{ "Event": { "published": true, "date": "2023-02-20", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-02-20", "timestamp": 1676937781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "880f169f-33e7-4224-8429-67e6b6e2085f", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5f40c6-b0c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1676858116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676858116, "uuid": "06c1adb1-ec12-4838-a031-479956cd5338", "comment": "Malware payload (LaplasClipper)", "value": "424243e32a86f3436c040f7edc51f724", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676858116, "uuid": "9446a186-330d-4b8e-8cd4-4dc3880da0d0", "comment": "Malware payload (LaplasClipper)", "value": "01d186d1a904fffc1e47dc652d669ae829654e0b4dd050918af13ad58ad3096f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676858116, "uuid": "915550c0-64b3-4a77-abb4-552d23668d7c", "comment": "Malware payload (LaplasClipper)", "value": "9af13d8c67e82bab35c81778ed86030ba847a390", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676858116, "uuid": "40e3d798-6892-45a9-8270-0c1295f20603", "comment": "Malware payload (LaplasClipper)", "value": "7b7240bb9be44ba916f8549dff3c072e9d0920873271575ffef6ae2eee3ad664ba607e3c4bda77c36b847206d970fa53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676858116, "uuid": "a8a23988-0598-494b-81d7-29d61520b741", "value": "T10DC53364BA908872D64F907C4555E6312FAF90B32258CF0F5BB752BE5F6E250F83E224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676858116, "uuid": "2f0a6998-07ea-41b3-8176-6914ad7bf6b7", "value": