid": "ba791d76-073a-4e82-a286-5d8e0fe8b116", "value": 366080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639142123, "uuid": "125900e5-37d7-46d8-8f95-1123417eb9e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639142123, "uuid": "6f50ede6-8e41-4e5c-8a44-ccd2236f74a1", "value": "ferrari.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d371d6-5978-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639113424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639113424, "uuid": "e7eec641-bf94-4e8a-8744-0522a2aa94e0", "comment": "Malware payload (Formbook)", "value": "cf5e58b0d39eb84e9263b3b8fcb7577f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639113424, "uuid": "35033b16-4038-42a3-9057-522d53da4586", "comment": "Malware payload (Formbook)", "value": "6cb8d14f4b4d63b7ce62aa928bd2190aae3be0f27a1ceff70ec90e9b097f55ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639113424, "uuid": "213e68e5-685e-41bd-97f4-fe58252ba686", "comment": "Malware payload (Formbook)", "value": "82b026c09fdbd590ae44c7ec583189d68d9dd10a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639113424, "uuid": "8ff289e7-b05d-4d74-88ad-c00c61bb7e49", "comment": "Malware payload (Formbook)", "value": "7538e0ffecbe944e22969c0b2d92790de27e6ccf945ac5816e0aa70fba7cd9f8c6c9a7bf7b100b71840314b8a47ff451", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639113424, "uuid": "569d931e-1830-4975-9781-4097c1b114f3", "value": "T17944130BD7C1A0F7E15305309EF3FB1857BA2AD510F14E0B0BB52F5A5A616B7D22E2A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639113424, "uuid": "a395f0a4-4299-4de0-9911-15dd7d3245e2", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639113424, "uuid": "74c582a5-ee2f-4b20-9acb-a020b3b789ba", "value": "6144:rGihn8EhLIrnqkwG3itu4ostJlOaTC1RqxYQxB8JwQ0E:dRkq5wkRosXlFC1RqxrxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639113424, "uuid": "aed307b0-e19a-40ee-bb26-7a16f1c71f06", "value": 268552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639113424, "uuid": "bc93b107-d6d3-4fb7-88af-dc3aed16a812", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639113424, "uuid": "6a98ffd3-e1a5-4114-857e-cfdb03157b67", "value": "73927-3603 L_R-DBF _PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2aebf9e-59e2-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639159046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159046, "uuid": "57bdaa6f-87f4-479a-8fae-ce24f108938e", "comment": "Malware payload", "value": "9c5cb686fd45368a9d149855e226b659", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159046, "uuid": "889fbe45-c248-467b-9e2f-c67460418154", "comment": "Malware payload", "value": "6d29e590dd2903ef44e8e282f53100c339895ff9e8321bb03ba6c367f73537bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159046, "uuid": "44627497-d8bd-4dc9-b383-fd13127b4c9d", "comment": "Malware payload", "value": "80f7e2c93c04a6012d68d09fb8bf32d029c9caee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159046, "uuid": "a4ca677a-a83c-4ad2-ba56-cacef19db250", "comment": "Malware payload", "value": "c7bb356723db68e30f8c5a8ae27087eb90b01420548ef3832f48538ff612857b33dfdee7d7ec17f3862662ad93df4af6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159046, "uuid": "518d4856-243b-4289-a9bb-1888ee383237", "value": "T14FF2E04CD42C7F87D6EE8CBCB65907A34F84B8C091BEAF4443680981E797647B28D969", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159046, "uuid": "5d8e6081-7223-4997-b445-b819d8d8c220", "value": "768:C84fs2uQHEqm2k54CdD/1AusS2a3ilCA5mwJUXA3pUWRC:Cff1jLK/1AdS2RlCx6UXA3p6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639159046, "uuid": "612ae360-a544-4b78-a0ae-22962eecb42c", "value": 36592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639159046, "uuid": "0ec6fd86-5861-48a5-8ff3-6fe2976867bb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159046, "uuid": "e2aa9c4f-c739-4659-8867-ecb72d6014e9", "value": "9c5cb686fd45368a9d149855e226b659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713e04f7-594e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639095398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639095398, "uuid": "1d5f9e3f-835c-4f95-ba33-2e505f8c1f83", "comment": "Malware payload (Loki)", "value": "984d8fec1255d8d52c75d4425f20a99b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639095398, "uuid": "72b6909e-4527-43e8-a5e4-c499f2eafc0e", "comment": "Malware payload (Loki)", "value": "6e8669e029cced959869d6634d6943b37bb16cf3e6cc5829ff230f09778659e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639095398, "uuid": "2d2d7698-3b94-42d6-887e-2613097bd1e0", "comment": "Malware payload (Loki)", "value": "eb2d21cc3e1612dad34d8d6163a86b80bc9d06cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639095398, "uuid": "707b8766-a495-45b6-acc1-2c539add1d0e", "comment": "Malware payload (Loki)", "value": "ff45adb4f518f2ad5b006de5dc3c706e52edc3f5d25dd4da0461bc9b707d7abcb7f2788dccb381aa8003fb1987e1bbe0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639095398, "uuid": "ba0ae986-8b1d-4ecb-8b3d-531eaf347760", "value": "T1E5949D50646D82C3F27A4873796BA17920A0AB9DB19FA06F765DB73A40F035604BF73C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639095398, "uuid": "c07345b3-4bc3-4846-9269-1970c83f7220", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639095398, "uuid": "4b89792f-2bde-4188-a2f2-8f0f1045a7f1", "value": "6144:8GizRk65LtdXObYxuVBQjLu22MBhhj+e2QWV0E/Cv9SrTFVg2Es6QP3Hrox:72W4TBX8///CViMU/Ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639095398, "uuid": "cf7d0510-d4c4-4e43-80b9-27dc43f7c9da", "value": 430484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639095398, "uuid": "73e9774b-f320-4f88-ae5f-906dc906b4e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639095398, "uuid": "8140869d-1d75-45e9-9184-c5d44d8a62b8", "value": "SOA Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b02844-59a6-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639133251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639133251, "uuid": "78d9c152-9244-4cf7-9137-abe26a26cf7e", "comment": "Malware payload (AgentTesla)", "value": "8ab7d8680f2bbb90c0058a9f3c62eab7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639133251, "uuid": "3d544780-fc94-4958-a742-ff4d2e42ac62", "comment": "Malware payload (AgentTesla)", "value": "705eb7c911674dbb7817a68f17dd3bc8b50d097a01d5fc8936855fa7c7383e11", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639133251, "uuid": "99c9de67-efdf-4efe-85fe-4215c970a4d3", "comment": "Malware payload (AgentTesla)", "value": "2bd12939815291fcb3ef1677b1e7b52707918756", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639133251, "uuid": "a7a5a8c6-ce05-48c8-8553-fbb9f0468004", "comment": "Malware payload (AgentTesla)", "value": "337a6f6b697e97e9c0811d3803ec5cf2cfef289e41bf75329e3786bd2c91fc3f31ca1aba2442edc913ee305c0eb1789b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639133251, "uuid": "1281b958-6273-4ca9-a98d-63a402e030bc", "value": "T17E35330383B4AA5DDB2E7C95D09635850B354826227B72FDB334EC9E708BD1ADE74C4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639133251, "uuid": "854654af-2a10-46d9-91c3-ffd577093b3d", "value": "24576:goMuTJVD51/2hyLGigxCH9VJzz5E/YUKGr6xc4y7H7wBU9eIg8Za:goMKfD51+hy2xOJX5EHr6xM7HEBU9d9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639133251, "uuid": "e7808311-6705-4365-a586-e22b79058760", "value": 1098650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639133251, "uuid": "464caf3a-07a7-4949-be2f-db07a3e3e1b0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639133251, "uuid": "345292b2-4ad8-42f9-a8b5-1f4ac4e77752", "value": "Remittance Advice.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a4d1b4-59c7-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639147447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639147447, "uuid": "ceef37b3-3d91-4c40-83ce-d7cb8e2ec393", "comment": "Malware payload (AgentTesla)", "value": "6527af37e6f8a30c33ae772607b9b2cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639147447, "uuid": "48d145dc-4827-46fa-8db2-3551eade7ae5", "comment": "Malware payload (AgentTesla)", "value": "70b5e018b7b81a621eb9788ed9c6efea0b6c6d2c6a3696d286ccc91c24251c5d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639147447, "uuid": "db4c72d2-1c2e-4816-873a-a1eca93c7b50", "comment": "Malware payload (AgentTesla)", "value": "43b874c144a696b6b057bc36501e0b466ac43573", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639147447, "uuid": "ca854adb-0ee2-498b-a54f-9641eb53e7ae", "comment": "Malware payload (AgentTesla)", "value": "d0387f1eab7e2297bed323d8a47027f2bb3d67b61e88d502a9b137a7e384e42ec0621c447d01c033737cda0b8c928683", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639147447, "uuid": "b177dc78-e3b0-4673-a2fc-5917258d1b08", "value": "T1972533EEA217BF9EC82D7EFF2B811D4555012205349CAE57A20C06B5E60718FE4369FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639147447, "uuid": "3ecae2d5-3708-4a79-a742-b1c8bb5b5bce", "value": "24576:YlptqD8qPVHdP3a+cKgGEVm3kA+pz2BZgGIrxly96AEcadWUN+:YvAoqPVV3Jjr3ExG0ly9b6WU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639147447, "uuid": "6a93f715-c6d6-4b58-ad8f-319fa6ac8cf9", "value": 1029831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639147447, "uuid": "37b2112a-33ba-4627-ad8f-4bc6404c29be", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639147447, "uuid": "72bad85c-2ecf-4d7c-899b-63fa39d60b86", "value": "Swift copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b57a8b13-59b5-11ec-96a4-42010a9c0029", "comment": "Malware payload (HawkEye)", "timestamp": 1639139751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139751, "uuid": "9fb1c79e-8f87-4b8a-bd52-0a6e7fed12e4", "comment": "Malware payload (HawkEye)", "value": "52d4245d65d5cc2da05298c480ffcc5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139751, "uuid": "8176623c-faa6-4bc5-b3c2-352b4209f3c6", "comment": "Malware payload (HawkEye)", "value": "70ef3c88a90dd590de9a0ac4634b5017f35ea6dedec14f3cc3b5d9eeb3ca84a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139751, "uuid": "be800b38-a48c-4399-8344-e85d80728571", "comment": "Malware payload (HawkEye)", "value": "b2ecf335eb93feba2cf923419e70d7b6cff79061", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139751, "uuid": "44761de8-f1a9-46da-9d88-fcf87b12293e", "comment": "Malware payload (HawkEye)", "value": "f9d6f014f7a359d4153cd7b51db621e504dd99a9fee41964ee5d308dd3438eab952e1d90cff4ff300e21ba44cb53e8ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139751, "uuid": "0ccc7e18-c707-4103-b35d-0fdb05b6aa23", "value": "T186A5C0C6E39580E2FD0667F79E24F6834B395E354532401D27AE3D6A6E730F2412DAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139751, "uuid": "9a9b2315-842d-415f-903a-0fadadefbfb3", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139751, "uuid": "9fdcfe65-051b-4a5e-8f14-d1ffca809249", "value": "24576:8AHnh+eWsN3skA4RV1Hom2KXMmHaurntQLuyoI4f+O2fRHonhhlvXGE3nR5:bh+ZkldoPK8Yaux3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139751, "uuid": "5919d307-c4d6-4984-bf13-fc87f5003fcf", "value": 2135040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139751, "uuid": "8db2a1d4-24ed-4cbf-b638-541873a02d0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139751, "uuid": "95e83357-e1a6-4e2f-a800-39272b496139", "value": "SecuriteInfo.com.Trojan.AutoIt.316.10986.27538", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6634546a-598e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639122867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122867, "uuid": "97ed475c-d9a4-40ec-8d37-5941750f6707", "comment": "Malware payload (Smoke Loader)", "value": "36d449c5b4df2ce38341a6cbc96c0667", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122867, "uuid": "41197d05-1cab-46f8-a801-c0804d1b3686", "comment": "Malware payload (Smoke Loader)", "value": "7128cfab39ecfb91110f39cdaf35c6d752524f139256ce7c5734f504692a42bf", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122867, "uuid": "5c5d0360-bdac-4be4-b731-0348b54450ba", "comment": "Malware payload (Smoke Loader)", "value": "2be0578677a2ec508a0ad1d44912287214149795", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122867, "uuid": "c6e15108-75cb-471e-8619-02b1c0ad6720", "comment": "Malware payload (Smoke Loader)", "value": "9d532f327c05013150027ef890fb3d803beeee0536019b7767cf229046e3a10e10ea3c8914cae3f268748af8661c9015", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122867, "uuid": "57b88139-462c-4d4b-90fa-8dceea417e57", "value": "T12354AE10A7A0D435F5B712F849B9A3BDB93F79B16B6491CB12D216EA1734AE0DC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122867, "uuid": "1acc210c-c6a2-418a-bd7e-d939b8258a5b", "value": "722252831a6fc255294abdd3e1a4fd3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122867, "uuid": "f1f2bc23-de5c-45b5-9679-141647240c65", "value": "6144:Zq1CJxUDvuYiSCW/QlKzDzZJYjZ5eksl23:IDGYiSCW/QlKXzb4Eks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639122867, "uuid": "96b96f99-871a-4b89-aceb-310cb152c556", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639122867, "uuid": "b6de15fe-ebd7-446e-9f67-994de3e741d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122867, "uuid": "69fedd2e-0547-4494-8a48-4ebe6e58666b", "value": "36d449c5b4df2ce38341a6cbc96c0667.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21355571-5a03-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639173003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639173003, "uuid": "f9e33019-5a14-4d65-8b62-846037be2096", "comment": "Malware payload (Mirai)", "value": "b296b1d88a4a9af64c25ea49b06e7fcf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639173003, "uuid": "1dcb7c4e-ec1a-4cbd-b36c-7154aaed91db", "comment": "Malware payload (Mirai)", "value": "727e65bf8083e12d21c68999d360beb713fad0555d81c8dce739f80eed33c02c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639173003, "uuid": "c17c9982-0ccd-4a7b-8615-bc68bf859c08", "comment": "Malware payload (Mirai)", "value": "14e9c19321b665dfbce879f5b9b83a247e094cee", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639173003, "uuid": "704f14d5-deee-4a4f-9ed0-490316bcbb54", "comment": "Malware payload (Mirai)", "value": "b0d89868fb982af01760d70deafc2d74ad3007630a59824990555066afc0b8331693cc3224f985a1ae3e4b310743d39b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639173003, "uuid": "55d899c5-a1a6-48d3-863b-fd353ca00360", "value": "T1E4F2F12685544AE8DCF5687A9DAF3ECF1424D72B2D00A8B0DFEAE3324423E730E15405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639173003, "uuid": "76cfa00e-4eda-4c85-9684-1b0a9e45a07c", "value": "768:Jub5mJeKjdiPhZSVippa1WJEd/MP8Zsh+HPH3YIK9NgIWRnbcuyD7UryqM0:I5mJeKjspMVijJE1MP8HPHozXgIWRnoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639173003, "uuid": "839cb933-e45a-434c-a32a-47045650b783", "value": 35304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639173003, "uuid": "e1ec5a3e-21fa-4c2a-a97b-f38646ce8606", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639173003, "uuid": "8a4c629a-1a5e-409b-ba2d-fabc8641d2a8", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e49e07a-59ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639141752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141752, "uuid": "2ba3d38c-0a28-4358-b010-d177ca8a55d5", "comment": "Malware payload (AgentTesla)", "value": "7162757999b5d7b350d28c0eafb4d62e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141752, "uuid": "7990cbc4-2ed3-4098-a311-b146113b2caf", "comment": "Malware payload (AgentTesla)", "value": "72e005698530718567f66ce480b99c5a48f1502b2e5e544f699552d9e6ed6b2f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141752, "uuid": "de285283-ce5e-48da-92d1-a1a9f3fa4516", "comment": "Malware payload (AgentTesla)", "value": "f1900fbb00b2dec641c577b29299b4dc1e55a386", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141752, "uuid": "9870ecc6-321c-43d8-9cfd-c84577307400", "comment": "Malware payload (AgentTesla)", "value": "cd1bbac219871e01094630c881db3728a1cb4e8b4e429c2ea848d03d690c04cfa9a6518b7d44dbe4c6d05fd066d1ea11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141752, "uuid": "edb845b7-b610-4b05-8de0-e796a59785ba", "value": "T1CDE58D335317FDCB1F3E2D80A04029A66C542D77AF7546ACFA8805EB26B5604EF698F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141752, "uuid": "5f181bd2-b536-47f3-837c-88992f20da10", "value": "24576:yZpBFM297jsgsTqqdgkGCwik4+UYsEgB1iPo+9kEDJ18adafrKsuY/ulXuii8lkM:apJ8jVOkGU5LWADTuY6Zk6T7IAqqjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639141752, "uuid": "93358f81-23af-4469-8a6f-d6c876966fdb", "value": 3096854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639141752, "uuid": "2fb1b532-9701-4dc5-bfcf-6d9a20db254f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141752, "uuid": "0aca09b3-0ac6-4496-8c5f-10139a828839", "value": "Documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dffa94c0-59ef-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639164733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639164733, "uuid": "46ef7ced-664a-4324-8be9-9d96a84b754a", "comment": "Malware payload", "value": "173c4085c23080d9fb19280cc507d28d", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639164733, "uuid": "ed35fb1b-9a04-4278-8997-5414ad4b13b6", "comment": "Malware payload", "value": "731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639164733, "uuid": "758e71c8-ad2b-467e-9bc2-8655375b7111", "comment": "Malware payload", "value": "a186c08d3d10885ebb129b1a0d8ea0da056fc362", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639164733, "uuid": "a8df0486-042f-41fe-8f4d-80ce4a157c2e", "comment": "Malware payload", "value": "9d8aa030c88c33f39b6b8ee59c77d8199f217045cef321b28697cd1240d04c2a024940fce106f55e2b6d69327d905c71", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639164733, "uuid": "0b07dd7d-7bc3-4dff-81f0-07bc13cc9ee2", "value": "T1C1E59E46FA4356ADCB971570305EB33AF63A491C602D9FA3E7E89D30FE2E71019C8619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639164733, "uuid": "cd0af026-4a23-45f9-88fa-c421a30f849c", "value": "55c1bce75ad836c886b7fb6bca398063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639164733, "uuid": "1f7fb702-5e91-41d2-ba24-b11ff5e75b5d", "value": "49152:rAnCsMZjVpVbl4D5GzNMFsl4UROAUc1y32ZxJFi4N1/RgaJ2w1M:rAnCs8pVblGyNM+l4UxUc1BhFDvww1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639164733, "uuid": "84597faa-7429-4138-9bf9-e1af62d31ec0", "value": 3068928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639164733, "uuid": "efe4eb1c-12fb-4c35-b112-4def95ba9ade", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639164733, "uuid": "6cc95a83-36b0-4527-8219-c586397ff466", "value": "veros5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd78a96-599b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639128623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128623, "uuid": "2957f358-5778-4efc-83cb-00accadf5e18", "comment": "Malware payload (Formbook)", "value": "f83746f0b14e397f8d70353ee34575ec", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128623, "uuid": "ce8f5eb8-2734-411f-a6be-df4022992365", "comment": "Malware payload (Formbook)", "value": "73db670546df4b0d3857c4874b4613f04d9c24f3a34b4506a1d0b653a671ae15", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128623, "uuid": "bde52238-358f-4866-874e-f214ad409e6e", "comment": "Malware payload (Formbook)", "value": "b99f696a624e1e62f9399a9f9ec842471aba5125", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128623, "uuid": "bea684d3-7bd4-46bd-8a58-45223adfb56f", "comment": "Malware payload (Formbook)", "value": "a9e704710e14fc60a8e2186ef3f63e4a769a9863396bdf951db0758abb298ecee99ba63ca88c6eb3b36d3b8e13784ad9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128623, "uuid": "fb2dd235-cf28-40f4-9152-16ebe117e0cd", "value": "T1922533C22618F9ABDE99547FFEF831B240A9D016C8E76945DD2F184C7C97E83882D136", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128623, "uuid": "70ebb74b-3205-4c38-bb38-efc1eccb682f", "value": "24576:Bz+57pbGBu6znIYYy27OhHqUbwRcEU7RSECWgELnc3CehLvpWE4A:Bz+L6Bu6zIYEmHqlU7RSECWgqc3CeLvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639128623, "uuid": "8fd366d0-8bc7-429b-abe2-0bcc886f3069", "value": 1041132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639128623, "uuid": "8a5e1b47-e446-47d2-9a3d-4d8bf6cca911", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128623, "uuid": "bd68e4dc-50e7-4ede-b12a-af4cff87f2f7", "value": "GLF786HAFH.PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c696e2e-59a1-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639130931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639130931, "uuid": "999d80b0-7a0e-4f75-a958-c39e237fee62", "comment": "Malware payload (AgentTesla)", "value": "a7cf8e42e21d2888406f52fff0712d32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639130931, "uuid": "09d0bc89-ffd9-4110-90c7-79d8f315a14e", "comment": "Malware payload (AgentTesla)", "value": "74f1db6997e92f548460fbfc2e9a7cbd756a7d01ca2e9edc067b6e66b98e45b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639130931, "uuid": "bad1bc39-eba3-4df7-aa86-3b6bb789958e", "comment": "Malware payload (AgentTesla)", "value": "c84f92e1934af741b05ddb787469beaaccdc23a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639130931, "uuid": "6582881a-aae6-4481-aa9e-70c02e56643e", "comment": "Malware payload (AgentTesla)", "value": "25b598a94092f3017f1b2d8f5dbad1309837ca93bcc9659aba3ebf8caeb930da501f8f6cd82f1c04cbd597729e6c8eff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639130931, "uuid": "a7962088-8cc8-45e1-bdf0-a962ae90c091", "value": "T14855121A39A1D52BD26D0B75C69F91508BBCF4072DF2EA7638C223BD7A34BC955022C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639130931, "uuid": "fbcd6dbb-5037-44c2-9f38-2fd227271bfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639130931, "uuid": "59e8af17-8b9f-497d-a4ef-7024dba77420", "value": "24576:kGIKjy/SYCpOVlZ2hp+a6cowZOqL65TNtFUQNl7hncjgpmmdSj6pASWVOI:kUjAS2VlkXV6coEOe65TNtFVNl7hnTpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639130931, "uuid": "c40da248-c688-4921-9362-1679abb05cf5", "value": 1294848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639130931, "uuid": "57cea84a-709a-41b5-9ae8-abdfdbee3fd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639130931, "uuid": "d63e230c-38d3-4dbd-8a24-86758125a32a", "value": "a7cf8e42e21d2888406f52fff0712d32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c075e1-59ab-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639135236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639135236, "uuid": "a363547a-62f0-4d39-8818-f0688a613562", "comment": "Malware payload (CoinMiner)", "value": "3b8f84394473e3f20ccba33d1b9c6191", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639135236, "uuid": "976ae28c-115c-43a1-908c-62b40ec3cfb7", "comment": "Malware payload (CoinMiner)", "value": "757ffe1da50601133ff5de5fa7f77c3bef8de506e520c931799456afbc1aa78a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639135236, "uuid": "d15953e6-0313-4f91-9c94-bf844b72a309", "comment": "Malware payload (CoinMiner)", "value": "85e29453fc67e4e278b350b6b79d525cc3e26b0c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639135236, "uuid": "055a4f15-1280-4f68-9d17-6bcbd7f1aa6d", "comment": "Malware payload (CoinMiner)", "value": "0bad05c9c5095ecffa208420b09eed6a6b7d0c84f2a01c8b9c06deaef02e12c8f4be313e268766d69d2b2f123aa625a7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639135236, "uuid": "8beb15c6-9ca3-4019-8d3b-fbd5f8d79e1b", "value": "T18F373361BCA420B2F4290D341197358CDCBDB6260B614AD757782F6F3FB16C22B1EAD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639135236, "uuid": "29de61fd-2649-491b-b2bc-bb00c1339591", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639135236, "uuid": "218dcfb7-39c2-4440-9bda-8748147cc919", "value": "393216:FFwUd1vWixd33ylicKnPb8873PSI9a933dSDXzofCksjt76TpvlfRJ6OpY1N:FFnvd33yLKA873A9ndeDXksZUNfnS1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639135236, "uuid": "d64c4931-243d-4663-82fa-fbb3761d58d5", "value": 22903355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639135236, "uuid": "32b4a095-5097-4e24-a17e-1f2fec1b31d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639135236, "uuid": "84d72d30-0f2f-41a8-8721-905c57b79d51", "value": "SecuriteInfo.com.Trojan.Siggen15.31967.13332.4090", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92523f8-59a6-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1639133368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639133368, "uuid": "a3c64e49-e86a-467d-b801-55afc5a1ce46", "comment": "Malware payload (TrickBot)", "value": "d9fa69ac4fcc720b34a7fed3ed9d1586", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639133368, "uuid": "d22aca7d-14c0-4521-9439-17030e71081e", "comment": "Malware payload (TrickBot)", "value": "758cb2d6a4c0ea0e21b0db00bd427f41d3d679883701e7865809e20a4ca89f7a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639133368, "uuid": "96a93033-82e9-4c5b-880d-87724d7cf163", "comment": "Malware payload (TrickBot)", "value": "b6cda924b9641b40305ce100acbbf342dd479c5d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639133368, "uuid": "b5e7e6a1-8e12-496f-a924-44298ddda805", "comment": "Malware payload (TrickBot)", "value": "4116b852798b1d2a1f9cf0bab41f7b6c7232780f4e00c823ec24104144db483bc525329c006bc5dcf78877b8f68de417", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639133368, "uuid": "1e8d24f6-2c04-477b-b7de-0f81119314c0", "value": "T1EE05F120B2A0C431C45B2935927ADA715A3F3D32EAF58547BBA837385F722C09B7D365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639133368, "uuid": "bd4a8d5d-9e72-4ec3-91f2-001f01064333", "value": "c24b5af71e321f46094351d9a2bf63c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639133368, "uuid": "50937675-5279-444a-98c5-20c88da27a46", "value": "12288:InhdroYY4VgbjWuEs3OLX2nhdroYY4VgbjWuEs3OLXx:m7YwYhQXw7YwYhQXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639133368, "uuid": "c108c6a1-31fb-4a6a-95ba-0b87d198d5a6", "value": 810116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639133368, "uuid": "130d2531-2904-4099-8235-e9d1f2939d2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639133368, "uuid": "6e79857f-d80d-4358-aacc-0519a3b5c16a", "value": "1.dot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4dc445a-59c3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639145736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639145736, "uuid": "fa6eecf8-ed3a-4893-af5e-1f8cb43c1a04", "comment": "Malware payload", "value": "23a8ac1d251aa7e4ed26e93cf311202c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639145736, "uuid": "ba30b73f-adcb-4bfd-8d56-3d9e4d6edd0d", "comment": "Malware payload", "value": "7672597785df87ceb512c5abf8a063c6525fad9fb78e7f14fb2b76e9a1d76805", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639145736, "uuid": "897cc147-dc0e-49a4-b550-367a790b6488", "comment": "Malware payload", "value": "6439a2c66deb500cada3d2b3111b06fd4f102ee0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639145736, "uuid": "5b272582-9510-41bb-8306-322ba8048414", "comment": "Malware payload", "value": "b17a635152be56f012549052f8789eab9d6e375fcb9535b790b9e2d5d5174ed71121640d4945d3f7f8a1235cdc0f7556", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639145736, "uuid": "b73ac874-6ef4-47be-83b4-91683f174616", "value": "T1D3B633447760B39FD0D3C37AD995AD7897942DEABB6B8203C0A32DAED52C44BCE105B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639145736, "uuid": "96f3018c-603f-45c7-9f78-6968414d47bd", "value": "196608:iGLxda/7FtyALQQrqd7hQoVz7N6XO9Qq4aNCKyov6nR/GW7VteLtr7cdq7pUEKSD:iGva/7FhLpqf7N6XcQqFNCKyXnRhZtqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639145736, "uuid": "aadf664b-c454-4be9-9056-b89ef51fd996", "value": 10905110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639145736, "uuid": "c78a32d2-b1bc-402a-afdf-3f91a227454e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639145736, "uuid": "98e9ac03-b6a1-480d-bc1d-58d7fa667f1d", "value": "76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75912153-5997-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639126758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126758, "uuid": "cc2da256-5491-4e82-9056-36e70e254e10", "comment": "Malware payload (Formbook)", "value": "e9b65706a11a1843330c2c6c222ca909", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126758, "uuid": "b4688cb5-25bd-4a61-982f-4343fe1c292a", "comment": "Malware payload (Formbook)", "value": "775e97d800d0495cc950870530ddd9fc3a3169b95095c6cba2f29c7b99e0cac1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126758, "uuid": "8ace83a3-5bee-4fd2-b21f-411fe791d56a", "comment": "Malware payload (Formbook)", "value": "1c413d7e01d0f5c8e008af43075eae7cbfad2d98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126758, "uuid": "6551d6d0-6652-4085-b098-b5f19f9d461f", "comment": "Malware payload (Formbook)", "value": "3ccb2d4396b3f2db2f520d75b50a5836fb8ded0965bd631462c15c622e8a2bb208aa2f69c97d65f41e2fe91284d39f62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126758, "uuid": "6f2dacf1-f68a-42f9-abaf-c8ad3ddff653", "value": "T1F325124A33B90B92F97D97BE146560254771711B6CA3F31C2E8231DE84F2B128B92F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126758, "uuid": "3a1d81fa-5211-4038-b785-5340ae695484", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126758, "uuid": "cbca27ca-a99d-4f4f-bbfa-93cbd79d7cc3", "value": "24576:zB8xcT4E5KkUqHmAB9oVM6fX7bW7pNHxGe4EqRWcRE0:zOx+V5KrqGG+Vzu7DBNy5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639126758, "uuid": "616ecd03-1be1-4131-88d4-3acf9cc0dffb", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639126758, "uuid": "c4c34a92-21fb-4e00-afbb-e3654d691fe7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126758, "uuid": "a2be059d-4bf1-42f7-9a62-bda30efd4d21", "value": "e9b65706a11a1843330c2c6c222ca909.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407a749a-598e-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639122804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122804, "uuid": "8b9bb0f3-dba3-48f7-b6f0-6285b2ff79ad", "comment": "Malware payload", "value": "3ba9ab0438e7ccaac884a91ce95d3672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122804, "uuid": "7f50f863-b0f5-40e1-b351-b9b5d347bedc", "comment": "Malware payload", "value": "7bbef0780511fd30f1aec96c9921821fbf5bdebb9bcdf2913f7210d79dbf5cd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122804, "uuid": "bc4062b6-99e9-4efd-bdad-c35eeaa225da", "comment": "Malware payload", "value": "21fd6d7fc7b489f344d951775556c3428b6a2e0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122804, "uuid": "11b8a867-df37-41cf-ad77-38425cdb6922", "comment": "Malware payload", "value": "df2dd51b0b74c1d0d595ee3d01d02cc6741a9ed9986b45977d9df4b4f022279c29a994cd337c5129829f1ab043bc5333", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122804, "uuid": "7303db16-f72e-4134-a546-45f5652d4bb8", "value": "T19274DF71FAABC871C5930D7148209AEC193BBC626960404FE7A4679E2F76F9C45E133E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122804, "uuid": "f8f20db6-9cd7-4015-a416-5c8972be485f", "value": "784912eb6940550282ff4b089d7e66e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122804, "uuid": "418293df-2dab-457d-8da8-1bc0cef073ee", "value": "6144:4IeqrD4LatjDhAoMUsq8UpY2eJjKbkh5CoVrKuzbgwu6Qiga6:df4WtjVX8TjpNxKunn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639122804, "uuid": "3877625c-51b9-4e02-b3a5-f46e108544f0", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639122804, "uuid": "0a49e432-91ae-46d3-9c35-f70b6c296f79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122804, "uuid": "cb41b6d0-3d4b-44bb-95c8-07aeeb0b5cf0", "value": "3ba9ab0438e7ccaac884a91ce95d3672.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c89527d-5991-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639124059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124059, "uuid": "cc75d5a9-9d73-4ceb-b5a4-319558a6d03e", "comment": "Malware payload", "value": "e8667f52e30bdf260e2c9946a39284fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124059, "uuid": "89a1d501-37fb-4aa9-99f4-6a9fae00dfe8", "comment": "Malware payload", "value": "7c6dd1cb75d98d015ee5a2238e5ae0ae89bab20f8a03de74af74f2dbb4753944", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124059, "uuid": "7a4d2148-05b3-487d-8644-eebdcc3ba020", "comment": "Malware payload", "value": "078bd220a2ea89c486e67e5df6b47688ee1866b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124059, "uuid": "6f3bdadf-3418-4425-8695-c7776b72b388", "comment": "Malware payload", "value": "21c809124201c94c77649e5ee1a022864faa3ebc256c52addf5846c4683dfa01e60cd77da7bd6ec32220af0601675aca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124059, "uuid": "730e12cf-8118-43e2-942f-2acf549d31ef", "value": "T10BB4D09C715072DFC85BD4729AA8DC78AB516C7B831B420391E71DABBE0D997CF180B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124059, "uuid": "82e1e002-f688-4e5f-bf5c-0334994cd784", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124059, "uuid": "c012a3a5-d1eb-49b5-84f6-5b35e965491f", "value": "12288:OaUH1aYgxhfVHNX7w9qeixsiFd/rWX6zAp29iiWsCHKvFh0HtNlqaL5BTY4C5MGM:O5H8YW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124059, "uuid": "d7c499e7-28cb-4a8f-a550-5ce1ecb9a195", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124059, "uuid": "4024c325-b4c7-40c4-9b15-31a9eedac754", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124059, "uuid": "7f590f7b-9586-43af-a31f-68e60fdf58a2", "value": "e8667f52e30bdf260e2c9946a39284fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd427b2c-59ea-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639162634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639162634, "uuid": "b9e2b8f3-7c80-4ea7-8770-d1608dd774cc", "comment": "Malware payload", "value": "b7498565e002d354687d4ef9ff1b33ab", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639162634, "uuid": "df94a291-ffbc-4fee-aa07-2e25f591c9c1", "comment": "Malware payload", "value": "7d499efc479588aa2d67f80efdcda196076f751fe15808aea42e9f59532fa028", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639162634, "uuid": "fdba0d13-4c91-4f7b-8d03-02f6b4e151bf", "comment": "Malware payload", "value": "10b37a99fc6c1c0da5a6a841bd60bda9cab952eb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639162634, "uuid": "cb3b080b-4876-4168-8b08-5259c1ed34ec", "comment": "Malware payload", "value": "717815fb8c74dbff93896ecee35da92105a9d5b9b03889f293590e0b14bb813f06c02c098e1afcc3e0caecdf626b4538", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639162634, "uuid": "ecd52278-2aa0-4995-acaf-cf64f4898b41", "value": "T1ABE4AF37F2D14937C16F263D8D5B7258E92B7E112E38A84E6BE41D4C9F3AA403526393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639162634, "uuid": "866e3078-9034-4d4e-8f45-804f681f7869", "value": "779533981cce29e233fa98f54323909b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639162634, "uuid": "0e10bd4a-6af1-4e4b-8ed8-a44bacaa57b8", "value": "12288:l4V3PLzRyyTYI8N1pYekopeZWPNyGgpEMaLClRMpuTiq5zcRr:WfLwu8N1CYKWozEMaLC0gOq5ir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639162634, "uuid": "8b138917-7827-4750-91f4-9b4e6fc5e388", "value": 706179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639162634, "uuid": "7c370d77-e41f-484f-938f-5fcab55239e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639162634, "uuid": "3394534c-db12-443f-b2e2-106a2c6c70ed", "value": "7d499efc479588aa2d67f80efdcda196076f751fe15808aea42e9f59532fa028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37408b2c-5985-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639118923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118923, "uuid": "a7b5e177-f00a-4d52-97eb-06c290b4cc9b", "comment": "Malware payload (AgentTesla)", "value": "7d2fdb20a2828c3f586724fe07e65d9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118923, "uuid": "5990f9fe-3efd-4d22-a4bd-893e697bf30c", "comment": "Malware payload (AgentTesla)", "value": "8053fc9642aec06a540c1a587e5c59bc2ed7ba540e8eba69175316799aefebb4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118923, "uuid": "149f2e48-6e5e-464f-9515-0714851e9c76", "comment": "Malware payload (AgentTesla)", "value": "567adc7b4730d36164a0d802ecf2bca42bb756a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118923, "uuid": "38bc32f6-81d0-4b9a-99cb-5fa18a863216", "comment": "Malware payload (AgentTesla)", "value": "3d6dc473f306ac466976b392af2fcc09c3e987fbcce2e95d09704386fd2fdf6d6deb0147dc40f3fde1430d2b3a1cb73d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639118923, "uuid": "ff845921-47d4-42ec-bae5-ce3d6d337f14", "value": "T185C42304C050185AC3EAEC226DDA192E1613F567163C5BE283DBAD8B73A5A5705CBAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639118923, "uuid": "6bb3326c-7396-462f-9644-a6340302cfb2", "value": "12288:7+lYRzgtVZLDiWFH4qX1ZNPxB4hLDNQkUja7Lxzhgmk3MobwjsR0itN:KiRktVZLn54ap6LDepjavxzhgmMpssW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639118923, "uuid": "4dc21340-f599-42cb-9ade-5caaedb979a5", "value": 581628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639118923, "uuid": "7cbb8900-30a4-4933-8438-3c0ee1e0302a", "value": "application/x-xz", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639118923, "uuid": "6b850e9a-189c-491e-8560-b6ea63203727", "value": "MT103.exe.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5450b7e-5972-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639111028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639111028, "uuid": "d0611124-fde9-4072-869b-60ef6007ef52", "comment": "Malware payload (njrat)", "value": "c151913c81c45053d186f4b91e85680f", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639111028, "uuid": "508a36e3-2c59-4643-84a2-6ba33189fb91", "comment": "Malware payload (njrat)", "value": "8089f15903c4925dc06bf871d1375fddb447e96e227e07b89e86f997b96c7db1", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639111028, "uuid": "15169405-e0e7-41bb-8833-75c1092536c4", "comment": "Malware payload (njrat)", "value": "e01616f9f7855c09ed2b68a2d18496c566349060", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639111028, "uuid": "1db2059d-44d8-4360-a031-acade46f579d", "comment": "Malware payload (njrat)", "value": "269b1202c777e8bb22ff6e1f60af3169997ad77e8dab38bbbc0bbb0357c23536f438b245e32102bb81ca444c6385aafd", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639111028, "uuid": "5d0e6f60-be02-4e01-b40f-409b8a06de35", "value": "T10672AFFE9A03E38DC7FA0B3155928CE96346D9055F6E74C94911B1A06B25A8BCFC248C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639111028, "uuid": "4fee27c8-0823-4e72-ba45-1d4d2438b629", "value": "384:dXPVKgGsznUGSOxZWNOWZuN1kmzKbkl/cd0:VPVXGgBDWNOWyiMKbQ/cd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639111028, "uuid": "0bac4978-1c3b-42c8-8d72-ed6437987681", "value": 15981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639111028, "uuid": "d1201e6c-0bd5-4d1e-8053-75605ac2c0ee", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639111028, "uuid": "2945df41-4136-4009-a2b4-8969e0fc6e04", "value": "Comprovante de pagamento.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f3c196-59be-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1639143320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143320, "uuid": "2a5ed988-b1bb-43d1-a573-5488d0db3d7f", "comment": "Malware payload (IcedID)", "value": "720722dc03e9e5a86e415401d3647068", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143320, "uuid": "2303241e-cdff-46fc-a677-b751bd47aff3", "comment": "Malware payload (IcedID)", "value": "81841949aacb21036cf55d26a6d82cc3f0bdde4bbfa89510ffd2b9063d42db42", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143320, "uuid": "46b56999-c6d5-4b22-a397-ef3f64380f21", "comment": "Malware payload (IcedID)", "value": "8516b71bf10726c6881c08de9b214672b13cc0fa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143320, "uuid": "868c51bd-a20d-44da-be82-b9e950447dae", "comment": "Malware payload (IcedID)", "value": "c94fefe6148b8178f597b947530a58ce476d0263b0f7c70b9673a2d535642013374546949d19e3d0a490286e1050d4ad", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143320, "uuid": "e3c54b7e-51d2-4ed5-844c-c046e37ed2f3", "value": "T1F7B407BB75976244FFB14C34AFE875F5CB93283AC96FEAF08691B0302A64091EC46517", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143320, "uuid": "58dd8671-8da0-44b1-bbbd-d75e0a079a59", "value": "12288:1s+jzJ3Wav5kdFcImyeVCKjnBpHMuoznN+TU:1fjzBgSVCKjBSNYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639143320, "uuid": "82eea431-0951-4301-a95b-dbae253318e6", "value": 531584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639143320, "uuid": "2a62bc89-1057-4040-95a8-273a2b9c2769", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143320, "uuid": "e3d23c16-dcba-438a-897f-00f15f5ee6ed", "value": "repa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8606c0-594e-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639095603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639095603, "uuid": "1272fcd4-9011-48b4-96dd-4565658857b3", "comment": "Malware payload", "value": "e6f027cedf4629427e79e8ffe7b99707", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639095603, "uuid": "605bbb09-809f-47d1-a1c4-fe2ccbc48029", "comment": "Malware payload", "value": "820bdffda7d982a9cfe3d7d2e469ac3af401aacf3ddd46a60e017b3f2d7baeaf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639095603, "uuid": "88b0d665-6773-41a8-82d0-30e75578aab8", "comment": "Malware payload", "value": "fe4681d84a780d9a26658ffce8c440eb43f591d1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639095603, "uuid": "d99b08be-c938-447e-91ce-cd1dacf88836", "comment": "Malware payload", "value": "82b9e23d61a7086c8dd0c16ae7bbb08bd0bd4efa1eda3b2e4bb15747b29b210814d2b2230ceccca0044e58ee75acabba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639095603, "uuid": "2a921678-8f14-4b4b-83f2-26348f5a7bca", "value": "T1D724CF10D141A036E5D324BBC7FFD9BE4A6C67600784A9DF93A82CB58F696C2B63114F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639095603, "uuid": "cd8a3cc2-c3c4-45d7-b7d7-19ecd72eb014", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lw:Wvef8+h61mRcHL+rF6l5EAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639095603, "uuid": "7707de27-f0af-4d0d-b815-c0ad17a7c64f", "value": 216649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639095603, "uuid": "947c1e3e-7f4a-48fe-bb99-cbc06f220d57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639095603, "uuid": "f9de2471-bb44-476a-958d-13b30ba61c5b", "value": "emotet_exe_e4_820bdffda7d982a9cfe3d7d2e469ac3af401aacf3ddd46a60e017b3f2d7baeaf_2021-12-10__001959.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a47e1bd-5967-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639106204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639106204, "uuid": "2e2f0d9a-94ca-470a-874e-ba709e9ebd19", "comment": "Malware payload (Formbook)", "value": "867004641139250d23e0512c2a185b48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639106204, "uuid": "ddefba5a-c133-4ed9-b4d5-beeae6d852c2", "comment": "Malware payload (Formbook)", "value": "82d711b2752fa2e63827190516b9252f95be76a774a239a9927a36a6cf0a7cf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639106204, "uuid": "15dbb147-e2ca-41cf-99a6-b7a2dd4044f6", "comment": "Malware payload (Formbook)", "value": "cd58c3f4cdb389c4aba2b15d1a34239a54a99f1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639106204, "uuid": "f20005a2-dfef-4238-8d28-54e737b694ab", "comment": "Malware payload (Formbook)", "value": "76926274d3a9eeaad058e85ffbef195eac1cd5095925a60b47ddca52541eb2fe988bd1e3a2afd528cf3fabcd151eff19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639106204, "uuid": "b30ffb7a-5708-474a-a0d1-d0cce87b2818", "value": "T14F441366FDC0967BD1CA4A70A933A37883F15A8916E255B38B10AFF96F735D30028DD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639106204, "uuid": "287d7dda-6954-4b3b-a2c9-f0327e93214b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639106204, "uuid": "631c5aae-ea4b-4f73-b72f-1ab6245bb48b", "value": "6144:rGiXq2maUba+P9f7KzXuDQE26IHQac+6rsJl4iSxQV:OlB5F7DDZ21orsJl4zuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639106204, "uuid": "111b8f77-65f4-4f0e-8075-4a4c0f6d9a93", "value": 269165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639106204, "uuid": "d9c50385-9150-493d-b069-974e3f80240c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639106204, "uuid": "c76b6ce6-34d8-4cb7-b273-4ea60adc5964", "value": "RFQ#5764021_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ac60ad-59b3-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1639138952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639138952, "uuid": "4d0381b8-cb5d-4c17-9f32-d506c460b6b6", "comment": "Malware payload (GuLoader)", "value": "09ebd2a819570ff97ec1f3953ca3b83b", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639138952, "uuid": "ca7328e7-a2c9-42d4-886e-be3881bbf2f5", "comment": "Malware payload (GuLoader)", "value": "83815b09a1053bc5ab7f8b187c5720ccadd9a71ca59155fe7212f383fc39a8ca", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639138952, "uuid": "e01751ab-4808-4948-a727-51e9d1038b99", "comment": "Malware payload (GuLoader)", "value": "d7a8d0691ba5a5880ab669e307d548326a7f8d2c", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639138952, "uuid": "4ea70472-e728-4564-9c3b-ebbb512e4c88", "comment": "Malware payload (GuLoader)", "value": "a42303d72abc627641705ed1fececf7164990783633a1e111daae98681a67710bb9116a6340f5c56fb807d73a76709ac", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639138952, "uuid": "54d9a980-e9f5-4f16-9beb-4a97023965a4", "value": "T1B53302339DC356E2C41737AB2E11DC00605E6E326E2F712D4ACF60C9592A7CA76E4C6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639138952, "uuid": "c88855ce-e8e8-485f-8d98-1526843d3397", "value": "1536:xi0ebnDDYtwpPBhgMvL7sr/F1kRuqwS9GoEmUS82t0:xirDHPDgMTA/F1kRNwmUE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639138952, "uuid": "4908e3db-fd5c-40fd-b78d-2f167d91679c", "value": 51459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639138952, "uuid": "107660a1-752a-460f-bd5a-052958ee458b", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639138952, "uuid": "e7febbd5-8e2f-4756-9798-a39beadecdc6", "value": "URGENT_ORDER.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd6fa82-59a6-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1639133294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639133294, "uuid": "fe5c51e3-97ad-4476-9d5b-d8427211b6bb", "comment": "Malware payload (TrickBot)", "value": "509b89137c78068be70638cbcc5ef8f5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639133294, "uuid": "d2dd1a1b-b0e1-43c3-b92c-3e9853feae45", "comment": "Malware payload (TrickBot)", "value": "84240266200f3b4252535bfcf7f1ddee2a4fd7fdbb94f61aa627f2e8f2c9d6d3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639133294, "uuid": "2c57b085-8f17-4edf-bd9f-56f75896c3f0", "comment": "Malware payload (TrickBot)", "value": "15fd801e764e7e02f90676a4fc1a18361be49aa9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639133294, "uuid": "5415b1e8-1a4c-4ac8-b20c-822ab488d763", "comment": "Malware payload (TrickBot)", "value": "9facab2f1e51898f42edde426629cc5a9f3f4bb56f520a62db400de3d1249489bd525a194112a51c7543fd041f730543", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rob142", "colour": "#DE4218", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639133294, "uuid": "b65ceef7-de70-4fc3-8134-75302782924f", "value": "T1679598F0A072A440FC1E2AA6F185388986C73DEF790FCE460528B57F25BA5D93B9445F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639133294, "uuid": "cd0cd6f6-e6d0-4188-a320-7814842e2b8b", "value": "6144:nGx3kcb7mT47I+sIm5p/KD/Y/tVzah7D:G5Bx4/m/YFIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639133294, "uuid": "bef02f4e-6ffe-4877-8ffc-959d836dcdcb", "value": 1970176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639133294, "uuid": "7ea76d98-daa2-47e5-ba29-56915c9c4876", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639133294, "uuid": "fb2d1a74-8c2f-40e7-a9ed-3c0821e61581", "value": "2.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a8502c-59f9-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639168898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639168898, "uuid": "6d0b3069-6657-442b-94d0-43154fa97bfe", "comment": "Malware payload (RaccoonStealer)", "value": "789597037c2678adabf1ddec22b7c22d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639168898, "uuid": "a647a5fd-19df-4877-8e56-8db30de9304b", "comment": "Malware payload (RaccoonStealer)", "value": "84ba0bb68b99db2b6fb6f489204e7874069a736cd893182768d918a8bf71485b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639168898, "uuid": "e4302e8b-77fe-404d-9b65-1470d58e1a0f", "comment": "Malware payload (RaccoonStealer)", "value": "a29410918ed42d461293c559cf888e9648d176f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639168898, "uuid": "13312763-7a06-4d9c-8da1-efda33f58495", "comment": "Malware payload (RaccoonStealer)", "value": "f946e4611a47aa2813ce11919cb4df076d2e7b92bd9141f2c9874c6b6703d38dde8fa63e38abae9f4d8dc8a3bd2e9d36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639168898, "uuid": "8f2ec1ed-2160-469d-b9f5-513a9cbe22d7", "value": "T135B4F1F226A889B0D5273D71C82196D05A3BBD51D9205016F274778E2BBBBCC4AFD31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639168898, "uuid": "3dff8017-dae2-4b92-b60c-f3114cb3b113", "value": "451c83d248b8a360a856e177bc85355b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639168898, "uuid": "23e69ab8-a092-47f6-b86c-bb9616c22777", "value": "12288:oz7R9DSlpPACWGdCJsua+aEIzbDNb/jaKunnn7s:GDSLPACWG+A+aEIzbwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639168898, "uuid": "632aea4a-ef68-4427-9e5b-2f58d221f38c", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639168898, "uuid": "2d402ddb-4396-4eb8-b3ef-2b1e616d1c3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639168898, "uuid": "b71d4b95-14a9-4413-bbeb-543fd199d412", "value": "789597037c2678adabf1ddec22b7c22d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e8767e-5995-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639125925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125925, "uuid": "bddf2b1c-c3f2-4da4-9aac-e50143e83aed", "comment": "Malware payload (Formbook)", "value": "986361816bf25ebb4ec2dcdde741ed41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125925, "uuid": "c735cce3-92b8-40b5-9627-dbced81bf674", "comment": "Malware payload (Formbook)", "value": "84f01d9761a5e76774cac6a3a21c50e3b653f725276d32ea3a10d7ec00e14c99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125925, "uuid": "a3ec6972-31c9-4a79-85ca-b9f2c33f045a", "comment": "Malware payload (Formbook)", "value": "497088494318951ceda9684916cafed8b49826ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125925, "uuid": "0eeca080-c2bf-4e8b-a045-f277c44e1d54", "comment": "Malware payload (Formbook)", "value": "30c0e33a2af50ee34ab0aef0979657ec0dac6dc7370d89f58ba94789a666010c7096a3675d800a6ea6654b6ce045f831", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125925, "uuid": "4341c49f-383a-4769-9368-8913417795f3", "value": "T13035236537F80BA6EB7A9BFFA81261488736B4077D73E70C6C8121DD4467B14CB42A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125925, "uuid": "bf4c8c4c-ef3f-4861-b8ab-8db6b4152675", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125925, "uuid": "61ad862b-6764-4090-99d9-e3601d8a61e6", "value": "24576:GGixpTsQq1sCZgwWdA6e+4x24/ttw95Qq6hWw:GzxV11CZgC6elx20M95xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639125925, "uuid": "f569014b-97b6-4343-829a-f2cd4c1e24fd", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639125925, "uuid": "550ad4b6-bf53-44c1-825d-c19d9b62ac73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125925, "uuid": "60c50b32-1792-4a3a-80b0-2b25560af39d", "value": "986361816bf25ebb4ec2dcdde741ed41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0f8a759-59fa-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639169405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639169405, "uuid": "9478c692-102e-4db7-ae15-ecdbbef030b8", "comment": "Malware payload (Mirai)", "value": "773835f59aea5efa576448be49146e27", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639169405, "uuid": "70d01898-4764-4c45-badf-bf10883ba56c", "comment": "Malware payload (Mirai)", "value": "85ace1aa7e0042d26c749be912ef3a584120c72e59dfcd2f573475754769afcd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639169405, "uuid": "701d21ac-0fe2-49a5-a50c-9d7ecf591ce4", "comment": "Malware payload (Mirai)", "value": "87cc3c9ecebc359928b4ca3a2869e64138b591a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639169405, "uuid": "a2427714-007b-49e8-bfc3-bc5688b88a8a", "comment": "Malware payload (Mirai)", "value": "15ccf1a7b3e33ca8e7698436d871a2ec2bd8f890e51bd9da91678292a2a28b9096ead1370f149d2d384d77745969d343", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639169405, "uuid": "8fee7157-72ac-4ef7-a220-a2849f3cfd4a", "value": "T1E1330125D7DE88A6CA200973E2BF1145B16EB7BCC0A677D6039CA8847DD72C7B674213", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639169405, "uuid": "4550d511-a884-40cc-b15c-6d17e1cb4117", "value": "1536:eAPtoKBLM7wUJSZsdUVeL8r1/t4iBpYu68JFJR:eAPtcZLIV4iBpYu68JFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639169405, "uuid": "c9b02ad4-6090-46e4-a8fa-6c66218d0703", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639169405, "uuid": "e430db9a-0654-4c0e-936a-ec0a6f1a011b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639169405, "uuid": "cf323884-5d0d-4f77-ac82-06f1c7ee4d46", "value": "trynagetmybinsufucker98575.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892f1b3d-59b4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639139247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139247, "uuid": "eb438d8f-ac22-44ff-9ecf-b29e0c0027d0", "comment": "Malware payload (Formbook)", "value": "6dac7fe3d5c2d600fe6650d571bfb44d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139247, "uuid": "52a1e4c9-5675-44f9-a526-201eaf42b887", "comment": "Malware payload (Formbook)", "value": "85dca30464e5d239a82140c6611e7d9d2e4e8a7400c869c36c3c4999a0b221dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139247, "uuid": "3bc88c75-5de8-494d-8d29-47eaaff71743", "comment": "Malware payload (Formbook)", "value": "dc4b11ceeb0c04d0528c7074cc181714b8176050", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139247, "uuid": "3a082f1d-88db-4041-ab40-80d37a5b58f3", "comment": "Malware payload (Formbook)", "value": "42657fbcae2798345f6a3ca03cb463c32925eb0dde011849d668c8c584b324b2c7ed48518d8c13618d932ecbad90e3f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139247, "uuid": "029cc71e-9fee-45df-be3d-57f53e8d1133", "value": "T148159EA2E2F05C32C07F16B99D4BAAE4653B7D103D199C465FF82D8C9F367A034185AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139247, "uuid": "b4418d99-3371-49c7-b0e1-1787201672e5", "value": "939d8f743f99c748d946de3c81bddd31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139247, "uuid": "534fc86a-56e2-43db-ad40-d3703a29e202", "value": "24576:suRQsAJcBdZF0bE25gAUQI+3c13TOqamxypnUXAGe:sL9JO0jUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139247, "uuid": "25856f6d-8b11-4228-a84c-170f00c4e6a7", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139247, "uuid": "fbbc6ed1-7259-438e-81d8-0ccef5566218", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139247, "uuid": "71e703ba-a2c6-459c-8c8c-273366b5b261", "value": "Copia de pago bancario.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe65d9f-59e2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639159203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159203, "uuid": "6ea5c39f-89df-4f56-838f-748183d96f08", "comment": "Malware payload (Mirai)", "value": "8bdd93e0aec47b8280a0816a693652b8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159203, "uuid": "f06f73c4-0267-4c7c-b2fb-ae6c1a7e0bb3", "comment": "Malware payload (Mirai)", "value": "85e3cf7a3dd3a265ff7360ae03821c4e60cd8d616e64803b1c5c1e706bffd793", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159203, "uuid": "f9e83805-fbfd-4084-a8ef-ea23b9b1429f", "comment": "Malware payload (Mirai)", "value": "bd99661205a3a13589d6324d0d01aee4f9a77b7e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159203, "uuid": "aaf48b2c-1c72-4bf2-b9c7-cf47b85e8463", "comment": "Malware payload (Mirai)", "value": "d8ac59ded987cf0c374ed714d15f77fedc832784b8a5878a0b2f28d14da08bdc487e6fc7d0778b3304babef7d446a6a1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159203, "uuid": "53f9ac11-09c2-4fa6-b17c-9681b3b21144", "value": "T12B43F109EA7AF635DF63893B5DB42088E2C5A778607F5329123AA51C7AD3C01547A01B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159203, "uuid": "b0053812-33a2-42e4-b425-251c4a91ec71", "value": "1536:KzNCg2cMWmlPQqaWyI1GI4UpI0ZLxv6/Bx1lqZ:K7MWm1QIB4RoLxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639159203, "uuid": "2e60041c-74e0-41bf-8d9f-23f1855338db", "value": 55804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639159203, "uuid": "f2a9c951-d8ec-4127-8ac7-9662fe720ea9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159203, "uuid": "2b0d89a4-b4b9-44f7-ae0f-9a7a11193753", "value": "Tsunami.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721ec17c-5991-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639124176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124176, "uuid": "bf87735e-7358-47c9-8028-1f88560effdd", "comment": "Malware payload (SnakeKeylogger)", "value": "cde602ef9019c891f98005bc0288fccb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124176, "uuid": "e5233390-73dc-4bc2-b540-dd152161ca1f", "comment": "Malware payload (SnakeKeylogger)", "value": "8622876ec5e7648e87a9d9d889397434d6ddac409a72889216113c9bae3a7962", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124176, "uuid": "9a243948-8d0c-4c28-95e5-d3f802d50d99", "comment": "Malware payload (SnakeKeylogger)", "value": "fd223002c3c6d3eebf14af2ee98a11cb6d4aeadb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124176, "uuid": "ef60b780-b8d7-41e2-831a-a249914d1894", "comment": "Malware payload (SnakeKeylogger)", "value": "61c0b105ace4a8825422c1cfc579786cff236a1094c8e32f61266e586f9575f40bbd63483945ac14df663336858baabb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124176, "uuid": "22c191ed-2c7e-478c-a693-acee2685883f", "value": "T1E42522BC359362CDD59993783766D03862B23C3B506BD29DE84A309F6D3BB447623B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124176, "uuid": "01e0511f-62a8-439c-b1c7-b214f590aa69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124176, "uuid": "3331eb74-867f-4615-8af3-eb18374d5914", "value": "24576:oyzbU4KBoBQKlIByahkSTy0+G8LxLpVK65m:oGbU4bW6wyai50+hJpVKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124176, "uuid": "8fc0f07e-0e7d-4fe1-ba53-639fbf2da862", "value": 979456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124176, "uuid": "a8893515-2068-46a4-938a-3637b6bc25e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124176, "uuid": "31048934-5612-4b24-9b8a-f582291e95d0", "value": "SANTSSWK20100001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23238497-596e-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639109011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639109011, "uuid": "75302dd8-3a13-4074-8ccf-d4aaa7501618", "comment": "Malware payload", "value": "6096a6249d79cccc57c24fcfb58edfbd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639109011, "uuid": "26044c51-f4ea-4ce4-986d-3819c5579f72", "comment": "Malware payload", "value": "862befa9d3c52f16a677919fa466d79ec9a1a9d89ee3516096fd9f2fefd04147", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639109011, "uuid": "c68003ea-7b5c-4fc5-8378-2f044515e51a", "comment": "Malware payload", "value": "9392b2e13d0d2d8af59995b2b9fae0b4ae59711c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639109011, "uuid": "fea306d4-692b-4742-8094-4652f7d6638b", "comment": "Malware payload", "value": "9491d12e91707ab19cb4de2e502a618debf83d43fa53f921e52c3341260a912659900dde361efd2a0473bd63e93fc284", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639109011, "uuid": "198f1a64-c099-4196-ba34-6d72e9c2c465", "value": "T1BB347B2276C1C036D2A334B0825AA67566EDAB301BF696CB6BC41D395F741D2973CB0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639109011, "uuid": "30ebe6cc-aca0-44a3-a7f9-082aa7735468", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkG:HVqLOGNVDzZtIlHN3nkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639109011, "uuid": "9ba95c3a-3c13-456c-b98d-2af74a90284c", "value": 245298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639109011, "uuid": "c4e4c00d-b26e-4764-8b6b-a423662c1ea3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639109011, "uuid": "72022dff-10a0-4d5f-af40-e7b0d633eba3", "value": "emotet_exe_e5_862befa9d3c52f16a677919fa466d79ec9a1a9d89ee3516096fd9f2fefd04147_2021-12-10__040325.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100f5b3c-59b0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639137326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639137326, "uuid": "d7406d78-6921-4e13-bd3d-8e317876e7ab", "comment": "Malware payload (Loki)", "value": "7e1af3a698b2e8f659e3be0597ffe524", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639137326, "uuid": "02ca6b3f-5c7a-4ce0-9592-6747a6d89806", "comment": "Malware payload (Loki)", "value": "866488972be13494253a32cbc5bd75617438e1de9d4650c63455bfe18db51eef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639137326, "uuid": "f8149432-b4a5-43f8-9a58-fda39589daa1", "comment": "Malware payload (Loki)", "value": "cbc280c710adb9ff2a02bc68ce0c03d638f9f76c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639137326, "uuid": "2ef30781-c261-4da2-b9dc-9f020725048e", "comment": "Malware payload (Loki)", "value": "b1627df63c65c2e92f2fdbd7f51b07acc556d3b1ccba16d2b71aaf1277ec6cd6a2ddfd7b6d18bd4976ea6a751b2d2f4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639137326, "uuid": "690ea693-42c5-42ed-a24c-165959174ec1", "value": "T1ADB412EE71C8C462CC658B731D32E638A7344C59A8768B7337963E2C6E730F6051169B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639137326, "uuid": "cdc6b87f-2df4-4cbf-9dff-29c407f827ef", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639137326, "uuid": "13a24bb6-b5a5-49e5-a7db-c8b110276ef8", "value": "12288:dDIbIUBhs9Naxla0AuNoSZ5yzy5g5iSpLmwwNf4y7:V/UjySNoeyzrUWmDfN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639137326, "uuid": "dc06bb43-4642-41ea-9298-dbf893a02a2d", "value": 529589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639137326, "uuid": "1f84d8e8-5862-4ce4-bcb2-c7606fe00cac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639137326, "uuid": "0fac0f0e-0f56-4f50-b8aa-d9356554ef16", "value": "RTI Invoice-127.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5b10cd-596b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639107686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639107686, "uuid": "72ca3c7c-9733-48fa-806f-0c75cc8c7f15", "comment": "Malware payload (Formbook)", "value": "15c34e5e1b995ffcbca4310b78f3f7d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639107686, "uuid": "d328dcc2-0af1-4c27-8ac0-03a182663490", "comment": "Malware payload (Formbook)", "value": "869a075f9809475dd6839987e3b1431a1fd437ad7879becd35e4f055b4a7f747", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639107686, "uuid": "671f76df-df27-4df7-8776-ae356e6e086c", "comment": "Malware payload (Formbook)", "value": "596dbe75dd64288d3b3fc7a29baaf40592ed93d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639107686, "uuid": "6ca8f248-805e-4f4e-b6f8-abd599469e1e", "comment": "Malware payload (Formbook)", "value": "b4f0406996fa9a3e3122c0cd1f488dca60ee7b7c81098370219f8807c3882ec3f472d96eb1a2d87b36134167280e3381", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639107686, "uuid": "249d7176-af8b-4079-8837-1a5b1304f99c", "value": "T1624512093AB5E517D23857B2C2EBC0908BBDF4473CA3E77BA8E2127D56387C95903256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639107686, "uuid": "5de685c8-b0e4-4f0a-92c8-60b1ee3e9af6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639107686, "uuid": "e95024a3-bd06-4053-95b7-ee36c5f9228f", "value": "24576:4tIKjy/SYCpqDaQVWLnLM1AoM/kYYuGqmlkpVEPSddE:4FjASyV+LcN2pwqGkpVEPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639107686, "uuid": "1183af0b-caaf-4dd2-92e2-2a82bb50d15c", "value": 1221120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639107686, "uuid": "00d78470-1dbf-44f8-ad80-2d17a19cb31a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639107686, "uuid": "b98670dd-3f88-4e88-9a4c-a96944f0b9d8", "value": "15c34e5e1b995ffcbca4310b78f3f7d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfbcfc52-59cf-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639150988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150988, "uuid": "4905aaf6-668e-4824-a68a-9c9058480567", "comment": "Malware payload (Quakbot)", "value": "f2735194348be2d55a9f07c5d7dd7825", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150988, "uuid": "87089a1f-94cb-49f7-a56c-da7bdb0eb754", "comment": "Malware payload (Quakbot)", "value": "89a0cba98818ce66aa9068ecb5dd2494dc7500b6a51009ff39b0dd907da1b738", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150988, "uuid": "847cd48f-35ec-41cc-911e-c7c84105161a", "comment": "Malware payload (Quakbot)", "value": "41544abb929311e281fe61a4668231654a327670", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150988, "uuid": "25010885-f635-46dc-8783-3505105b484a", "comment": "Malware payload (Quakbot)", "value": "ca12d11f6c1b98b1d5a8a798a8df54a51ad9f0c79d0aa4f71497d096884f95553277e88e579e442e4d884ebc2d736c41", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639150988, "uuid": "97c8c519-73cd-4d69-b7d9-09aa4f52b5d1", "value": "T161E3AE07EC190A43D4648BB8FD0B1D3CBE2D192DA9E163FD14261DCA6EA52675EDF00E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639150988, "uuid": "014bacba-a697-4360-867f-83a2b668ed2f", "value": "3072:oF7K/FGOztQNL0cBLJUq1dJZvPpz7+fp7Ktr7:oFW/0OzSNLJNUydJZvPZC1Ktr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639150988, "uuid": "ccb55d6d-803a-4a9d-97be-9f517414f7c4", "value": 143948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639150988, "uuid": "6f8f816f-5292-4c10-b92c-af85df55818d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639150988, "uuid": "8b198940-175f-40c8-8884-8c99d6ebbd87", "value": "GP-1414504672.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4450a09-5991-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639124287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124287, "uuid": "a3582651-b7d7-44b2-8bfa-ef39fcaf4fc3", "comment": "Malware payload (Loki)", "value": "20e11dae2780a39280c95ed2d1bcd2d2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124287, "uuid": "5ce99422-300d-4ca5-b0ab-e9a6dbc53269", "comment": "Malware payload (Loki)", "value": "89dc9bb3ed5034854f97935fbfb51b4d1dd80c58a0d3fe94b2862e36fdb911d1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124287, "uuid": "6093c9eb-f87a-494c-a8f9-58f7f8e82dd1", "comment": "Malware payload (Loki)", "value": "372980a904aecee5eca3d0526a6012eba36f62bc", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124287, "uuid": "30c650fe-a531-4be3-b52f-9896bd4a5c81", "comment": "Malware payload (Loki)", "value": "fb35db82b737e90210040acfde80ea4540ec4c4fd2ba127f09b6f07fbc467792e3d86457729d359ed164d7ed9ff28e6b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124287, "uuid": "14f44526-e9d2-4af5-beda-f0db648a3d39", "value": "T161341259631AA32EC95B7B7B1770C9036DC7FE014064C64F2B8BB35981B4D82EE3552E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124287, "uuid": "368fe4ac-fc08-4291-a732-893a99b6f90d", "value": "6144:BiXyKu10ifDPKKrti9HHIK4sdfCtqBCu/sRC9fZC:gCtpf7KCSoK4sk+GI9fZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124287, "uuid": "81efad40-ea43-4f7a-9332-ecd0edccb86b", "value": 234760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124287, "uuid": "d0f91efb-2b0f-4fe5-9a23-11692044cfa3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124287, "uuid": "72a501ab-1202-4493-83ec-4b5b502ef6d7", "value": "SOA 10.12.2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed1cb2a-5997-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639126613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126613, "uuid": "284e0252-0a45-4c47-9181-9c0a8489a2c2", "comment": "Malware payload (Formbook)", "value": "e5a032efe620debffd2caacf4053dcfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126613, "uuid": "71058aaf-a732-45b8-af89-03ba8f9931fc", "comment": "Malware payload (Formbook)", "value": "8a0d28c7d412d1b45cf59ed1ec014c557e51d20cdf62e3a8eca1dddd152ec9a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126613, "uuid": "b0491e9b-c18d-4248-9f1c-bf33253be48f", "comment": "Malware payload (Formbook)", "value": "f811f5beacb0a6bbde65203936ccc9ae7eedcf6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126613, "uuid": "a04f8daf-243b-496c-9d42-3404d0855cf0", "comment": "Malware payload (Formbook)", "value": "48e3b90275bd50c6d82a639da67a91f1d240ff72908f805e5cc4d525c6e9a415640f2d763858385fb04e024cbd190a25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126613, "uuid": "3905fbf6-57f0-4386-97af-2701dbe2eeed", "value": "T194442313DAD54CAFD3E2583860B7D7B9D3FFE2C8067175638B44AF35A09398282196E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126613, "uuid": "33065eb5-2dd9-4aef-9378-b90c8fcb0645", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126613, "uuid": "50990970-72f1-4064-aec3-d7c68a309d42", "value": "6144:rGiHkM+Z3KmYpXijjAZDB+TJzPwDMYHLdMwucOq:zxaupqjAd8PwDMYHLdJu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639126613, "uuid": "e46ce118-9ffe-434d-9f3b-11a8ca7b19ae", "value": 265407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639126613, "uuid": "843673b5-e177-4bfd-9ca6-6205804b71a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126613, "uuid": "fdb4c691-fa5e-4dbe-9136-ee874465fe43", "value": "e5a032efe620debffd2caacf4053dcfb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8d8d55-5991-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639124217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124217, "uuid": "7f8ac934-e854-4524-92ce-88a2fbeedce8", "comment": "Malware payload", "value": "2ba349cd1e002cdfbac015221ddbf98e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124217, "uuid": "f9ce6237-8f19-47a2-a152-fa087184e48e", "comment": "Malware payload", "value": "8bed61e3511fd413526b1be76df8d0c74a5a13effa814dae1b0849981dc5bf5a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124217, "uuid": "ff330a88-1af0-4364-94a3-23e4d899694b", "comment": "Malware payload", "value": "93ae568929796de31413a0796e73b6dacefcc304", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124217, "uuid": "f2c165ae-0b64-43cd-b227-a9812972b883", "comment": "Malware payload", "value": "341341d9f22a9f3d72e4c716afe1bcefe57b78d19009b7dbb52808dcdb99efcf8552e3bd3c5cd0902c4124f602963203", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124217, "uuid": "16d6c09b-5df3-40e1-8005-ed0c9c5608ed", "value": "T19B658E36F1D2C537D1676E38DE4B5259A835BE601E28584E7BE81D0C9F397803E2D2CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124217, "uuid": "7c0241c4-8f37-44c2-8f52-76f5890f5543", "value": "24576:wtFe5GYZAROp4F7PxW5Adm3o285/ykWlooVAy1Q4DZ+coqssPpgA:wtYGYZLwaY2EyjONsRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124217, "uuid": "d768ff6e-8f3b-4bef-92dd-b04e0f3a5548", "value": 1414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124217, "uuid": "0cfce1ea-30bb-4fc1-8df4-3f4a0b4e7579", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124217, "uuid": "fe2c95e2-3a7d-4dc8-915c-5030e0a84f39", "value": "Factura_08122021_(977KB).PDF_office.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e8a8d3-59e4-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639159641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159641, "uuid": "d8144969-4c07-4b5d-b637-286cf1d81e99", "comment": "Malware payload (RedLineStealer)", "value": "170978633222c5022ad467964a060b14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159641, "uuid": "c880938a-d426-449d-abd2-a603b222b77f", "comment": "Malware payload (RedLineStealer)", "value": "8c2ba38b7412390258ed0c536fb88b80f92a47a4aa6889c47c2a480baa545a01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159641, "uuid": "f6146484-d638-47b8-84c9-75fa7d6b3a9f", "comment": "Malware payload (RedLineStealer)", "value": "6351187cb66f14637b5fd098eadcc6cc35c50cbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159641, "uuid": "50e37b2a-e500-4631-ba23-7819a8901ae0", "comment": "Malware payload (RedLineStealer)", "value": "aa9c0f07d3d4b01cae95d449e76e21728da0fca682ccd6511f62d2ea135a0126f5b6c4546c560afef49d3eb5146834bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159641, "uuid": "6905a2b5-af8a-494e-9f78-0d843c11b830", "value": "T13C24ADC176EAC5F1F1A23E3098619EE10E7BB822D630554BB37497AE1F723D0562E312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159641, "uuid": "57c4a3fa-673a-4eb9-9a23-018271bb0029", "value": "b2616be51073ac1efb3a25b718df0d5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159641, "uuid": "e129c05d-ef30-423f-9fa0-447bc4efd337", "value": "6144:+7ELTkdoFt960g/628XbMb7ITsqXiga0:+7EvkdoFtwb/6hQ7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639159641, "uuid": "1b7fe90a-81e4-4d48-a20b-e304e913c7cd", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639159641, "uuid": "869f571b-7b24-491d-b092-27c8f0383189", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159641, "uuid": "3748d979-11d7-4c43-868b-0038e00a51cb", "value": "170978633222c5022ad467964a060b14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ac4db8-5997-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639126732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126732, "uuid": "1fb46204-ded4-4d3e-8bf5-600494f12c1a", "comment": "Malware payload (Formbook)", "value": "d528a4440d93e577df6367c74e5098f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126732, "uuid": "4b7b574c-910b-4516-8592-096d1705cdad", "comment": "Malware payload (Formbook)", "value": "8c6a4adf039e56bbd76bffa6978405f66a8d9a186d7e263affd6afb06774a7f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126732, "uuid": "906fc34b-6309-4bdf-923a-7897c83488a5", "comment": "Malware payload (Formbook)", "value": "1ae8c00ff171834af16117632061628f2bea1bfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126732, "uuid": "aa777bab-e04e-4d1d-9b8c-3380fc344966", "comment": "Malware payload (Formbook)", "value": "e07a576025b8e8217fdca6f19b980a1cba5aedad7aade49b3fcfce3ca4bf63b5a6139810d33fcd1fc130f4db7d1a1b48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126732, "uuid": "7b325f80-d685-4731-934e-85ff6778e04f", "value": "T1F4441346A2D44ABFC1D2253413B3BBB7E3FEC69051C6AE4F1B80AFEE69575020919523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126732, "uuid": "9afe1faa-0438-43b1-997f-0764fa3b9602", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126732, "uuid": "89850686-0ce6-4ed3-b452-8f9886abec51", "value": "6144:rGicsvQ/TEEBGIRc2I2GT0fUL8kvDNw9B/onUVPzyM:AqgMaXhGT0pkKBLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639126732, "uuid": "e38a6cd9-650f-413e-b961-49f4373d8092", "value": 270817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639126732, "uuid": "81dba0eb-0f7b-47d3-8ff3-6ac1735ff5a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126732, "uuid": "4a2e4754-ab90-4f84-a429-ce6a3ca1b4bc", "value": "d528a4440d93e577df6367c74e5098f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1020b2-5994-11ec-96a4-42010a9c0029", "comment": "Malware payload (CobaltStrike)", "timestamp": 1639125318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125318, "uuid": "4c84f2dd-390d-4457-9c9b-e9ad86e84ee5", "comment": "Malware payload (CobaltStrike)", "value": "f306ee57ee63c8d362538c7a00ecb711", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125318, "uuid": "32422797-a624-47cc-87a9-46197d28b191", "comment": "Malware payload (CobaltStrike)", "value": "8da42a20312683b4c8c788935d0922c5384c411b71e225b6a177f334b7ec15de", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125318, "uuid": "760ca9da-cd15-4387-a3cd-d669304d0102", "comment": "Malware payload (CobaltStrike)", "value": "ee0155ba9ba60e5f08b1d6f33e98cf95b8a0480b", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125318, "uuid": "54a4a6da-aa20-41c6-8323-1e403515c592", "comment": "Malware payload (CobaltStrike)", "value": "0653009ebeeee3649c3e28e4f1190b10172b5cb787a7ff79ba0f81f7c7271119cf421e79e70137cbeb0d9d27413a366c", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125318, "uuid": "408f1838-87d2-4772-9459-2a81e47fa81f", "value": "T194A57BC4F182FB92DD7DC8431778AE5D80321AA60A13A7A4D70D7B762E643A31F5CE46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125318, "uuid": "d2059c43-e415-4407-8ec0-42813eaa134d", "value": "26c4413ba40269d3c40723f40c262f84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125318, "uuid": "62e52b18-d65a-4072-ae97-ba64a545042d", "value": "3072:6w8za/e6cljz2QeZWYNqQIYOUgKK9pku0p0QIa4CYdTmCHqveFz7fmXnK77WQgtW:T/ckQeKQUUgKKhiXwV9LN7ua77Wjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639125318, "uuid": "cebe32e5-7ec3-4e12-8fd7-e87f97c64ced", "value": 2190336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639125318, "uuid": "1a9f35a4-af96-4aed-bab1-4f0cd2df162a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125318, "uuid": "3d97ed93-077f-45e1-a3a7-4c79121dc709", "value": "f306ee57ee63c8d362538c7a00ecb711.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f7d990-5997-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639126737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126737, "uuid": "40ea9da7-bfa2-4cdf-a8a7-163b2add5d61", "comment": "Malware payload (Formbook)", "value": "b9b9dddadff10e3895c0157451ee5fb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126737, "uuid": "04f8d884-5a95-4b0c-b5d7-3fc4b4f333e1", "comment": "Malware payload (Formbook)", "value": "8e1582ef41bfd2b7b11f0300618807eb95cd40bb63927fc4d178e460d6e244ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126737, "uuid": "e87d1c70-9492-4114-ab67-159a03260139", "comment": "Malware payload (Formbook)", "value": "77183ff5d0a14d55135824ebb0348bd185b8ac80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126737, "uuid": "a9b03a00-c9d2-4b8b-9bcf-6ca9c64c36ca", "comment": "Malware payload (Formbook)", "value": "ee57fede7f121494458963e4feecaf8f0b9b76db21af9d368750522044c3a46cc93ca2ef3716a5a6dbcf72cf98234be0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126737, "uuid": "83fa975a-865b-41bb-9852-a90320703162", "value": "T10845121639A1E426D12517B2C2AB80A08FBCF4073D72D3BB3DD152BE66397D94A03787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126737, "uuid": "fe9f5c88-6f00-4e93-b427-6a42f863e148", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126737, "uuid": "d686054c-ff8a-4293-aca5-5ea7cf19c6bb", "value": "24576:bIKjy/SYCprGtuVcEWssE7JKzXeqmEkjDoh92sTDsPU303GCau9k2L:bjASjGPKVErmEeDo2svMU3GzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639126737, "uuid": "bc7d54de-c362-424c-8aa3-17033051e037", "value": 1270272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639126737, "uuid": "a64858e4-fdb7-4bd1-b0a2-473d7150f9d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126737, "uuid": "5e518831-447c-4a07-ba49-2bfbae2ca0bc", "value": "b9b9dddadff10e3895c0157451ee5fb3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c79cb4b-5979-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639113858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639113858, "uuid": "e74b5c53-d0f5-4f18-97f3-cd05b31768c1", "comment": "Malware payload (AgentTesla)", "value": "b242d13a72e797e341d6b629f46552ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639113858, "uuid": "726f4ae2-ca53-41a5-b7c3-01622f305aeb", "comment": "Malware payload (AgentTesla)", "value": "8e62bdcdf048c2abe0dfaabfc43952e1588883d6ea84c19f0f489d8f24d60d85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639113858, "uuid": "f83f73b1-f0c4-45db-bb67-5d7154749c6d", "comment": "Malware payload (AgentTesla)", "value": "faa8e9ebdf2484cff5a40a24e021a3197323d8a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639113858, "uuid": "a3b18cdc-4fc1-44b7-abc5-9223e0a6e20f", "comment": "Malware payload (AgentTesla)", "value": "aaa3a79205433117dbe5d5a6850608a00fd80abfcd062d900fde7dd17161e16008f0e731c948a8d05f40f588895f7b60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639113858, "uuid": "8439d808-5dde-4014-b574-8d8beeb88c96", "value": "T145B49C2C35C7D6DCF93ED7743AA4619403E0BCF9E603E1DEF898355B6973A506A22121", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639113858, "uuid": "022ad7bc-01aa-49fe-9183-908b20340cd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639113858, "uuid": "34bd63f0-e5f3-499f-9ce9-49338495960d", "value": "12288:FUOGsGfLmb1HbxQc1wvGJpC6aRK6IYJMM2pzaey+9+/:SOGsGfLm57xh1wApCRLOM2pz19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639113858, "uuid": "7582f9d3-85a3-46e8-8011-ba654a994f57", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639113858, "uuid": "7b52767a-e1d3-46cd-b2be-ec602d772879", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639113858, "uuid": "6a82ba3d-aaff-4cd4-8144-8e41150a2b9c", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37dfcdf-5a02-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639172845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639172845, "uuid": "b2106267-54d0-4d96-ae95-53b8800194c6", "comment": "Malware payload", "value": "58f4493f5f62fab28bae845c8c7be822", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639172845, "uuid": "2b4c043d-20fd-4888-b825-ad1969682678", "comment": "Malware payload", "value": "8f2fe9050989fa67b5075ca8f19c993eac27095da963de63ccbb42e3dc212008", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639172845, "uuid": "8cd2591e-ed6f-40c2-a5e1-4a0df73fd6c0", "comment": "Malware payload", "value": "9f2a236d5e9e5a9e161b31e45754d6e92c58d2f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639172845, "uuid": "32fbb3e7-3f31-493c-91f4-c24b28e2b7d5", "comment": "Malware payload", "value": "f6135ddc967942283d51384b738e8b0eb2335571fecd9cf75a4927cdf55c7bec46da993f47a60c7db3b7cc1a005d1f24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639172845, "uuid": "172caae3-e139-49c7-ae59-83e2602727a7", "value": "T160F633667EB757DBE5832C793E540AFC0789E7E42823C94FE316B22630516E342DC1A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639172845, "uuid": "38ac8721-e05f-4820-b175-0679bd9217bb", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639172845, "uuid": "a5cfb8da-da39-4d2e-8efc-dc760c686987", "value": "393216:JE3oqJRp0l7zFiteCMsoEilIx5WGjSO4dPz0A3:JuPJRSNzFAezso3dG26A3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639172845, "uuid": "02906b01-b536-4c8c-be7f-8859fd9e33fe", "value": 15811479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639172845, "uuid": "6931d214-d4ba-44f9-aaaa-b8457b1ebff2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639172845, "uuid": "1cf1c5ef-1881-427a-bda8-40583788e904", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3efe96-59dc-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639156375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639156375, "uuid": "c8adbdc2-78d7-4307-84d7-b7942c9a531a", "comment": "Malware payload", "value": "b49c323a4a96fa023e2956f8eb4d3f2b", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639156375, "uuid": "47676296-9e81-4c34-bce2-4b63d1e25fd3", "comment": "Malware payload", "value": "8f5858cc6e149d97c9f3f3b3ca7c642aa2b29b2b4eb8adb40ccc3acaeb5a4cc5", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639156375, "uuid": "0291c3f8-883c-4f1b-9d25-b635306c6b81", "comment": "Malware payload", "value": "7b30c95ea3d9590f8f157a28d14f432912cdc2b5", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639156375, "uuid": "7709b99c-8e67-44bf-b776-1b8a32c4fe0c", "comment": "Malware payload", "value": "1e2dbdafe8b1e1b0c53b3c93eb0737ce18eb24e10ea34d85cef52f818eecf5f9ab2ec2f2906acd228da38eccbcd51bba", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639156375, "uuid": "552c49e9-b777-4dbb-a0c7-2a706573a0e9", "value": "T153751228C2A43DCED68A85B1EA0F290D57ED30A184C9C3CE5B50E6E715D1F5ED123A9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639156375, "uuid": "82078160-61d8-40c0-879b-ed151b507510", "value": "24576:RYZHOLatWYZHOkIYZHOFMjYZHO+NYZHOsfYZHOEpXQZZauNLwbPGfWvGXV7nOy7t:Ou4uQuuQupu5unVGbPcWvw178eszs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639156375, "uuid": "7550f809-6139-4be8-b5c2-ba0fc74913fe", "value": 1689452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639156375, "uuid": "94045b43-4e8c-4e1c-8d03-61b69a7da326", "value": "application/pdf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639156375, "uuid": "70469386-c7cf-448d-a656-4b4a25690103", "value": "OOO SEVERTEK SCO AVAILABLE PRODUCTS.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19575de8-5994-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639125315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125315, "uuid": "85badb24-8668-4a51-9a14-30f60dc94f27", "comment": "Malware payload (ArkeiStealer)", "value": "ccb57ffac6c17d64deaf890838e552e9", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125315, "uuid": "52d1ffa3-eb91-490b-9cbd-32a38559d2fa", "comment": "Malware payload (ArkeiStealer)", "value": "8f9a7de19aeba5c09a79ee2eea21ed654109e234e242a6ab05911c15be73c394", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125315, "uuid": "2f3ad8a7-7f95-40c1-8ce3-6e34627d85d3", "comment": "Malware payload (ArkeiStealer)", "value": "55ddcaef6e504b2895628da290db48485db20fc1", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125315, "uuid": "66dda6b5-dae7-431f-869a-9bd7698f3241", "comment": "Malware payload (ArkeiStealer)", "value": "b6d1cd6e9beb4765d1e11ad057d4a65d92273aec1ca4b3b192739fcbff12adb550f0e904e21a089481c4da488440a57f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125315, "uuid": "708364cb-c610-4312-aa20-54edd68518bc", "value": "T1F0E4023276AE8532D1B30E31442897AD5E3B7C425E60808AE354A79E2F72FDC5AF531D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125315, "uuid": "e717254d-712b-4360-9e39-77f0d4e10730", "value": "d541639438edf94a0fdd982ab363141c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125315, "uuid": "b38dfe79-0901-43cc-8641-dacda37c7498", "value": "12288:KH3wy6cpG1kzvjOq/fkqRHGzKt1OIN1mLRHxOXTFtZRBhMuTunn5:Zlcw1kzvjOq/fkOLB2HMptZHs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639125315, "uuid": "e65dbb0b-bf15-4670-9a42-df25e64d693b", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639125315, "uuid": "645824bc-1415-4319-9351-87bd79d3471a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125315, "uuid": "bd605238-1dd6-423a-9106-4bb68d2a5adc", "value": "ccb57ffac6c17d64deaf890838e552e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14a3ecb-59ad-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639136361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639136361, "uuid": "13c30799-e7be-4ecf-9b8c-c8b0661aee67", "comment": "Malware payload (Heodo)", "value": "56d65eb56367a3fb8c19d63a3f281ad9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639136361, "uuid": "daf97977-5447-4784-b9df-d342b5a6b4f2", "comment": "Malware payload (Heodo)", "value": "8fc59bc6b20df2b346595e72381e680b1881b639e16c42e5fd6cd3a0c117d4af", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639136361, "uuid": "8762ceee-2ad9-4142-8d4c-e1ca29dd15f0", "comment": "Malware payload (Heodo)", "value": "8c5715342c1428a302f6e329f00748f00c839d27", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639136361, "uuid": "a939bd43-0267-4151-b6bf-ba596845deb3", "comment": "Malware payload (Heodo)", "value": "9c19e6a55c6625443abd2d378ff5fbff9ff583568a409b46768347f9fe255e1cf9b7d02fc81d9856d3e0778a75986a31", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639136361, "uuid": "2b934c12-19b7-4ac9-aa88-5e7a16c89f05", "value": "T1B544BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639136361, "uuid": "a733bad5-7a15-4068-a950-3087896fd95d", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639136361, "uuid": "f8c598ec-df43-4c87-a33d-67135ded4203", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBm2ypv:6jIG/pjjuLbJLmGshoCUnWTKpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639136361, "uuid": "5244e11f-a8ae-4f3f-ac24-89217106b204", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639136361, "uuid": "8d7b7335-d3fc-4bb0-befc-d50736595410", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639136361, "uuid": "2098de29-7049-437f-b724-2a761992ef82", "value": "08n1QEvF2vylvIh4ZnTGk.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c96bb6-59dc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639156265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639156265, "uuid": "c6d03532-7f34-44c5-a1d6-116436a907a5", "comment": "Malware payload (Heodo)", "value": "5ced99f037ee8ee3bf9899a5d2292639", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639156265, "uuid": "54e51c92-4439-4265-847a-e5bc9741d939", "comment": "Malware payload (Heodo)", "value": "8feea7be9644e6725104daf7c9f1ba5bf42e6ba7653f71a79357677921f3bd2d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639156265, "uuid": "f433af62-3888-4098-8197-bc1e2b95c724", "comment": "Malware payload (Heodo)", "value": "673e67d85624c725d08fe7a7aa44dca338ed8582", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639156265, "uuid": "9f0740b3-b924-489b-bda6-5dccd52d1bcd", "comment": "Malware payload (Heodo)", "value": "04773a125ff43859cbccbf153eea626b147d96ba9fe5319dbe1ac5e5d6efcf729d1146a180fa1e07b1ba7d551f060ddd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639156265, "uuid": "e226edeb-2b27-43c6-8780-1d3747dbad07", "value": "T182F49E40F680E032F4BF00B6C6F786AA567C772057A2CADF16C81AE95B255D07D32B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639156265, "uuid": "de0cd61d-47ca-4587-928c-d5f0354e39c3", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639156265, "uuid": "d49553a7-4442-47a8-9d2e-1589abe9c4aa", "value": "12288:JKUuppiKVFyYUwGshoCUnWTtpvF9UfNWuoDtS+7g4jQj9J/tWTR/+:JapiKfZhlUWTtpF99Md9J/0Tw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639156265, "uuid": "eae5cac1-c031-4bab-891c-e89d01b2878e", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639156265, "uuid": "3aa4f3ef-7c57-4ce8-a33e-a49d5893bee6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639156265, "uuid": "64e44de3-dd1d-440d-9585-c63d134814d7", "value": "emotet_exe_e5_f5b4f2684428f1f7a6803d961416bfe86014e865ffe61ea61f32060a50176e88_2021-12-10__171059.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4556c63c-599b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639128395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128395, "uuid": "c6b9630c-67b8-4b69-afd3-0c153a0bbd35", "comment": "Malware payload (Loki)", "value": "5b2f589ff97aceb0058335ea95d84e93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128395, "uuid": "7484cfff-8f87-40ad-8550-fa6162e92d07", "comment": "Malware payload (Loki)", "value": "90edcea96c2e51a783328247bfc85dcbef2819da21918d20904d6464fd5a316c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128395, "uuid": "7f62a22d-411e-488f-8d2c-68fbc9f8653c", "comment": "Malware payload (Loki)", "value": "c35840e5d45eeda0b9cfab345a1a9d6f75b08e4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128395, "uuid": "57e18aee-3c56-4648-aa06-d5118fad9ddd", "comment": "Malware payload (Loki)", "value": "02751c698f77a63c0534074881777cf7fb209722ecae9e5b192b22a3d1a79b99bbbe6cbab30b223e4a2b535b42b246ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128395, "uuid": "1fae8e98-2377-4459-ae18-1b1716a8a2cf", "value": "T12444122F78C0DCABDAD05A746A35C7E6FAFE9B80434042131B802E772D56B86D81D6D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128395, "uuid": "a76ec27b-f4ca-4308-bd45-6e046eac6348", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128395, "uuid": "67fc1cfb-b6e9-4630-a41a-b061eb9d3b2f", "value": "6144:rGiEpEhHhFZJjSPDXE/C6FTNGKBe/YM7pGsPp7EObjfi:opSnBSrU/C69cPYO3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639128395, "uuid": "1e50cf00-7313-484b-b99d-2b3dfcc0f12e", "value": 273067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639128395, "uuid": "aa2143b1-a374-4eb1-b92a-7f941caf0c1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128395, "uuid": "a86d9415-e733-47eb-ba9a-3cff9bae3cf5", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81475a0b-59cc-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1639149541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639149541, "uuid": "37284888-853e-497e-a6cb-6de7119925d7", "comment": "Malware payload (IcedID)", "value": "66c83dab8a955502e979e0ba02c98cf9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639149541, "uuid": "06c23875-9a69-4d27-962a-4bb344dd87fe", "comment": "Malware payload (IcedID)", "value": "9385db8c3d2cfa98e87d97dbce2df036d3ac2c4d797930f6d400db5b1d4028ec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639149541, "uuid": "99924457-e274-4af7-9aab-8e65cc84b7a6", "comment": "Malware payload (IcedID)", "value": "efb731305004457cf3f2698a260d96c784a22adb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639149541, "uuid": "631c0539-c07d-4daf-bea0-8d93439533ad", "comment": "Malware payload (IcedID)", "value": "7fcb1c3e62b39fa4a99c27a90e6aa086e9dbe04554965fd04f380325f53951fce645155b0389487059a1ecfb33637a84", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639149541, "uuid": "13690f49-a59e-4fe0-a0cb-9e43b03355d9", "value": "T172444B498446DAA7FE924C78EFC4B2D1D0937B394E78D2F7B8B4C02029249E54E67763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639149541, "uuid": "53e3f852-3f6e-43bf-a5f6-d5b0888e2fad", "value": "3b4014f1ffd5245ea948c717c78d1d57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639149541, "uuid": "c6f31899-3913-489a-a16d-93ebb5a7d381", "value": "3072:JhdCRXxa6zi6i8oe7ObPkIjYb3p548xBfBbrHDKpbjaxDu9qAPrJfqPS4zpUw4Sc:DdCr4VtqdqXkdWgjoZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639149541, "uuid": "19a44908-8f23-49ea-a306-ea9ad68f801d", "value": 257672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639149541, "uuid": "31d4b8a4-c8ec-4c6c-92a2-84cdda6f6796", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639149541, "uuid": "43178798-bc57-42be-91d9-11e1e384258c", "value": "66c83dab8a955502e979e0ba02c98cf9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5e2fa1-594c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639094638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094638, "uuid": "79673be2-3acc-4fce-98ce-96c3c2ef2e56", "comment": "Malware payload (Heodo)", "value": "55d3f8d9e49f5674e3126459c7e21b28", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094638, "uuid": "d947d85e-0411-47e8-9eeb-997d4b49f55c", "comment": "Malware payload (Heodo)", "value": "94ace027f2027129d3a50e3044f914b7e04c3dcbe2e4536a970843e36058899d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094638, "uuid": "4bca7c78-3f40-48b8-8cf8-f8ee42fd3926", "comment": "Malware payload (Heodo)", "value": "40d1c730b1604d7b892228e58efd15d7e3c908c2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094638, "uuid": "41969608-1cd6-444b-a0a7-57f09cb02129", "comment": "Malware payload (Heodo)", "value": "a337a68695ea407aaddd7d4861bd473641a372edd374d92ef520a3f1dfaade0fd8c22d7bf9c3c122a1c0c536d3fdc9d6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094638, "uuid": "ff0835f8-245f-4c64-b1a9-8a4ea9b70643", "value": "T12144BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094638, "uuid": "bc218d10-8594-4c89-94c9-2e4149b9355c", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094638, "uuid": "68eaf81a-96ef-4fe2-875d-cbb3613742a3", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBP2ypv:6jIG/pjjuLbJLmGshoCUnWTFpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639094638, "uuid": "d7790227-be77-4993-92ff-403e2cd94b32", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639094638, "uuid": "4e6d0414-be69-45aa-b387-8752148dcbd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094638, "uuid": "a025c670-a0ba-4b99-b7d5-f997be3f1d58", "value": "emotet_exe_e5_94ace027f2027129d3a50e3044f914b7e04c3dcbe2e4536a970843e36058899d_2021-12-10__000352.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace81dab-594c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639094639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094639, "uuid": "fdf6dfb0-0dce-4bee-89e1-0790d8424b75", "comment": "Malware payload (Heodo)", "value": "14da23d8f25c9082f7c9643f47f20ad8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094639, "uuid": "c374bf5b-3e22-42c7-b83b-ac9f51187dfd", "comment": "Malware payload (Heodo)", "value": "9677bcb4932280d87f162e3e71e8a1f1db6c3d8891da685df90e87c59aa0aab1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094639, "uuid": "247e8f7b-36c1-4944-8a6f-cf73457852c0", "comment": "Malware payload (Heodo)", "value": "a87551ee0bdf33655a0bd8be323ad07df4c736d7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094639, "uuid": "cd3f11e4-1299-46fb-bf5e-563c32663c1a", "comment": "Malware payload (Heodo)", "value": "ac53c2a4cf8d551b3adfc3ccacb236602629a129051e495cf9b5a1e87e78ca17cfc8d0192c0d25978d4e9f094b1479b1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094639, "uuid": "661d9733-07a6-41b5-845f-887b71fbb360", "value": "T18444BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094639, "uuid": "e5e7c96d-abc5-4619-9ab5-e3c7629cf634", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094639, "uuid": "de873cc0-3d3b-41b8-b757-de66bfa011e9", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBT2ypv:6jIG/pjjuLbJLmGshoCUnWTtpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639094639, "uuid": "e37e140c-3031-4cad-ba34-80b0eb0d115e", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639094639, "uuid": "d605e44b-497e-4ded-afd3-53208ce3d468", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094639, "uuid": "8ed86f5a-ef70-431a-94ba-2b5ac4f02adf", "value": "emotet_exe_e5_9677bcb4932280d87f162e3e71e8a1f1db6c3d8891da685df90e87c59aa0aab1_2021-12-10__000353.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e7f67d-59b4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639139266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139266, "uuid": "d35bc074-e8e3-41f5-a2fb-f018b79f84fd", "comment": "Malware payload (Formbook)", "value": "552e5d5f88448d7a9fcae61160ba7e1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139266, "uuid": "13b6263a-22ee-45b1-a537-b58af9430142", "comment": "Malware payload (Formbook)", "value": "969f23feda2971e5174b6e99caf296d4e21f69c7ccef0747c1efc61ed9c3a414", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139266, "uuid": "6c873dab-8c4f-455f-9d3d-fee56ab29c34", "comment": "Malware payload (Formbook)", "value": "4bbc07a8464f5f9c0b25f679966f48c6b9a8b8cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139266, "uuid": "2eeede87-bf55-45c2-9cba-36ac2aba2ec2", "comment": "Malware payload (Formbook)", "value": "03c0c23cfdba1da20e10c9a85658b2776c986a280d13548b25f2c60924b1b3873c76e44a07eaef78a904fb29f3ec41ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139266, "uuid": "7a9eab51-ecb4-489e-b31d-20dd02120b2d", "value": "T15725236437F94BA4C9BE5FFD443691640376B11B28B2E70C0DC620EE06BA7508F96B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139266, "uuid": "7e3d166d-67fe-4176-8384-9402aff5749a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139266, "uuid": "d50989f1-f586-4a28-87f0-1823b99b1136", "value": "24576:/7zxWTRu/Erd3o/KefBHuKdKqLHMst/qbpWZPawU8fCGtQHF68:/nxwZgxJhMsty1WgwU8ftk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139266, "uuid": "e3e90cce-f7dc-4bae-b195-955cd963e42b", "value": 1016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139266, "uuid": "1ffb42d1-905f-4322-b0b5-c548b7b93102", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139266, "uuid": "71379da0-4a5c-442d-be42-272889f5090a", "value": "ORD0210467.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f91e4d-5997-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639126861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126861, "uuid": "1ef40365-b4fa-4281-9c81-11fa64dcf4b8", "comment": "Malware payload (Formbook)", "value": "fd6ffe18a385a479531d20ff67d56330", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126861, "uuid": "07f13099-9eb0-4fbe-8938-c1ce79741bc7", "comment": "Malware payload (Formbook)", "value": "97e48eb6d569e2c55c73a5dbc918a6b8f7f2c65f39bdd6567d323a57e8771543", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126861, "uuid": "a098c70e-83f4-42a1-9436-0d3a9fcc5755", "comment": "Malware payload (Formbook)", "value": "c26d1e773cac593827461d7931dfd48b57055800", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126861, "uuid": "874a9cde-96b1-4cd2-96a2-4194975a5433", "comment": "Malware payload (Formbook)", "value": "d383446e9377b5f526d218c9753d9adcb5f4e9f3093f424dddf06baba6af9e87d675ba34d99e60c2d6354a03e348eea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126861, "uuid": "72b87fe0-0fa9-424f-a52a-ebaf5638818b", "value": "T1B144220FB6DB46F7ED925B3134F76BB8E3F98AC80420AA5703321E592E7194B458C197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126861, "uuid": "e5b57914-c3e4-49dc-8a03-2323396b4917", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126861, "uuid": "3d016578-e8e0-42b8-8f55-66c44e45e32e", "value": "6144:rGirg5a1vU7YZ4wxyCMibYM/ZVVNX5/pZC92SKi1XjjV:o5a1sEZ4uzlbBBVVNX5SkLq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639126861, "uuid": "a261186d-4fcf-4308-a008-fe92df94d419", "value": 264950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639126861, "uuid": "eef076b2-fdd7-4b85-83ba-fb3205d3d0d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126861, "uuid": "0800421b-e67b-412f-88c8-deeeac8d9e33", "value": "fd6ffe18a385a479531d20ff67d56330.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a6e544-59b5-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639139747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139747, "uuid": "0a2f3690-abd5-40f2-aced-d77dcc52bbef", "comment": "Malware payload", "value": "912bd4051cfd23d71cea400b3250cdb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139747, "uuid": "26191721-d786-48b8-bcd8-b33b0155ec22", "comment": "Malware payload", "value": "983a83ac88309cc8bb1f79580a93ef851ec7e15e71de7b8f4ec70fe2226a6d04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139747, "uuid": "fdd55e58-b0d3-4222-9355-6028aa4d77d9", "comment": "Malware payload", "value": "459dd72e245091dd895ddd5eece41f31a88d439d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139747, "uuid": "31a89d9a-3157-491a-a716-f35b32bf505e", "comment": "Malware payload", "value": "2d9ca18cbec0d958d3da62b89104f98598b93730cd8fb2b4fc4298e72e5055af53eee430ec245750c36a8091996fae72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139747, "uuid": "2c76fad4-04ee-49c7-9ce8-6822a7d55efc", "value": "T132558D43739DC2ADFE5656B3FA3462F246786F27C122401F32D8BD6C79710A9122D6E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139747, "uuid": "655e10d9-0377-4bc2-9b47-6ffed5adb6f0", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139747, "uuid": "d5f21679-ce55-4bea-b4f2-9c51828b676a", "value": "24576:yAHnh+eWsN3skA4RV1Hom2KXMmHafi+GmBlf4EcfBOQToBdX5:1h+ZkldoPK8Yaf38oF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139747, "uuid": "9857cc4d-5377-4a41-a84f-080743e87686", "value": 1406976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139747, "uuid": "e5019e30-3c37-4537-94e2-342db1f93f52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139747, "uuid": "363784e5-3533-403b-93ed-0f492e40b47d", "value": "SecuriteInfo.com.Trojan.Nanocore.24.30280.850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2052c3e-5963-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639104607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104607, "uuid": "c41842f4-fe01-42f5-8c2b-92af4d7d0807", "comment": "Malware payload", "value": "65f9c62d3208746c461c1bae955c55fa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104607, "uuid": "212509ad-2792-40d6-a8a7-267cd1f98ddc", "comment": "Malware payload", "value": "990ee8069d5ae1b15f77055a33ff20cd53f0003923efd1693c9bc05ae9c10e97", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104607, "uuid": "b4c99100-e64c-43a9-99c8-5d35a96e5ce7", "comment": "Malware payload", "value": "9842a871828928b538b84b498497df92ec4ef2ac", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104607, "uuid": "aefc356e-b76a-435c-8636-084131345e48", "comment": "Malware payload", "value": "9d53599faff104a89454526c288ca765d4e3d5989af1fc7c2c15520469c9a3032a4d953cc001bb55069e8f6d02c174ae", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639104607, "uuid": "c4ca5b22-c7d9-4ab0-9456-eb2040aafd8a", "value": "T101E2E082D60718B7C0626DBABE690005BA57DBB4DD3E7132AB08790C50A7487DBE8693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639104607, "uuid": "bae979b1-6050-476b-b45b-99c51b8c0b65", "value": "768:VlCEJNiDTPCPLnN93jZN/iHXCj9IUf4sNkYk3Uk:VlC+OGLnj1NKyj9IUgsKYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639104607, "uuid": "4f3a717b-2f6b-4879-8d19-d3f00df836f3", "value": 31752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639104607, "uuid": "7a8e5fd5-ecba-42b1-b14d-f3030b9921fe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639104607, "uuid": "0ad53a61-fcc8-4122-a44d-3f12daa5bc75", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb065476-59b5-11ec-96a4-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1639139760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139760, "uuid": "66f7f69f-748f-4378-9787-6090738432ef", "comment": "Malware payload (AZORult)", "value": "ccf952f4b80f8e3271da815418cd2b86", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139760, "uuid": "0ea654d1-dfd3-4cde-8b7f-0a1729c8dec4", "comment": "Malware payload (AZORult)", "value": "9979ee1cbfd99dbb9e054b9c9736ac0e7e9f674fcb6c8d462e3a9caaa80f610e", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139760, "uuid": "7ce626d8-099e-4d53-b50f-e0c5ab914b19", "comment": "Malware payload (AZORult)", "value": "a445967eb7fd8a7f68d864678390b741ebfcfde6", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139760, "uuid": "b5dd2e95-cf5e-4be3-86e6-3a927c92c7d6", "comment": "Malware payload (AZORult)", "value": "4f20ee6b13eae391c8d5101363250265a580b232147891b7b8bddaf481fa90a2c913bceceaee1f45bbaabd1f40ca39a2", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139760, "uuid": "8fe6546f-bc7c-4813-b370-b690232acb95", "value": "T18EB66D53B3C8603AD4660A3A8C379684A93FBA3139268C1B77FC1D4C5F35B456D2A35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139760, "uuid": "a3af9ab8-6327-4d39-92e1-124b0779389e", "value": "6eb791060dafbd3298e22885804925bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139760, "uuid": "7ad7d7c8-8e5a-41a9-8f42-a907d33e450a", "value": "98304:pQKamnojop9XYlWWwGIlfBHpue6o05hwyjSqAlPNPaHJ4TMDnyyxK:pQKvoEQTiyjBmiHJ4TU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139760, "uuid": "3c65f39e-bf0b-45c1-a28b-1b783bbd55ab", "value": 11427328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139760, "uuid": "e8a1e3cc-7f78-401e-99e7-7c3b289e9dd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139760, "uuid": "5ac8f1a9-0ae4-47f2-a63d-2bca7ae3a507", "value": "SecuriteInfo.com.Trojan.PWS.Spy.21525.2016.6564", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1fe6ccb-59ac-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639135879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639135879, "uuid": "8f4964ba-68bd-4b4f-9230-712282cc9d90", "comment": "Malware payload (Formbook)", "value": "ac67dfe31ef3679ed853f7d3883b537c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639135879, "uuid": "7b6aca86-e376-40e6-9c26-8905ca12325c", "comment": "Malware payload (Formbook)", "value": "997f4d95e988680224b82f4b22a8f71a1ef8d82f254d41dd67a1233b5074df96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639135879, "uuid": "fce9ea99-c813-4cdc-890e-3ffcbe25ecb5", "comment": "Malware payload (Formbook)", "value": "8ff7336fda6d8ede2975866ae73f4a3e57b73efa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639135879, "uuid": "6a1b3e81-0c6b-4607-91c6-c10e472a295b", "comment": "Malware payload (Formbook)", "value": "61cf39908b8b20838b3cfc724713d2be30568d9d8906eac9e8dc9038b46cd257b8e729f64a19a2731e1adbe3675adcb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639135879, "uuid": "6717d415-edf2-4f5a-b553-466e0ff755d2", "value": "T15B94E0D1A18149A6ED264B706837DC281367BDADBDB4950D1A9F797FEBF32D20023807", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639135879, "uuid": "e447bb3d-1fbc-455d-b3c3-bc2ea6703cce", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639135879, "uuid": "2c26aa18-3f20-4ad9-9066-60c510b10842", "value": "12288:MLLYAVLLLLEoLLULLLV4LLILVLLLLLLvLELWzKdvvsAJJLL5f4X74S7LZEfBihW1:MLLYAVLLLLEoLLULLLV4LLILVLLLLLLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639135879, "uuid": "f22d2b75-4498-40eb-a1cb-fb6fa9629a9c", "value": 432566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639135879, "uuid": "204e5def-1be9-409c-84d9-dfc46b111cbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639135879, "uuid": "1fd0f25f-4d2a-4db3-9593-32372b460f90", "value": "MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad199e9-598d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639122419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122419, "uuid": "5c2d55bd-c0ca-4014-8f5a-663930d3a10c", "comment": "Malware payload (Heodo)", "value": "9ac7812e27bb05a92980881f1c3a538c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122419, "uuid": "6eeef708-f24c-4126-8237-ac052ef7527f", "comment": "Malware payload (Heodo)", "value": "9a0286ec0a3e7ea346759c9497c8b5c7c212fa2c780a1cabb094134bf492a51b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122419, "uuid": "ae56a02a-c148-44ee-be4b-7173679579dc", "comment": "Malware payload (Heodo)", "value": "4ad35a6129a5b2067d169ed752369a686bc615b2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122419, "uuid": "b814d865-9f8d-49c5-926b-dd5889be5c88", "comment": "Malware payload (Heodo)", "value": "483ca2164c228d0efd76a9afed9ee14d29548b0dc2566c2501777cd64681393b4bc303d632a9c75b030d9a4d6a956854", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122419, "uuid": "b420bed8-0520-4ab7-96f0-20cc49545760", "value": "T1CA44BF10A181D036E5FF087A89FAD9BE466C76600B80DDDFA398187E4F6B6C1763059F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122419, "uuid": "0830e6c6-0396-448c-907b-14c1f6fddcea", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122419, "uuid": "b285c913-81d5-46fa-bba1-839cf4f7f4ae", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTBPmgL/S:Wvef8+h61mRcHL+rF6l5EAQWTfL/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639122419, "uuid": "9ea71ff9-34d1-4e6f-b3c8-cb54277d3837", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639122419, "uuid": "e7eaaa92-a29a-4bd6-b06a-b1b89cb6a291", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122419, "uuid": "637446c5-bdd9-4850-a823-de312c6434bd", "value": "bestb.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7148d2f9-59e9-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1639161970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639161970, "uuid": "70e354a5-3a6f-4ff8-9012-ad4ab7d2442e", "comment": "Malware payload (AsyncRAT)", "value": "f651c1af868d68c5c4add61917e5edf5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639161970, "uuid": "1d75c678-266c-499f-8bb7-cbd06a927050", "comment": "Malware payload (AsyncRAT)", "value": "9aa0f4d7e5514045f9a558fcbc3101fcc3422c29ad58de2f2c3af9a97b3c8780", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639161970, "uuid": "d32ce1d9-26b2-4fb1-be20-a0cc783e9cd7", "comment": "Malware payload (AsyncRAT)", "value": "2cd372b4b011e85447d4efbe9513a5d3b57ae7ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639161970, "uuid": "e21e40e9-8691-4329-87aa-358ad4a93825", "comment": "Malware payload (AsyncRAT)", "value": "ef925e64ba39e7172350c375aeea28bef41a37a21bb57997e21f03fa2b18cfef15462779ea17e66ef601359968ceabfd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639161970, "uuid": "d0b29c0c-c034-40c4-8177-309fc89c155e", "value": "T1EF947D0DBB07B209F89DABBA7E372F501B20B6B5BD15CD32334B257E84463B66D40592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639161970, "uuid": "0d5cfb02-4931-44e8-b7bf-e73e1cc89196", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639161970, "uuid": "bef42fea-b882-4805-9354-ea5cee28505d", "value": "6144:6TbudN12WzL1Su6qjbhSkJBdaLVEEnNUI1yA4QmhPVaZxlZktGYsnDlcZF:lfLDllzzUZDihPIYDsDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639161970, "uuid": "a7bdfa4c-b87d-4092-89f9-8d8d2d993c7a", "value": 448512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639161970, "uuid": "eba5c2c1-d3a4-413c-a12e-457a53b9443e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639161970, "uuid": "122c3142-27c9-4dba-ae0c-9801222bf9a4", "value": "f651c1af868d68c5c4add61917e5edf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622b1a3f-59cc-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639149489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639149489, "uuid": "2cb26d39-abb1-4214-9304-5060447c28c1", "comment": "Malware payload (SnakeKeylogger)", "value": "11b79df7765b4e44b496cdb97c43fb57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639149489, "uuid": "9dd6606d-74aa-40e7-84bd-280e6197eaf6", "comment": "Malware payload (SnakeKeylogger)", "value": "9d66a0a80db6c5ed87e65ac2c711bf018155398416dd58b0fe752aca1fde0385", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639149489, "uuid": "008e4876-f41a-44f7-93f4-e128a3ce7473", "comment": "Malware payload (SnakeKeylogger)", "value": "a5e5b29c44a5056d5a0faa7d5dbab983bcfa76fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639149489, "uuid": "f8dbd880-15a5-4f43-9eb1-f0505cd9e09a", "comment": "Malware payload (SnakeKeylogger)", "value": "8670b6f2c9a750b888832f1cef2a469a65c8d611c9dd60f3b300a2bda1c54c8a7b5ac8a854082abcc1893655ee80be30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639149489, "uuid": "2288e5c3-787e-411d-8235-341802facbbc", "value": "T1AEB4D0B6E11E649EFD4E38BC41374ACDBEF4A8224965452B65293D37847C283DD0EC2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639149489, "uuid": "09c7d124-b5a8-4c83-945f-d16f008c4282", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639149489, "uuid": "8c5b098c-8969-440d-9486-718f3cc11c24", "value": "6144:8GiCxlqWn1mQMuYl00jxm7WJlWkoTMMH7K5HdwDJb1JnD1y0m9NIL0AW5JhkgGfk:TnMPVtnoTFKpdwV80ssghkDpjMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639149489, "uuid": "5b6f49ba-c62c-472f-b4f7-d39f2747e9d8", "value": 533837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639149489, "uuid": "492d936b-f721-4d27-8c49-01f7e6e2c625", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639149489, "uuid": "282b77c9-d377-43b2-87f9-7efa22f31bc6", "value": "20987654323456789987654567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e09a595-599b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639128437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128437, "uuid": "9a32fc45-e959-4b8e-a45a-d8028936e1a8", "comment": "Malware payload (Formbook)", "value": "acb55a8c25693bd165e2c0bfdfefeb78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128437, "uuid": "9e85cd76-4ca6-45eb-999f-b07d96b47605", "comment": "Malware payload (Formbook)", "value": "9de88671ba35f867dcb611c8ac29b94ad4354f2a5107f5dc3730da56775f6c1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128437, "uuid": "82504bce-2dd9-4155-bb2a-7798f65caa17", "comment": "Malware payload (Formbook)", "value": "b737bda2732e92f8beb4a58267e9c73f9e952ce4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128437, "uuid": "0ab194f7-3255-4e41-93cc-5dbdbcc8f00e", "comment": "Malware payload (Formbook)", "value": "d2c80648f5f195ed7eea31bfdcda4949b05cc9e0c135ea0d9f51aab2c33b849d37e599502d5abd50bdf29fe8db787ae9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128437, "uuid": "2fb62770-a5f9-4997-8cb7-464e8e6940bf", "value": "T14A54124698810477D9952B321A73AF3D6AB7AD9B39B4FB4B1EA97E322F734C31001485", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128437, "uuid": "36babcdf-5ce2-4d2c-9eb7-0245df77a5ed", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128437, "uuid": "37e36dcf-4dde-403e-94f0-dd72ce3839af", "value": "6144:jGiYusSuCXesCQmSQQKiJJWSkzjxwN2Lf4jFxqbe73vtjBMjPhRtaaE:0us6esCQmSQQKSdEj8xFxqYvJ2lRgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639128437, "uuid": "a76a3959-baa4-41f1-9da6-6bb94836b457", "value": 293773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639128437, "uuid": "54c31263-291b-4b02-a14a-cb651edfe74b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128437, "uuid": "c7b98f8d-cd68-4087-b63f-4205ee5a6b64", "value": "INCENTIVE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33aa6f0-5970-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639110111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639110111, "uuid": "e199c407-2b1b-4444-9124-d275c34b1455", "comment": "Malware payload", "value": "b7ca6e90ab545678a0be77f2b3928ce5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639110111, "uuid": "65f8976a-65ca-42cb-893b-cfc771270327", "comment": "Malware payload", "value": "9de9c23304808d0728a883d4bd680c65f9bc21c956a82ef777b496af46444775", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639110111, "uuid": "6d722d30-8050-47a6-947f-45a87b25120c", "comment": "Malware payload", "value": "e068b8eaa0b673809901d529f98ee2332a97de3c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639110111, "uuid": "c4504621-5e0c-4b10-aaaa-54bfb6589f0c", "comment": "Malware payload", "value": "b0dec296e205aa8933abc6896204bc68660680462a0d8862920801b9387a2a73fd350194dc4511bce7198dd10d31b166", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639110111, "uuid": "e0e82d60-6482-4a0e-bc61-17931b01cca7", "value": "T1B7349E5277C680B6DAB322B18A56632EB3F9C700473B69CB57D50C246B355C3A33DA1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639110111, "uuid": "7d83c176-5a40-4e5f-8ea6-b1eb7f905207", "value": "6144:WKEUPDI8HTI4IPualOM8Vka11WqQtXwpomuU3w:WKEUkuAOLka1miSmuYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639110111, "uuid": "bd3cf339-566c-4320-b785-5dfcf15afd0a", "value": 245226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639110111, "uuid": "db31ec0f-6ff5-4d91-8f1b-7e6503f54176", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639110111, "uuid": "afceb873-20c7-4a54-97b9-b029160f1d5b", "value": "emotet_exe_e4_9de9c23304808d0728a883d4bd680c65f9bc21c956a82ef777b496af46444775_2021-12-10__042146.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c23f7a-598e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1639122791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122791, "uuid": "0683e22e-3f32-4303-b4f5-ef997fb479d6", "comment": "Malware payload (Socelars)", "value": "ed206cfd5bd8846f5d08e135f4a7e418", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122791, "uuid": "598141a7-1e54-4b96-b6b1-9195773773c0", "comment": "Malware payload (Socelars)", "value": "9e82491c1d7447149643c79947431e3b7822b87e67da732867c2e16947b7ee35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122791, "uuid": "2368a1eb-7453-4167-a3de-eca996b41b7e", "comment": "Malware payload (Socelars)", "value": "f72daad3571ec4771bb9d300287e2702c657befa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122791, "uuid": "c014d8ac-dc63-44f5-92e8-7d2d2424f7a8", "comment": "Malware payload (Socelars)", "value": "e91a7363f83f179aa5a6de1c8cd5adc73e6e8c6d9cf89ab44f77b492c011f62872d31afccb79265059f4fed744bf355a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122791, "uuid": "25b79ae5-c5a3-44bc-8147-e726a74e1454", "value": "T169657D51F7426033E8D313BB89FE36FA8E386519030456DBD3845B69BA715E23A32D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122791, "uuid": "215b7208-4acc-4bab-96ca-3fa0fe7ff3e6", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122791, "uuid": "8cb8b056-d8ff-4c89-abd2-53c120a0b255", "value": "24576:caApxEmUociWVxvX2LfeEyS2ZrU2xbVGUpgrnRiZ+pd9plj:SpLfvjqltirnRiZ+p/plj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639122791, "uuid": "7dccc9e7-2a0c-4a39-8bdf-65bd326f0da1", "value": 1516032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639122791, "uuid": "c72ab9cc-687d-4db3-968c-aabc9a3727d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122791, "uuid": "0f489a3b-d9ca-48b0-a7d4-053136a3e4b0", "value": "ed206cfd5bd8846f5d08e135f4a7e418.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582184d9-59a2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639131433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639131433, "uuid": "052d97a1-d02b-4819-82cc-981f5407fdef", "comment": "Malware payload (Formbook)", "value": "02f70a35c51b230bd5e71a1eb4c6ab1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639131433, "uuid": "2d8e332c-94aa-478a-bfc3-cf9a508d7bf6", "comment": "Malware payload (Formbook)", "value": "9eb83b030fff6874a3a944d6f8c97f8e9930075891cfa0a62e01625c89396c1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639131433, "uuid": "8d8a69e5-0544-4100-a2db-3a28384ccb3f", "comment": "Malware payload (Formbook)", "value": "6d462c2499c0061761a60a269110b4397d50ad97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639131433, "uuid": "de6be8a3-eae9-4ae3-9e12-42226f9be30a", "comment": "Malware payload (Formbook)", "value": "95abd90478b9401d489462e4a69522faf759271bd688e364aed9c315f529d1cf163b17b392284f62750d3f94101a8497", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639131433, "uuid": "bd400fe4-4110-4a6c-aed1-9104909a3ada", "value": "T123B401597F65C92BD355B1381AF1FB2CEB70D1D86E39C653BF01BAEC2A147DA2824102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639131433, "uuid": "00d50afc-9b29-4b0e-9bd4-2913142a7261", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639131433, "uuid": "9c102171-48e8-46e3-9296-45c0e0080a51", "value": "6144:+Gi3lToehk0qMzzMbS7HCV7KyU+1fIOMw4RxrqIJdvoslze6IM1bfuBYW6KsuNc8:eXBzCS7+KyV1ROv1PBfZaNJ6INkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639131433, "uuid": "00c6e5fd-4bd1-497b-9004-817264894ada", "value": 523017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639131433, "uuid": "c0d83821-b0db-42eb-a6d3-2312b3ae25a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639131433, "uuid": "16b01f2f-f88b-43b9-9fc5-03c8e36a16f5", "value": "PENDING SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c23ed1f-594c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639094503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094503, "uuid": "391d2391-510f-49f5-9f3f-0d1ae3d3cdcb", "comment": "Malware payload (Heodo)", "value": "bd5b9820e10e876c0e83f2862dbd6de0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094503, "uuid": "807c2c10-d962-48f2-af89-ff1f890c0c6a", "comment": "Malware payload (Heodo)", "value": "9ef4f8053d6dcfba00a464725e8a0b5f76643f19bd6bcbfc69b0d37a4f37acb1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094503, "uuid": "73c30dea-fa65-4352-8964-8209ee4b9488", "comment": "Malware payload (Heodo)", "value": "585679cd5f1be570fe5e85d315c3653ed5c0621b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094503, "uuid": "533b20fd-359b-4f24-bd24-0cd53462837d", "comment": "Malware payload (Heodo)", "value": "d3b049e025ad49af39a4981162ebf228e1825390352a84a797540e2c30f493b72da3d081e9c05d8f827b245a9c9231f5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094503, "uuid": "f80a4626-7823-402d-ae79-4fca593e2779", "value": "T17344BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094503, "uuid": "eb8c4c8b-ca09-45aa-936d-772c2b0c15e7", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094503, "uuid": "70479f18-d34b-4039-a9c9-57d028aea0c3", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBr2ypv:6jIG/pjjuLbJLmGshoCUnWT1pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639094503, "uuid": "446158e0-07d2-4e0b-b65e-322e021de450", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639094503, "uuid": "19ce5cc2-ea9f-4ef9-9c45-d0536f72bf1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094503, "uuid": "cd5988ee-fd27-4f7a-af97-9c5b9ca7ecaf", "value": "emotet_exe_e4_9ef4f8053d6dcfba00a464725e8a0b5f76643f19bd6bcbfc69b0d37a4f37acb1_2021-12-10__000139.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be23ff3b-59b5-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639139765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139765, "uuid": "8f06dd05-a18e-454a-aa5e-edcc576e077a", "comment": "Malware payload (AgentTesla)", "value": "2790feb966e26a8c7c565bc5d0550971", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139765, "uuid": "76efe9a3-2921-4d18-8155-1879c0934162", "comment": "Malware payload (AgentTesla)", "value": "a080f4600176a1660cfe47740ffd0c0c8fd670db86a0f7f29a6247584118a7e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139765, "uuid": "3db0bfc8-0593-4ad0-99ab-38bb69dc0850", "comment": "Malware payload (AgentTesla)", "value": "e67ba55ad75cb21a058c807e4fe26e2b70aa89ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139765, "uuid": "7025a291-c495-42b8-a10d-b1e01cae2506", "comment": "Malware payload (AgentTesla)", "value": "4e065b9872bc5bc098fea7edd8206843b1906fcfd91be4843188b0609003a402ee1599e4f46c2278acc227ea62645098", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139765, "uuid": "746c288c-9fd0-483b-8b21-dfa62d6d2a66", "value": "T19445BE02B3D1D032FFAB92739B6AB20556BDB9258137852F13981DB9BD701B1273D263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139765, "uuid": "23d99bfd-2229-45a6-86dc-be651f7d721e", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139765, "uuid": "9589f8f1-2596-41cf-a389-91fd27c67536", "value": "24576:A/AHnh+eWsN3skA4RV1Hom2KXMmHanXxWIAr75oAQ+NT30YCQ6a5:Aih+ZkldoPK8YaM4b+NT30YjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139765, "uuid": "6d871f59-c014-4a29-b0cc-2d752a431268", "value": 1240576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139765, "uuid": "f1766010-8f6c-40c9-b7a4-e9de2b4509f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139765, "uuid": "949bce60-d947-4523-8a2b-db94ff800de6", "value": "SecuriteInfo.com.Trojan.PWS.Siggen2.30629.14165.21471", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381ec33b-59ce-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639150278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150278, "uuid": "32a826d6-81ac-4236-a905-716f173c9cd2", "comment": "Malware payload", "value": "15a8d04137ae883a15aa182e023f4210", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150278, "uuid": "e4bbdebd-a57e-4861-b10e-feaaf0b7b60d", "comment": "Malware payload", "value": "a1b166738dbf0d9569df05c2b8d578127e7862ea3a71fb34f701a74da6699499", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150278, "uuid": "54615d90-bd32-4bbd-8364-7e6ac8bf5600", "comment": "Malware payload", "value": "f3b8b102706d35d8c4897eec5930a0e7c8127f40", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150278, "uuid": "e5779f5d-d07e-42b5-a445-b60e46ec7448", "comment": "Malware payload", "value": "73a0e19f1d9a854ceabf7224b3a4642bbb8484559d2f2dd54487fb205692502ee1243136797d1749b75972dc0c1a4a8e", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639150278, "uuid": "57cadfd3-6d4b-4b21-8edc-13863a02b2ce", "value": "T16021E1022BEC4624E2B78E76287FE3108731B555AD27D62D0298D29C1CB0B08FE36722", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639150278, "uuid": "e0e25ade-1cf9-49c2-9e51-6215e3603443", "value": "24:8MJVbzLWesDA3OZ1+/3Cpk+/Clk4kwOo0aPfkWBpAXD/zusmv:8sb9sk31CpkNlkaOo9BqXjzus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639150278, "uuid": "26083d66-69fe-4592-b37a-483463f1bd32", "value": 1366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639150278, "uuid": "84e129a6-fef6-4161-a667-bb32e320f372", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639150278, "uuid": "d817924b-f1fb-4c44-86eb-90db049ec8ae", "value": "Documents.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b0d04c-59c6-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639147057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639147057, "uuid": "38fb3e39-5b71-4e67-ba7a-5d8b4339ae7e", "comment": "Malware payload", "value": "8ecbe23f13fb5fb2355ad4da4342fa98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639147057, "uuid": "f502e528-84f3-4dee-9bc0-fb94b9d0a893", "comment": "Malware payload", "value": "a279f950c579cfeb6c58d8b1ba128b32ab1e63b02eaf0dd14cedd3418c69fdc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639147057, "uuid": "a15f2ffb-4443-4ec6-80e0-e8bf62440f46", "comment": "Malware payload", "value": "839e6feb8f28217b5427f77e4a2f7e9ff53cf423", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639147057, "uuid": "7053f4bb-b656-4d2c-aa1f-72a3712aeb0d", "comment": "Malware payload", "value": "4d9523f110d6b45d70853f6cf2496fc0d1eec410b31723fc2e5ff8f6f725b49d0e4c78204039226d4e48729091391294", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639147057, "uuid": "ae8391be-001b-4026-a6c7-b8f97d60f540", "value": "T15305CF1EF713D246F94897709FB32F212B60EEBA9C65C356F6243A2CC83E3791548652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639147057, "uuid": "e0d93a96-a473-4049-a77e-48d082107585", "value": "12288:kOY/JKiF7848nteCLOYxrZlBchnq88Pjti8s4U3T4/V4q1zLppM8nD4u3Jl8MAIi:e/NuPeCyq8UJwKGq1t9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639147057, "uuid": "08ae40cc-ca63-4ef7-ac07-14482c6d95cd", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639147057, "uuid": "3084a2bc-5114-4317-90d4-82009ebc4468", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639147057, "uuid": "e0149a4a-6761-4d88-8e20-27764967e82b", "value": "8ecbe23f13fb5fb2355ad4da4342fa98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f5998e-5956-11ec-96a4-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1639099031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639099031, "uuid": "98685732-95c6-4540-b3aa-256be94f9b75", "comment": "Malware payload (NanoCore)", "value": "5556f416dc9a7b1b0656509ca1ab4e88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639099031, "uuid": "cb8f6324-5a02-45b6-ac95-8096a754cdda", "comment": "Malware payload (NanoCore)", "value": "a342cee6b10756a698cdb9a91ff146abe69956b8828f4750d2ffa5ebf6102702", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639099031, "uuid": "3de6c258-84d1-4729-897d-e244c81a1d3e", "comment": "Malware payload (NanoCore)", "value": "45e427fd3a47cae98cf334dd0b8d95bdaa156bed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639099031, "uuid": "029fd60f-fa48-4e19-8fce-33bf7dca12f2", "comment": "Malware payload (NanoCore)", "value": "f79de4998a416262c8c8dd2934dcaf1c866954f58ac96f04fa2ebc287b86772762ff20e8bac73d7a33dffee285a0e965", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639099031, "uuid": "b992e76e-cbc5-45a4-925a-13c0e6e06f9d", "value": "T19BD4AD4EF3129102F94C5BB19E361F2017B4FDB6CEA1D66B724C3A2D88A73761C89746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639099031, "uuid": "b20f6fb0-f1c5-4a35-9b6c-8d8391816506", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639099031, "uuid": "fd7fe139-1751-4e67-9f35-058308b5def3", "value": "12288:VHRAagmhzBkL4wtAR+pjf+XpYosHuVf5OwlNM0k5kCwv:VHRAafzByltAI3Ed5xlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639099031, "uuid": "b7ff0172-3721-42df-a4fb-1ffd39bf9ffa", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639099031, "uuid": "85702865-3443-4dbc-b66d-0ffb35768666", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639099031, "uuid": "06109476-c46f-477d-aa20-43f1665c62f9", "value": "Payment confirmation .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbbd2c58-59a3-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639132057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132057, "uuid": "1b73d8ba-d688-4026-8c99-05c6649c0fef", "comment": "Malware payload (DCRat)", "value": "9d1af0100597194c6a4ff921f5cee664", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132057, "uuid": "620de862-029a-47c5-997a-195f2843a22c", "comment": "Malware payload (DCRat)", "value": "a3b523e9f230a7c208429e8dca59372cc3611674471dd40d76810793cdd8f2de", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132057, "uuid": "2b02c7ad-01eb-4bd9-998a-4af0f92fba17", "comment": "Malware payload (DCRat)", "value": "9337f0989e0195126f2bbdd6408643a9d67b6087", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132057, "uuid": "755cb924-e5e2-43e0-b29a-74bb0daa8803", "comment": "Malware payload (DCRat)", "value": "0ae871c9a2882b840f38528102df2c405ba0937f72b9b21755b1d51a73135f74fe91d5d2dd522a1348bdb2e35b999fce", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132057, "uuid": "9ca592b5-ddaa-4990-afb8-1f479898c05c", "value": "T126657B027A84ED12D129963BC9EF405443BCBD112662CB1FBEAE33ADA5513A35E0D5CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132057, "uuid": "18c487d2-7cd8-41fe-90eb-4a70ec44288b", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132057, "uuid": "7098225e-e43e-48a9-a345-1eedd86277cf", "value": "24576:M2G/nvxW3WbNKW5Jt89GEfO/ZHm2NmNjWu/g0uWLf4A4jh+4L:MbA34Dg9pWUT/gljgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639132057, "uuid": "eae6f197-1948-4f28-a87e-1ef5dffd56c8", "value": 1490072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639132057, "uuid": "930665cf-006f-484e-892a-06528c01c4f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132057, "uuid": "3d9e27f4-c181-462b-bfa5-0004ec82790f", "value": "9d1af0100597194c6a4ff921f5cee664.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b1d236-5985-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639118831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118831, "uuid": "98f3b8c7-56fd-436e-9465-a00b25d9319b", "comment": "Malware payload (RemcosRAT)", "value": "526b9fd30d0ec2b195110a9a84e3a258", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118831, "uuid": "8df7bb7f-28e5-4ec9-af90-1bf131f6a737", "comment": "Malware payload (RemcosRAT)", "value": "a435c9db494875e799827d9a55f152568fdbc49eae4976b87856bb8d3d6b66a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118831, "uuid": "fad1396c-0554-41aa-9af1-0660f8a67eb1", "comment": "Malware payload (RemcosRAT)", "value": "f454b61f5ecfe83e434e6c7713a0289bdfda28f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118831, "uuid": "eca98a46-f40c-42a9-a4ff-4d8547dfa2c0", "comment": "Malware payload (RemcosRAT)", "value": "965fddfd06020dc41a589678776fe3fe00653d4553ce162f1a0f27f8361dee92fcd8970f3feee88ed064e07bce684349", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639118831, "uuid": "8e173c05-4a06-4e55-87e1-e8004dcf9868", "value": "T1F365122132B88C11C6BB577ACCDF951403FCBD1AB422D62E7DE532DE15723961922ACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639118831, "uuid": "f75651b6-8baf-4c9f-a674-cf40d6da69c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639118831, "uuid": "7e6c547e-24f5-483c-b2e7-1b9a9f31a2cd", "value": "24576:Pa1HxS8RAtHxxYf4Cwe9gFAtv121+7zZi72vybotXKCSuuqJU/1cu6eh/Mx:SBxS8RAtHxNCxJuozw27tXKDaJUdcXea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639118831, "uuid": "8efb3895-c2be-4920-acb8-69c7a95f2215", "value": 1427456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639118831, "uuid": "2138f2e9-5141-4b70-a82a-e4d793ba7759", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639118831, "uuid": "af6f0bf6-ea2b-4690-b25b-46d62fcebf18", "value": "Neue Bestellung PO#673218976,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d6b8aa-598d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639122603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122603, "uuid": "45881637-3487-4f17-807a-6d42931c052a", "comment": "Malware payload (Mirai)", "value": "ef4a58903e6663b07407669bc0322115", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122603, "uuid": "31a78d8e-95ec-4018-84cf-5724f250b313", "comment": "Malware payload (Mirai)", "value": "a4bafc2a3dda923676a85e7c3cccd905da3d1a0694a1596826d4f6baf4ec7ebb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122603, "uuid": "310247cd-ecd2-417c-a79b-2261b319efb3", "comment": "Malware payload (Mirai)", "value": "16547e4eaef1b476950e174670e66a79b0744cc9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122603, "uuid": "c73e7f2b-d4e7-4028-a3d5-a66c1c31c3e1", "comment": "Malware payload (Mirai)", "value": "a525a1030083c14335688e04e57151d6189a066b1c08991808b800a809da8faeb51e54563f4f01caa2710e886bebcfca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122603, "uuid": "fd5e26ae-ed49-483e-b9f6-080a5558f54c", "value": "T12133F133AF180D0688216C73A9B546A7A5FBC7BEE01D59F5E1074CFDB940802E9E1983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122603, "uuid": "e91dd81e-83e6-4fa0-805a-195aa985c397", "value": "1536:QBd49Pl29hwd14wElc8y/T7vTL4LAN/fBZ/q2lI:ZPlRdFd8yr77L4+JJq22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639122603, "uuid": "7743597b-c837-417a-9343-6aca98391272", "value": 51692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639122603, "uuid": "c3eaeb45-afb6-43ee-b4eb-672b50febcde", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122603, "uuid": "3c7d4c35-8aee-44ce-95b3-a51f2e735281", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68ef0ff-59ce-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639150517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150517, "uuid": "f09a7194-ab57-42c1-828b-3d57e16a0bcd", "comment": "Malware payload (Loki)", "value": "bb1cba1e5c9337455dc4eca757bceca3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150517, "uuid": "0c172591-d227-4184-970c-7c234cba6ed1", "comment": "Malware payload (Loki)", "value": "a55f42644d0a122db35f0fdd95825d89283425b2d3c1b46d9c3973b224962884", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150517, "uuid": "4ba1f2c0-04e0-4af9-acb2-83efd0d9e649", "comment": "Malware payload (Loki)", "value": "22c76f5081f3c60fb7f86948850a447725f0366f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150517, "uuid": "4048e725-ddc3-4ba6-a149-7ee16a3db776", "comment": "Malware payload (Loki)", "value": "06bff332e9635167c5c61ce6bfc356e0807833bb1a8c514c4f845bc164b5d9174ec5260c22bb1f65a6fec16b5760ab01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639150517, "uuid": "a25d245d-a910-4c73-8c43-d6b0b1a66d29", "value": "T1A751CC04A9A8F663E05F67FC40CA4009B3B611642996FB5D0FE278F322673F394849D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639150517, "uuid": "4617e34d-f28a-46c0-b3d8-d92724e91c03", "value": "48:6Arq3ezxJP1ziDbRb2CbqdHHm5bqpKxHxFosSvV8uud1+gcOQP/7MzlZ2KjzlONN:v9t96bEHG5sUROFt8ulUZAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639150517, "uuid": "5551b115-dd30-4f98-b888-32bc4a952e33", "value": 2564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639150517, "uuid": "b8c7bdc2-3b32-4068-8d15-ccdfea5991fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639150517, "uuid": "02120583-2038-4143-a308-c016b8aacd7a", "value": "bb1cba1e5c9337455dc4eca757bceca3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985681a5-599e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639129823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639129823, "uuid": "6a124167-06cb-4d0c-a003-4e4f051b2ad4", "comment": "Malware payload (Formbook)", "value": "8afefe1c62408571d17366c8c24221a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639129823, "uuid": "6d5a6d45-6d11-431a-b82c-7f5628744bed", "comment": "Malware payload (Formbook)", "value": "a68ee889934b72674cf041985be7f72e7531ebcbc5cd07c12c5ae900ed5b5a1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639129823, "uuid": "81753cb8-ef9a-426f-ae7f-591e162a5b48", "comment": "Malware payload (Formbook)", "value": "bad8f5cedb14316822a7390c4ddb3ed3f9454a51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639129823, "uuid": "85a7e75b-a48b-4b5f-8d02-a9370777be3f", "comment": "Malware payload (Formbook)", "value": "0225fe84e6b72e60a74c55bf0e713aaaa1d86d55775c8d2f045a4943d776ab4ce8fed77187b2a6adc8b5232f0425bd66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639129823, "uuid": "3eb2c651-a6a9-4d70-af91-88d63b1d112e", "value": "T15244233B3EC1AFB3D6D6E8B204B76746E27A92CA434D0F1553843DED3B226D1C481A59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639129823, "uuid": "3a356550-ccb6-4aff-89b2-e96458c79f46", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639129823, "uuid": "b75563d8-3d47-46f0-8e7d-9aad81cfe6a8", "value": "6144:rGiZgrjld9GaDSpWfRTUsfCHpwhVsfSuCoDbff/+TidiZ:12jhdDSp+RTz8SSDbOi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639129823, "uuid": "28d38ead-abfb-4a22-b998-269abfd80706", "value": 277780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639129823, "uuid": "86a1b48b-7fe2-4fb7-8f07-9def67bf06f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639129823, "uuid": "bfb90388-410d-4d5b-86e1-6b813dccffeb", "value": "8afefe1c62408571d17366c8c24221a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83bd912a-59b4-11ec-96a4-42010a9c0029", "comment": "Malware payload (DBatLoader)", "timestamp": 1639139238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139238, "uuid": "99753e0c-efb7-4567-9930-45e4f4956e25", "comment": "Malware payload (DBatLoader)", "value": "3a45e8bcd4b88361149a10abedad392f", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139238, "uuid": "f265e362-f0e2-481c-bd93-ed3148a4a2a5", "comment": "Malware payload (DBatLoader)", "value": "a78e89ef2769dd705ce27a6b5876ca2fdc5a5aa078ff9a4d86f186d4bb6edce8", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139238, "uuid": "226d0b91-462f-4223-aa8f-b2780cdde326", "comment": "Malware payload (DBatLoader)", "value": "dc7f8b6d6b9e2b332aca78fdd899f96baf7debc8", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139238, "uuid": "c2ae4961-ace5-4ff6-9fcc-5d45aae263f5", "comment": "Malware payload (DBatLoader)", "value": "058bf3f72725b54ffe696269ff8f3817c271662ea88e417612c4b2f37d12a4a6979cf1667806287f8ea559861b40fb81", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139238, "uuid": "2cad6a87-5b0e-4b29-a25e-8bea82807120", "value": "T1A4F49E6570A0E473E23B91BEDC67A7EC5430BE226B54DC452AE8BC4E4EF5750B81B243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139238, "uuid": "ebadf3d3-57c8-49dd-b8f6-28b48c5fc48c", "value": "cf4ac33deb94090eb70c93b194aa229d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139238, "uuid": "22abedbc-9ab4-4227-b647-cbb0aebcf564", "value": "12288:/SYSMXRFwZEQ5TYy2apWLDcdIy72dFRcqzit:/48wKOD2aI/VZ5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139238, "uuid": "0c7eacc9-ca8e-4dd5-b9a9-cac5fdea2b95", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139238, "uuid": "d40603f3-ea4a-4475-b241-fb11505f37b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139238, "uuid": "a45a319f-3b3c-46d3-8fa9-4eb7363d3ef9", "value": "Amxoarzogpggeozursulwknspwqbfjgqxt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec85ed0e-59b9-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639141561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141561, "uuid": "2984af5e-341c-4430-b13c-1b1d1188e921", "comment": "Malware payload (AgentTesla)", "value": "ae5867a642bf929ad5b439529c90b62c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141561, "uuid": "4e319dcc-380e-4bdb-93ca-7a4cc9dd4c97", "comment": "Malware payload (AgentTesla)", "value": "a81183619cf8dde1a9389734dc3ae61e5d98c44fad502c5a36baad0456b25a78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141561, "uuid": "2860d301-6a3a-40ac-a53d-4c14c3e568a3", "comment": "Malware payload (AgentTesla)", "value": "f890b3acf1d2ae0977b199175a64b07f11fb0ab9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141561, "uuid": "f4503d3f-af4f-4aed-bf5a-63319e77ead2", "comment": "Malware payload (AgentTesla)", "value": "92e583c3a9f93b1a214b05c6996c285c9a20e94f8f3a6fe0e9f28a5048580ead47c91119a2d3ffcae3b7b7816df2f796", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141561, "uuid": "b34a8810-1e64-4ec1-bd75-7302d21c1d6c", "value": "T11E2419166714D520CB5F417FC41A820831F1DB07972AD6DF5AA6D8FA2F812CEF92B8E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141561, "uuid": "479c601d-903a-43d1-b16b-3d0019605990", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141561, "uuid": "44cf9f2a-ebaf-4b3e-97b9-2535ca503de6", "value": "6144:JZnuYFtUa9bk83DQ2RTl4qGPJm44s6n6Ud:JZnuqZ9VDp1lMRD4s65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639141561, "uuid": "ce1ccf5f-f7aa-4511-a64d-9c7a9f1770f6", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639141561, "uuid": "d7422b99-2bcc-40bc-b3da-35ea66925107", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141561, "uuid": "f54dec56-2d34-4c37-abc9-2625404669f9", "value": "den.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6fa0d8-59ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639141698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141698, "uuid": "e844f864-c2ea-4193-9850-dc3bc7d952b2", "comment": "Malware payload (SnakeKeylogger)", "value": "95cb21c03fe049e74d575dcc24483c7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141698, "uuid": "326755cd-d7a5-4b49-aba5-b578377f1ca9", "comment": "Malware payload (SnakeKeylogger)", "value": "a89ca55d45a991f545ea85eaa84aed5297fc0a9aba666bbdf9ac2969499d8999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141698, "uuid": "5e4874d2-42f9-4e5e-818b-b0bee41932d1", "comment": "Malware payload (SnakeKeylogger)", "value": "3f9663b61eabd38f5ddbcd674cd65486f54030b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141698, "uuid": "85e86602-8169-461e-8459-b1110475674b", "comment": "Malware payload (SnakeKeylogger)", "value": "7a316ed0fd6a309b181abbd4a53ebacff449445251e4f6084a6399f86c033a6d87998238f3b1e94c37183baa94e865ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141698, "uuid": "3e878218-41b2-4786-b097-73dbc8a47b36", "value": "T180F40246F281638ADC54677121F38D32133FBC7DAC74695A2ADC32767BB72A2001669F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141698, "uuid": "58d4962c-32af-4980-9392-1779029ee6a7", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141698, "uuid": "44d2d764-e680-4c3e-b3bf-2309de5167bc", "value": "12288:y0Fq17L8NYcuUyf75l+phFLhc/HLOOPpW8rEURFUVap+9JcXtzr0:yz4NYoymPc/KOPpW8rEUI8p+bch0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639141698, "uuid": "94d0c3b3-4920-4259-8e91-739d16e6982f", "value": 764023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639141698, "uuid": "90d41fc0-e15c-40e1-bc16-13e19f8e779b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141698, "uuid": "ba180d6c-286b-4bb8-888e-f3270fa65a32", "value": "2098765432345678-009876545.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf99186-59e2-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639159062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159062, "uuid": "8a2d2fd5-b68b-4452-bbbd-3d8095e3676f", "comment": "Malware payload", "value": "e72b6afa8569104b70eba5f4778e3b8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159062, "uuid": "6cafb12a-b8a2-4722-81b2-456d5dbc0825", "comment": "Malware payload", "value": "aa44b90b008e3fbaaee709adec3c6f64e60c6ee21298e1a0a4d2e9849f63e6a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159062, "uuid": "ad248d4b-a7db-4792-a55a-b8f3ee26b6da", "comment": "Malware payload", "value": "04855c8dc3cb5f918395458cbcaf72e9a2c507f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159062, "uuid": "e0779e92-536b-4a92-befb-2cb71ef4975c", "comment": "Malware payload", "value": "324da71583355a6eb3afc8100507b6cb9f86c00c518cb710c2efd98107475d64698bf6fae4a67103841d0f391a214b76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159062, "uuid": "e9d0cd51-c07f-4c72-b5cd-6f0812085262", "value": "T156F2E1392E8698A9E915D5FE016007107870C7DB7B438E5F3AA9D66F3FC05443CA5ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159062, "uuid": "4b754d5d-870b-4568-9f23-f9e7414ba54f", "value": "768:4CJK+x6JZaCTFtIQ8pvzJVZsM6s//4tPwblQ31ISJgGlzDpxYsx:nKM6eGFtIQeFTsM66/4tYhQlIWVrYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639159062, "uuid": "21072778-6707-4706-b91d-db9ad72ddfc6", "value": 36076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639159062, "uuid": "fd3e2b0b-b4ab-4ce2-892b-d9573d612aad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159062, "uuid": "e9eb1f34-4c85-43ce-a603-d14b4ae86d66", "value": "e72b6afa8569104b70eba5f4778e3b8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b15d9fa-59e1-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639158604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639158604, "uuid": "a54fc2a0-221a-4575-bd35-7be34d15cfc7", "comment": "Malware payload", "value": "c13fb30cdaa7040601bc6e22f925047d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639158604, "uuid": "ecc7606f-7862-46a9-a43f-d37122d9fc5c", "comment": "Malware payload", "value": "aa79f664e7f57c8429a49a1db17d2b9ddc9d4255c68fb813181cc40047edd187", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639158604, "uuid": "b9cdea4b-2ee4-47de-9c93-76edf798da73", "comment": "Malware payload", "value": "c7d94e494d12aecb0c45d1239a5d3323dc23ebee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639158604, "uuid": "258d0fac-8f54-49d3-beaf-bc091e369a91", "comment": "Malware payload", "value": "284ee734648a6327ac8ff0c8c2566c60462a862627f417133a3e2f96780a6eaad33a26d500f2c135fbe27698104966a8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639158604, "uuid": "7f13af83-ffca-40c7-bf3e-204092aca3a8", "value": "T1D2530232D40D0932F4E19EBDD4F3A9845AE90F7DE08D35C61200E725BFAB5C299694D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639158604, "uuid": "a82f9090-bb3a-4822-b998-a274d5ac9f03", "value": "1536:7iP2ITxKdOQZIrXcrCz3cO4lIv392sYHvUaIV7eZ7U646DU8BXP:7ExIOoQqCDcmFHAs6Z7zdU8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639158604, "uuid": "abeee393-d5ae-4cca-824a-dff124f07dc9", "value": 61700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639158604, "uuid": "7d6fb82f-09c1-413d-a64a-e4146418cf01", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639158604, "uuid": "13f45827-f58b-461a-ac3c-3a08e00e2b25", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3fb4d3f-59ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639141976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141976, "uuid": "818f1117-fe8b-484a-a32a-37d0c605b3d3", "comment": "Malware payload (RedLineStealer)", "value": "0e7aeb823d343a715740b3958be7f1ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141976, "uuid": "0b7bc76e-63d2-4f4c-a8bc-7e84fde554c8", "comment": "Malware payload (RedLineStealer)", "value": "aaf9772d7c3c38130cfadc390c1826a1ff31827ef6a998bfbf02e0569c75a756", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141976, "uuid": "4bf8e038-389f-485f-9e01-cd3c8c536594", "comment": "Malware payload (RedLineStealer)", "value": "f71d38ff8f4b6bae0a7426ee1f72bb5ad983b333", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141976, "uuid": "c0a3495f-909e-42bf-8791-686e70c3ffa4", "comment": "Malware payload (RedLineStealer)", "value": "c33ac4e7697671f91fee6a92b674f19daf6c2327ad59d2ea600e4ef958668bb415460d649b69c6f719a23ff4e642cb0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141976, "uuid": "f42067aa-ac7e-4ffe-9377-1c374474fb49", "value": "T1946533B280D5B24DDD4D37346A19E799D2C74BB830E9760EF3800F97897D893FA590A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141976, "uuid": "5ef9313d-1410-4bbe-bc2c-2e4d8170df7c", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141976, "uuid": "8eadc9a1-fb99-4e53-8cce-28a0ba48540f", "value": "24576:nc4peftTvtL4rXAzHE6py9LollUlsYBFCepcEAtuJcO0URJfHPqpkEaHNYK367oS:5peVTFbHETL2NECj20UL/PqpNaIU6NVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639141976, "uuid": "9958ed6f-3c6d-459a-b702-19e12ea90a8b", "value": 1488640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639141976, "uuid": "030a0715-8dcb-4a14-b3b4-b08b6b3b3e15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141976, "uuid": "d21653b7-06e5-4652-a5d6-e8a12eec30ae", "value": "file3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a691b2bd-5953-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639097635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639097635, "uuid": "666a9365-7eee-44c3-a150-b681946c86ab", "comment": "Malware payload (Heodo)", "value": "d95490f421b2bff3d1b5305dd1d3949d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639097635, "uuid": "8ba3d6d1-6dac-4933-aecb-54f82b75eb0f", "comment": "Malware payload (Heodo)", "value": "ab6da0a56aaea17b01d8a07b3d52b360695a2bbd4c1f39f4ba97a8f7052a87a5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639097635, "uuid": "13f6e6dc-f563-4d04-a263-0fb28113ef34", "comment": "Malware payload (Heodo)", "value": "0d1758e15a37a5a6c7e0cae8b22e0f1fe4724042", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639097635, "uuid": "69d08dde-2505-4392-9521-959db15e55e0", "comment": "Malware payload (Heodo)", "value": "5c6657e31215706dae7e755472a66b47d8c228390e73d207d6aef7c8d47667dea16275078b3006e2caaaf5687fceed19", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639097635, "uuid": "28fec10d-99c4-452a-babd-0c1ee38cfc0b", "value": "T132D4AE1277C1C0B6D56E02314506C71C72F2ED908FFA4687AFD96F2E6EB01D2AB35626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639097635, "uuid": "e1ccf3b6-cb19-4a4f-ac81-cac3d7e6dc8a", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639097635, "uuid": "06377869-4199-4409-aa8d-9af96ae84649", "value": "12288:WKEUkuAOLka1miSmuYr1V7eAobS3qTHPR101:TEQLka1nBVqAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639097635, "uuid": "bd31ebfd-bb5f-46e6-b84a-0a4d13d1793f", "value": 638326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639097635, "uuid": "1cf5c4dc-9548-4052-9059-31aaa47221d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639097635, "uuid": "73765a55-1acb-447e-95b9-8829f0d0d3ba", "value": "emotet_exe_e4_ab6da0a56aaea17b01d8a07b3d52b360695a2bbd4c1f39f4ba97a8f7052a87a5_2021-12-10__005350.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645954a1-5997-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639126730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126730, "uuid": "b96e43a9-38cf-4111-80c7-637e5b155a1c", "comment": "Malware payload (Smoke Loader)", "value": "deae2304fb4a78eaa34c9d3fadfa9062", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126730, "uuid": "08112ee6-5143-4a43-b4c2-1c2b78e928bb", "comment": "Malware payload (Smoke Loader)", "value": "ab998b52449dff643dcc9268d0da10f57bf30eaef8dff835f5fb4b4a999d10c5", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126730, "uuid": "ac2101ae-2a49-41e8-8790-09f704f4e84a", "comment": "Malware payload (Smoke Loader)", "value": "c70f154560e40b6add9da5e56db438d5aee6fe38", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126730, "uuid": "3346bb8f-6d7a-44cf-956f-d01bea3866fa", "comment": "Malware payload (Smoke Loader)", "value": "9e477d83b946f2704a457c631596b8fcb14bb71a8d849535b8f494cb6a764447a369d9245e2d7bb66045d00f3dc87b2a", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126730, "uuid": "a94ebd29-c607-4865-a52f-21f07963de2b", "value": "T169249D3276E9C971C1A34D30D820DAE41D3BB8715A20545BE3A867AE2F72F8C55ED31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126730, "uuid": "e777a116-cd57-477b-aeb2-82c427cce897", "value": "784912eb6940550282ff4b089d7e66e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126730, "uuid": "f789df39-cb8b-45b8-8028-7b54d4214e08", "value": "3072:QgDOSLhqLNkIUGkNIIK6iNxryX05hPpCoE5pIiWrxpzbgqruXhs7sxkgaBChUck2:QgDHL2kFGkNI1Qcq5xuzbgwu6Qiga6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639126730, "uuid": "035c18b8-56bc-4ca6-95b2-2b615cd5b571", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639126730, "uuid": "76e21b67-bb36-4ac3-a237-c987a81dcf6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126730, "uuid": "d7532e78-573c-4ee9-908a-d6ad8aa1089c", "value": "deae2304fb4a78eaa34c9d3fadfa9062.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477dc1c7-59a2-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639131406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639131406, "uuid": "a55f78d6-5333-4574-9dc3-b07f623c7e9f", "comment": "Malware payload (RedLineStealer)", "value": "e3139907bbf046c71134ab4ac9e3d7f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639131406, "uuid": "d6ec1347-dabe-494b-8dca-fea1d7104aa1", "comment": "Malware payload (RedLineStealer)", "value": "ad55c0297b971a90db8b4e181cceaebf588ecaae4c42954a429f5ff4996e3351", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639131406, "uuid": "93b80d38-8f8b-4b08-a229-041e57124a19", "comment": "Malware payload (RedLineStealer)", "value": "9fa91d655973e897d2f3db429c8ed6b8afd99f71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639131406, "uuid": "d2182a80-c22f-4e66-b921-dfd5e3773d9a", "comment": "Malware payload (RedLineStealer)", "value": "4a074d55ea493378121a52ac91a2ebaac5ae1d9b21bfc70ee643daaa5506694c88e09f15fb9620fca75a3d26c6c169aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639131406, "uuid": "0c7c8269-f961-41e1-acc9-5c1a4bfc760a", "value": "T11CA35D3067AC9F19EAFD1B75B4B2012043F0E08A9091FB4A4DC194E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639131406, "uuid": "ffc95c9a-5645-4f84-89e2-fa2867c1bca2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639131406, "uuid": "67b4b437-5e48-40df-a5e7-e886b4658991", "value": "1536:5qsCbqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2w3tmulgS6p8l:XEwiYj+zi0ZbYe1g0ujyzd68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639131406, "uuid": "69e69750-518d-4eeb-9ff3-16e675923aec", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639131406, "uuid": "003621af-57ea-4fb7-9ad4-c9621bbde2c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639131406, "uuid": "67edf2fd-cd13-4ed0-9de9-fe7280a2b099", "value": "e3139907bbf046c71134ab4ac9e3d7f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada178e1-5997-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639126852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126852, "uuid": "d4a6ec3f-eacb-4d5f-b4ab-4a5b90a662c0", "comment": "Malware payload (Smoke Loader)", "value": "ffeb0c73fde20a4612aa492f2b48585f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126852, "uuid": "67c00502-6906-4eb2-b940-545974a6281b", "comment": "Malware payload (Smoke Loader)", "value": "adbcbaf928507a75d1026b1437105d99adc515f70a6fd7f99bc51035a7983df0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126852, "uuid": "da6e7e90-16f3-4f2c-82f4-7dab70dc7432", "comment": "Malware payload (Smoke Loader)", "value": "4f3048c029123865f34402d6e0bf47b6743e3b75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126852, "uuid": "3d9e9567-020d-412b-acc3-4e124ec3d0de", "comment": "Malware payload (Smoke Loader)", "value": "d3bc664776997793b9bf2d5ce64c59263aefac8baccbc86310bddc3ac814d93059914e49b13f341d67901cb470a23b4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126852, "uuid": "908bc7c6-f46f-4a75-b420-bd38bf3082e9", "value": "T16F549D10ABA0D434F1B712F959B6A3ADB93F79B26B3494CB52D226EA17306D0DD30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126852, "uuid": "16a71398-d0be-47a3-8f56-7660fed577f4", "value": "722252831a6fc255294abdd3e1a4fd3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126852, "uuid": "2dc3d5bc-a49b-4fd3-a769-95413fe43635", "value": "3072:50KfSiyJwYEVVVn0Ulfv9HH8tOhDPr3dznLJwzxyYBmVTcJesp9dPrQTEDgRHgA5:4alFvdctmDPrdzuzYY4+JesRQ2aHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639126852, "uuid": "4ae1389d-1edb-46d5-a3a1-bdaa45cd0fbf", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639126852, "uuid": "6a33de23-f293-4051-b852-066d985f87bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126852, "uuid": "1a7df461-3e8c-4263-97ce-68e5b5abb0ab", "value": "ffeb0c73fde20a4612aa492f2b48585f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0569a58-59fa-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639169404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639169404, "uuid": "8b368a62-d202-4cd0-b674-d4c15bd68436", "comment": "Malware payload (Mirai)", "value": "df95510dcb30f3aa5c11b53b90550692", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639169404, "uuid": "121bbcb0-63b3-4ad9-b9c1-b24564e243d4", "comment": "Malware payload (Mirai)", "value": "adc0d3938dea6bdbc992027c7c659de9299e29a009c337c693672eae4d1dd630", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639169404, "uuid": "b3ab5a97-c9b9-47df-99ec-b0aa951db863", "comment": "Malware payload (Mirai)", "value": "e4096e3b7b12188ffb486f7a20a072c1d694719d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639169404, "uuid": "fc264cd9-9d22-46e3-a323-973fad4ea4a0", "comment": "Malware payload (Mirai)", "value": "08212c7dacc303515fd316c5397fe0988c4cd90856208fe3b6d0d318b158feeeb00320dd6ae6f88e42346131f68f06ec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639169404, "uuid": "db5bf930-a616-45a6-a60b-b458b3d4d9c6", "value": "T183D2E026E9569B90C9EB40761DEF776E8424C2499C4422F1AEE8B05FDD00F547B1E2E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639169404, "uuid": "79f833f7-d090-46c2-ae49-1d37973b70fd", "value": "768:KJ55ogT+lbYMTq714SV4puGZzMELmag24M/znbcuyD7UHQRjJ:W5oDlYMTmGkOu4LmagjMrnouy8Hyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639169404, "uuid": "ec116408-bbcc-498b-a8ea-c767151ba4b2", "value": 29700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639169404, "uuid": "2f75acbe-7968-4146-b143-06ea6ffac562", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639169404, "uuid": "4aad33b4-1943-4f11-bfde-324c3bb9ee30", "value": "trynagetmybinsufucker98575.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7749630-5984-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639118735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118735, "uuid": "d1e084ef-aa76-4479-968f-1772894ba9b7", "comment": "Malware payload (Formbook)", "value": "494c25c6e342db8f0c253da4a57292f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118735, "uuid": "750ccc6a-ed1e-41fa-9d22-152038a2a674", "comment": "Malware payload (Formbook)", "value": "aea82dc29f0c4463b5d09b61c695b488be9eb1b07e1868c1c4ef72523c853cd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118735, "uuid": "40045980-f0b2-4a36-b083-ec6dc7c6ea4a", "comment": "Malware payload (Formbook)", "value": "c5a81dbaaa6232ac08210acdd0d9cc7f0b41b6ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118735, "uuid": "4ad7c8e3-1cc3-4a1a-bebe-73a230784d1a", "comment": "Malware payload (Formbook)", "value": "594b17da32ab53ec276a305d5510ca25310677da51e65450567623ede82a78a934c2b0f767f99a23dce7dc5f840f3545", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639118735, "uuid": "8c1ac431-8e86-43f4-9675-09ece06fb771", "value": "T1830433C606676A45DC3401BE5D01AD40A47CCABDB2787FB2CEA7B051DC732B9AC7E05A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639118735, "uuid": "38098306-8747-4ccd-aaca-0217ebda2fbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639118735, "uuid": "0c7eb47e-cf9d-4cc0-a61b-a6fb0dfb22fb", "value": "1536:gml9UCbS/WrMJWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWPWWWWWWWeWh:nUCbS/WrMJ6yjVh0ZBBccot4f5pgZZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639118735, "uuid": "26a171cb-370b-4a4e-b80e-19806a55bb5f", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639118735, "uuid": "81734600-20aa-4290-a376-ba1dfb60dffe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639118735, "uuid": "0cd299c7-8f80-4cc5-a9bc-7c45bbff9904", "value": "494c25c6e342db8f0c253da4a57292f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d32c3fa-5989-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639120624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639120624, "uuid": "d833363a-f7f9-42f4-950a-6f88c7567dc7", "comment": "Malware payload (AgentTesla)", "value": "c5dcc74e48075bdd539c250deed4c880", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639120624, "uuid": "72db5b0c-bffd-4e45-b046-784eaa1c5456", "comment": "Malware payload (AgentTesla)", "value": "aee2277adebc238c50c733b42a5273255530fa764a61f38cc42beaef9c84f153", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639120624, "uuid": "a238f638-57b5-493a-adcf-de73491705a3", "comment": "Malware payload (AgentTesla)", "value": "89a65bba2390b43d79890624bbcce313bbfc912c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639120624, "uuid": "d01ea2ca-37f2-4825-ad2b-2a82c40a2a84", "comment": "Malware payload (AgentTesla)", "value": "4f90e31db5efef3e8fc2784589ad314cb789ba6cd566b2ad3560bed6b9922149834f242be6d9871097de5d72aaab50a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639120624, "uuid": "be245448-54ea-4b2a-bb98-0c2cf2784de7", "value": "T14045122436A9CF11C63A1B76CDEF804003BCFA0AB012E71D3EE5B2ED85527E959516DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639120624, "uuid": "98648b58-cb21-4fd0-b077-e4da950ebac1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639120624, "uuid": "0f757b06-e40e-4425-9761-5258ffb044ca", "value": "24576:+kG0XozaWKpsY23VxnnG6EV/BxoPy0ppTRjiiVnolsTwCfGYh6M:rXoOmnls6EVZxT0nThFVnoSfGY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639120624, "uuid": "b4741b34-95b6-4e8a-8b44-9fd9d3acd31b", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639120624, "uuid": "6b2df5c6-30ef-4afb-bb8e-6d98832951ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639120624, "uuid": "522303bb-afa7-4370-a418-95633b193aa9", "value": "Remittance Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b408f983-59ff-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639171531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639171531, "uuid": "0bbd7379-1226-4c5a-9226-81b2fb60ef91", "comment": "Malware payload", "value": "ca953803478aedadc726d3f74326540f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639171531, "uuid": "27188e9a-9442-465b-97a1-a2605336ac74", "comment": "Malware payload", "value": "af272122f188b51e70b6395a02507129252a54573a1dc4219b38919e859dc27a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639171531, "uuid": "e9b0bfb2-21ba-41f5-8e13-1dde26973a77", "comment": "Malware payload", "value": "9c577327594ba59a71c849f32a7256f0284a5178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639171531, "uuid": "b0fd2048-7404-4a0b-a3ea-046865a2e481", "comment": "Malware payload", "value": "eaf69764d4ae1c25b49765c7a822fc2956d48e261a9c9ec9ab9ef8eaaa249d7ae470dc80cb9f2f829781c09e4a49610a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639171531, "uuid": "7dbc9aec-4da8-4b39-b598-d156db464efd", "value": "T1800633F1E9B97CB6D04A3677B838723C73C7D66D884410B9EA8FE44924A59C424F2E47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639171531, "uuid": "3d7f7cf8-d9cf-4a4c-953d-24c32b3d4a65", "value": "98304:0mjfS3Nga4OwiVo2B60FR4sjObxVMWblpmxlSs3H4JYqfob:/q3NgaeQoSD4sjObx6Wblpmifo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639171531, "uuid": "3158e2eb-c0c4-444c-ad9b-16e6a3c113a5", "value": 4001792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639171531, "uuid": "2eb5e1e1-3b68-40aa-9d64-f30e0b763de9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639171531, "uuid": "aeb6a1fe-2b62-44fb-a987-8c8a9cb05d87", "value": "Vape Patcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada75182-594c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639094640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094640, "uuid": "988fcc25-b501-4468-a846-3e1d8833911f", "comment": "Malware payload (Heodo)", "value": "5909215218fe310a234ae7c15bd79df9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094640, "uuid": "ad69c796-a596-42dc-b3ed-507008ccc8dc", "comment": "Malware payload (Heodo)", "value": "af28aa42af49a59bd639b3f52caf6c000082f6e7c907b8b15762224a083106f9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094640, "uuid": "efa560dc-8412-4563-b384-220abf71a609", "comment": "Malware payload (Heodo)", "value": "7b9c3f8b5a40acc47e7bdd0068d5ee7926e6c15b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094640, "uuid": "5af36c5c-dcc8-4562-aee5-3357ddff7ac9", "comment": "Malware payload (Heodo)", "value": "931e7b2dc12ac2eb6b0e30a923579e1369929824457fcbc654661b9852bea10c71a4a21d3efed8e881b9a699440ccd34", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094640, "uuid": "773c586b-e418-488b-8a24-2bea3f2b3c3c", "value": "T18D44BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094640, "uuid": "55ae1169-0c18-4d7c-8951-c68f0e5d4f14", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094640, "uuid": "42849d3f-2f9f-4611-a0f3-53d86521defd", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBi2ypv:6jIG/pjjuLbJLmGshoCUnWT+pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639094640, "uuid": "d9a59b71-28df-4c8b-bf35-c5e5cbb595ba", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639094640, "uuid": "4d695071-d62b-4ec0-8152-92f444578d02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094640, "uuid": "39a7faec-3e47-4c71-a25c-27c8fecd827c", "value": "emotet_exe_e5_af28aa42af49a59bd639b3f52caf6c000082f6e7c907b8b15762224a083106f9_2021-12-10__000355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987001a8-59cc-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639149580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639149580, "uuid": "5b05d152-1d8f-485e-aae0-0e8a036f54fc", "comment": "Malware payload (SnakeKeylogger)", "value": "49fb3eb041763a897b6a0fa3c34d615c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639149580, "uuid": "bb12a0f1-695d-4c5c-a03a-e32c77f34f4d", "comment": "Malware payload (SnakeKeylogger)", "value": "afda672c9295d3a37951d62a5a32cba69ef000483fa2f1e43c4b504404fe4684", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639149580, "uuid": "4697807a-c9bb-4ed7-942b-42a94c63457d", "comment": "Malware payload (SnakeKeylogger)", "value": "d2c57cadde25867aa138bcca3f14afce91dcb99b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639149580, "uuid": "d041b819-bce3-4be1-b7e1-6b3b1f9216b3", "comment": "Malware payload (SnakeKeylogger)", "value": "99494d7c880d2b6325bc3a24c90dc3a900664c2323f5cee7231b8eb7625ac4985a49394df4878abe1345ae9ef5ba49ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639149580, "uuid": "778b2d80-17a3-4088-b859-2a76e4ae607a", "value": "T10205023B52985AABC2C50731AE56D079EBE6AC4A1E74911F07E0FDEF3B7E4D68507200", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639149580, "uuid": "e540651e-bf7e-4abf-af85-21c026899c4a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639149580, "uuid": "0dc264b0-93f1-471d-a05f-fcad8db55306", "value": "12288:9r89dP/ZbicWayMt5T9M53XXvVdWYtSYdBin6VuwiEyw:8dHFoadT9+nN0mFdBbAwJyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639149580, "uuid": "c8b62ae3-4a28-440f-a21d-5f131cae61d9", "value": 843541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639149580, "uuid": "af12bdca-7737-471e-9363-dba434dde764", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639149580, "uuid": "8004a7da-a902-4bea-9ba2-dbe2cfe116a6", "value": "3976590987654560009909.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6c99fc-59be-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639143490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143490, "uuid": "91daea74-f465-458b-a322-f690f80440cc", "comment": "Malware payload (Formbook)", "value": "0b50a75467d375b948edc7bcb6f01b60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143490, "uuid": "a1161ca8-0c54-485a-b527-2b6696f67691", "comment": "Malware payload (Formbook)", "value": "b13782a081582cd40a427da82c93035d3a59cd7dffea1e9b3f3821c55fde233c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143490, "uuid": "4989c299-d82e-492e-96c7-e625769b009b", "comment": "Malware payload (Formbook)", "value": "d9d70c204806b74acf34e95e44f5528031e777a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143490, "uuid": "0850eb56-de7c-4793-819f-d28d99695736", "comment": "Malware payload (Formbook)", "value": "0c1cb719cc04ec032c6fa9ef2066cb57e928f149c8634600c76c1707f76348a53f2058be716bc207933de7901453ca72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143490, "uuid": "c8ff3313-019c-48e1-9026-5f4fb9421f4f", "value": "T16954124BB6C0684BC2CE9E3362F2BB7EE7BE860E110105778F955F6338057A64D5A097", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143490, "uuid": "2bbb14df-e9ef-4e76-90a9-543ff302e7e5", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143490, "uuid": "5b3e7534-5c86-4ffb-9b92-8b28331b05cc", "value": "6144:rGieWZfaQ1pqOM/62zIalek+sK2yuaFy4iK2eO0dnzc:6I+OakkhMuua0O0dnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639143490, "uuid": "d2293faf-5055-43d9-b037-2c3967b378bf", "value": 280236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639143490, "uuid": "399d2147-7a1f-436b-8056-8ccce5066745", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143490, "uuid": "14ed5f08-239d-4564-ab0d-c5bef060f0ba", "value": "0b50a75467d375b948edc7bcb6f01b60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b0b695-59ce-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639150193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150193, "uuid": "886d9e56-5c6d-42ca-b205-cf57f5587a1b", "comment": "Malware payload (Vjw0rm)", "value": "f7f0fb3bd069507c55637774e8105ebe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150193, "uuid": "bf627514-0340-4b26-a4b9-42beba7afedb", "comment": "Malware payload (Vjw0rm)", "value": "b18be335fb0f42452659e206d097036abb5d63e9c31c6af9b89588b81f1b42fa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150193, "uuid": "12acb05a-9691-48e4-9d96-2be18ff6c728", "comment": "Malware payload (Vjw0rm)", "value": "886b54c5e1d0323e6ee772bd917348c46c744b84", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150193, "uuid": "055a5517-e154-4838-a65a-b5fc818bd44c", "comment": "Malware payload (Vjw0rm)", "value": "5f296a4675d423fa8889bd597030f0e7193c04f041ec94b6d17e9d93a3837f3e89310327ea2ebcadc7e6f61a2f6de8e6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639150193, "uuid": "85fc2945-b477-4567-a035-1ca30dcf8dcd", "value": "T17F146CB07DC4157DEA8A35A366DF551F03BC60637580904AF992F2242EFBFC0962BE19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639150193, "uuid": "541ed2c4-f64d-4599-bcde-71619158add0", "value": "3072:pfWBHEwnYo+mU8k8foqZQVOeylCm+QUqVU6gMAolC:pfWBHEwnYoZ/IkU6gMAolC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639150193, "uuid": "455079c5-3127-46fb-b08f-c43c70c6849e", "value": 209004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639150193, "uuid": "4d4a32d9-195c-434e-9476-4d225b347302", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639150193, "uuid": "b92f2678-60e9-44e4-a38a-ff807ee9b00d", "value": "SKM_12102021110021.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f838b48-5975-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639112226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639112226, "uuid": "57e86607-db99-4fac-a328-eec4619a329e", "comment": "Malware payload (njrat)", "value": "a32cfcc44e02557cdaa58e5d0d0bfecf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639112226, "uuid": "b046bae5-e341-4d58-b545-b62607d007ee", "comment": "Malware payload (njrat)", "value": "b1a1e14bc010b33f4aaf307745f56ebb6fc7aa2f156c1c38c645432ed7bca50e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639112226, "uuid": "506fc136-2d0f-4dad-b717-9449b1abf690", "comment": "Malware payload (njrat)", "value": "e528b1545dad304a0e11c5b3d85a54bcb6d08124", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639112226, "uuid": "62fa1da0-a1a7-410c-a813-a6ef29962e80", "comment": "Malware payload (njrat)", "value": "5168a5b987e6f8f629007141f9c4a93a5e32383bcc05155ebedadb4c5b7735b4413e7476916cd2660687521e20e652fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639112226, "uuid": "5e010420-b133-4e06-a920-8f771f329abf", "value": "T19893E84977E56524E1BF5AF79471F2404F34B44B1602E39D49F218AA0A33AC48F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639112226, "uuid": "ef073421-1058-47ba-81d1-47f4f587398b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639112226, "uuid": "8cbe1cfa-089c-4c13-84b1-87cd8d82199c", "value": "1536:h+wYW6qbkW8aVpO1ARkoojEwzGi1dD+D7gS:h+k8aVpO2SCi1do0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639112226, "uuid": "16d69d2a-6754-4524-8a3b-ccc17b907418", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639112226, "uuid": "0311f163-969d-45bc-b046-e0608d5c3fb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639112226, "uuid": "ebb04ab3-c5f0-4adf-8abf-10bd4f0ece90", "value": "B1A1E14BC010B33F4AAF307745F56EBB6FC7AA2F156C1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c52b37-59a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639132188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132188, "uuid": "4f870011-e564-45cf-9366-9366522ea4dd", "comment": "Malware payload (Formbook)", "value": "d0b2d25bd003ad5d90349e219687d62e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132188, "uuid": "b12bb715-f42b-4c8c-96d4-4626748dd344", "comment": "Malware payload (Formbook)", "value": "b21871cd30cd9e3cad6cc9f06080d375bfa0172cd4a33b6620fe25a95a70f2ea", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132188, "uuid": "0fbb0ad6-debe-4c81-8d8c-70003c4206da", "comment": "Malware payload (Formbook)", "value": "b2c4d477c7e6e1cbd860d4ef6e0ccf7b9941009a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132188, "uuid": "a776f927-4daf-4c35-b5c5-43501dc2b75b", "comment": "Malware payload (Formbook)", "value": "78489b8a81c0e84ae933885c73c3541a4733ae3da318e1613e3b3a2b6f56097e757f60c2e06ab4f043ae9a4ff254a2bc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132188, "uuid": "f5f16878-ba95-4936-958a-174d57315511", "value": "T10A34131F3F7E8294F292653989A07EE4044CCD2C75049D541F3E316AEE339F0AA7796A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132188, "uuid": "5bed3aa7-90c1-48eb-a6b5-b2ca2aede397", "value": "6144:6qJMzOqYPqZK7oWq82qBzLvbFkteo5NO2K4u2mgo+Uk:6qJMzMPqE5PZutE92mZxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639132188, "uuid": "b7d4b55a-207c-4c58-a06c-06069dca1e67", "value": 234952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639132188, "uuid": "ebf61f5c-2c0f-47aa-83c2-01744eaa645f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132188, "uuid": "0e34621a-6660-40f5-9a3d-7f0b12de85e0", "value": "Order listing.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284cb08e-59ce-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639150251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150251, "uuid": "ed043a27-f618-4d69-98b7-c513f6b4b995", "comment": "Malware payload", "value": "873c772282a9bc3cf6afc23dd1799533", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150251, "uuid": "74bc5265-5d11-416f-aade-4107366e8260", "comment": "Malware payload", "value": "b325d03cc900f42882adb04ba77ca8ec03cdd92dc295c03fe219d9bb339f611e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150251, "uuid": "d8777867-e8da-482d-8704-4924f337ff3c", "comment": "Malware payload", "value": "09faeb0911eff53d6d6f7df3a77707878ca3a550", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639150251, "uuid": "c1bed856-f907-43f0-be24-003a74007f6f", "comment": "Malware payload", "value": "7f6fefe87c91a6d54b67b24aaf078c6d0d99d9d4c7f8b23d2f72e74d5f74c30853825258ae09c2475699aa8268e7af9c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639150251, "uuid": "dddd9d9b-85d5-4ea4-9fcd-7cf6216b0928", "value": "T19AF0E969E41BABB90C7320CFB7D70CDA4C4D188B5625802455530389F349445965961F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639150251, "uuid": "27ad1523-9786-4311-bd5c-e556aca1d966", "value": "12:moVyj7mg5KUzVE0B2RnLjGmNog6pgRTpvkZC:moV+iMKU5E0MRLjMgHTeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639150251, "uuid": "e3279abc-9c8e-4adf-9574-bbdb3e622805", "value": 548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639150251, "uuid": "4f088d2c-2e45-43ef-8768-4e1cafaca4fe", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639150251, "uuid": "ac6e80b9-13e6-4fb1-a304-9006b0599bc3", "value": "RSOJD50BSSKODH.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e714dc4a-59ba-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639141981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141981, "uuid": "c7a6d8fe-ccfa-4890-865e-b30364303dae", "comment": "Malware payload", "value": "4bddb46aa0336868e69240085ecfe32e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141981, "uuid": "643aa93a-d3af-461d-8d70-7a7af1be56f8", "comment": "Malware payload", "value": "b394a9383e13a8fe41ad484795fca3cc7a65ddb943936755a8d7ef8eba666568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141981, "uuid": "c81638c7-bef0-444a-afb8-61c3ca6655a9", "comment": "Malware payload", "value": "08663c41b1fc65634de29980d22733eb0e287c98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141981, "uuid": "a2ba21ad-0b6c-4b1c-8343-8b48fd413da9", "comment": "Malware payload", "value": "b5fc3c9b40a93db3dc46cea2feba06faed4bc309c99211a12ccef7bcc3527a9d6fae89894e97caeabbca0437f59e56e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141981, "uuid": "74fb612c-63fe-4a97-a5b4-fdb655122784", "value": "T1BEB5223D71848A44C6493D7ED487C1A04BD2A7992333E39EEA6B069B2F433F18D952D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141981, "uuid": "7fcc00e8-8d27-47ab-8de1-03fe568ab801", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141981, "uuid": "5fd0b616-6823-496f-af96-f8a571796b0a", "value": "49152:shAqT5GG5iVgP9e5mpjYhq97rGTidqxqo1y62HxG2+jqNyF6e:shRT5GRVgF5pjYS7rsidqVyIoyFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639141981, "uuid": "e2f2dc17-26fc-4ae6-a365-74d8fb7d61b6", "value": 2416864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639141981, "uuid": "0e5916fd-aef2-46f2-a218-48695a05d9e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141981, "uuid": "e24fee16-12ef-4dfe-ae09-2283a6a7a973", "value": "file4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918329ee-5963-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639104471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104471, "uuid": "3216fdbd-abff-4500-b30f-68f3692586e4", "comment": "Malware payload", "value": "5df780428f90630be572beaa4b9d68e3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104471, "uuid": "61a894a2-c293-4b09-b253-605f4f6389be", "comment": "Malware payload", "value": "b3d40d5f0799a2152091ab00ca51d4233d1de2abb064f1b8995fd572d2839e2a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104471, "uuid": "68acef59-c905-4854-9cdb-590e3dceb756", "comment": "Malware payload", "value": "a560575eac7c3e967f91ecf5a0bd567827f1a78b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104471, "uuid": "93d819e9-a948-4114-b6a5-e64bb90e8138", "comment": "Malware payload", "value": "51d2b6205c8bcc159ccd0dea2249b14a6368689be65790ed16f63af34ab04b7432d5ef02d18f7023fb5792432f94f70f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639104471, "uuid": "b0da948f-0a59-4767-9c0a-3043805a7d19", "value": "T1D71423CB2603ABCCC02709DF6C4E524628D9F1BF033EC955A639B62ED8D69743974623", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639104471, "uuid": "160d367f-afee-4b70-94e9-c426e9f704c7", "value": "3072:x99uTH7FPM/ijVyN15iRl8FcrtziSiH8tznk3nltjaHKMeoPgza5xpqwfICriwjm:x99uj7hM6jV+1HFGo8zsl5aqa5j5EImX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639104471, "uuid": "a1757478-cf18-4f09-9a5b-1aaac3b79f0c", "value": 200685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639104471, "uuid": "48697612-852a-4832-97c2-9f65e1f1e3e5", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639104471, "uuid": "fdea0462-36b2-4a2b-a916-c83e6e0bfd12", "value": "sitdolorem-2702446.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1bbb4d6-59eb-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639163044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639163044, "uuid": "0c420564-b75f-41cd-833b-abc5ed0dd236", "comment": "Malware payload", "value": "5fa8c2a5fa1e58f558f582fd7d1d0e37", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639163044, "uuid": "5995b827-fec5-46b5-8abc-9aa6b37ea5ad", "comment": "Malware payload", "value": "b452f57c50edd5efb9efc60c08e65643d34baa804f37c296abdc807f47471e0f", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639163044, "uuid": "f613ba54-33ee-4d72-957c-91353c9da0e0", "comment": "Malware payload", "value": "413f4d183edca539895e994e0e7affbc55647dd1", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639163044, "uuid": "56ee4076-0fa8-4c38-a091-d817a25b7386", "comment": "Malware payload", "value": "2bd9ee9995dc122e86b7a0ac4c8d406765135496f8d9955459ef3c3fea9760bcb311a29ba776fe9c57afcfb1c0973147", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639163044, "uuid": "411bad36-63d3-4e89-a26d-033380495fd2", "value": "T151E3AE07EC190A43D4648BB8FD0B1D3CBE2D192DA9E163FD14261DCA6EA52675EDF00E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639163044, "uuid": "8fdfd1f0-8758-45b8-bc34-368655c71314", "value": "3072:YF7K/FGOztQNL0cBLJUq1dJZvPpz7+fp7Ktr7:YFW/0OzSNLJNUydJZvPZC1Ktr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639163044, "uuid": "8ef3caa1-2a85-4cde-9b4d-ddc5a7eec2b6", "value": 143948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639163044, "uuid": "6e23f9b4-d84d-482f-b947-a73b3d664029", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639163044, "uuid": "18567570-d645-4e50-8406-764689dc0c33", "value": "GP-1583223053.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d86428c-59a4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639132194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132194, "uuid": "2e27c097-a52e-4e20-a51a-6ab7df3c85d2", "comment": "Malware payload", "value": "26d138f902ffdb2d0d1fc19435a58545", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132194, "uuid": "a5fa8ce1-9796-4375-93c4-1cfdc65c00b0", "comment": "Malware payload", "value": "b5995c051a3fb690ed9ba74fdfbda5f7cbab704f22050e4e877f810f167d4406", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132194, "uuid": "a89de13f-40bf-4bd7-b881-75b935f9130a", "comment": "Malware payload", "value": "5263ed18b305d7f78fc975f696395063da8f53cb", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132194, "uuid": "777aa0ce-41c2-4dc0-824f-d6217b5493ef", "comment": "Malware payload", "value": "203834b78661208001528cc15bb2af61cfb1db9b7dd54e53d02b8be8c7312c09f3a42aa2249c6b5991248420866f6f91", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132194, "uuid": "9f50cbd8-a38d-4c92-996b-3c9482100eb9", "value": "T18B341299BF21C086D60327B4F3DC06EAA365ED8AFDDBBA92D10130E4167E995108F375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132194, "uuid": "6d8388fe-dac1-43ee-b835-a76b14675b5b", "value": "6144:sGCe3OtuO0gYECXQx2MynKtlid8/oQwMhci1q8LqxX:sGC1tD0UP2pn4iZQ9hf1q8qxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639132194, "uuid": "300caffd-03b8-4950-b8fe-1a46a112121b", "value": 234472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639132194, "uuid": "409cd3b2-f17d-48d7-a4e4-650c9f5c12c6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132194, "uuid": "8a622c05-69c9-47ee-a984-eeae887e32ae", "value": "New Supplier Registration Form MopcomsTurkey.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38e749f-59da-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1639155746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639155746, "uuid": "ad3674fa-a539-49be-b4a3-deaa1d9dffdd", "comment": "Malware payload (IcedID)", "value": "5733db1ac948a3a87c0298c0c8f153a1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639155746, "uuid": "c58bf5e7-f202-4668-8654-d700ee02b946", "comment": "Malware payload (IcedID)", "value": "b6053ec5f14ce232c394ae971a542437ca2d9654bf4fb5c6c9dfa21e415a71d4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639155746, "uuid": "20a3a14e-1e9a-40d8-91bf-239d02425d43", "comment": "Malware payload (IcedID)", "value": "0a9ab84c890dd7e259e47eb7a98e8a0505ffb99d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639155746, "uuid": "7f71119b-d058-4b8f-abbd-054ced6cc1ff", "comment": "Malware payload (IcedID)", "value": "ad6120d849f46c54b149f7396f79076e33d8ad51d8677f4a1b1264dcf92fce147b0e07fd88756253e0cd679356dd1cd5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639155746, "uuid": "f63c54f4-c8a4-450b-b98c-d6c044f6d6db", "value": "T15B044A3FDEEAE0DCD50910F1D73AD2679D36F52DE43AC6239B4A07C8B150E1298AE194", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639155746, "uuid": "934d8761-3c3b-4d55-8d2a-15a144353898", "value": "3072:LoeBs5e8lMTPUjogWNCnD5RxwG+g02+Y/QMbjvT:LoeBGe4gDTMlR62F/QM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639155746, "uuid": "753fced3-a57c-4cf7-9a87-5df737834fc1", "value": 175616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639155746, "uuid": "3bb2ab5b-5599-48e1-9e6d-3086fdb1b4c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639155746, "uuid": "519e938d-90d9-443f-994a-3fcdb0d6d26a", "value": "5733db1ac948a3a87c0298c0c8f153a1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09084855-59ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (DanaBot)", "timestamp": 1639141609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141609, "uuid": "e0c9d694-9caf-4e5c-bdbc-d267d2999232", "comment": "Malware payload (DanaBot)", "value": "f1de31c32b8f35e5b72865701581e047", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141609, "uuid": "5d012008-82ab-4781-ae48-3d69c3c2a54f", "comment": "Malware payload (DanaBot)", "value": "b62632795f15efe4e59211c9f808f250d3beff2d62d48e58a1fad692485838b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141609, "uuid": "d1c0dd8c-ec6e-4054-bcba-28522d0cad86", "comment": "Malware payload (DanaBot)", "value": "90f0b7c2b5ab7b2be79e3b327652976725904c5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141609, "uuid": "fc80b201-0172-450b-bd0c-cf48efba198c", "comment": "Malware payload (DanaBot)", "value": "8b55c563967e908655055568cf10ade2e599818b1642d7f9e71470291b07f899c9d1435608fe82a477cf7f0a7fb2f910", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141609, "uuid": "00a5c273-1fe6-49eb-8f7e-3c1c0a031dc7", "value": "T1C2852331755AC936F5E30E70192792C5C46BBD21D9A0446BE2606BAE2BB3E4C43F231F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141609, "uuid": "d06ff5e3-f06b-4441-8065-bbafc9c2aa13", "value": "05e6c127a979d4c88f42e175bdeddbaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141609, "uuid": "2dd9c91a-886a-4d85-bee0-208626247b33", "value": "49152:YUH3L4HN2ebT2ewiv4nqIikDHKmgQTIo:FuT2ewiAnVirmP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639141609, "uuid": "fd040739-5ccf-4770-9e02-08b7ba85cd88", "value": 1817600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639141609, "uuid": "7dfcb186-1216-4109-88d1-575e7e1f3ea0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141609, "uuid": "292c8e4d-20c0-414b-a29f-d445aa35a0b4", "value": "f1de31c32b8f35e5b72865701581e047", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d1df9f-59b5-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639139756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139756, "uuid": "a6f7b249-c4fa-4ed6-ab48-b45a93f1668b", "comment": "Malware payload", "value": "b748979e4e7fe319b428f223019f4348", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139756, "uuid": "19876ed1-1c80-4c4e-94b2-37d7ad7a3e1c", "comment": "Malware payload", "value": "b65cb0cc1f773bd017c20c2a3f8062c9fdcde62a4abfbda062eb8bfa86d68ce6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139756, "uuid": "18b5fab3-a98c-4228-899e-2e35fac8b340", "comment": "Malware payload", "value": "fd7a36cc96d008d440f9f9b08ef1a00cca79960f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139756, "uuid": "93b3cddc-7967-414a-a6e3-08a0393a7426", "comment": "Malware payload", "value": "8dddc39c530e5f60fdc4865dc842442b2f2d76e3dd72612335ca085d49f38935ec6c6209f47011bf8227740d7c5cf74d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139756, "uuid": "1a9a9b3b-c5e6-4495-8eda-eaa88da916c1", "value": "T17425BE0273D2D036FFAB92739F5AF24656BD69290123852F13981DB9BD701B1233E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139756, "uuid": "3dffedad-90eb-40b6-9203-1933772efff1", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139756, "uuid": "a8a36dc6-cc75-4d24-9c10-ce7cf073a382", "value": "24576:SAHnh+eWsN3skA4RV1Hom2KXMmHahc1nEZCbm5:Vh+ZkldoPK8Yam1EZCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139756, "uuid": "f7b9ae42-3f7c-466b-a911-a20c46766ca3", "value": 1016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139756, "uuid": "00fddfc4-c070-4026-8330-42f768d30c5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139756, "uuid": "9b08733c-ed9f-4948-9037-09b4f10ec11f", "value": "SecuriteInfo.com.Trojan.DownLoader27.11756.6125.21181", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67257f07-5997-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639126734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126734, "uuid": "e6c97b1e-3d1e-4ac8-9242-ac224dedb60f", "comment": "Malware payload (Formbook)", "value": "b08224cb12c7c35e202004c112b36243", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126734, "uuid": "81f77230-31c2-47df-a992-00810b157643", "comment": "Malware payload (Formbook)", "value": "b66d6c6e18090a5f05fe4ecf925b670a2d98737e2557ecc57aa269697022f6bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126734, "uuid": "a9c9a68b-a38e-4b91-a386-7b2dc0dad528", "comment": "Malware payload (Formbook)", "value": "d368acb1bf48bfad5463dbe2437acf99b00c67c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126734, "uuid": "ddd19f37-b2cd-473e-b506-97c361e40778", "comment": "Malware payload (Formbook)", "value": "92fb284280fd63965158f822d79e5dbf3ca60ca40de42b6b63cada7a6b9f8a0ed8e3cc7dea364236472fcd9e47b041c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126734, "uuid": "8c31e07f-6ab5-4564-ad71-7fa45b14da12", "value": "T1B9641256B8C5D36FE7E6853A64767BF8B3FD09F64382095B43C42F263E220CB8916521", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126734, "uuid": "c17ac281-38c9-4491-a16d-eabf9f50a251", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126734, "uuid": "07a17bc2-2a42-41d3-9166-ce3bb3bc2e55", "value": "6144:rGinAVFSVufZe60R8O/6M47C53HhDvStb4cVoczrBdfK:bkUAZe685Sb+53Bi4c6czrBdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639126734, "uuid": "02942eed-4bb1-41bc-91e1-f934665a0292", "value": 312689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639126734, "uuid": "e240f5ed-c9c8-47d8-b9f0-bb3757d3d740", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126734, "uuid": "32973a49-075c-4179-89d6-a7df2af21302", "value": "b08224cb12c7c35e202004c112b36243.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acdf5ff8-594c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639094639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094639, "uuid": "111a955c-cff0-4026-b3ba-f49d1826771c", "comment": "Malware payload (Heodo)", "value": "21066c36dccd667bb6277bd479e29894", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094639, "uuid": "06802370-a1f8-4ac0-b910-c0189bc4d860", "comment": "Malware payload (Heodo)", "value": "b8638843091200a2a06892a82439640a0ce3e33d7b17d5400ea20e771be6eda8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094639, "uuid": "9aec93c3-158a-454a-b4d2-169623a4bf69", "comment": "Malware payload (Heodo)", "value": "cd04de529c0cfdfaf548388fc5d4974db7f4ed9d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094639, "uuid": "2f8e89f5-e08d-4fdf-b199-6d0ae349c449", "comment": "Malware payload (Heodo)", "value": "19a38bad42da65aecce047a491cca613adbf102cd0ff8a2cbbc2564219721b115e584becff2cc92fbad50c780cc83799", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094639, "uuid": "8345e25a-d565-42ca-a7ac-6490eb83a2d3", "value": "T15944BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094639, "uuid": "284e9db3-eede-4146-a4b6-3f21b69f8f0a", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094639, "uuid": "e50925da-ba93-4caf-a4d0-05d03f65728d", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBi2ypv:6jIG/pjjuLbJLmGshoCUnWTepv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639094639, "uuid": "5bbe3e35-cf84-4509-a0cb-1eeb69b7d3c4", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639094639, "uuid": "7638d9b2-1f22-4b4d-b564-14604dd0c356", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094639, "uuid": "aeb6884a-cb4d-4e1e-b73d-fd25a3075dd2", "value": "emotet_exe_e5_b8638843091200a2a06892a82439640a0ce3e33d7b17d5400ea20e771be6eda8_2021-12-10__000353.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a6fe25-5991-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639124178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124178, "uuid": "c7bd9fae-f35b-4258-95be-d8581eaad361", "comment": "Malware payload (SnakeKeylogger)", "value": "d7e0ec4bf83fc957091eefa0100a57fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124178, "uuid": "8443b1fd-7e63-45b0-ac1d-a41096c98a31", "comment": "Malware payload (SnakeKeylogger)", "value": "b8f617eb5f87e11164980277be240af87f4df315d1d2b207360c83b34eafa4ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124178, "uuid": "704397ad-907f-4cb3-bb4a-20fe660dd172", "comment": "Malware payload (SnakeKeylogger)", "value": "501ea6e958c294f87497802cde4c5065c169fc80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124178, "uuid": "292eb9d0-0989-404a-a309-3b1c1ad336d7", "comment": "Malware payload (SnakeKeylogger)", "value": "27b8e12637dd001925a10d15ecc119049a08219894852c50e738ca53d8262223d753ec8d30851c70dae862f0d0711d32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124178, "uuid": "b65b65e0-db1c-4614-8b68-4397ad235c7e", "value": "T139B48C27FEA91845D641B87D274FE0A10875DF046D7BC24A6B697E32B3B8CC429077CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124178, "uuid": "061c3a70-ec89-436e-88c1-8efaaa75c004", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124178, "uuid": "6a978602-14a0-4a1c-a6d0-c285cfb925f2", "value": "12288:qeuE/7Mek/2p6aJ6coQIBJMEK9PefmAyeWT8:QoJLocoQYGdWTZM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124178, "uuid": "2d987f3f-3e0c-4f48-a114-a75ed78ded74", "value": 524926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124178, "uuid": "3e9313ff-0ca2-451c-8167-201683321e46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124178, "uuid": "8933b6c0-0a39-4cba-a6dc-7893326961d5", "value": "46789009876545678098765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cedf32c5-599b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639128626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128626, "uuid": "da9752f1-c57e-4e0a-b840-173804931bfc", "comment": "Malware payload (Formbook)", "value": "53d8db967f12c23f40765b1416d8a07a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128626, "uuid": "ca86080b-802c-4734-b783-79e8a87344fd", "comment": "Malware payload (Formbook)", "value": "b92975326017e182a0f02ac457cca1ff63dcf585eb02d19872c85389e5466e67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128626, "uuid": "24ad360f-4401-47c5-a3bc-c44030a96994", "comment": "Malware payload (Formbook)", "value": "385a393f9de2b5f3386c3b1ca0a3b204a72b82ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128626, "uuid": "cc62ff03-5654-4733-b2aa-222678d3db04", "comment": "Malware payload (Formbook)", "value": "98f86fb1df7a85a2db4a6fef7b33a77a4e9e8ab30b6bdaf5764b7c2d96c76e385b803965fc0243ae8ba74be0894fdd53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128626, "uuid": "e62abbe1-5657-4a09-8df7-776215fe0e0b", "value": "T12345E15D73604783F1282B79C9AE6E0403742C7D7482D7D8BAE5739BADA27E6483305B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128626, "uuid": "e43f8069-ed5b-47e4-b212-826e889e6bbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128626, "uuid": "f7ec990f-9b17-49b4-84da-b758026e19b8", "value": "24576:eFpxyXnUEgtmiO3bEmk00vw+bT+4R5EhCNJDu2ZaA7DJ9DpgqlzyqOen:mxyXStm/VraLy4/EhCNJz3DJt9lzy2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639128626, "uuid": "b89699c4-8bcc-47e5-8344-bff793cfe316", "value": 1193472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639128626, "uuid": "a4c67b99-878b-41a6-b715-b7caa671852d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128626, "uuid": "e01d13ec-0991-4d23-8b3e-59c2523a73c3", "value": "GLF786HAFH.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37521b36-59ab-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639135244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639135244, "uuid": "9ec929c9-968f-46a0-ba04-351649a1b371", "comment": "Malware payload (ArkeiStealer)", "value": "d37668d81ededcddc98a88f90d2fbee0", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639135244, "uuid": "61d249df-e562-4c5d-811c-c8e17f1f205d", "comment": "Malware payload (ArkeiStealer)", "value": "b97794e5522653fe9154e1b7c0037eff5affc213a968bb70852f5ba685aa1ff9", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639135244, "uuid": "5e60ce8a-a449-4222-aec6-dccd9a0b4233", "comment": "Malware payload (ArkeiStealer)", "value": "473cf4c992061859dfae876d75a2ca12628511c4", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639135244, "uuid": "c234c424-8d44-4412-b1ee-1d3b99e74adf", "comment": "Malware payload (ArkeiStealer)", "value": "ca096c9100917a318cbc5bf0c02693a19110354d959791a0668041eec8f3c30f3e7cd570dc030abab1431956c8e83cc6", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639135244, "uuid": "6063641b-501f-4e99-a2d7-9042871eb48b", "value": "T1AE44AE3176E9C571C2634F3084A09AE45E3FBC626A20506BE364679E2F72FAC55E131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639135244, "uuid": "949080f0-b4e5-4432-a0a3-7520802c7e24", "value": "d9d80fc68e5de9a4648b84065bf1f199", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639135244, "uuid": "30e49a91-135f-41a5-a6e9-80ccafeb8932", "value": "6144:k/JLjNez0878kA5GzU03V7ce7awuzbgwu6Qigas:k/Jj877YGo0l7Ltunn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639135244, "uuid": "89b753b3-d861-4985-b274-cac1e0e90de7", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639135244, "uuid": "b69272b9-eb0e-4d72-a6d4-ee520d422648", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639135244, "uuid": "47c3182b-16a3-4652-a82e-3b9b733da898", "value": "SecuriteInfo.com.Variant.Fragtor.46790.29546.23787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4325d521-59ec-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639163181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639163181, "uuid": "e148dfbe-2754-401f-8d6f-442eb3e785be", "comment": "Malware payload", "value": "bc1bd22792345f7316a1e96d4ddb3916", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama143", "colour": "#82C71F", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639163181, "uuid": "cfffc0a1-cec3-4c9c-a878-c053c5035b03", "comment": "Malware payload", "value": "b9ca73ddbf2962e60f3c56dc327da233c9c39e91afea9597436df329825a0c14", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama143", "colour": "#82C71F", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639163181, "uuid": "0403fc58-5edb-489c-ae2f-5b81ce714b41", "comment": "Malware payload", "value": "e898a8ba3b948de8ab46c3ce6b10e203e5ac8373", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama143", "colour": "#82C71F", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639163181, "uuid": "451050aa-b2f7-437b-9cbb-f94d48dea3df", "comment": "Malware payload", "value": "7859042cc4ad18bb06144b520202fa8f1ae9cb6bd5611697a342da2b73fcbbb336aeb55d32af6d7028deed02f184d365", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama143", "colour": "#82C71F", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639163181, "uuid": "c9d880f8-0fd0-4bc5-9eb3-8361c8a8f321", "value": "T1B9E49F37F2D14937C16F263D8C5B7258E92B7E412E38984E6BE41D4C9F3AA403626397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639163181, "uuid": "caff0e9a-d031-4510-b8c9-5aeb68c2c27d", "value": "779533981cce29e233fa98f54323909b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639163181, "uuid": "dd458373-2542-4b2d-8beb-a41e4c90459d", "value": "12288:l4V3PLzRyyTYI8N1pYekopeZWPNyGgpEMaLClRXYeaWg01/RZK7NSbM:WfLwu8N1CYKWozEMaLC/7tg01/mgbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639163181, "uuid": "d5fc13f8-f43a-4a55-b1a8-af24afb3a07a", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639163181, "uuid": "50dab8d3-9372-4110-8263-68802a624650", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639163181, "uuid": "548aef3a-19c9-4164-b4ba-d24c356b2498", "value": "b9ca73ddbf2962e60f3c56dc327da233c9c39e91afea9597436df329825a0c14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3112c2d4-59bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1639142105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639142105, "uuid": "27511fa4-e153-4f1b-9c81-9e8435378893", "comment": "Malware payload (IcedID)", "value": "7b040107a72797e0930b4a08ebfc6a69", "object_relation": "md5", "Tag": [ { "name": "1677747888", "colour": "#DC4208", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639142105, "uuid": "2943b96f-1877-4852-a877-bdcc658dc498", "comment": "Malware payload (IcedID)", "value": "bbc7fdaf1d7c5886d564096f7923c75235a373230d60a40a20670be117f860dd", "object_relation": "sha256", "Tag": [ { "name": "1677747888", "colour": "#DC4208", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639142105, "uuid": "d34b4c14-8e69-4f52-83ef-47aa5063889d", "comment": "Malware payload (IcedID)", "value": "33e8cd480a9968ed3f6dc439b125a43463b160ce", "object_relation": "sha1", "Tag": [ { "name": "1677747888", "colour": "#DC4208", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639142105, "uuid": "a69eb555-82b3-4c0d-aa5c-b3faacf6cca1", "comment": "Malware payload (IcedID)", "value": "04d2a38544d605489f412c29b2f87a9a94b60fac2f0edbeae64e9b18fd771c0ff2aa82c93791e5927cf21f0190222850", "object_relation": "sha3-384", "Tag": [ { "name": "1677747888", "colour": "#DC4208", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639142105, "uuid": "bf8b199b-9379-4fff-9ce6-9003aaac0993", "value": "T1F1B407BB75976244FFB14C34AFE875F5CB93283AC96FEAF08691B0302A64091EC46517", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639142105, "uuid": "2b39c9d5-4d03-49c6-8313-8cec22c6d88d", "value": "12288:1s+jzJ3Wav5kdFcImyeVCKjnBpHMuoznN+T+:1fjzBgSVCKjBSNY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639142105, "uuid": "5117263d-2d8a-4b4b-9365-76fbe70cc111", "value": 531584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639142105, "uuid": "e3b4d9c6-f1de-4e6b-8c30-3b812b222e91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639142105, "uuid": "070e6154-e9c1-4d32-90f8-eb15e7d8c545", "value": "girlKarol.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4fbed9-59b4-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639139277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139277, "uuid": "c27ff0ac-ec9e-47d5-afce-220f5a069d7e", "comment": "Malware payload (AgentTesla)", "value": "0a3a1385c70ecec991de3baf9ea504e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139277, "uuid": "60e541b7-de66-43f3-8f30-80f0efbf464b", "comment": "Malware payload (AgentTesla)", "value": "bc1c5068758bf788a3e39e19e6eb76d8cc3600b1c7cc0e710cf960a9e7cf3f1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139277, "uuid": "f69897b8-c30c-4b56-a871-8f177f6c437b", "comment": "Malware payload (AgentTesla)", "value": "86816fa13e9cba505c8566460d40d83d38e8d0aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139277, "uuid": "99c12da3-940b-40be-9326-0cdac47fd541", "comment": "Malware payload (AgentTesla)", "value": "e4b8bd89963871697e76faeeec4673214cb08b83285bebbd7f8f125fe20dcc20f40b484e13587c4d0df6cdf5d830a7cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139277, "uuid": "464ce4c3-8474-49c8-83d7-78f474b2de31", "value": "T116A4E0877651D1F2D1795A33BE83981E62272EF4EC21C90A77E3F35A24326A14D046BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139277, "uuid": "2a4160c0-ff3e-489d-8298-415585c93fa5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139277, "uuid": "27ece607-918f-4a80-9ee6-be039dc4299e", "value": "12288:STqUTyVdlu7Ujq5atKk9/7V4nuHT/83O:S1wdla5atKk9/7Suz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139277, "uuid": "71a6bc86-6b9b-4d64-99a9-ba87a368dcfe", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139277, "uuid": "08e15dc5-f49e-4b14-a0fa-2d871a4d9f06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139277, "uuid": "3cbe4a3e-4a79-4015-9321-76bdcd333351", "value": "Project AC (Minutes of meeting).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfb9392-59ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639141884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141884, "uuid": "c7745c91-bd7e-4014-bcda-72fa7eb29ffc", "comment": "Malware payload (RedLineStealer)", "value": "29731e21c9b68d957c7d588887b4623d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141884, "uuid": "f4cc35e9-0e6a-4729-9e0f-fc60207471f2", "comment": "Malware payload (RedLineStealer)", "value": "bd286644044f31b40feac78567d25542391c1c8446bc7c352c0e56aa5600731a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141884, "uuid": "6a1041c1-952a-43c6-9c07-3274db2c2c97", "comment": "Malware payload (RedLineStealer)", "value": "797563d171aab99a29d187bec66179b9f41d6677", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141884, "uuid": "df689a40-e8dc-495f-b594-246c54b1480c", "comment": "Malware payload (RedLineStealer)", "value": "e5f424b898cae293204734d5512712a74ab37e1403d15a0452b8ccf2e8a509f04591f9ba4cc2e7fe3fbc0958d00c99b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141884, "uuid": "ea9407ba-f959-4005-b33a-ee9f83dabaf9", "value": "T1766533506F70FA30C1DF26F43B7F7B5AF127AAA588CCD259B13062881A548335B5F61A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141884, "uuid": "e96c0851-03c6-4fb2-b54b-2ac71da1dc88", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141884, "uuid": "d2bfe39a-fbc6-4f8c-a900-19ac1679a8c8", "value": "24576:68JvXOhEHHC+hASWH3wQez+lWvGtvFr7UPE/Y0PtGkFkEaHNYK3Dp/HEXNsB9:PJfOhEnOW+oevFnUPszPzNaxxosr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639141884, "uuid": "0dfa16ff-243c-438b-bab9-0a22354a256b", "value": 1413856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639141884, "uuid": "f913d00d-a21c-4e0e-aca7-376d5eeec536", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141884, "uuid": "7484597a-408a-4ed1-8f55-17d550a03d8d", "value": "file5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98594395-5991-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639124240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124240, "uuid": "e8c55cff-ecc1-461d-b9d5-9072815c0a79", "comment": "Malware payload (Formbook)", "value": "7bb060c5854b2d98b74402cf9720d4ce", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124240, "uuid": "2e508389-fab8-4b45-9777-133295a4e2b1", "comment": "Malware payload (Formbook)", "value": "bd532d8ac0c16ac4fa4f81ab2f4b9937606c9f6ed6b6268ea1e4714e9210157b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124240, "uuid": "5daa0364-3c40-4454-a57c-f3c2ed2b7e0b", "comment": "Malware payload (Formbook)", "value": "16af0fd7c6ea92758aedd8ecd63d8e192ca278e0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124240, "uuid": "7f72ede6-42cc-44dd-8d04-958321735b54", "comment": "Malware payload (Formbook)", "value": "363c8c42736d5cfbf303e0286784f591ebd3ccc2e5ba674e718cc6e689a4b04c5c0288f347e5b1ac763b4ab333cb3348", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124240, "uuid": "20a7df9a-b11b-46ec-bec0-d2711cbc8fb0", "value": "T12E8282ACC49705988F46AFF82B2B6F45058CB62DF38895B2367CA73557D2C3A811393C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124240, "uuid": "57a0eadc-8d25-4985-a888-d589cc5a6788", "value": "384:0OjuV0zbz9SnEl23kERZkcoim8hvaBscJXDwqMauU+IPiiHqQs+BWZ:0PVWRjBEAb85aBscJsqMauwhsQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124240, "uuid": "763f4f64-1d76-41a4-835a-33a3102e9deb", "value": 17877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124240, "uuid": "2d4a47b0-d31d-4b25-96a8-d8328a6cc125", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124240, "uuid": "318125ee-11b3-4b4c-8c61-e60ccb40fb8b", "value": "20589647.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b3badf0-5997-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639126661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126661, "uuid": "770497b4-9420-4d33-930e-77b98b2e4e59", "comment": "Malware payload (ArkeiStealer)", "value": "de6ef07c3242026ff1b5aec93cebe636", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126661, "uuid": "6da0e87f-ced6-4b9e-b3ab-fac42d3f1a52", "comment": "Malware payload (ArkeiStealer)", "value": "bf33198b06b150ee0397d7fb83a5a0c43d0e2cda70d86e0929a0700a0441f737", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126661, "uuid": "9362fd64-f62b-43fe-9d8c-b4bb5e2fa082", "comment": "Malware payload (ArkeiStealer)", "value": "8beb5e9eff31966eacf014d9b5cf29beafe18c98", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126661, "uuid": "afbeb54b-73f3-4ffb-be36-81c08c83bf8e", "comment": "Malware payload (ArkeiStealer)", "value": "a88a85fb6f517b7115b07c36f38dee0d767490fc0ae0a5f19dda8a8b44b99734bdfdaa2ca09d696e9f20552cea1f7027", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126661, "uuid": "c26f5e66-5b2c-4987-a855-356e0b994b84", "value": "T17444BE3135DAC472C5B30D30A9A0DAA41E3BB8F25A20510BE754B79E2F72E9D5DE131E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126661, "uuid": "b9dea9a6-3bf0-4d1a-99bd-f546025d78f5", "value": "d9d80fc68e5de9a4648b84065bf1f199", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126661, "uuid": "1949ce85-a990-4a2d-ae4f-361bf6d63cd0", "value": "6144:MFJLFNez08vK14lLttYTyDDq7Wr74eZWHejduzbgwu6Qiga6:MFJV8vllLtqYDq7u7HZhunn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639126661, "uuid": "02dd9710-8ffc-4af8-aae6-4081bacca3b8", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639126661, "uuid": "d1e1712e-0cb3-42f2-a872-e451577f30ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126661, "uuid": "3462be11-37ee-42e8-aeb5-5a287155cd6a", "value": "de6ef07c3242026ff1b5aec93cebe636.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f45052-59e1-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639158725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639158725, "uuid": "4626b013-32c0-4ceb-ac87-5b08d0496fe9", "comment": "Malware payload (RedLineStealer)", "value": "391f2e5d0c4819a238cad03c88b6ae77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639158725, "uuid": "89fe6068-0849-4640-b392-7dc7aecc4d21", "comment": "Malware payload (RedLineStealer)", "value": "bfb5d8ab558d5057f1980c1bab9bfb8215d43f41f0065caa25944a973b6af3eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639158725, "uuid": "0315ec13-3cef-43a9-8b41-327ddbc4c64a", "comment": "Malware payload (RedLineStealer)", "value": "b669e25d87b470114761988cb4cf9fbb28fc0a3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639158725, "uuid": "32f8d4b9-cc19-447e-ad0c-9c8f366ceb2e", "comment": "Malware payload (RedLineStealer)", "value": "77b8eecd3052bd128ab9f4c335ef8ff4b945e7ff151df6911abc51189411bfb1846852eade8a422055c83a47c35dc7d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639158725, "uuid": "9cb56dce-9924-4064-aa54-d3bda54b0949", "value": "T1CC9418C5B0689481CAF8B5F2B863E91121F92CAD9EC3564D72FD32361473A97DD0A90F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639158725, "uuid": "77ab0a09-a07b-4b96-b2d6-b9a08b00c0af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639158725, "uuid": "78c4c673-3805-4517-972a-093f05b1824a", "value": "3072:wlOUyO7zxgpuRRCPoRNyHXIQenAKo7MMye9zurKCy5bl0EBUUffNtWEivOOOJZoN:woIxgCfAb7nC0WEG05iTz8aIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639158725, "uuid": "ac4cf56e-a669-4035-997d-aaa12bda5826", "value": 427112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639158725, "uuid": "5be1b8bd-21bd-47ed-b241-ca79a395a028", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639158725, "uuid": "6ce2094d-b0c0-49f0-a461-1d27a8a36a58", "value": "BFB5D8AB558D5057F1980C1BAB9BFB8215D43F41F0065.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c3b5190-5997-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639126716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126716, "uuid": "84b2aa7b-9efc-4314-9efd-f8b6c3e25b4d", "comment": "Malware payload (Smoke Loader)", "value": "b03090cd1bd177ae33407bf0660045ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126716, "uuid": "bb6ac7f9-399f-4784-929b-22e6ea7ed5d8", "comment": "Malware payload (Smoke Loader)", "value": "bfb63daf8e5d09c7a464bfec38d2d5e4737bd3d2c04974616ef46b5ffddcc8f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126716, "uuid": "06feda28-ca96-4895-ab34-53d94fe8e2f9", "comment": "Malware payload (Smoke Loader)", "value": "2813830526d47eda025534dcf6956b468b340dcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126716, "uuid": "6c9d45cd-8d92-458b-a530-9d46e5148d13", "comment": "Malware payload (Smoke Loader)", "value": "009a44e28cef57e6d9656084e985c4be68a883fe2b53714234476d0c0aaa79974c8b05d28b3295188df049b0999d23c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126716, "uuid": "e12ac47d-c69b-481b-9959-12f67aae6d12", "value": "T1BB249C3176E9E971C0A34D3048238BE94D3BB8615920547BEB946B9E2F72FCC55E132E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126716, "uuid": "62d1b3bf-050f-47b9-9d70-2ef415c60c16", "value": "784912eb6940550282ff4b089d7e66e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126716, "uuid": "b86af81b-0cc7-4c9b-8374-3abe0048f047", "value": "6144:DpDHLUkFCWHFY0tf8zPEcHkTuzbgwu6Qiga6:DRHokFCWH2qfmHkTunn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639126716, "uuid": "67f44844-afde-4687-85df-2a3c7ec7cf3d", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639126716, "uuid": "785677c5-3657-4ef3-8e8f-6bce4948f9e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126716, "uuid": "12b4f353-82c9-4ab4-862a-5b12f27995b9", "value": "b03090cd1bd177ae33407bf0660045ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010df11b-59e3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639159205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159205, "uuid": "a3c9b9b6-563d-4aeb-84aa-520b5b4c2a66", "comment": "Malware payload (Mirai)", "value": "714ecce28f1d4bcaf371c3040e0eb2f8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159205, "uuid": "cbbd9a4e-8410-4110-819f-2b16d4679c46", "comment": "Malware payload (Mirai)", "value": "bff98186793368b4dcd7c077484e68961d8e4f976638eb167ed607b304f6b293", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159205, "uuid": "9e83b1b1-53a4-47a9-8c19-e65a0ce8db42", "comment": "Malware payload (Mirai)", "value": "7fdeecd1afc165c4eb3a43b3d4e27b38ab56c2a5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159205, "uuid": "97f00f7c-62c6-48d4-9161-c6f1c1f5b2bd", "comment": "Malware payload (Mirai)", "value": "b171c2322a76e9604498e60bb3bb03811e7df467c2cf96e2b426e295f4ee81b7433d4b72a0b1b1fc3f9f767bd9b28d1b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159205, "uuid": "4c6c1b3a-cc49-4ed1-a58a-5a22d79536c0", "value": "T146D2E1342B0D436287B06E37FA24529B1D0519FC94DBA1BF3898813079167C6BDBA79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159205, "uuid": "c9b4b761-f433-42e1-aea6-fc8c274c9c4f", "value": "768:tbIVYFP04lmQwQw174+NXtiUnNqHWdqI5lYs3Uozy:Oyx04Vw51NrQHWYILNzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639159205, "uuid": "f3a00cbf-ebb8-44af-8983-84705b9d28ec", "value": 30764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639159205, "uuid": "805bfe4a-2a2f-454c-bcbc-470193731576", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159205, "uuid": "1e72e1e5-073b-424b-afee-4cc91f09ea49", "value": "Tsunami.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb69ef64-599f-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639130392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639130392, "uuid": "d862e8d5-4da4-4e7f-b36c-61674357ccf0", "comment": "Malware payload (AgentTesla)", "value": "73783024b3a5f92d89f45d13225cc888", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639130392, "uuid": "89bd2f45-c479-473b-812b-87c3ff14860e", "comment": "Malware payload (AgentTesla)", "value": "c0a870b74d45727a8b1ea6b73a6837c9d5ada2c7288b2a1daf0351ba9bfbef82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639130392, "uuid": "aabecba6-4906-41c2-92a2-adf578a2f3c7", "comment": "Malware payload (AgentTesla)", "value": "289a6f8af215ac7a5a34acacbef9445c591307bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639130392, "uuid": "cd297a84-bd28-4d6d-9fdf-ff81db71968c", "comment": "Malware payload (AgentTesla)", "value": "60c36ac5dcde9c75e993c94a2ee9f744d0219f93763285460a00da2404e08313b9895c2f1cfb075a4e4be3498caa903a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639130392, "uuid": "9320c372-f4aa-4e9a-a68e-5d4d1779065a", "value": "T10655AFD1F1908C9AEC6B4AF2BD2BA53011A77E5D94A4C10C559DBB5B26F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639130392, "uuid": "d7b769c6-9be9-4ba1-b990-5ab9213031a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639130392, "uuid": "0c4d755d-0925-4be4-9303-f5dadeee58d7", "value": "24576:XYJxPTliXHmSV1FdLW7pXdoc6z4ei8e/GWt7b01a+jmu8tZZ2rmE:XixrlamSj1W1icC4Vp/GuumuaZZiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639130392, "uuid": "420ea36d-f850-4a6a-acf5-7e7e828761d7", "value": 1401344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639130392, "uuid": "655beb6b-88a7-44d3-abf7-038c2a553724", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639130392, "uuid": "4198a44f-e2c7-456a-9611-7f28c0f6c223", "value": "PO_287104.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5be122b-59e3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639159508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159508, "uuid": "b133cb46-47de-4c67-a947-49ac38d7f88f", "comment": "Malware payload", "value": "c907b9c896717de86a21447533e80b8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159508, "uuid": "687e5d84-8ca3-4b8d-9d13-4a97e63258a2", "comment": "Malware payload", "value": "c1d7c06aa467644bdb790f178a0132eff30df55b04f41e6bceb45e829fcec8d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159508, "uuid": "1213e633-a30b-4b1d-93cc-3f7ac064e25b", "comment": "Malware payload", "value": "fe4f5992cdc11e83fdf75a52e972f6ae22a94ef6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159508, "uuid": "83d6eb33-c370-4dc2-9e0c-f164685e267d", "comment": "Malware payload", "value": "e37a8e0bac0b22a7cf492afffb6470d165ba826542cc4666f8b67f151b979460a1b9b807e3180b15abe06b186daf3f81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159508, "uuid": "6f08da59-6f54-477d-9933-54bb3dd0067f", "value": "T1A934D00723D90D7BD43286B884A34A9AD3B6B8201721EEEF0364539D1F637C19D3AF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159508, "uuid": "891c8739-f147-4684-8b42-a9fd6c471672", "value": "4e0d9a7737a22848b48dac3b7af204bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159508, "uuid": "2dcaf1ba-fc2f-4aad-8566-25f408bf4215", "value": "3072:u3n294W8z9p3PEGZTUMg/YP10GwX0uNmxqgHg6vOGCzg4xbCLQ7w0AjY8O7YC3Ae:uiyz/EGZTwYOxChSxbCLQk0b7L3WU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639159508, "uuid": "f7ce1f90-2210-49e6-affe-ff964ee4e876", "value": 251392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639159508, "uuid": "43fff5ee-66ff-4509-8a2b-ab75bb5d324f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159508, "uuid": "4c3ef78e-b630-4303-95c5-547b89d828c8", "value": "c1d7c06aa467644bdb790f178a0132eff30df55b04f41e6bceb45e829fcec8d4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "401b097d-5997-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639126669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126669, "uuid": "fecd8c3a-082a-4777-aaa9-2e36697a089d", "comment": "Malware payload (Formbook)", "value": "986e82eb9da9c38ac50494c3348db075", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126669, "uuid": "814a5df8-a21b-450e-a369-7adf1142f94b", "comment": "Malware payload (Formbook)", "value": "c3658d5869cbdae036a490191e5cf72bc227dc7f8a3413d694573339a19bc55d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126669, "uuid": "9bc5c29f-07ff-4598-8b5b-da0f5ba3cf6f", "comment": "Malware payload (Formbook)", "value": "371f6cc7355efef76c1079818aec8da68c47dd4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126669, "uuid": "3a971964-fcab-4cbb-805a-b4199a2c6aa1", "comment": "Malware payload (Formbook)", "value": "573524ec3b98d380250467ed7e11ad5919ee33740ddaa22949a0e82fd1fe647bac3702538a6755f32eedf98a0b6cb0e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126669, "uuid": "caf76ef6-282b-4342-992d-613dc199a070", "value": "T10C54125FF1E1CDAFF9C543310CAEAB34DBB946501176154B2BAEED5F0E920078A27682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126669, "uuid": "9075edf1-0fc5-4717-b9db-1b1b1fbea413", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126669, "uuid": "5182d8cc-507f-42de-833c-17fad0293d4e", "value": "6144:rGi9liIxtXU5tgEIiNHug8570ljOmQRbZXMg5GNDOnY6:BliIxtXCtgwp857+6dbZc4qQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639126669, "uuid": "6d5d7436-094e-42fa-b9b9-c621c7fa45f2", "value": 279174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639126669, "uuid": "6011de3e-ffab-46dc-9610-313cc934ebed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126669, "uuid": "867874f4-68e3-4350-b994-a31324745483", "value": "986e82eb9da9c38ac50494c3348db075.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d531b7-5991-11ec-96a4-42010a9c0029", "comment": "Malware payload (LimeRAT)", "timestamp": 1639124066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124066, "uuid": "56b149a4-a02a-4e54-a3be-300918875240", "comment": "Malware payload (LimeRAT)", "value": "d4bcbbecafaa086d90213d348d150775", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124066, "uuid": "2a1a75bc-af4f-472e-b7cb-299f278fa075", "comment": "Malware payload (LimeRAT)", "value": "c40dae36177028336a0abe29ebac16b871b6415c44e80b49ff0ac5451062f352", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124066, "uuid": "2a6987a8-58ed-4cec-be8a-7ed49a0069c5", "comment": "Malware payload (LimeRAT)", "value": "9c4a4c576195640d5544c63932a7629261e0553d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124066, "uuid": "205d94f7-279b-44e6-92c0-38b438463c04", "comment": "Malware payload (LimeRAT)", "value": "ccb2d0b11db08db5eb5ef2885b8e0fe95ce0b1bd510041e8ea3f66345e1284b0333e7c90d34ea7e5d1ceba6a220e99d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124066, "uuid": "5b7c2149-a2c7-4cd3-9cdd-da5281d2cdd9", "value": "T1CB25A6A734010DFBF5641ABE8B0F5140F7EA99BD0B33919D192CAC40D396386BE5DB89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124066, "uuid": "5bb5cd9e-bf98-4559-a846-51069a3fb38c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124066, "uuid": "7300034b-1645-4f28-a08c-09322d0cc49d", "value": "12288:EL3QQUFFv0fqVjN6iAx11ZboX+AAvgAq7H6/n/nehUXUA:EL3Q/iio1HVgVm/ntU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124066, "uuid": "799a0be0-62cc-41a2-a049-faca5699d61f", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124066, "uuid": "b90e5179-760c-44c3-b82a-3b0d5ead00ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124066, "uuid": "2594377e-2595-4884-840e-687e4a678948", "value": "d4bcbbecafaa086d90213d348d150775.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41943789-59ad-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639136120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639136120, "uuid": "5bdaec10-19d9-45ec-b5f8-839248f95ab9", "comment": "Malware payload (Mirai)", "value": "b71033b2e3fc020ae0f15a8d7792d9d6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639136120, "uuid": "31545c0e-5762-40f1-9d5b-c3093c4f85f6", "comment": "Malware payload (Mirai)", "value": "c526c3fb948732ecb170da7c7619039ff6f94802e8f8d381f683cb595897293e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639136120, "uuid": "9645ffbb-871a-4e77-8f8a-2f70e4de022d", "comment": "Malware payload (Mirai)", "value": "b413b05535360f3e55fc1991634c9f2062127ae0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639136120, "uuid": "2a2d5263-fb7d-4693-924c-8b6a5524c981", "comment": "Malware payload (Mirai)", "value": "6833c65fcc97f1b48e15d55282dde7bb983a0c78cabe9f34b1533f6b099a647a296022324068c37abdd772750e124174", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639136120, "uuid": "447d96f8-1a02-4371-a7dd-07c8475b37a5", "value": "T1CD055C6AE1B374FDC193C03103DF9B72A939B47901216EBB22D4AA353D41EE11B19B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639136120, "uuid": "7320e0cd-dd01-4275-a750-a914be8e33aa", "value": "6144:Zn/g18iwQtfmR2Iw7b3UHMuyVYipoI6biuoOFb+IrKWQmqP3IwVgM5KAeuaDF79X:ZnU5wQipMlmI6FLrKqqP8MgVjggpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639136120, "uuid": "f2b2e79a-70bf-4206-aae6-258d5b94d3d1", "value": 826752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639136120, "uuid": "9edca799-6859-49b1-ad74-e3557023bf38", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639136120, "uuid": "09692973-1ee3-432c-bfe0-7ff512a7a316", "value": "b71033b2e3fc020ae0f15a8d7792d9d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ba5434-5a0d-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639177629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639177629, "uuid": "7c7aeef0-6ea6-4772-8a15-8a7c50a6f746", "comment": "Malware payload (njrat)", "value": "ad6d18c89eef983fc9f430c196126c8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639177629, "uuid": "1d536684-91ca-40f3-92f4-38504445c3b5", "comment": "Malware payload (njrat)", "value": "c54173049678a8818d2857d63c4b671ffe1652c74280ede9f210f542881e0287", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639177629, "uuid": "d6259bdf-3911-448f-9855-14feee75f100", "comment": "Malware payload (njrat)", "value": "afb1de83bc99267054f39829d9a43974b9e40a20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639177629, "uuid": "2f06f015-4fb1-4112-aaf4-0ce8bd9c76f0", "comment": "Malware payload (njrat)", "value": "3d3e93f5d86b448cf04d9ed0903b9ce16fe24614fece5d8dfbb8a4e340d3310900af678d374e93236fd35c440d19dbb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639177629, "uuid": "9186482f-df0a-4f99-a9f8-52e26fd31e72", "value": "T172033A4D7FE18168C4FD467B05B2E41207BAE04B6E23D91E8EF5649A37636C48F50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639177629, "uuid": "e0fa8fc4-3811-4454-af68-a1575950d605", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639177629, "uuid": "63c49bea-9ebf-4b92-ab28-07044a873963", "value": "768:Urn2DmmUbCv/cP8ot8bMsrM+rMRa8NuGat:I2DCbW0UU84/+gRJNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639177629, "uuid": "95d719f4-d0ff-4771-99f9-dd1bb5aa2aab", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639177629, "uuid": "4699d8ec-3fa6-4b8a-baad-2798f8b98291", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639177629, "uuid": "6ffb6673-cea0-4cdb-8071-0331ba3c083a", "value": "ad6d18c89eef983fc9f430c196126c8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04fea7bb-59ad-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639136018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639136018, "uuid": "89efc9d7-d2f2-497d-b0ba-194b73cbfb9a", "comment": "Malware payload (Formbook)", "value": "76f5614de27b01d92249f8c1a52aae5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639136018, "uuid": "0b2c7bc3-b992-4fc2-b942-4119ff708cb6", "comment": "Malware payload (Formbook)", "value": "c5bec5a7613c624c3003e96ab4b3deb5f1a98831dd2301386efebdef11a1301a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639136018, "uuid": "bf67b6f4-0457-410a-aae2-eda008f36757", "comment": "Malware payload (Formbook)", "value": "d03a73ef69a7b9de495825e8a393b1f5d5f2d3b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639136018, "uuid": "19c365af-b25f-4df3-8468-77bcfee03682", "comment": "Malware payload (Formbook)", "value": "d379e5ccdfb23bd7c490d6208ca3c9cdbb745067b69ede31660df5bbb2dfc2c56761a234d9fcc4055c3f5490116cfdb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639136018, "uuid": "f98428ed-3be3-408d-b93d-1fed975f7b07", "value": "T16794F1D1A68049A6ED664BB0543B9C151327BEBD7DB0E50E5A9F382FE7B32C34063907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639136018, "uuid": "359c0692-91bd-4bc2-ac42-a642f0c08da0", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639136018, "uuid": "12cb4843-d205-42e1-98da-cdca0a8f9ce3", "value": "12288:MLLYAVLLLLEoLLULLLV4LLILVLLLLLLvLELWzKdvvsAJJLL5a9X8IqfzwwPBlZWN:MLLYAVLLLLEoLLULLLV4LLILVLLLLLLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639136018, "uuid": "9cb23e5d-4ade-4c5d-b9df-7893f68d853f", "value": 435478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639136018, "uuid": "46f100da-1a67-4456-b9c3-f2c92412f35c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639136018, "uuid": "5666216e-0803-45dd-a722-9ceeedae1dfd", "value": "Salary Receipt_27845 pdf (4).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b9a7ce-59c1-11ec-96a4-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1639144925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639144925, "uuid": "2b4c7818-7d68-4dd5-8741-5c82f4e00364", "comment": "Malware payload (AZORult)", "value": "f020bd44928bd6af8c4be60296272f2c", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639144925, "uuid": "44953411-aef0-4ef9-83c9-3a2499d4c56e", "comment": "Malware payload (AZORult)", "value": "c6aec21812226c153f9104572ad90149c4763aacb83e9920368c2cf9f2d07790", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639144925, "uuid": "5a419da0-0545-4bf2-a13d-3ba99a64fa76", "comment": "Malware payload (AZORult)", "value": "8143da24a213257a6b6fb45fac55badaa1a562b1", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639144925, "uuid": "c241ff58-d63f-461d-9f25-727ce86dc272", "comment": "Malware payload (AZORult)", "value": "521bdf5fdd796c3a2c4f452e2eb4f807940c3e764cf15b133b17f76a41741c8c35f35a2c0695558ff4c0cb8829a3a7f8", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639144925, "uuid": "c5fd6c4e-f43f-445c-bf7d-bf6a295de6c8", "value": "T1A804C3DE6B38801DE59F59B3C92BACB6514C3C12A901491776CE7E1A3F306E27D7063A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639144925, "uuid": "bb16ba4e-90df-40d9-9038-f3313b9cb40c", "value": "17190a28efe86926c01e77a255924bfe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639144925, "uuid": "2feef798-a91b-4498-9120-15b1a74220db", "value": "3072:/PeQM3jtQ24zYzYDKmKz4UYVds98EuMQe:31M3jtQTczoAYVdsiEuMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639144925, "uuid": "eaac59fd-d1c6-458f-9b1c-afb3e72e55ad", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639144925, "uuid": "37542371-3110-49c0-a99b-6e90da472afc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639144925, "uuid": "5c63a63c-def9-4a2f-9ba2-bb807c335862", "value": "133960.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd742e2-59c4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639146311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639146311, "uuid": "73f7607c-e1b6-41ad-9064-88bca31351e0", "comment": "Malware payload (Quakbot)", "value": "5205821053de2cdee28d05aa43d20e9d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama143", "colour": "#82C71F", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639146311, "uuid": "707d3af6-360f-49fb-b534-80dfa739a373", "comment": "Malware payload (Quakbot)", "value": "c6d70e62181d63836705e471dbbee1019bbe1ef2863fc45198e66acd60bb6743", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama143", "colour": "#82C71F", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639146311, "uuid": "dcdf0160-a399-4f55-ab5d-99947616c50b", "comment": "Malware payload (Quakbot)", "value": "ba0bff4ada28ef92aab4bd7598970f13b9843c3f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama143", "colour": "#82C71F", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639146311, "uuid": "a116ed30-0957-4cb1-a6c6-811ec3f3af8f", "comment": "Malware payload (Quakbot)", "value": "e72877400b00c7cb5971980082220198275cece30849fa6eb44d1a0e8e448e6b607bafb17cf49b1ade31fc9e349dafa6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama143", "colour": "#82C71F", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639146311, "uuid": "3e31c4a3-ee3d-4649-9253-2b9efc2a2624", "value": "T1A2E49E37F2D14937C17B263D8C5B7258E92B7E412E38A84E6BE45D4C9F3AA403526393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639146311, "uuid": "2a85f1bb-4bc5-4b95-b41b-cd218ae43b33", "value": "779533981cce29e233fa98f54323909b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639146311, "uuid": "2d5437e1-8528-4f4c-9463-fdb21097c709", "value": "12288:l4V3PLzRyyTYI8N1pYekopeZWPNyGgpEMaLClRHQG2Wg01/RZK7NSbM:WfLwu8N1CYKWozEMaLC/rBg01/mgbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639146311, "uuid": "5ac47963-0b90-419b-b137-5e1487d54254", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639146311, "uuid": "58358680-0eaa-4370-ba3c-d7bbb25d7c2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639146311, "uuid": "ccba169b-e11d-4cab-8abf-ed46e3321982", "value": "44540.3550681713.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af833fdd-59bd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Guildma)", "timestamp": 1639143176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143176, "uuid": "10a80ba2-8cdc-4063-bb5a-9b865587b54d", "comment": "Malware payload (Guildma)", "value": "543d050114b03975cd704d0ad520688b", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143176, "uuid": "15665eeb-4dda-4463-b625-b45e85ad1f4f", "comment": "Malware payload (Guildma)", "value": "c71823faf189b9537ffb10d7dad80882f9ed3cb392cba9b3b304e23e879deb02", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143176, "uuid": "745cadd4-05cc-45b6-9006-cc6b024f1678", "comment": "Malware payload (Guildma)", "value": "0b41e5fb3e183b142406249b57ed1282788958c6", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143176, "uuid": "3c7aea90-8805-4464-ab74-40d8cdcf5e58", "comment": "Malware payload (Guildma)", "value": "d380a54bc9aa12919dfb81d7bff40a35e679e79d27f3a2721ebbc7b52404501b4443c60b91dc442e222ab708fbf0b88b", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143176, "uuid": "e4c0eff1-16a0-45e3-ba49-250b6c18bb15", "value": "T1BCF023EC2F345FD1C4280EBBC0618F499C71788ADD597B3871D829407CA00806F099FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143176, "uuid": "ff31a298-7563-476f-a93d-8de0048d9346", "value": "12:8DpOB+PlyWflEV75FFG87FYOSx4GrgS5+:8HPlDNEr7COen+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639143176, "uuid": "347bf3dd-ec17-4ed1-b577-f9a7edeeaca6", "value": 536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639143176, "uuid": "b8774982-a773-492c-8dae-a59094a2dc16", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143176, "uuid": "52c644aa-bd1b-4887-bcf3-8037e6744848", "value": "543d050114b03975cd704d0ad520688b.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f014432-5994-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1639125325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125325, "uuid": "1726ad22-7ace-4f03-b451-ee48daff9199", "comment": "Malware payload (AsyncRAT)", "value": "9ebcbfbbffd0add36f3839226c5d3747", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125325, "uuid": "17789705-e25a-4a61-838f-a73694427372", "comment": "Malware payload (AsyncRAT)", "value": "c8316fc3f2645d367608caf4a93687819bb27258285dadc9ba20d9ea0fb9386e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125325, "uuid": "a03322bd-d4d8-44cf-837a-3fd80cabd21a", "comment": "Malware payload (AsyncRAT)", "value": "4a7dbbfc46c8afe22b126df3c02f2075420741c4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125325, "uuid": "278a7e48-c8bd-416c-b943-fb650d714ef3", "comment": "Malware payload (AsyncRAT)", "value": "e9fa9c06945bc2109d159591e2123ecc13b9b0444f7404d654e6d826d7ffaef90c65e735c90266a4f3c14735438c7336", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125325, "uuid": "71603dfd-2e50-4855-9d01-dd7a08de7000", "value": "T12E947B2C26C7D6DCF83ED7743BA4A19803E5BCF5E543E1EEF899305B5973A406A22121", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125325, "uuid": "59c451f7-370b-4447-a4a3-444e7b63c731", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125325, "uuid": "6e0db4d0-1bbe-4c05-a317-a5951b2c07ae", "value": "6144:4kA5iuOGsGOL2FmWFRSXtebkTl4LBhzqI9HmeqdVpSuWbeJqtqeFDaQt:dA5iuOGsGOLaLSI9HYgNeJc5FD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639125325, "uuid": "03d0a94a-be12-4b1e-9fe0-fdf9a940e51d", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639125325, "uuid": "fae79134-4f76-4a4e-a504-6d47be0da2b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125325, "uuid": "761e8803-dd2c-45f8-a957-288bda04de57", "value": "9ebcbfbbffd0add36f3839226c5d3747.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9305b2-59be-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639143386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143386, "uuid": "a8fcf1e4-df69-44a1-9b58-141936a36d5c", "comment": "Malware payload (RedLineStealer)", "value": "07377d05174c87818aff1ddd4be15753", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143386, "uuid": "4455bd87-8189-4093-977a-38c2d42c37d0", "comment": "Malware payload (RedLineStealer)", "value": "c89607ea81c655486fc2a96271220fad5bace56fa3ffb552df5b10cb4c40e717", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143386, "uuid": "351cb673-c1a7-49b7-bb02-e49d882ecbe8", "comment": "Malware payload (RedLineStealer)", "value": "2c0b6df1891cd743f4d27b697affb39c3e7cd2ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143386, "uuid": "ad04fc13-27f0-48d0-89a8-9a0fb982d217", "comment": "Malware payload (RedLineStealer)", "value": "95fb5729f4a26bf17ff1caed11f2f168167f23714fcf9b50bd28afdddde306580371400ab6edeab81eeba9bf68b8a8bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143386, "uuid": "5662dee2-c1b4-490a-ba4d-b6af7d07f610", "value": "T1F6B47937EB9834F7EDD2A27248A34D55C9935C7F88CD023A12CEBE94D7A624117CC1A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143386, "uuid": "3173b145-3406-4185-bfeb-6d9695865256", "value": "4214402b503b329a782f8a267e6f256a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143386, "uuid": "433a5208-6eab-4794-8ab9-354770629313", "value": "12288:ul0GLy54ka8rjT+AoNMu21ULVHwQ7EsrjAD3Uwd:ulS5bjTZ31UNdvALUwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639143386, "uuid": "78cbee9e-9222-45ff-bcb9-110f1a759399", "value": 517024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639143386, "uuid": "7ded92d6-57d5-461f-8a73-92f2fe72b1d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143386, "uuid": "115d0fe7-74d6-4b22-a43a-992a47988ccb", "value": "install9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad18e6c0-599c-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639128999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128999, "uuid": "a0bbf0ae-801a-460b-9d26-714539f669be", "comment": "Malware payload (RedLineStealer)", "value": "c43c55d06289937a04bc44e3e7956d58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128999, "uuid": "950448dc-f0c3-4c68-b084-09784c9836da", "comment": "Malware payload (RedLineStealer)", "value": "cb92bbb6c25766d2124660959225a72382a9744e13f518fd7a342e3081105957", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128999, "uuid": "6a809f88-48fe-4a6e-88eb-7d3129be4c05", "comment": "Malware payload (RedLineStealer)", "value": "e6d268483fc13f02c4b93e6e4c77297ab03e0eec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639128999, "uuid": "0113808b-571d-4cf4-92c6-4b4d9b3d1d8c", "comment": "Malware payload (RedLineStealer)", "value": "237d5e644940975f5bc45b381131742e762309a81715987ae3cf5e6b63035151f02b7e3342e1ceb4a130563f641bfeea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128999, "uuid": "61fcd204-5585-4295-aa60-8a2a3a829a20", "value": "T1B905D0100A5F5C0FD883F9399B21CE9B80F25C645D1B8672B9E63C69BBFA24771612C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128999, "uuid": "eaec56b5-ec90-4082-a11e-6d72bbd54a41", "value": "45012acf42bd10b935fe7f60567b4080", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128999, "uuid": "e01176a4-b133-45d7-9fe4-2d0e1413620f", "value": "12288:NpDpOEkQB7bj7UBFWFg0hKeckED9pdkb96q76H1IyFVkZfXfArFjKRni:bDd/XQ30h/ckEDKM5HDD0fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639128999, "uuid": "4e6f5e12-205d-47d2-ab63-6f0feff325ec", "value": 831360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639128999, "uuid": "216722e4-53f4-4cc0-9ded-38bf855ba62c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639128999, "uuid": "bf41c03c-a215-436e-971c-90a2f53bef95", "value": "cb92bbb6c25766d2124660959225a72382a9744e13f51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e13802e-5985-11ec-96a4-42010a9c0029", "comment": "Malware payload (Guildma)", "timestamp": 1639118961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118961, "uuid": "866524a4-aab6-4f69-b6cd-6dbb733fa6b1", "comment": "Malware payload (Guildma)", "value": "dd50688e82d6d2dd2189d2c2f2a9e25a", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118961, "uuid": "e3829ba8-07e5-4c35-a529-f1097751ed35", "comment": "Malware payload (Guildma)", "value": "cc4895120775abbd3bafeb94ab1800bf4ffb4ff64ad4f0b1998db4c88e021437", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118961, "uuid": "4c58b0a2-fc00-4e0e-bedc-87ed24a4df19", "comment": "Malware payload (Guildma)", "value": "2459eb717ce947748c2f24d44fd718e4747a1252", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118961, "uuid": "2a7032dd-7191-45bd-b639-f12cc38ebed0", "comment": "Malware payload (Guildma)", "value": "ac9672d06c576ce6a7d69743bea87666ccb5bf6761256b4693ad3a9c306dd2d4d70bf1120847a7c35d72f4a929032ae1", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639118961, "uuid": "7be04ad3-1df8-4349-bea4-36ef0c6d3efb", "value": "T1B353016A9FDBCE8006153D35A05DA9187420A7E34D38F75C67E5CB86DFD89BA4C2C484", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639118961, "uuid": "3acc0b16-90a4-4d6d-b188-80cb4bdcd377", "value": "1536:671JkyKVvJ7fG62rn5niAoLlzQKRbpUDnZb65:M1JkydnZIlhRVinU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639118961, "uuid": "4a251780-c188-4d29-8016-fed7c019e5b4", "value": 61212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639118961, "uuid": "79b1ad1a-5c25-4f68-8a6e-e8865a95b3f3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639118961, "uuid": "c2cfd7fd-7514-4b4d-8fb9-cf6da3852fa9", "value": "Foulardb.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a47970-5966-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639105931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639105931, "uuid": "423a6c80-b111-45cd-804a-a8ebe3061224", "comment": "Malware payload (Heodo)", "value": "f5c531623cc0a40cacf78e0861ab8c8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639105931, "uuid": "56c610d6-d173-4d42-9847-b2ae5e6bcafb", "comment": "Malware payload (Heodo)", "value": "ccd871ad115218c113de720c144a0278fc363447fa45db885a0fe323a71e21fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639105931, "uuid": "260c9204-55af-4281-a1fb-fac21e009f46", "comment": "Malware payload (Heodo)", "value": "e82bfc7be0973dd0eee879d74b28ff7cd4b8f92a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639105931, "uuid": "cfc217ba-9b58-4e41-b2e7-e322a93104d4", "comment": "Malware payload (Heodo)", "value": "7a8d5414e927f2e44c9bc24988854309a6a491f570c3a408f97d3e8c1891a87f40193e0a5e685516899afb494343db8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639105931, "uuid": "79418764-2cd1-4d44-a736-dfa850b25534", "value": "T1F344BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639105931, "uuid": "6ad45af9-52e2-4cf5-af3c-8723ebf45d48", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639105931, "uuid": "1d84b143-4593-44ce-9d6b-b0a99bd81e25", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTB52ypv:6jIG/pjjuLbJLmGshoCUnWTrpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639105931, "uuid": "f46aad41-5d41-4dfa-b2aa-1e28c805f338", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639105931, "uuid": "4491a558-5257-4069-a36c-9ec1c1f5e552", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639105931, "uuid": "440a57c0-033b-4442-aec5-33725c397f06", "value": "f5c531623cc0a40cacf78e0861ab8c8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a203978a-5991-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639124256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124256, "uuid": "351fa5a6-f9b4-46da-ad2b-0515b146e39a", "comment": "Malware payload (Formbook)", "value": "c1bbf899e0c6d2a97dab683bb9b379b8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124256, "uuid": "96dfac49-60fa-46f1-8a1a-b6c22fb8ef78", "comment": "Malware payload (Formbook)", "value": "cd59e5461fa2964d9dccafc6d88b1df5152315c658b8c7fdf5e1f14f481095ef", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124256, "uuid": "44f90c31-35fb-4a7a-91c2-4ba3e2fed41e", "comment": "Malware payload (Formbook)", "value": "1e8e074cb3bb1f957744e0816bdc5703436235c4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124256, "uuid": "f687bcf1-01e6-48c6-a2a3-9ba939ffe607", "comment": "Malware payload (Formbook)", "value": "c7547aeacc75b3fc54d066560ccd3198c07c403eb77b73dc61ad8d10160a391f407406110aa933da95638a4535e3551d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124256, "uuid": "21c8e071-9e5c-4429-a1fb-ba86d684a1af", "value": "T154524E6CC09B42E88F85ABB87B1B6F46114CB66CF785A532367C67361BD2C3B541683C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124256, "uuid": "919ebb1c-a429-474e-93e5-af5ccc4d4893", "value": "192:ooNoRBNN+gu3LVylKqxdPdO83AG/oWc9Xm/IJk6ZVkIZYsh+9TsciSHtATQ:lGRzIRLniV1VMxBZGIbQaciSNATQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124256, "uuid": "05aedfa0-0a75-46b5-bd0c-ca0342f19821", "value": 14308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124256, "uuid": "402d711a-3b50-4f93-9353-cb27248888ee", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124256, "uuid": "bc3a05f3-8313-448e-b95e-770e6d469616", "value": "091221.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec5eecc-5991-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639124277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124277, "uuid": "e8d291b3-be8a-41ce-816d-cc71cbf14f41", "comment": "Malware payload (Formbook)", "value": "efc314fdfb449cf7707bff6641ea7717", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124277, "uuid": "6ca3587b-b8e9-4f51-b0c6-feebfe5aafaf", "comment": "Malware payload (Formbook)", "value": "cfcee54c89eb5773780215808722fdf75e51d2a25079f28dae363e5ba1d23921", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124277, "uuid": "46f742cb-84cd-4623-be8f-f80e8f9d1a81", "comment": "Malware payload (Formbook)", "value": "e127052ab1c9d78e593adc2104c381c33d58d460", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124277, "uuid": "c4e083e0-db08-4bcd-bccd-40ecdcc76e8d", "comment": "Malware payload (Formbook)", "value": "3470cfbced07ed96cd88217c4bef7baaeb6afa9752f60b00fd1d20097b9d8d899cf49a3bd8b74400ca161727427c564f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124277, "uuid": "08807df3-bf84-4ecd-87f2-a4647df4c3be", "value": "T1D364123EB7ADC363E993707A1F23ED9C5EA0DE6D889128622101770194797732E705BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124277, "uuid": "68173edc-9b7e-4b61-a2dc-8b98913c337f", "value": "6144:+sfzA9Hs2DH8KFZ7aeGuh+/mZv8WOpqXzsWRR56IYKPr6SnZkoj6:+s09Hs2D8mmVupv8csWRxPrxZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124277, "uuid": "db104021-5fa6-4b32-b205-8e3ef2976204", "value": 321176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124277, "uuid": "0a08e39d-eba2-4841-8814-47b266e90d8b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124277, "uuid": "e5373d87-94b5-4b4a-b21f-b2a3ba824f9a", "value": "ENC COTA\u00c7\u00c3O 08-12.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c54efd-59a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639132372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132372, "uuid": "f8c93b27-e3c4-4e69-81f7-4025ef49e3ab", "comment": "Malware payload (AgentTesla)", "value": "bac1cf57c69848f78d8cda8832263feb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132372, "uuid": "f006e4da-dee0-4103-8c44-4cf882417673", "comment": "Malware payload (AgentTesla)", "value": "cfd40bc629e7e6e341109a8a7b13185185637997686effed210c8fba0506bd4e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132372, "uuid": "696ebb6e-4de0-4907-9522-dd57bda4c289", "comment": "Malware payload (AgentTesla)", "value": "ebfe6b27ff829a9a890784cb7f34ee508c42c147", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132372, "uuid": "d31c008c-3a83-4e0e-aa45-0a2d36873007", "comment": "Malware payload (AgentTesla)", "value": "7f9859e09e0fb146a101cdd7a0a2283bf31eaf6cd47da35f09fe194ac3b9e45e05333a9fb15d6145563c56e183e93ce5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132372, "uuid": "6cacf7e5-0edc-4712-8ec5-3a527cb98eee", "value": "T16291FA9AE38AC8F2C1E81E386B574B6E591C8889DF8CC1161AC9489F6D5B3A405BD3C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132372, "uuid": "9b5df8ee-485b-4086-a0c7-feab42fcc95d", "value": "b4600698c53729ee3c35db074184b1f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132372, "uuid": "b2966f02-7d77-43fc-9b92-590ab3c53f92", "value": "48:ZvtSF+ROJYONpO0wprqtBH5YBI/E28VJFqRm7kgB8awKtogCIo:Z1S+R6YoM0wprgBGI8/ygSE8Io", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639132372, "uuid": "836cbe33-086f-4bbc-9390-f93a77a68576", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639132372, "uuid": "b498bed7-2c50-4013-b5c8-06cd6c1d8de1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132372, "uuid": "b6508fca-2394-4fbe-a090-22ae313d866a", "value": "PO01134.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5348114e-59d2-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639152041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639152041, "uuid": "90931c25-f6d8-4bf1-a305-4254577c8f9f", "comment": "Malware payload (AgentTesla)", "value": "65a049b12fd622bc1f19b1efcdfd6090", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639152041, "uuid": "14a060f8-fc0c-436d-8cf6-339db11c2e7a", "comment": "Malware payload (AgentTesla)", "value": "d027dce67e53fb65df9ef50d2df91344b13aff778278b0441cf51d6401de69f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639152041, "uuid": "0e686196-3bef-4456-bb98-2c5618322152", "comment": "Malware payload (AgentTesla)", "value": "cc9ae634eea1e1edd2e9a9fad35a3755055e9e7c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639152041, "uuid": "f806741f-0c65-4d79-a3f5-46350d08a3eb", "comment": "Malware payload (AgentTesla)", "value": "f5c10a73cbf518d6b2120122f1e471f93f6b6dc0c2c8416ff773f709fdea1744103f6ae9aae2948cae76a2c790116449", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639152041, "uuid": "7f8b9840-f222-4773-ad2e-a725204cc0be", "value": "T1CE35126032A9DF00E32B5B7ACC8B600443FCFA157823E71DADD572EE09537964952ADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639152041, "uuid": "4cde6f6b-a0ec-4fe1-a80b-339b98f81a5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639152041, "uuid": "ca4dd4a6-3c32-4a57-ae02-2fabd28fff1b", "value": "24576:9Gs1x3Pl7ilRz0tCb8DpbrTDkwRsZ51g7fqSwuyIXqfqGhFrXSuE:d1x39ARTb81/8wW1CSSwuyIPGPrXSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639152041, "uuid": "92152816-38ae-49ee-b221-c5949e628587", "value": 1139200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639152041, "uuid": "8c238f68-d540-44e4-9e91-d4e5d2abe99b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639152041, "uuid": "0bd200c4-64cf-416d-89ee-c7226ff020d2", "value": "Factura comercial.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35e3b2d-59a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639132419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132419, "uuid": "a4539e32-cde9-40b0-b86f-b51c793d3673", "comment": "Malware payload (Formbook)", "value": "1720032e0d3cd0bcafee9ff819da1c11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132419, "uuid": "4d4f399d-a039-49c3-90c1-5dae6cc6d896", "comment": "Malware payload (Formbook)", "value": "d13183473c0e9826a1d3d60e5a245999dddb94275371556398444fa69cb1c987", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132419, "uuid": "ab7c2fa8-8974-4d14-ad82-d0cc838980d5", "comment": "Malware payload (Formbook)", "value": "83d690a7bb4b557cbc89ccbb8fc078c3a909c036", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132419, "uuid": "dbc81daf-2baa-403f-9f49-28eb257adcef", "comment": "Malware payload (Formbook)", "value": "bd2b527f002b066fab64c933085102fbb7b60107fc2c61ccfa9ed65e0b73839b760e0f403906998d6ba7eb433b33f2ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132419, "uuid": "8ae75c48-65f6-418f-9b8d-b98fc44a0859", "value": "T13E4412AB13E011E3F1A325318236E774F7BFA36452A60E430BD45EA16E703B50D69AD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132419, "uuid": "083a6e65-72b1-4f46-a922-bcda45d5d7df", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132419, "uuid": "a95f1238-c31c-4d3b-8aa0-a58b6853f88f", "value": "6144:rGiuIPvmQPDQ8JVyJ6kb9CjketWsnGAI+orlsr/iScF:yIPeED1JVol7eRXIdGcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639132419, "uuid": "967b8901-ed4f-47c5-841e-603bf92b200f", "value": 278129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639132419, "uuid": "5d8413f1-e1ff-47fa-b194-da07150d04c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132419, "uuid": "b51d909e-f6a2-48d7-a5c2-7b82015474ba", "value": "1720032e0d3cd0bcafee9ff819da1c11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda5fd68-5997-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639126987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126987, "uuid": "2f4c581e-ab7b-457a-9475-aae22e041bbd", "comment": "Malware payload (Formbook)", "value": "289ac551a700a0e050a8e4a1abd0e6f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126987, "uuid": "4c3e8e0c-2f77-4a98-aae5-59ee0b3ecfbc", "comment": "Malware payload (Formbook)", "value": "d211ed2bfcc045537d4c74ad6e630cbc455a9ff1d76c51470962883398f3e2bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126987, "uuid": "8c51a079-3d23-4f96-aa05-b63509b78f4b", "comment": "Malware payload (Formbook)", "value": "008e1bafedf6079732f0072ac87e554f37f24a40", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126987, "uuid": "e3f5179a-d818-464e-bc72-16883df5b246", "comment": "Malware payload (Formbook)", "value": "c8f17552113725d24b20f6b2c12ba9fc37e9bcf7264f37cf3cb4033d133b658eb8cb7d0a79f5cd50f25b44a019f379c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126987, "uuid": "21f0566b-31a1-47ae-857d-5e39d4c21381", "value": "T18C3522297BBA4B32CEBD5BF98124125447B5B00B3C63E71D2DD629EE18B2F514B60B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126987, "uuid": "565222fc-e88b-4ff7-8336-e81ed9ae73ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126987, "uuid": "6a146ecf-6c7a-46a1-bc76-4b63d4bb595b", "value": "24576:0EUxsTtB21GujPnlgcLb3x2JdSJ2tkkikeetslo7hp6JNJ1G6GG:0LxOtB21GujPnlj/0TYu6kolyp6JBG6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639126987, "uuid": "38cbf240-096e-42ab-aace-1fe8373a6e48", "value": 1097728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639126987, "uuid": "17f5f564-44cc-44b2-96a0-527b1fc32242", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126987, "uuid": "91bc34b8-4c63-48d7-b493-c4b24109c5fd", "value": "289ac551a700a0e050a8e4a1abd0e6f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8019d7-5968-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639106423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639106423, "uuid": "0f125e4d-b670-445e-a84c-540a74d5dfd4", "comment": "Malware payload (AgentTesla)", "value": "e6a31d1cafbb142682ac49624f94df80", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639106423, "uuid": "99199d41-0778-4ea2-8c2a-8786f6410686", "comment": "Malware payload (AgentTesla)", "value": "d3ca8229dad7c008bdf5699f093834688933ee74adb6f025711a47ee0328a4b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639106423, "uuid": "c2c4ffbb-bd8d-4985-9f38-9cb4e4daf474", "comment": "Malware payload (AgentTesla)", "value": "46057524df268656db5f9468c1d6e82f6d148cca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639106423, "uuid": "dbdf1c39-bb41-4fdb-98b9-550f482d2449", "comment": "Malware payload (AgentTesla)", "value": "a5c449c3697b76594e3d9db9c0c1039e3c7d0a9ab67e56a95ab001f79e77d8240852fcacf04ff12bb93119df3ec14f62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639106423, "uuid": "fdc4b7e9-75e6-4850-9668-0e7670667689", "value": "T1773512A331589B77C7B916FDE08432C017B8E0327265EF8A9CD5A7EE51D2B804B53297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639106423, "uuid": "285145d4-edff-47d0-9a43-9dc81632d149", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639106423, "uuid": "c010176b-d7c7-4363-b2e0-0a8b3aa83f4c", "value": "24576:flABBFggkEV0xnEUHUXtHYI/Dj0ExvPFJyEsTgq:NA5AH2trLj0ExvPFJyMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639106423, "uuid": "1e584a29-e4c1-4d5c-8fe7-821be626e809", "value": 1069568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639106423, "uuid": "3d6777d6-164c-45b1-80d5-8d3ad2dc9813", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639106423, "uuid": "dd07582b-1022-416f-9750-5efc9793874d", "value": "Remittance Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cef7c02-59ab-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639135253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639135253, "uuid": "5d85e22b-5357-41c5-b8b3-699f1f6fd0f3", "comment": "Malware payload", "value": "515939f29b306526ef6dc808efa3e424", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639135253, "uuid": "492e53e9-a76d-4e70-bd26-7e63aee0d254", "comment": "Malware payload", "value": "d6f9a8f51e28a1f018494e71b362fd092e847a421ba2807cd5de8669ded68dcc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639135253, "uuid": "cc9f8679-2900-43f6-a405-b6f27225c0a3", "comment": "Malware payload", "value": "c910914e3b56ca1ef9adae9329937294eb519d91", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639135253, "uuid": "cc2d6ae8-cc1d-4b3d-9e37-1477ec021713", "comment": "Malware payload", "value": "4c18020a6cd8b00f733c98f11a3cfa6c00393d11961c8bd02be6c152f672a5316fa6cff63211dc160ae1b08b8767732b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639135253, "uuid": "0dfab083-3198-4ef5-adf4-45f247359c85", "value": "T19A73848063DCEF75F5AB12BE4C71286C6C69AC301B4FD1EB87D49C4A41A0ED17EB1992", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639135253, "uuid": "8dade448-6a10-4ac9-9139-b3cb976d816a", "value": "1936a423a4b0a11cd1b433b7100aa163", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639135253, "uuid": "4380915a-a969-4cfb-bf6e-d90cd99c5f54", "value": "1536:cgmRHiYI7m5WzA7cEhrl0p7hSMMMjVNjsCV5rU8+T/bdGxJgUx:crRvMkcwy7VMGNf5rU8+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639135253, "uuid": "c44d5ef7-1b52-4a5a-ac55-82fbb22ee1e4", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639135253, "uuid": "84c19ef4-6f5b-4b8a-aead-4f76caf64150", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639135253, "uuid": "13f31544-fe8f-4877-856a-aeeac3e658ef", "value": "SecuriteInfo.com.Trojan.Win32.Sabsik.FL.Bml.28772.15434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e01267-599f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639130175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639130175, "uuid": "467da004-ad36-488a-b488-3849c2555cc1", "comment": "Malware payload (Loki)", "value": "77facfb48be35d17045cb78be0b07d9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639130175, "uuid": "291de81f-3c83-4184-81a5-d622344a610b", "comment": "Malware payload (Loki)", "value": "d73cf1ba1a827f662d09a2812855c8e3195d723e7b31b8322e68c665a033551a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639130175, "uuid": "e65a113a-f928-4378-9e36-852cf223b713", "comment": "Malware payload (Loki)", "value": "eb9e31ecdd7c865f6c8571dc890bee59dc1bef08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639130175, "uuid": "eef43630-9855-48b3-b0d3-800d9361cbed", "comment": "Malware payload (Loki)", "value": "5a226ec39be025db2cb9ed09dbeefa791a4e713be06e9cff3e3b18f3d5e2b625754e2daff453d75e3a5f4804f8a958d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639130175, "uuid": "c098e6f9-9959-4c0b-a53e-89153581651e", "value": "T14DB49EE1319185E1DEEF60F25C0F80593BF7A4BD96D4D30A93DA7B199CA2393028B91D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639130175, "uuid": "299029bd-fc63-4baa-87a1-5042311f3c6b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639130175, "uuid": "60598f1e-d6dd-4cdd-967b-062affc6f118", "value": "6144:oGiroAxqjaa6QTEd7XHLuVzjZ3SjWIY/MR86DgBkGjM/1gWg9LAIqDGQs3:mxqOR1d73LuZMzYE2fkGw/1gWs5BQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639130175, "uuid": "2006034f-de74-4f82-a19a-882c623986f7", "value": 515769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639130175, "uuid": "c9eff194-207a-4c30-8438-655942ab93bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639130175, "uuid": "5c8a9474-754f-4f36-803f-56f8505b5ef6", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c386ac4-59ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639141614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141614, "uuid": "2e9ce75e-ddac-4aea-b940-183edada776e", "comment": "Malware payload (ArkeiStealer)", "value": "bc79a32785c65eabcdb3bf96753e2b92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141614, "uuid": "c5368f20-4293-4fb2-b332-b3597e2c5ff3", "comment": "Malware payload (ArkeiStealer)", "value": "d8836511bbc0ebd678f9b87f6ac8db47b57a06a1219523b2fbe311e44c421861", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141614, "uuid": "865d2ead-8a03-4382-9aaf-d1e08bc6135e", "comment": "Malware payload (ArkeiStealer)", "value": "34c98e8348bd3589eec5e53b008db0e35ae7b862", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141614, "uuid": "45eb66cc-dfbc-4949-8947-c23d777a559d", "comment": "Malware payload (ArkeiStealer)", "value": "dcef455aaee0c2547aef9d5317d60c8bfcbc2410ab08cd616bfdf41f78eec2b4ebd896eedfefa2188d5384a5b0c54040", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141614, "uuid": "e70599b1-542d-4dd6-a9b7-b9392317d023", "value": "T19644BE3679FDC432C4934E3198A4DAE409BBB9225A30400BE764779E2F72F9C59E131E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141614, "uuid": "8bc78392-4b0d-4b46-8902-c6566ee64113", "value": "05e6c127a979d4c88f42e175bdeddbaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141614, "uuid": "a35821fe-d241-4509-ae6c-e11884b0434a", "value": "6144:qLtLnNez0A7P8hSe7QeckOXYNuzbgwu6Qigas:qLt/AAhB7vHOwunn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639141614, "uuid": "8327cdd4-145c-42b5-a991-edd1ed571df3", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639141614, "uuid": "08345cc4-74ec-4055-bf84-3fd368f65776", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141614, "uuid": "18a0a584-1cf3-497c-8185-f5e0ab5a1778", "value": "bc79a32785c65eabcdb3bf96753e2b92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f82a501-59c0-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1639144197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639144197, "uuid": "0fd51f05-b28e-4eee-90f0-d783fe4c4905", "comment": "Malware payload (TrickBot)", "value": "6cbc099615b6ffbd2047ff3078834176", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639144197, "uuid": "8a678db2-4e0a-40fe-9cf6-39aed85ddd5b", "comment": "Malware payload (TrickBot)", "value": "d8c7a137d9a27325bf49f1b9a0476eb248fc270c4110238b5d6e0dd755283253", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639144197, "uuid": "0a46be23-7863-4dad-b0e3-e3a7d79569d1", "comment": "Malware payload (TrickBot)", "value": "593435d283fc4ef081cdcbc76aeb5af88e214d6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639144197, "uuid": "cca63d7c-e18e-4259-bcbd-a8b687a2e3a1", "comment": "Malware payload (TrickBot)", "value": "71bc581331982e5737f7269c601d2fce86e2d419ba1baec82fd8cf4658cd5cbf548d7d9af3d27a455af6ae7cd3d2c1c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639144197, "uuid": "6f3edda4-00d5-44e1-bbdc-bef6192b5b05", "value": "T112955A85AA73DA4BCFD95820E333D63948BA21262D1A03B385D9E59C5C3FDD2CAD7131", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639144197, "uuid": "cb7fa119-9542-427d-a627-1e4a53742f13", "value": "9a242c3f2a6a5326096a83352fc74cfc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639144197, "uuid": "7e197dc5-20db-4f02-ab8a-40eaa9adafaa", "value": "12288:K+It8evAH5v0pakZ1p/bQkojcsCMSGzrbpNxBZY+yPbZGOV1Y2sIlBFYIc7AlWhi:5ys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639144197, "uuid": "25085786-50cb-48c2-b2f4-acab5753f87f", "value": 2023424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639144197, "uuid": "6272d76f-0a96-4a6a-8f2a-cdb50824efb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639144197, "uuid": "ff3fc90e-fdfb-456e-bce7-75394efe6134", "value": "6cbc099615b6ffbd2047ff3078834176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9fed44-5991-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639124009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124009, "uuid": "c392b252-d583-4b07-ba0a-9068da09b613", "comment": "Malware payload (ArkeiStealer)", "value": "044e43dc96d4ec3d78f8838baad48e97", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124009, "uuid": "65d5d96d-60c6-47f2-8c00-c07d6aac3c38", "comment": "Malware payload (ArkeiStealer)", "value": "da21c4cfd745dc0ce5276a248cc1eba2a24b1f668338c4478089f5ea12b3ee75", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124009, "uuid": "cab936dc-e3b6-446c-af6a-7c5af0dc0bfa", "comment": "Malware payload (ArkeiStealer)", "value": "ad49374d3c61475b61a4ff5d1c4e802944db8502", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124009, "uuid": "7fafaeb2-406e-4b65-955f-d77e03a5d2d9", "comment": "Malware payload (ArkeiStealer)", "value": "2a42aa07158927bbbd596f2b7f131729232cfbd788b5096f619ec5c13a1c6db2ec7ed715635fecd864fdda25170e8486", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124009, "uuid": "378766bc-e5b7-4905-9b2b-02ddf4d1c183", "value": "T1FD64AD00B7A0D435F1F716F459BA93BDA93E7AA16B34A0CF22D116EA5A346E0DC70317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124009, "uuid": "43bac301-013b-43f3-8975-b391754b591c", "value": "c50981c3cb3d1a5776b7d51392f3f197", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124009, "uuid": "c7bb7453-5e6d-4b24-8a91-206dcc23c6cb", "value": "6144:WV66/WtrDt3ApEcW0VzEEoAJuD01liAT+y:k3YrEEc1VzEMc01b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124009, "uuid": "0a5ba1bb-0f36-430e-b1a6-95cb316ef872", "value": 309248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124009, "uuid": "a565d4a9-cc2d-4456-9f11-0826a7ba382c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124009, "uuid": "32db2364-a742-4f51-86cc-81786f798500", "value": "044e43dc96d4ec3d78f8838baad48e97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efec3d87-59c3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639145862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639145862, "uuid": "1a8fa0cd-f8d8-4665-a351-7fd8929f6a87", "comment": "Malware payload", "value": "d18f8c121551239824027b3a452d1dfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639145862, "uuid": "eb271dc7-8bb4-4a4c-b076-2a78cb4c92a0", "comment": "Malware payload", "value": "dd07624b967cb3025aeb37e93f16001aa77d9ea9c36f923bf14b1475fe2a4967", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639145862, "uuid": "541970da-8138-4af3-9524-3103e99aa13f", "comment": "Malware payload", "value": "08e229189e40a41142c19ab329d45e2995419cfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639145862, "uuid": "75a48fae-07f1-4aff-b39c-78932693cc32", "comment": "Malware payload", "value": "9b4ed37bf9638fbd8ee95b3a4df1765fea5a86ea5ba8767d7e202c71155bb1f348e692fbda17c179bf721c8cb23132ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639145862, "uuid": "71a00a5c-49e0-46a6-b2aa-b25eb8b5cc10", "value": "T1A3F5333BBA8A1375CEB9E7B58CE134DD3231D9D19A078B710924478B46A9B844D37FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639145862, "uuid": "f52c84da-3131-4f9d-a0a6-6b84c7bd4936", "value": "49152:CRI6w8JowsGNZgVyJ54hqTZ6vtrXb3CzoEI5SXsfPeL/EovXfLc+ADFKNX9DzAoG:h8JooHgYJ90rWzPIkXsugemZ4zAUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639145862, "uuid": "65e870a7-3bed-4b33-a235-7cd90abc0ef6", "value": 3571712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639145862, "uuid": "2743cdaf-6267-479d-a643-eb61ef37408b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639145862, "uuid": "d6484027-eb7e-413d-a3cb-5ec9722abf78", "value": "dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03685b49-59a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639132150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132150, "uuid": "f16a6e7f-3eb3-4c26-8e5f-f6a57467b6c8", "comment": "Malware payload (Formbook)", "value": "b7637e47ba59800d5286f30c15ab1a8a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132150, "uuid": "53b801a8-a15a-42df-adef-16b5202ba744", "comment": "Malware payload (Formbook)", "value": "dd131b523e19862053b938fcd6468db4a3a6e42259c1fd01d854bd87225a2019", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132150, "uuid": "b47632df-4407-429e-9afe-86ca336bf26f", "comment": "Malware payload (Formbook)", "value": "b593004f32c805fff51af01d46a2845f7870f8a3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639132150, "uuid": "cf91be56-4abd-4616-a73a-c7f33ecb03db", "comment": "Malware payload (Formbook)", "value": "67b15a48ec93a01cf67325f2035daa394c03d8843d07287cd70795c4ac28877aba393ed066ee7735ee1e5b87bb0a7867", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132150, "uuid": "451be764-4943-4a38-b3e5-495225218d89", "value": "T1EC6108BCDE752417EDA300A5EFB6FD7E21E4B4C94AC6404C706C95D4437731ABA92486", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132150, "uuid": "147dcfc6-1d89-41fb-bc61-d9ee054de39c", "value": "48:ON4M6456mykOL2VfdMJXInKBNdzgWBxeHjxnz7K0gwiIg8oKSEZaPWxmzCYZ4YQF:rMj5Lyf0fdYXIncPdQPL1kEZaPH4nyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639132150, "uuid": "aa5c3044-cb5f-4eed-9407-575d264e329f", "value": 3220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639132150, "uuid": "67251516-ce8a-49de-964e-bb42ac21b31a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639132150, "uuid": "6e86e54d-f1ec-480e-b6a7-356420d66b48", "value": "PO 212RC048.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd022c5-59b5-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639139627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139627, "uuid": "3631afee-fb7e-466a-b1eb-fec3c3966f89", "comment": "Malware payload (ArkeiStealer)", "value": "d2532bd682e54fa454a68fc928856f36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139627, "uuid": "14e5e6e4-1105-4abe-93a1-c485c4dcacd2", "comment": "Malware payload (ArkeiStealer)", "value": "de5f758afe037a61f3b05ddd858f65149b3dc6bbb7d24149b9c60346586dc4a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139627, "uuid": "8a976e0f-7998-4c15-a0ec-c8d8e13c3848", "comment": "Malware payload (ArkeiStealer)", "value": "ef82a5e09dd2ed38b558b16bfe351afd521177c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139627, "uuid": "6b9e999a-764d-426e-9a79-b5c3e7b09d4a", "comment": "Malware payload (ArkeiStealer)", "value": "bbeabea53081685c06cb1dc164d4c71af1d2b8f87472f74a8de85ab0f3565d31d6f171e0f7903fbd0cd1d70b6ac8dd8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139627, "uuid": "9ee8b414-1c20-46da-a66e-322be27e6f00", "value": "T1D144BE3176D9C872C4A34D3058A0DAE4DD7BBC625A20500BE7742F9E2F72E9D46E231E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139627, "uuid": "ec895399-7114-4fcd-b94b-42649b310b4d", "value": "05e6c127a979d4c88f42e175bdeddbaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139627, "uuid": "e8e2c93e-0e07-439d-8248-fa4d60356bc9", "value": "6144:6rtLWNez0Adk0klE7+p+G7uebI+uzbgwu6Qigas:6rtOAdWESp+G75bI+unn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139627, "uuid": "c66e4a36-b534-4a79-910f-187d1603937f", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139627, "uuid": "246ee899-9264-4498-9b5d-632aee7c2edb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139627, "uuid": "9136d0a8-4b76-4129-8dc0-a955eb5399a3", "value": "d2532bd682e54fa454a68fc928856f36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a07eb7a-59a7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639133584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639133584, "uuid": "9219ed9c-ed80-4a21-9cb4-6be97e715a4b", "comment": "Malware payload (Formbook)", "value": "1a900b21c8d71ee951af057e28965284", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639133584, "uuid": "e886cf85-961f-4be9-8aea-8cd4e6e4527e", "comment": "Malware payload (Formbook)", "value": "df05fe254e55928777bbc3498bd842807aecd061ff8747e6d4889608f9729f63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639133584, "uuid": "58eedf36-9c97-4043-a613-2f26548881a1", "comment": "Malware payload (Formbook)", "value": "e96959dcd4ee44239558badc2fc4219504c01665", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639133584, "uuid": "fae3e5cf-380b-465e-9caf-d297ab4d02cd", "comment": "Malware payload (Formbook)", "value": "a57ee106fd1cba6c1754789b783b0765b30a31f4733076196d2668ecbed1dcea2388903331384cd94fd1652c5c996cff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639133584, "uuid": "1895f7ca-6811-406e-906a-26eff858e62b", "value": "T1A83501CE711072DFC86BD4719A982CA8F7903477930B4513A4675AAEDA5C8CBCF294F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639133584, "uuid": "447736fb-e93f-4ad5-81fe-2bb988bce983", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639133584, "uuid": "9cdd5f21-00dc-4ae4-955b-d53bf003766a", "value": "24576:yHa9kToheWA6lqkTIBMfCYFpo+hK/Cs6Ih+l8gRI:tzeZ6lOMKyo+CRh+lI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639133584, "uuid": "4c36b99c-12a0-49fc-a5ae-92479f4deaba", "value": 1160704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639133584, "uuid": "22b6a33f-a4e2-4439-b274-d6e5a9632f48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639133584, "uuid": "c712b191-aae2-444d-9be3-4eb27c06710e", "value": "1a900b21c8d71ee951af057e28965284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181a3abb-5994-11ec-96a4-42010a9c0029", "comment": "Malware payload (CobaltStrike)", "timestamp": 1639125313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125313, "uuid": "f14aeded-89fc-43ce-829f-23a70a83df9e", "comment": "Malware payload (CobaltStrike)", "value": "fd21e856fd4aaa71cb088ee60a530fb5", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125313, "uuid": "a45a4878-536e-450c-82c2-9b6317c4a46a", "comment": "Malware payload (CobaltStrike)", "value": "df8b151d1d91477ca4b30d81995b51f98341edf49a92735aec01a71b723b8b14", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125313, "uuid": "c9f1fed1-11ec-422b-911d-64c366cb8198", "comment": "Malware payload (CobaltStrike)", "value": "0670d737975e04bb2ceb8e91247897cdbb91681c", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125313, "uuid": "f9a92d4e-144d-40ce-bda6-5a626e79f13a", "comment": "Malware payload (CobaltStrike)", "value": "79d3a6b286f117b20fbffb832e20c864306ce44ed3334b5bca70424619d91ee061e36877b0a93b5e7b71be54899bd668", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125313, "uuid": "113f45e6-5a6f-4db3-af3c-b1633df31401", "value": "T117A57BC4F182FB92DD7DC8431778AE5D80321AA60A13A7A4D70D7B762E643A31F5CE46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125313, "uuid": "f8f9d3fb-d9f5-4de2-852b-d228df11a09c", "value": "26c4413ba40269d3c40723f40c262f84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125313, "uuid": "0a46ab38-1d58-402e-bbc8-981cca4a2f3e", "value": "3072:6w8za/e6cljz2QeZWYNqQIYOUgKK9pku0p0QIa4CYdTmCHqveFz7fmXnK77WQgtj:T/ckQeKQUUgKKhiXwV9LN7ua77Wjbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639125313, "uuid": "7d57603a-470d-4d95-9082-0a40920bbbfd", "value": 2190336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639125313, "uuid": "e5c92021-dfac-44a2-bf1a-49940536aa0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125313, "uuid": "4ca0b46d-7ffc-4ba4-9ad0-9a1ff5fdb2ee", "value": "fd21e856fd4aaa71cb088ee60a530fb5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e37cab-59aa-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639134757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639134757, "uuid": "cc380ef1-5913-4e62-8583-ee0120bd25b8", "comment": "Malware payload (Formbook)", "value": "e0539b5fef3c3da325890748268363d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639134757, "uuid": "e67aa7b0-dab8-4e4f-b666-5646e7a2d17b", "comment": "Malware payload (Formbook)", "value": "dffddb54c5bfc1f09e217008c304a3b37ae25ab0c0e535e4609955843a7b7720", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639134757, "uuid": "7ed506f0-023d-4bd0-b4bc-7452a9d6ffdd", "comment": "Malware payload (Formbook)", "value": "dd80a7dd947957d6c2774b20bc056e4a5d7c2c63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639134757, "uuid": "1b159232-2086-466d-904b-1582f261cc46", "comment": "Malware payload (Formbook)", "value": "011d3dc3161aafed3a2f42ea89a7a3f0bb58ab7c06edde89617930b33a6c01e58c14cb3518f6e5140dd9c886d8dc4207", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639134757, "uuid": "53f126ad-e88e-4e6d-bf41-63c2dcda902d", "value": "T1F84413907DC44D63EFF74AB409B2A9F5E7BEE28482A51EC74F100CAD1EE34A35AD0241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639134757, "uuid": "577a6323-ba09-405f-919e-c4f62a16a624", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639134757, "uuid": "8da3ae0d-00c7-4557-b0b6-ff2c2695c517", "value": "6144:rGiyZXs2hTbCeqi7x5JcxedNMo+qNapUR4lgQ8cOyw9DwL6:eZ8A/xLcQx+FZgQ86vL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639134757, "uuid": "254700d8-430c-488e-92e7-79058177d804", "value": 266431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639134757, "uuid": "438485ca-5186-4313-ac4f-980349660c4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639134757, "uuid": "4e401438-d1e8-477f-88c0-f4ee9fa0482b", "value": "Scan_009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b88ca8c-59aa-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639134983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639134983, "uuid": "2f932b13-e757-457d-b5d9-4c4586cdf6b0", "comment": "Malware payload", "value": "3c851672d3e817230c16b098c406f826", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639134983, "uuid": "742d655d-efa7-4d51-9378-c4c477ea790c", "comment": "Malware payload", "value": "e03f35ad032ca1371d378819e77b8b03e57e1d0dab0892dd33d9988d3787f344", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639134983, "uuid": "5802ae92-e83f-4517-9cf1-ef86c37b1328", "comment": "Malware payload", "value": "59919ab2738edf6d8311136de7db3a152f50c556", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639134983, "uuid": "6239a8e9-5e16-414f-a040-b32b0636e431", "comment": "Malware payload", "value": "bc91ba2d5cf0a7331fc5baef1a395236fa9d48ac5758fe3c3bf3ff796b2402afe11ec9f8721d5aa2394c5c6173b092f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639134983, "uuid": "0f7ea0a0-5b7a-4373-8dab-77ced44c2021", "value": "T117032A42C29302A3E6AA96B3B49397C35BA4A40D5CE00EAB98CD311F4D9F1197857FDD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639134983, "uuid": "67c7d49c-d6fe-4b74-b7d0-c2ee3a669f5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639134983, "uuid": "236e1e80-3230-419f-a580-3aff8408a391", "value": "768:DKcf3pAgka/8HHUTQQQQQQQBdy3bI91GN6bcE/2ihWSCAtkrjL1F:v3pga/eHUTQQQQQQQBdBgN6b5/2kWSCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639134983, "uuid": "ee8f3e6e-f7f6-4736-bd59-2a4b90ffea13", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639134983, "uuid": "f1937165-6234-47b1-8292-13ab5fca2cf6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639134983, "uuid": "cd83c609-a24e-4e6d-93a2-dfd1876dece9", "value": "Imex-PROJECT1 2022-pbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb518d2-5994-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639125541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125541, "uuid": "12ac4ed8-54c1-4a1a-a822-a5ca62c90d35", "comment": "Malware payload (AgentTesla)", "value": "1bbe2daf269968fd4d938b2ad0d88a7e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125541, "uuid": "a7271d2e-14d6-43e2-aa64-b892622890b2", "comment": "Malware payload (AgentTesla)", "value": "e3fb5c3711f553f4bc641d018bab9f2ba4099fc5bf524900664812b89f5f4437", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125541, "uuid": "60cc1eb2-3e84-4520-89cb-56dcd3bb9a61", "comment": "Malware payload (AgentTesla)", "value": "49bc7024c0b7dc0def20ebb10284565ec4bb29cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125541, "uuid": "e28249f8-8675-4e16-a86b-3f6a94e7d0cc", "comment": "Malware payload (AgentTesla)", "value": "bafabae25ceec07c37e4cf42cc36ad80f73daf36fe2ce4308d2e4b9457e271ec0b11abf55b8dbc479c0c705389989fb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125541, "uuid": "7883def4-c5d7-467a-bb6a-0882b4a19063", "value": "T1983523283FBC2B16CABDEBFF541524949B75F29B9493D70C4C8126DF58B37018A82A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125541, "uuid": "e0f4314d-356d-4b81-8693-de662c3b5518", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125541, "uuid": "3850e673-d01b-414e-bc8f-00531441daca", "value": "24576:BFHoxATikrKUMperYL18hU9qWFebKMxauloLFBg8NiNUz9o4s2jMBGG:BuxKHLWJ8ecW8joBN4Uz91s2jMBGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639125541, "uuid": "1de193f4-d64c-40db-abb6-cee350573597", "value": 1112576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639125541, "uuid": "cff97a93-5176-46e7-b23a-a1587cedba61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125541, "uuid": "b2f29a10-a82a-49a2-851f-0386004e8865", "value": "1bbe2daf269968fd4d938b2ad0d88a7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649e5eb5-59b9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Guildma)", "timestamp": 1639141333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141333, "uuid": "14b142f2-e6aa-458f-bc7d-628cad894522", "comment": "Malware payload (Guildma)", "value": "f17f28e6c5cd4665810f9c2d23af6ef0", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141333, "uuid": "4fc47b2b-a45c-4c58-bb41-169ae7ff4a5f", "comment": "Malware payload (Guildma)", "value": "e411a010a62e5dcad4adaa948a3490cd54d70fa224d54078cc5d31a0edce9068", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141333, "uuid": "afeac868-75e0-4ed0-ba72-9176f0b81b26", "comment": "Malware payload (Guildma)", "value": "c5237f147512bf98d8608da3f0ed64c722438497", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639141333, "uuid": "d4448290-d075-4fd8-a8cd-76e81844933e", "comment": "Malware payload (Guildma)", "value": "d99f6881ec2e3fd1b07194c1922625dc38a772a26134153d6fc6ad6a7977f01abd01ad05e0de730e2876ce397a6a4627", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141333, "uuid": "9210e854-04e7-45ce-9fdd-859f026dce3e", "value": "T1AEF023643B14A78CD1550739C0364F158830244E4D40FB7C52D56640E42C0C02FC9CF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141333, "uuid": "03d431c4-9a4a-4866-aded-b3c8333919cf", "value": "12:8DpOB+PlyWfyGEV75FvsyIgJHQzK8GrgSA:8HPlDpEJjFqi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639141333, "uuid": "85b16eab-1cb5-4a6b-a161-47e88b8e2bc5", "value": 540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639141333, "uuid": "f5e963b5-a3cd-4476-893e-a3616acf4420", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639141333, "uuid": "5a3ba941-ba81-4574-a08f-d27b57949680", "value": "f17f28e6c5cd4665810f9c2d23af6ef0.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97ba199-596f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639109692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639109692, "uuid": "4e57f205-20c5-49f7-ba9a-c0b1aa0479a2", "comment": "Malware payload (Heodo)", "value": "574998f360313e9e39762a02ffc0d65e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639109692, "uuid": "6171b3f4-3a57-401d-8ea5-6976754c6ad5", "comment": "Malware payload (Heodo)", "value": "e50032b575ee2182b7760bc47423b6d02c13d7dfa5c361cc50cb62965872b4ca", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639109692, "uuid": "7e81c0b4-8eb7-4b1e-9ca2-7bfa576a029d", "comment": "Malware payload (Heodo)", "value": "20de38e8b0d0a2333077dfa9483d6a23db59e6f9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639109692, "uuid": "0a85189f-173f-47cd-9d4b-a3e2f3140f3f", "comment": "Malware payload (Heodo)", "value": "de05204088fa76b20d54e1a3cda05c4a1fc97ce0af0fcbbf40cb75337b3c926707f32c1ce501cfb5c5275adf001af8c4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639109692, "uuid": "106e2cce-97ce-4a08-bc04-33605240b242", "value": "T1FDB44B00E311F13AEAD700FBCAFB88AD9569AB14239519CF55D86EE6E7590D03C3261F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639109692, "uuid": "ebbce33b-b391-4139-990a-543d7db06e8c", "value": "12288:me+n9DJGtOal5V8yMcztuEpzZ4GbOX8+Dn:m5MtOK5VXNzZ4GbOX8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639109692, "uuid": "3580f060-3fac-4f56-92c6-e69af590d5b4", "value": 523647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639109692, "uuid": "35d56d8b-91d4-4cd0-a971-2a1206b98cb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639109692, "uuid": "71ee1fc6-79af-47ab-9c77-d5d528446ef0", "value": "emotet_exe_e5_e50032b575ee2182b7760bc47423b6d02c13d7dfa5c361cc50cb62965872b4ca_2021-12-10__041447.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ceeb79-599e-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639129611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639129611, "uuid": "f199b46d-4ebd-4d5b-90b3-d590a77403e7", "comment": "Malware payload (DCRat)", "value": "cd9c969514291c96420097c9931a7327", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639129611, "uuid": "aee804b8-1769-4443-b2e5-c6f45d047278", "comment": "Malware payload (DCRat)", "value": "e546d7b89a41dfa0c1de4927fb9a4211d8ed5ab5015dc424c282f10e43f6b9a5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639129611, "uuid": "5ce77306-70b3-4f21-b5d5-5b619032d136", "comment": "Malware payload (DCRat)", "value": "0933ac9af3b2263223f80f4e2685a251e8fa1dc2", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639129611, "uuid": "fbbec169-13c3-4853-874b-d752c137390b", "comment": "Malware payload (DCRat)", "value": "94dad9534106456591324aa2bcfd9d02fcb9c5ef4e20be0102a52d1acc687fefe680300ddc4edf79f8229c224408ce36", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639129611, "uuid": "d0f4cbc5-3b1a-461c-a56f-5da58e74d27f", "value": "T1B6C52312B99109B2D6B22D70A5346B76593D7D200F68EF8FF3C8452C99720D1EB317AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639129611, "uuid": "b38a235e-bbb1-4b6b-90b4-3e7b2ceef858", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639129611, "uuid": "65bbd95e-da79-4b60-a438-754e5056ae1d", "value": "49152:y84eZ35Y3H0n5jHLAOH640zmt+OoMkZbyN88T6q:yF3HkHLADRdOVrN55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639129611, "uuid": "47c36133-c967-46cd-b6e6-88b47c5986c9", "value": 2726466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639129611, "uuid": "bfad9522-e1bf-4211-a568-f4227776bdc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639129611, "uuid": "5f7d22bd-403f-4091-9754-67de785a4653", "value": "E546D7B89A41DFA0C1DE4927FB9A4211D8ED5AB5015DC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f728aa-5a03-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639173004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639173004, "uuid": "56c194f1-3621-47ba-9595-e39b8e219500", "comment": "Malware payload", "value": "9f95feec201db8de760f684599387a7d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639173004, "uuid": "4971bc6f-fd0b-4753-9442-115b916bcbc1", "comment": "Malware payload", "value": "e6346f8e0ab7d07b6d47e55c537c0a868eaa7998f79606bad0c9c2176621775e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639173004, "uuid": "5295dba6-94e4-4aff-a3cc-3342d05cef63", "comment": "Malware payload", "value": "f6c15dd1977a31d29566dee4d7dec0205009dbb6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639173004, "uuid": "951af9d7-d5b7-43db-a72f-cc89f694cbc1", "comment": "Malware payload", "value": "0ec496da5c04a70ccb3770fcc16e44878fe225ec8171562055d5eb1cb822167df17c7b4673982155c31456cc4082c94c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639173004, "uuid": "4665a266-f7a6-4305-a6a9-325c2c34972b", "value": "T1F753025ED0025272E26A8C788052825FE9283F74E0CC3EE59225CDB5F7C284BCABB745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639173004, "uuid": "e28eae2c-ee84-4286-a2eb-ee0e35926f71", "value": "1536:FADh7rqRID8+nnyVtT5NrJWevZXU4kd2RtCk5nKsJb8hrzB:FCHqqDXnnyjfJWUX/3CSnxitzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639173004, "uuid": "6cf341b9-77bc-4dc1-975f-41277aeb98ce", "value": 65876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639173004, "uuid": "09ae9bdb-042a-4a2a-9c31-25087f3af593", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639173004, "uuid": "b98bf44e-6fd6-4bc7-9007-d4873c110bdb", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad31b85f-594c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639094639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094639, "uuid": "fbe9ece0-a731-4a78-a745-5deea511a7f6", "comment": "Malware payload (Heodo)", "value": "ece21eef87eafda952b19a8332079d59", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094639, "uuid": "330d4621-528b-48c0-9586-4005ec1ea879", "comment": "Malware payload (Heodo)", "value": "e95a6389b596e44d307fd29f2b98a1e5c2086d85a28170b83b45b10fd2cc93ea", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094639, "uuid": "96dad3fa-171a-4ff1-a595-55f2d77e2a0a", "comment": "Malware payload (Heodo)", "value": "92af3884df5d3a0b6ab6c555a6fdea20e9ad4597", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094639, "uuid": "439788fd-3f5c-45fe-b1ce-83f035289315", "comment": "Malware payload (Heodo)", "value": "f313479152327b5874dcb8585caf7fbea6e0b3e08760be2cc669e536123e0b0efc2aec426d0a574366ae3e7f18a688ec", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094639, "uuid": "ce8ce3bc-cd5c-404a-9c7b-709c9159a61d", "value": "T1FA44BF10B181A032E8FF147A89FAD56A4A7C7A100B80DDDF93D8197D4F775D1BA309AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094639, "uuid": "34399624-3ec7-47ff-b229-91774a1f3b90", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094639, "uuid": "4ceefeee-7a15-4a5f-9a93-b018cb6ea2ae", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTB+2ypv:6jIG/pjjuLbJLmGshoCUnWTypv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639094639, "uuid": "c901bd2c-7966-4021-9d96-ca4bf2250907", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639094639, "uuid": "349afd7b-4fe5-401f-8497-f0fb3d562362", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094639, "uuid": "e4fde146-c2c7-4053-991c-967445e4b0f4", "value": "emotet_exe_e5_e95a6389b596e44d307fd29f2b98a1e5c2086d85a28170b83b45b10fd2cc93ea_2021-12-10__000353.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0a5b72-5993-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639125185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125185, "uuid": "fa35655f-ee35-4a53-9b0f-dc8a24bf5e3c", "comment": "Malware payload", "value": "52d9e3f86c487bd73d678429e94cfe63", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125185, "uuid": "99c7af1a-f2c8-4d4a-9e5e-451c7d4ddd0d", "comment": "Malware payload", "value": "e98fec3c8adc5cfa6d99679943c5124c8594f0f262fee739c58b2eeee19d6ff5", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125185, "uuid": "5291aa3c-62b3-4395-a7b2-3e1a3d7f6bbe", "comment": "Malware payload", "value": "8940f0906bd73be2849bdb221a83537659948067", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125185, "uuid": "2e0c65f5-a8a9-4eb5-8e44-11e25bf16957", "comment": "Malware payload", "value": "6f2c16f0ba05d2e4a2e35ca8bc0009dbe7c668656badf67c21cce1f2e165f03b19b1b0a852f030941a16f0af5d80d10b", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125185, "uuid": "c8ac9897-0e64-4fe4-b775-aa1a1b111dde", "value": "T181736BA6B6D1DC06CE6A077A4CE7C2D6662AFC551F53838B324CF75E0F71AC0891261B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125185, "uuid": "089f6555-3878-4b2a-84f5-d3d30289ae0c", "value": "1536:Hk3hOdsylKlgxopeiBNhZFGzE+cL2kdAOezI0ScDNzmVQyrnHRBoESK4nceC7r9Y:Hk3hOdsylKlgxopeiBNhZFGzE+cL2kd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639125185, "uuid": "671c7586-ec88-49cf-89e3-72240aa1303f", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639125185, "uuid": "978c40f5-357d-4e2b-9de3-b56163e63932", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125185, "uuid": "a791ce8a-e1d5-4e28-a7bb-409717a1f474", "value": "Past Due Invoice 20053920.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02219b5-59b5-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639139768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139768, "uuid": "cdfb53f6-69c7-4f29-a2c1-002610a661ab", "comment": "Malware payload (AgentTesla)", "value": "4ae95714ed3aa578276b7a06a1d3966f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139768, "uuid": "e21e9fc0-c4cd-42e7-b1ba-3a025e0f2c61", "comment": "Malware payload (AgentTesla)", "value": "e9bcbfd654307b0c2e6960776084c20444dae83a4300b301f541e5473077b257", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139768, "uuid": "ac663ae5-2c94-4056-9bc1-4ad68619af4d", "comment": "Malware payload (AgentTesla)", "value": "e93dbd7618d106c98a77958dc19f7138ff92b039", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139768, "uuid": "50c7e6ce-f2e8-4614-b664-495716c3b673", "comment": "Malware payload (AgentTesla)", "value": "123d92a3c925a7e9918b3f6221b709bc215de48b2f2c43c4019bf37588e2785ab2bbc6afd3b0fc8a69774ebdc7db54de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139768, "uuid": "67bd689f-9c87-4fa4-b249-f07938d130cf", "value": "T18EC4DF312348CF66E17EB7BC85216010A3F0E907E723D75EBEE814EA16AAF454763653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139768, "uuid": "583b09f0-4e6b-455d-9777-3a4b6ac4f43c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139768, "uuid": "982d6245-e791-4364-afd7-a10d82db72ab", "value": "12288:vXksSu9pG9feMDzWfWtJMcmdiTukY5Pnevp1Rh7eSv:cspkfZ0WjMcmkiBQVh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139768, "uuid": "e35f01de-f1cd-44ba-978e-50c280f3ffca", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139768, "uuid": "0f49bf07-0cc9-44a4-a7e3-156250f23aba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139768, "uuid": "d993c155-a87c-401d-9b2a-623ed217f08b", "value": "SecuriteInfo.com.Trojan.PackedNET.520.25144.19239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1695bdb-59ff-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639171580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639171580, "uuid": "055e0ae1-097f-414c-8ce3-0428c970245d", "comment": "Malware payload (RedLineStealer)", "value": "aafdd6064e82ee1fc554f9278ec21c33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639171580, "uuid": "c34ab9f5-e343-497f-9d44-e6966e270250", "comment": "Malware payload (RedLineStealer)", "value": "ec023d6b5c815745264f62bcd9a73633489ae3ed505c22f1764388493ffc4cc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639171580, "uuid": "12f2e966-bdf7-4e22-8d24-c8162f8e8f30", "comment": "Malware payload (RedLineStealer)", "value": "c6bca49bf33bf94589a7c4fa7e258c1d214e2a6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639171580, "uuid": "5c2ac494-ccb4-41dc-a8e5-59e599db518d", "comment": "Malware payload (RedLineStealer)", "value": "5199cd9db2d6198d8a18a370fb0290a4b9948d44dafb04317b0848747807d9aa904b27d534203ced8ada3fcd62c242ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639171580, "uuid": "e354244f-0bf1-4428-b79d-3068d06654ac", "value": "T190F6331080B6F553C677C738DB6F4ACCC4359AC72D2CFBA2032B2665BE60342956769B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639171580, "uuid": "dbb11ff0-be4a-49cf-9f88-fc91e0447d59", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639171580, "uuid": "1928cafa-1926-4813-8f7e-5df9a2a7f360", "value": "393216:J9zKlDDptfYL/PdBatBROhOGz/cSZw7hbq1+IHiJkX:JtKl3YzdBkHrOm7YxHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639171580, "uuid": "48888d57-501f-4eb8-9be6-3772fa7ef17f", "value": 15382297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639171580, "uuid": "f15a7e2f-617c-40f9-bc65-1c146942ce80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639171580, "uuid": "aea5b1c9-a64b-4bbb-b889-c7c0fc190d98", "value": "aafdd6064e82ee1fc554f9278ec21c33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291b2e25-59bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1639142092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639142092, "uuid": "0c3d531e-1755-4024-87c3-87638c3e828f", "comment": "Malware payload (IcedID)", "value": "a42af3510d1f98760cccdada9f7b4c80", "object_relation": "md5", "Tag": [ { "name": "1677747888", "colour": "#DC4208", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639142092, "uuid": "ceade4bc-38a7-412c-81de-67dcea84cb80", "comment": "Malware payload (IcedID)", "value": "ec61d1e88dba974b5c9057bf2c52ba3359dd06e0d0db0b2c41df36c36cf1a946", "object_relation": "sha256", "Tag": [ { "name": "1677747888", "colour": "#DC4208", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639142092, "uuid": "23cf7330-6a81-417c-8c93-28a08960af80", "comment": "Malware payload (IcedID)", "value": "da0b2323c44e74ba80e30c8b31a540a716c170e5", "object_relation": "sha1", "Tag": [ { "name": "1677747888", "colour": "#DC4208", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639142092, "uuid": "19e0586a-f0fb-4a6c-afbc-2281f457a29c", "comment": "Malware payload (IcedID)", "value": "e3bb7b3d4790bdf6be1d5f165a1948d3076f11661ec601fc9d6b19b13a6a3c2984f7adfbfb66c95a59d2bebf3bcb1447", "object_relation": "sha3-384", "Tag": [ { "name": "1677747888", "colour": "#DC4208", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639142092, "uuid": "4f3c5308-97a7-498d-adae-e9e09c00d0a6", "value": "T16B13D014E4239E01C69D1B3A61FD01E07FB7439696918156AFD2EA0F4C212EFCB9E58A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639142092, "uuid": "a2bb464b-e471-4d32-bf60-63da48b3854d", "value": "768:277rmIutpnYC1DoTF0n0BKW2rq/eEflhRSfwdDQWk/HQFCqrLfxl1IJ6:2TStpYqD8F0n8KWG0lhRSfwd8WgtyLfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639142092, "uuid": "711d1ae5-a60b-4507-baf5-cb744f2bf644", "value": 43305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639142092, "uuid": "b320f048-d82a-40b0-8ec2-f1e1ab6fc8d0", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639142092, "uuid": "3afc4c14-4bf0-41d4-90e7-70941b380a07", "value": "order-12.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5dc8f3a-59bf-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639144019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639144019, "uuid": "b15efc5f-5968-48c7-9cd5-51cdc724c9ac", "comment": "Malware payload (RaccoonStealer)", "value": "8f1c8b40c7be588389a8d382040b23bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639144019, "uuid": "b6ebf1d2-8e6c-44dd-bf96-3f2b029d3c1e", "comment": "Malware payload (RaccoonStealer)", "value": "ed58ffee46a583c177c792b56c9fc20ccd9509d125f2e3fc90c4f48de7e2c2a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639144019, "uuid": "94b4c04e-3a45-492f-afe6-62d22a2144b2", "comment": "Malware payload (RaccoonStealer)", "value": "bef5209ae90a3bd3171e1e0be4e8148c4ccd8a6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639144019, "uuid": "c46c3566-3871-479e-bd13-2fbfefa50073", "comment": "Malware payload (RaccoonStealer)", "value": "18cdfa1f817a3c2693f5fc9a6c3ce8392053ebec26bf0f4622452520ab729fc65c3207acc6105e335b4e85dabae25ab6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639144019, "uuid": "e44f4994-9157-405e-85cb-f5fb5708b973", "value": "T1C64501037A254403E1580A7249E697E53B3EBD17B6036E1FF788BE2D1CB27462DE057A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639144019, "uuid": "5d9f81ed-5f1c-403f-88ca-d872c25c6793", "value": "a1715d4e9b83d4067f1f68c3c4012c17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639144019, "uuid": "89ba9d52-7e36-4c9a-bccf-9c3d5e44d47c", "value": "24576:mMyMzC8+ovorlBtugg0uHqJkSkSZI7C8JaYRHwOwhNGWwQ58Xaj8rac:mMHF+lxuPHYkSfI77aYRQOayac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639144019, "uuid": "67f8ce61-796c-4203-bc94-6e47431f7510", "value": 1241088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639144019, "uuid": "ae728fe8-9150-4cd1-99bc-23d6a51be5cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639144019, "uuid": "ae230731-5e83-4232-a09b-e634952805e4", "value": "8f1c8b40c7be588389a8d382040b23bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d873618-59a1-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639131094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639131094, "uuid": "395d3135-ec0d-400b-a734-ed0e9449c9e5", "comment": "Malware payload (AgentTesla)", "value": "6e20b3dabf96bf08c8b536746480ecc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639131094, "uuid": "ac613c56-b00a-4a69-8d50-5714a9a3599f", "comment": "Malware payload (AgentTesla)", "value": "eeb73ed53f9126728017296e7bdd789269964e862f9c16b088df47dec66f4037", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639131094, "uuid": "c4dccd58-3b08-4e82-8cca-de342fc3bebe", "comment": "Malware payload (AgentTesla)", "value": "81ec6e320b488885f9370935dc7809156e6079d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639131094, "uuid": "1b62f5af-4f8d-4f74-8eb2-b12324c8c393", "comment": "Malware payload (AgentTesla)", "value": "8a0b3856611cc952e45ffe577f05744aefaacfdfcb078918167c877c066c49d016279a76e6498c758b9914bb874f6447", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639131094, "uuid": "f3fdcf8c-5723-48a9-976b-df6c151fbd3d", "value": "T17D23F1B09859DF09526DDE5E8849B226D29BFBB8405E0DC1A2C3FC03186EE74E18397D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639131094, "uuid": "c83b3c30-ba2f-43f0-986e-f759228dd52a", "value": "768:Vi3Afv06iKRWA2lx7tEzOEEBM9uxpoU+f6bWOR4NAa2q2eMX+M7vGl+7E/OJqp28:Y3KJiKH27tE1ES9uxfUU5RcSq2eS+M8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639131094, "uuid": "eb3e020b-0e83-4a6f-9265-9a157dd64e3c", "value": 46481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639131094, "uuid": "8cd80ce0-e6ce-41a3-be30-d7e99ec91225", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639131094, "uuid": "709163bd-fdf9-4bb1-960a-76e37256356d", "value": "Facturas Pendientes-0039.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0efc0e0-59b5-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639139743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139743, "uuid": "cfd3e103-9772-44f3-8b35-87a52571960f", "comment": "Malware payload (AgentTesla)", "value": "b2713477c64d4d0dc1a1a7232493e4b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139743, "uuid": "6a093acc-517b-4c6b-aa68-ef22f0020475", "comment": "Malware payload (AgentTesla)", "value": "f0c934d2366c25939e817cd5d1940afd3b911d291a17aa7a686d2a7b0fc550b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139743, "uuid": "dd02a8a0-b01c-4e24-8f00-197fe3137b98", "comment": "Malware payload (AgentTesla)", "value": "d0f04faffad5e73b90cca833de2cc0f952f5104b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139743, "uuid": "2da24252-682f-4590-afb8-8eba8b2de638", "comment": "Malware payload (AgentTesla)", "value": "b69cc5865e9e8b60e59d1f0f7fba580dd22495bcdd962fe385b5fa80d43ba031c4b45361261c2dca12b9d8875a83d210", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139743, "uuid": "dea913a2-c3df-4126-a4fa-96d2c3579cd9", "value": "T1C875D182B3A580F2FE5766B39F15B6824B7C5D314533802F23992DA9AD721B1423DB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139743, "uuid": "ce12b69c-9c3b-4a12-8e1f-e4b22c53308a", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139743, "uuid": "195b6cad-05d6-41c8-b0bb-a5b459287eab", "value": "24576:XAHnh+eWsN3skA4RV1Hom2KXMmHae7jJ+leIhF34lobBuqwM29b3j5:Kh+ZkldoPK8YaiwbGxbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139743, "uuid": "dc3a8c86-8642-4d15-a265-5bdf3e205e5c", "value": 1646592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139743, "uuid": "19c39f80-3b98-43a9-b325-e6aaa0f52fc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139743, "uuid": "d64061d2-3b37-478e-8bbd-ec87ae063295", "value": "SecuriteInfo.com.Trojan.PWS.Siggen2.13090.21256.16513", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "014fa444-59b6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Zeppelin)", "timestamp": 1639139878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139878, "uuid": "2f596217-6ba7-460c-8bb2-fa7002429142", "comment": "Malware payload (Zeppelin)", "value": "9fbe16a50773ecb9dbace5e388a6c37e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139878, "uuid": "f0d6c395-3e9a-415f-adbc-5d04b5865372", "comment": "Malware payload (Zeppelin)", "value": "f38c40c74a0a9953697c63fbd375c064cb2d59ce478435c7357bd68f382dd26f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139878, "uuid": "a981e261-7260-4423-b7a7-80a896991fd3", "comment": "Malware payload (Zeppelin)", "value": "d9da6460238150e2bc24a9e4b2bd085bab2b3e9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139878, "uuid": "598769b2-6c9a-4dc4-a34c-c0ca9163f72c", "comment": "Malware payload (Zeppelin)", "value": "a1d01719278bc71d1f747b5537b27dd1ef906a79e0625df76e48f1b6f29c4b9508a7513190edf712e6c8815012735f47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139878, "uuid": "217e60eb-0a08-482e-a8e9-41f431fa7652", "value": "T19044E0DAFC0ACC65E2CEB931042A4F48733BED1A1761E64635673B41597B1F0249AFE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139878, "uuid": "d95a5541-2606-4670-be96-4655de43f234", "value": "f7023dd7fb9e445f38fcd83e7edb3f9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139878, "uuid": "58135f43-a4ee-427d-afcb-96ea8ba45185", "value": "6144:PWfM6iKwtADM5njFGKfi/Xm51QCG8VG1XhmIQ4m:+l0LnjFGKf351rGagwh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139878, "uuid": "2c05cab7-4618-4943-bde6-4a88e769d88c", "value": 256047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139878, "uuid": "eb604cfd-0767-4ca7-a453-0558ed45b128", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139878, "uuid": "7364c23b-32f5-4e02-ba47-54f59cbc6f14", "value": "1107.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb51e53-59b4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639139258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139258, "uuid": "049ad26e-a381-4040-a590-a7a2b3070088", "comment": "Malware payload (Formbook)", "value": "a94ab2248ae9c7616a7914a6de6fb193", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139258, "uuid": "1f5a276a-513c-48d2-b0ee-91cc7f75a44e", "comment": "Malware payload (Formbook)", "value": "f3b71d5ef4c1ec94dc7553f209503d662f462e75bd38aededabb54a478a30d57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139258, "uuid": "022c860a-eb1e-4325-9b60-f18cbc932cf1", "comment": "Malware payload (Formbook)", "value": "2e6dbc4b60a5a621d7fc963dd000a5b27737c39f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139258, "uuid": "ace10529-4885-4a00-85de-1fd4b4786d78", "comment": "Malware payload (Formbook)", "value": "59130602c2f646ab609c70437b1699be2f2e7e9d88e2f37f4bb9a2e0bcbe341cdefcb431880c6b2fc7bd779bb9611a59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139258, "uuid": "cfcbb817-ca2e-4128-9358-9d6b2c05bb10", "value": "T10844124FE5C10C17EA620B700A737770A77952A90A94275FD7042F382FB69C609DBEB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139258, "uuid": "68554ea0-a723-413e-b771-fd89f0fa7b3d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139258, "uuid": "7dd2ead4-ea89-4272-9a0d-d5e66e2a29b6", "value": "6144:rGiKP2eyIRcFq+zGTwYFwNU5e6Zj5oMNIh8yql51jE5h5Tr1:eP2GC/GTLwSc67oa+VqSN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139258, "uuid": "89fc63af-4ab9-412c-bc5a-498a88d1d1c1", "value": 275908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139258, "uuid": "b128f686-2524-4259-99a7-03a2159e2715", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139258, "uuid": "9079e923-19ee-4d71-be3d-f8ea72ea1fa3", "value": "MT103 SWIFT_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06dd6bc2-59be-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1639143323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143323, "uuid": "65366a0a-fd80-487c-87fb-1c59adebca40", "comment": "Malware payload (CoinMiner.XMRig)", "value": "ef42f07fb2fafbacf7e0c8866760c155", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143323, "uuid": "29a7c6e9-7e81-4405-8252-ff2c780eac5f", "comment": "Malware payload (CoinMiner.XMRig)", "value": "f413e421a85becef3240e73bdddb670251e3b6ad573b3e8f8858f0b5a45d4cfd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143323, "uuid": "7e906ecb-7a41-4bea-b578-4e9638247d34", "comment": "Malware payload (CoinMiner.XMRig)", "value": "ebca602579482f8b182f0e31a9bf47c89b5b7371", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143323, "uuid": "898b9eff-4c17-46c2-a2c7-8048e991b56e", "comment": "Malware payload (CoinMiner.XMRig)", "value": "b68ae9b89dea63df43412a268894898daab12ebfc105057f7c47e91f2daf4f4c21df4ef72695de5ca7d58e21a0a73d3d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143323, "uuid": "8cec1a29-8814-4a34-bace-4f90b1d04d58", "value": "T17484239B4C1D9AADED82433394FF08535A67FB9C33324E3D9A618C402DF2A645B864D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143323, "uuid": "87ad5bc3-ba31-49d1-9c02-219167184030", "value": "aae73b7675bdc323442f02d62bb383ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143323, "uuid": "0073a87c-e8fd-4ec6-b589-1317702f8b3a", "value": "6144:udg1ItuNpBfTPcPPdpo2iy/kaBPE2EpB9tk1ObAV1D4ltDlY/ZlFgXVlzVxm+Wy:usxpBbIkhycgXIBhkDWPY/HgVpVg+Wy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639143323, "uuid": "934d779a-c774-4f09-a501-032889527417", "value": 381404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639143323, "uuid": "57ee5819-fe22-42b5-bb35-f26df1c806df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143323, "uuid": "6461d685-238b-4a3b-854f-eb0f4a95b950", "value": "ef42f07fb2fafbacf7e0c8866760c155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229cd4d1-5a03-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639173005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639173005, "uuid": "656de913-6965-4b61-b4d7-fa494cf68905", "comment": "Malware payload", "value": "49ca4724497597963b5900f9f382594c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639173005, "uuid": "a6156aed-7ad2-4f4e-b3cc-d344a0855ffe", "comment": "Malware payload", "value": "f63095c1f2c8b4877511ee471e4559899a29438a8de6fb9641f02523c2246948", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639173005, "uuid": "2a1c5f85-ac35-4c51-8595-4b4f1256cb0a", "comment": "Malware payload", "value": "abe474e30a274e7a89c0adcad46bf9196cda687a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639173005, "uuid": "5255088b-fdc2-47e4-97bd-f019cd281fa6", "comment": "Malware payload", "value": "5a6efaf298bc32b7b6a482a6db10168da006d3de92efc8fcac366f8094830450e688b4c10bc38dcbe712717898f3db2f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639173005, "uuid": "b19490a4-ece2-43a3-8e7d-abb7aed70908", "value": "T17103E274B64F80328C803975C9AE9202DB65D66EB57BB2A6BB80862BE3B11551F7E005", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639173005, "uuid": "fc9e7d01-fa47-49cc-a367-aa8ebd85b4c5", "value": "768:HT8TYd/M3QhMX0BBndVWcq1al8jmn5A4T+w6p/l4V3Ul:zyYd/MgcCBndVWVg+KnPV63h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639173005, "uuid": "46f0a6e5-70a5-4b6e-bb28-58e90829c0d5", "value": 38376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639173005, "uuid": "54d7c889-ae93-46a4-a5d1-ee685b408a7c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639173005, "uuid": "c57330be-775a-4eaa-85ce-a0adc9f11806", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e8e5e1-595b-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639101149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639101149, "uuid": "7aa65f42-173c-4982-8b82-1bfc3ae91e45", "comment": "Malware payload", "value": "8af53560828d0c47f04a94c6290c7a5f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639101149, "uuid": "ff09a70e-ce62-4bce-bf29-1caf5ce6e14c", "comment": "Malware payload", "value": "f6b93e35eb9522cfb3c8fa5c403690967efff4f0cae469664880e32c378e4eb0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639101149, "uuid": "1909fdb0-4570-4c67-8749-cac17fd32c9e", "comment": "Malware payload", "value": "dda4ed1d37be8dab31fd01e1cae2b90d711c7420", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639101149, "uuid": "748b4d0b-9631-4697-90b3-36575f214c01", "comment": "Malware payload", "value": "a5a1ef220ffa2c955ce35013ed9a8d0d223676d216fb434e02a57be9c280078178a831dc8dca1d49c3e09ab4c59ff53c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639101149, "uuid": "dc67c4f7-95d1-482b-965f-04c06f3bfe7e", "value": "T16594AE11F781C436C2AF31706616D67965AEBA708FF582877BD41B3E5F301D29A38A0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639101149, "uuid": "b08d3a47-5054-4d9a-a3f9-c10c20430911", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639101149, "uuid": "bdcd9bbf-d093-4533-865a-9d59abd369e2", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkHDa63P93XCJdjW4+WxnKYRRV:HVqLOGNVDzZtIlHN3nkjZXC/j8uV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639101149, "uuid": "933dc47e-3a32-4d16-96eb-ba1784452fff", "value": 425468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639101149, "uuid": "4b2c6877-436e-4eb2-8223-b28a915c30b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639101149, "uuid": "819dfb5b-5266-4704-b413-10717140412e", "value": "emotet_exe_e5_f6b93e35eb9522cfb3c8fa5c403690967efff4f0cae469664880e32c378e4eb0_2021-12-10__015224.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be08fd6-598e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639122850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122850, "uuid": "cdd4bb54-c111-4bc0-9c49-d9c8e8a2c6e5", "comment": "Malware payload (Smoke Loader)", "value": "7143d8cdf34062acfb10ed7697df5e89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122850, "uuid": "e84186af-b0dd-4cf6-9378-70a690721b07", "comment": "Malware payload (Smoke Loader)", "value": "f6e14fc7eb1cbe97ab0c86b2a5b473591c4e0cfd1563f3c2b12ac13793680c2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122850, "uuid": "7014ac34-ff48-43e6-8e69-e3385aa322fd", "comment": "Malware payload (Smoke Loader)", "value": "34a2bf350029f3530ffdb4ba84e4a3c34e07d004", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639122850, "uuid": "9a8e6dd0-5d91-43b0-b0c8-576ad91987ee", "comment": "Malware payload (Smoke Loader)", "value": "df36f60f3b0b14b611dc45e9b74213e0f3cb4915b89b0b3f2811afc1267e74496753a60f7ddafd0785eeb269769cd5ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122850, "uuid": "b753f5f7-0190-425b-b916-c03186fe4092", "value": "T12D946B2C25C7D6DDF83ED7783AA4619803E4BCF5E603E1DEFC94319B6933A506A22521", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122850, "uuid": "b8756c6d-daca-42cd-b8b2-28f918f3f330", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122850, "uuid": "52859c8f-abae-4e87-b543-314501b95a52", "value": "12288:ZA8lOGsGILZvk1A3a4TFjSyOGgtJjAMOabfVs:ZLlOGsGILDfNWAMH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639122850, "uuid": "60983b5e-a94c-4be2-8bdf-56ce487fc4dd", "value": 436736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639122850, "uuid": "726e96d2-3b8e-476c-96dc-e17fb08f07cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639122850, "uuid": "d9f5c5fb-7ce8-4ad9-b9e4-6e00de82f8e7", "value": "7143d8cdf34062acfb10ed7697df5e89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a084da-59be-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639143500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143500, "uuid": "e4d5d2f3-8c60-428b-85c6-ef62df4a8b93", "comment": "Malware payload (Formbook)", "value": "7b36ace1c180faa31de8b7390b166f7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143500, "uuid": "8574dd7a-16f3-4c78-991f-376ddc555a09", "comment": "Malware payload (Formbook)", "value": "f6ec336ad7902fc73ca6256fc549d449e8a59daec2ece6053f68cdca3fc09011", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143500, "uuid": "0825fba6-c7c7-4288-98b6-caaaf4fa7beb", "comment": "Malware payload (Formbook)", "value": "dbec78f06cacd2fb4083b2fc4280aecc5128953f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639143500, "uuid": "1cdfd4ea-dd2b-4ce6-805f-63c85f6f9026", "comment": "Malware payload (Formbook)", "value": "f3a9d447430e37b7649dc03c1e46bf5e1bda0d91bcc9543431527728d47e1bff92bec1e60364470e8c82e95ff6fe0583", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143500, "uuid": "17058b1b-ea99-4f99-b901-39a086ba3be7", "value": "T1B644228EB1F18DFBD1894A321D373B6AC6BB557001825A030BE04D57BF72EC75A19396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143500, "uuid": "dc157278-bd0a-4d28-8b0c-dea8d72f9dd6", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143500, "uuid": "30f4c440-0bfd-4b58-8fe2-d1b179ebfea8", "value": "6144:rGi49en1w96kgvP4TWZPR6IOCkQ+HLoxhhMrkgMPFCgwS:EYi96kgvPEW1qUmwhSrkHPjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639143500, "uuid": "b548724d-73e5-4ddd-9a0e-fd3654b4dfb8", "value": 278179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639143500, "uuid": "68c5a8b0-e71d-4505-addd-6f717410238a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639143500, "uuid": "b7517d2a-0f72-4c86-803e-959d84dcb0a9", "value": "7b36ace1c180faa31de8b7390b166f7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7d1f60-5985-11ec-96a4-42010a9c0029", "comment": "Malware payload (Guildma)", "timestamp": 1639118957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118957, "uuid": "8ce523a6-9247-4c81-9247-0597225c3452", "comment": "Malware payload (Guildma)", "value": "9e762a5a129797e9ec23d1e483d67b06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118957, "uuid": "6625de01-3f96-49b8-9e87-b1314fa2f1f7", "comment": "Malware payload (Guildma)", "value": "f8abd77f45b066ef139c336cccff9aed152f36609e22826e7c170d8cba334dfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118957, "uuid": "d10d8477-76b5-4e57-943c-c970a6aa57f9", "comment": "Malware payload (Guildma)", "value": "5a27479f27101d563cfde20fd7ba6690fb25040f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639118957, "uuid": "a1241b80-e8a7-46ca-8928-490259a99c2a", "comment": "Malware payload (Guildma)", "value": "f5b09684de05b2b8f7b834dc8304be06462caf7b567f51f1e38832c4b40a558d58e62c15af7354b955b2c178e8294599", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639118957, "uuid": "1425169f-ad3b-4697-8d79-0f9d29c3bbe1", "value": "T1F1E36B8F3718F4A5D68E0630147FA474DC963C526E270877F8CEB72558B16B1E7A8227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639118957, "uuid": "76d46c96-e625-488a-9a08-6f0541a29ef7", "value": "a5aa0c1a5391a570f94217e0b8c14be4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639118957, "uuid": "34e15b11-1322-4ebf-8093-00fbbc661611", "value": "1536:Pk31KAWQBkvW1zDxhuILTG1113LfUz0CFF9haCPGmPRVBTaDXKO7W:cF3CWRnq1baF9hJZRVBTCpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639118957, "uuid": "a5d97f98-8685-468c-8d5a-a925c38e8b3f", "value": 155729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639118957, "uuid": "26c485f5-eb54-4c0c-8545-9a987c0cfcf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639118957, "uuid": "b96fddf0-3e63-4645-9a29-bcf972c25b31", "value": "Foulardb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6be6fc8-5997-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639126841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126841, "uuid": "aff60082-97a2-4691-a6a0-b98949cac8e5", "comment": "Malware payload (RedLineStealer)", "value": "5ca84720f5b93c425708b797ca974743", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126841, "uuid": "5b0e72b5-bcee-444d-a857-4cdc06bb7aad", "comment": "Malware payload (RedLineStealer)", "value": "f90dddcb147c9025f8e9e4a57016b2685a95d7b2f4932f4ef0fb76079a877089", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126841, "uuid": "f3177bbe-ff2d-431b-808d-7b1264f90f6e", "comment": "Malware payload (RedLineStealer)", "value": "3efb3f831621c4e29791ab70041755ab10568dcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639126841, "uuid": "d54e1087-8863-4704-957b-fed31ce41e17", "comment": "Malware payload (RedLineStealer)", "value": "c6fd457b85eb1d22d60f858e8dc7977e494d20364ae3123c681afcb5df357ee2f72616362a133b051514c68ad46346c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126841, "uuid": "7dc2dfa4-3f61-4554-b5f7-a8c4442086ea", "value": "T110D40132A999C571C7A34E3098219FC55E3BB8625525401BE354279F2FB1FAC4BF232E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126841, "uuid": "1c67bc01-4fb0-461f-a03d-84c26aafdbba", "value": "784912eb6940550282ff4b089d7e66e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126841, "uuid": "f862de53-3504-4fe4-a4f0-37319d010c18", "value": "12288:1Jkbo3GPUYtqFixnrPeoDiNCwcickgxtzGI3tGVDHxwbpqTqqH5usunnXm:LkmGCYZrPfACLicxx5GstmHxwbYTTuPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639126841, "uuid": "b637fe6d-e0b0-4ad4-8fa5-a36761d773d0", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639126841, "uuid": "43dbb75e-e0a6-41ed-beb8-dcf274801cd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639126841, "uuid": "fa346225-c6fa-4ab5-8684-6b7e5f89509a", "value": "5ca84720f5b93c425708b797ca974743.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3780c6e0-59a2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639131379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639131379, "uuid": "8085c962-eb9c-4a41-b64c-52d4faaa2c7d", "comment": "Malware payload (Loki)", "value": "86bf2ee026c2c60ff8eaaab84191a400", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639131379, "uuid": "0704d437-0c18-44cc-8e52-951d7e1e6b73", "comment": "Malware payload (Loki)", "value": "f958bc571f586776a957ca1fded0806c7f7976b75ba6570a73741635678bf7c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639131379, "uuid": "d6c7f08c-a375-4536-8a48-79b7707a89ba", "comment": "Malware payload (Loki)", "value": "6adc2f0850292867fcf6baeee4427157e967f9d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639131379, "uuid": "592f4cca-213d-4cea-8701-fa3c72ab50a9", "comment": "Malware payload (Loki)", "value": "0dff26165665523686cc9fcdc3442b3652d490a7b6e40ace62e960eef2c2c7027d976903d4de5974ff3fab8fe5907218", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639131379, "uuid": "c5fb799d-18b5-4412-9667-6518390b4337", "value": "T1DD35231A1AF0F4BBD42946F68B9BC0508AB9F0432C63F2F55C5182FDBA38995D603B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639131379, "uuid": "74039518-04f1-406d-8624-ae59586106fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639131379, "uuid": "153d4653-8217-4273-a470-2001d5a3afff", "value": "24576:RIKjy/SYCpFjEgJjod8fVmMBuVy/LeQa7epS0aCp5cM2:JjAStwgJjodWmMYVTgS0Dp5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639131379, "uuid": "339ba00c-9bfe-4955-a402-4b7bfa17f2e2", "value": 1123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639131379, "uuid": "8ebf492b-c4c2-49b3-86f5-d66a4e8756e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639131379, "uuid": "9cd4888c-e1da-4180-b3aa-f91fdb0599cc", "value": "86bf2ee026c2c60ff8eaaab84191a400", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0ca2bc-5994-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639125323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125323, "uuid": "23a216ba-7d7e-4ac6-bcbe-05fa19281d02", "comment": "Malware payload (AgentTesla)", "value": "baa1c318edc59d3cb771ed61023c8b8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125323, "uuid": "73cbc05a-e56a-45a0-aae1-a349474ae9de", "comment": "Malware payload (AgentTesla)", "value": "f9fb667c1ad88479c4fe0610db4ca19495d70b5cd4b8d86307d7f1e0a24473eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125323, "uuid": "91aad90c-b2a2-448d-a4ff-064cb927f15e", "comment": "Malware payload (AgentTesla)", "value": "2e5913e52ee54152d20e05f34fe072343b3d705b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639125323, "uuid": "3ecb7858-ba59-4be5-8ecf-288a11d73316", "comment": "Malware payload (AgentTesla)", "value": "25f148133ed6ff69d7503b9a3d528383e7d6170bf2432f69404a9e71e4276f89ddd6fbca974cba1d6ff6894ef9704d0a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125323, "uuid": "2d57adcb-e38d-4450-ae74-470d7827346c", "value": "T1983523643BFE4B95D97A2BFE942124188775A8571866FB2C1EC270DE14B2F004F78B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125323, "uuid": "2da179a6-8fba-483c-842f-d027a9c66ea0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125323, "uuid": "2151e30d-43fd-4607-9e85-5cd37827e7fa", "value": "24576:lJCxhTn12L5KGJkXsd3Gbg2RxmhbqResvn5EqzXvMKU3YKj:l8x9n12N2sdWnREqzvn93UZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639125323, "uuid": "baa694ab-0232-45ca-8f94-1a7fe9847f38", "value": 1134080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639125323, "uuid": "fa1c909c-7d80-4b0f-947f-e414d924bf95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639125323, "uuid": "645aad0b-b829-4803-9453-af4c15ee5fbf", "value": "baa1c318edc59d3cb771ed61023c8b8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beef35cd-59b5-11ec-96a4-42010a9c0029", "comment": "Malware payload (HawkEye)", "timestamp": 1639139766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139766, "uuid": "0b341483-7c50-49cc-9dcc-7a1350baca84", "comment": "Malware payload (HawkEye)", "value": "e20ff757a8a3e61cd78528c83d8dc796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139766, "uuid": "4f8a40bb-a157-4a89-a575-5ff6885d91d3", "comment": "Malware payload (HawkEye)", "value": "fa228078490ab490d0990eade1bf3900837b83db09ac9b245d932106ba565e48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139766, "uuid": "2ca676e3-69a7-4cdd-93ea-dabe03413a58", "comment": "Malware payload (HawkEye)", "value": "265b8fb5a4d43c1b4e4730845db8613fb8950902", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139766, "uuid": "f38df1c6-f33d-41cd-bb2e-c84dd4338efc", "comment": "Malware payload (HawkEye)", "value": "85fdea8e5554f26e0864dc97731bb4e579b4ee9970073af1c9af3643261c1d5fd00d7efd0c0bb979178b163b8623613a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139766, "uuid": "30d1c15c-4e00-4e40-ae9e-3ea89cf5746e", "value": "T1DB85D0027391C025FEAEA1735B55B24186BCED25073384FF12A4AE79AA711E11F3D36E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139766, "uuid": "061b2a90-6464-41b6-bb28-f057ec010fd0", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139766, "uuid": "34adaace-1137-474d-a103-3d5b30d086b8", "value": "49152:wh+ZkldoPK8YaAhtlDzYRGEqO64glOTRu:x2cPK8CPzCYOalUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139766, "uuid": "a34ae09a-f263-4210-8abd-04e34a084063", "value": 1771008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139766, "uuid": "637b9ebf-2caf-4a98-a432-5f34fad7b15b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139766, "uuid": "b96bfc4d-dc63-47e1-be8d-7aef7b17ef7e", "value": "SecuriteInfo.com.Trojan.AutoIt.449.29642.1194", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a69034-599e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639129815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639129815, "uuid": "363ab9a2-28c6-4319-8bbd-d9f43dea5d0c", "comment": "Malware payload (Loki)", "value": "80d356310a3d58d13b07f5efafe5960f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639129815, "uuid": "ad863d00-47a7-47d6-b7de-8090b175cfac", "comment": "Malware payload (Loki)", "value": "faaa858188b945fb78db843189fa2018c2e0e5d18031c5dc86c28ad5d425c0b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639129815, "uuid": "8ffe1a71-01a0-4769-8d16-99d5e1911b57", "comment": "Malware payload (Loki)", "value": "793a2cf1f1c9c05b3fd01c4da7ef62c572b3727e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639129815, "uuid": "8c3a277f-52c9-45e7-9c9d-ae0bc4e83628", "comment": "Malware payload (Loki)", "value": "8a338bd9e57750eb6fab217f12f33e5c09375b477cd47d46569aac7e3f38b452a5a6260d7e1abbe34babdc20b8522f57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639129815, "uuid": "23cab49d-5130-44b3-ad49-69ad383872ba", "value": "T10044221726C6B9B3E6C449302733B7AEF7FAD46881954F85ABD01ECF1992657008E2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639129815, "uuid": "8c95bb4d-b350-48d4-9f24-527d128e476c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639129815, "uuid": "1c0dad24-459d-4c24-a483-8244d9027748", "value": "6144:rGitzR8IEAgcbBAL0g1K/1IBllaRIx0djmejl2W4P:5z6QFGA/Wk2waex2WY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639129815, "uuid": "09239f96-c431-49ec-90ea-939c9591e0dd", "value": 272829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639129815, "uuid": "dabe464d-c4e8-4d21-8c28-da2d51eda220", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639129815, "uuid": "cd76f52e-6c7c-4a8e-8106-071d7a8ada49", "value": "80d356310a3d58d13b07f5efafe5960f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f117f73-5a06-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639174314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639174314, "uuid": "cf9f9a3e-a358-4e65-8201-77ca56707c36", "comment": "Malware payload (njrat)", "value": "acc5c7bf3d24c6156b7defab87f564f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639174314, "uuid": "3533b75e-4111-471b-a4b4-d9916d1335b5", "comment": "Malware payload (njrat)", "value": "fcdcfc11a385aaae03e3f31964503798eaa76a1ba726d17cb59ab440e155a5f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639174314, "uuid": "0339bcbc-c4ad-43d9-a3f2-efc91f5adac6", "comment": "Malware payload (njrat)", "value": "53abe0aa5938faed0fd1eec79e8ebe84be0be570", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639174314, "uuid": "7828a1d8-18ee-4daa-bbf9-0291821aafe7", "comment": "Malware payload (njrat)", "value": "cacc4087c47ace92edc82ea1bdd889dbe175e543633fe44614b99cbbf05bb84e50b39084f22dc8f1fd763055f07184f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639174314, "uuid": "16640a64-4446-4ce3-aec4-807ee76b2610", "value": "T1E8B22C4E3FB98856C9AC077489B5965003B4D1470423EE2FCCD564CBAFB3AD92D48AF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639174314, "uuid": "8a768dfa-1062-4078-864e-3aefd472b3e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639174314, "uuid": "0833daa1-0cd0-4c08-8b4a-8ea15725781b", "value": "384:ZsqS+ER6vRKXGYKRWVSujUtX9w6Dglo61Z5DVmRvR6JZlbw8hqIusZzZaa6:Sf65K2Yf1jKRpcnund", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639174314, "uuid": "db24940c-5063-4f19-9fc4-4c11854d1658", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639174314, "uuid": "a40fde14-cc25-4aa9-8203-28843a710b13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639174314, "uuid": "61478497-c1ff-455b-b4dc-cbb2abf79fa4", "value": "acc5c7bf3d24c6156b7defab87f564f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c06a35-59d1-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639151851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639151851, "uuid": "715bcfcf-458e-4303-bc61-e1d1c50de6fe", "comment": "Malware payload (RedLineStealer)", "value": "0c5a2e3adf399e22fbd34b5c1f268c32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639151851, "uuid": "85cf617e-d35f-4d34-92f7-8e249e930b91", "comment": "Malware payload (RedLineStealer)", "value": "fd227833291c51902cd7fb9646e8041c8afa9ddb330893b9d2bb148f8726855c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639151851, "uuid": "5dea444c-8f89-4ff0-af41-911b1984304f", "comment": "Malware payload (RedLineStealer)", "value": "eeb2bb907b955d909e0f5fb2c9505f598f1da3b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639151851, "uuid": "aed3f236-c568-4a87-833f-3c7cd2a2bcb5", "comment": "Malware payload (RedLineStealer)", "value": "67561153aabaeb4e9337064a689e5412ffbd8883c16eb5fac638544e8b326948e0ef81d31c9c02807abafbe13fd60227", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639151851, "uuid": "78a9a03b-421d-43c4-8e81-fab5ae4bdda3", "value": "T16CA35D20679C9F19EAFD1B74B4B2012043F0E08A9091FB4B4DC1A4E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639151851, "uuid": "9c0e75f2-5a9b-40ef-ae1e-11d3888b15d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639151851, "uuid": "6c79c96e-a236-4121-803b-900d6a6768d7", "value": "1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed27teulgS6pY:rAMOY3+zi0ZbYe1g0ujyzdnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639151851, "uuid": "706a2256-5938-47e6-bdec-633390c19bbe", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639151851, "uuid": "e68987db-98c8-4290-8a3d-d8861da90b44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639151851, "uuid": "86769843-52fd-410a-810d-8cbfabfd6803", "value": "0c5a2e3adf399e22fbd34b5c1f268c32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d284fd12-5998-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639127344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639127344, "uuid": "6853a604-c607-4185-af74-5f431777e874", "comment": "Malware payload (ArkeiStealer)", "value": "d351f6243d8ccccbef310b4c2f8b9f12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639127344, "uuid": "73ed3b04-715d-452b-9b9d-a734eb7e1eaa", "comment": "Malware payload (ArkeiStealer)", "value": "fdeef71875ef8922e1d279a8baba6bda2632fa0ba2d518afa346b8d3048b03d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639127344, "uuid": "050b1045-20af-4fce-b1d0-5b9c9b98ab6a", "comment": "Malware payload (ArkeiStealer)", "value": "fcd99dca1ade9a7c27d2a4d3b26698e65bbf2c0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639127344, "uuid": "b70ae6e6-020d-4de8-a27d-5b6b8b7a5b06", "comment": "Malware payload (ArkeiStealer)", "value": "ba7d048e28c035ccef4d52205ac9309a02d082a17ec3d7e91acea2c697930509f074945d50556e24d22610b4b96fae62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639127344, "uuid": "179ff1b1-07be-4b88-8496-4afd59826298", "value": "T18B44AE3535EEC871E1A32D3058A49AE40E7BF8626A21404BE364779E1F72F9C55F231E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639127344, "uuid": "346b8b7a-4177-41a7-ad72-531cba892589", "value": "d9d80fc68e5de9a4648b84065bf1f199", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639127344, "uuid": "b0baaa79-0941-4f8d-a6d1-112dd58733c3", "value": "6144:0oJL8Nez08YMjNlhd7neuCl6uzbgwu6Qigas:0oJc8YMNd7eh6unn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639127344, "uuid": "926359d9-233c-430b-b706-fb239f60f6da", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639127344, "uuid": "35682dd4-b489-4288-bf85-3cf741d27742", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639127344, "uuid": "2fa8cfbd-8a3b-473a-959c-009ae49b202d", "value": "d351f6243d8ccccbef310b4c2f8b9f12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf52d76-594c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639094505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094505, "uuid": "3f74801e-aeca-4434-91bb-accb50a49baa", "comment": "Malware payload (Heodo)", "value": "ca61869dda67191e428124172ce3f4f5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094505, "uuid": "df63209d-32b9-4f25-aed2-f5164d073b9b", "comment": "Malware payload (Heodo)", "value": "fe2ec6ccd3e9de3604d999c58d801da96b0cec35fcc83c6cc2fc76615b9ef22f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094505, "uuid": "2dfbd3f1-8101-4428-b798-bb3fc32919ab", "comment": "Malware payload (Heodo)", "value": "451586ca019d276d86d68baa87bb71e044920ad6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639094505, "uuid": "0d1b3eca-ed8c-47bb-b718-235fef7fc598", "comment": "Malware payload (Heodo)", "value": "f43ca4fb1045a185d514f34e70a12f2123fa564d768a574fa8f0de68c693edc4855d9cde3c4721ceaeaccf82ce66c851", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094505, "uuid": "1fd595c6-5e86-41c4-9a48-f6ad0cb4cf1d", "value": "T11344BF10A181D036E5FF087A86FAD9BE466C76600B80DDDFA398187E4F6B5C1763059F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094505, "uuid": "67838d8f-8443-425c-b002-c152fa9f8291", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094505, "uuid": "d613dbb4-439f-4ce7-bc66-635936c67d2a", "value": "6144:WveDflm0NLph6TZm1T3MHL+rF6l5ER0lBr/lQWTBKmgL/S:Wvef8+h61mRcHL+rF6l5EAQWTOL/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639094505, "uuid": "694c89ba-3a89-47ff-bc81-9a3fda316e0b", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639094505, "uuid": "78528612-aee9-4428-a0c1-7394050a0720", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639094505, "uuid": "4658ee9e-8973-4fee-9a55-76203d7b618f", "value": "emotet_exe_e4_fe2ec6ccd3e9de3604d999c58d801da96b0cec35fcc83c6cc2fc76615b9ef22f_2021-12-10__000141.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e088e856-5963-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639104604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104604, "uuid": "8839acf5-f71b-4c37-82be-037d0cc9eaf9", "comment": "Malware payload", "value": "62c454f3f0638ad69077ba892a48c18e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104604, "uuid": "f1d8fa2d-fb6a-4413-9c40-4a9a59a003e7", "comment": "Malware payload", "value": "fe885ad9cf2bf51bb7a548f637c519ea714468c2ad619d764fcc5535cd9376f4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104604, "uuid": "a031a007-104e-470f-9e4b-7a761c649ec5", "comment": "Malware payload", "value": "fc559fe9f359e38d0db0347b7b9178215bd34cd8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639104604, "uuid": "2877545d-80bb-4ea0-b91e-49d5dd6b3ace", "comment": "Malware payload", "value": "4be64c40bb6359bfbe5146978c7c0e950a9228d6d6449f7f229e15f6e9fd167a0088ac2489d2eb708f7f32811742f1fa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639104604, "uuid": "de15d764-ea02-4c1a-a51e-d15ff8e29ab9", "value": "T167430220EB25D92CCDB42AB2BD940163BA491FD0F2BBA553D3360A6E45DC58991F7143", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639104604, "uuid": "49d92df7-ff80-46a7-aa7f-a137bc0293c8", "value": "1536:Qin4/vSgGE0HGF+Ssgynev0SSvZErXGo9jE:p4rGEIY+52vGvyXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639104604, "uuid": "964f41ed-e389-4437-9485-06fa378b6fde", "value": 58716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639104604, "uuid": "42f01067-7bef-4b8b-ad81-a6073648a6da", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639104604, "uuid": "1051effc-b5bd-4a4c-b0c4-80d90c0d15cf", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67732fb-5991-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639124290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124290, "uuid": "94e7f161-4ee9-4dd0-bc8b-cea0068352e0", "comment": "Malware payload (Formbook)", "value": "708a8938afe1bd63eef3c27d946acc5f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124290, "uuid": "44a0f45e-37a4-4d31-9e84-7d8123bffea3", "comment": "Malware payload (Formbook)", "value": "ff083c7aae0fdc8630cc507a3dce9787d76fadd9446f074ef9a01c168b6595af", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124290, "uuid": "39dd7dc3-1a68-4151-9ca1-9bb6506e4083", "comment": "Malware payload (Formbook)", "value": "176177a2cc37ad696a1fb7fceb735dba35b51b46", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639124290, "uuid": "ae29c59e-af56-4c45-878c-16a9fffdbb12", "comment": "Malware payload (Formbook)", "value": "498a7fc741633ac45c4b204a72a2591c643a9511e361b2e499bdde3adadc774523671ebb1c959b5b2b4bd59f381a71a0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124290, "uuid": "8360f59a-c7c7-4ceb-ab02-7d54a231518e", "value": "T11034128E7A9C8C51E6EBD0B15412A7DEBB43FC6DA4201493D548322F6E378210BDD766", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124290, "uuid": "9f784ee9-717a-4cc5-998b-8c776b85e707", "value": "6144:Kgyfp+5yR5Jtv3GprTEI68SHgg/e9uyaEBflVzF/:KgWkk3GaJHgZaInJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639124290, "uuid": "5066065b-82af-457f-9cb1-acef68bf3b32", "value": 234824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639124290, "uuid": "74180717-07a0-4b9e-b31d-60d52c39477b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639124290, "uuid": "e1c30041-bb30-4cd9-b977-1629907070d3", "value": "payment copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd840f2-59b3-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1639138956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639138956, "uuid": "6e03685f-4a8b-4b23-a5e4-478db4b8985e", "comment": "Malware payload (GuLoader)", "value": "711da08d4eae888d986c8df5a686ce5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639138956, "uuid": "11e52c72-13db-480a-9eba-0d97c703c60b", "comment": "Malware payload (GuLoader)", "value": "ff2eb4c5822da1c3c299ecdf34ff5bf8f231bbbac659e402f1b4ec61d58b2f3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639138956, "uuid": "569d46ea-4825-40d3-99c5-7934f7feb5a5", "comment": "Malware payload (GuLoader)", "value": "1486c92930f481f598f9b7c891e173fd8b767e35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639138956, "uuid": "59941a24-b7f3-46ec-af73-b7578b538e80", "comment": "Malware payload (GuLoader)", "value": "285f591c7e3a610ea78873b199c91169d37c378842b4c6d7628d910d8383bbee6acccba4becf778c94108223f3dbfb38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639138956, "uuid": "95538bbe-70c5-40f1-aa13-4d56ca25ab42", "value": "T1F8C32BCC11357B96F7F68335E816A92D55E108B29D1683AF2096FF38B1F23C11646A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639138956, "uuid": "43796403-6af1-496a-a7ee-21d880236a11", "value": "58ec3e068c9d3469ac8cb497b88f41d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639138956, "uuid": "dfc36c57-a4dc-4c6b-9cbd-f093348e7e52", "value": "1536:pm1zDAUFgeRv5UaK5k1bWCc4Iw/Ws9iu:Y50ev5Udk1bMwOvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639138956, "uuid": "e4e0b93c-c029-4d6b-81af-c40eb48083b7", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639138956, "uuid": "26bbe25b-eb88-4806-a4d3-2b030d295450", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639138956, "uuid": "794f3b36-f975-4b18-ae9c-d3ac9af0c308", "value": "URGENT_ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc08a58-59b4-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639139280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139280, "uuid": "b73a573a-d386-4ca0-9998-828e38d0c1b0", "comment": "Malware payload (AgentTesla)", "value": "f684147315664d3e650461d7aebd8afa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139280, "uuid": "0989fb3c-4579-49a4-8be1-89305a943d06", "comment": "Malware payload (AgentTesla)", "value": "ff6e25551d7f0365851f54022ecad466eba683dbbc0dfd0046daa9e8f7502cd8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139280, "uuid": "ea6c5418-808b-4673-9181-4112a372c479", "comment": "Malware payload (AgentTesla)", "value": "7b8b53d887a61a6cf16ac306018abed474c0758e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639139280, "uuid": "d16e5add-9427-48cf-9c2c-8d6f42756778", "comment": "Malware payload (AgentTesla)", "value": "a3e3bba940e26fa79f40e9d041fd655535859fd5d861bbe067d01e9ffa373e4e53232823105f6f37e877914a4faa13fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139280, "uuid": "710b567c-7504-4c4f-a089-72781d7b9acb", "value": "T164E46C691142A7EEF03EDB74A620746493F1AEF6EB13F28DFCE170CB5573A816611122", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139280, "uuid": "6b2f10bb-1157-45ad-9c08-8cc8767ddc4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139280, "uuid": "a82da6e4-d12a-412e-98f2-dbec91d234f8", "value": "12288:qFZnYdrwt9CWEcAjeKWvZO8p4yE7UF8T4QN:qLnKbrWvZl4yQMXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639139280, "uuid": "72e50f05-61e6-4b4d-bc40-9a344c296ef1", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639139280, "uuid": "6fa2198c-dda2-4324-acde-2cf3b8af4abf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639139280, "uuid": "79bc981e-564a-4bbe-81a4-ded0faf0e7a2", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b030a99-59e2-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639159033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159033, "uuid": "08e7634e-c296-4aa9-bc9b-34786fecebd2", "comment": "Malware payload", "value": "4f64146b9450292ae0fc6180e11d9db3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159033, "uuid": "b8ccab0f-7fb0-4aef-9545-ffdb558ec64a", "comment": "Malware payload", "value": "ffa689204b2f4b109d2738baff80501e76afb227744298b0f3bd07f0b848ec52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159033, "uuid": "6d8becdf-77e0-4960-8dc7-250dd720228d", "comment": "Malware payload", "value": "7b90e2908ede707d0f6384fffed712182e0cd1a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639159033, "uuid": "14cd33a1-a2e6-4aaf-a54a-2ebc4e8f7319", "comment": "Malware payload", "value": "fee6f5cf59319bd9ec638c4d74e04c2808d2c228d1a42ade5f88dc7dd9d5eace9f29f3f2027dd7a82ee94ad2870170b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159033, "uuid": "4734e26d-25f3-4015-b04c-5158adc3d6c9", "value": "T17803E16090033897E1B0B2FDFBDB5183B18A6A6CB5E670507696D99CF9D7603B0A4C13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159033, "uuid": "94590dea-7435-410f-b377-1aab0c16cba4", "value": "768:fz4GVrDhX4AZ9CT7XlKQVbrEo/elS9ZtcfKi+d/uQ8oW8YAPYP2/nDGq3U7Ks:fzfrDt8T7luozd+Kj21oW8Yu/nDin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639159033, "uuid": "14e1d364-11cc-4f57-a945-5503092a56c0", "value": 39984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639159033, "uuid": "d1a2a388-4286-4517-b084-8c2f6afe2b8c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639159033, "uuid": "ced81e46-625a-412e-b855-38073d7db77d", "value": "4f64146b9450292ae0fc6180e11d9db3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }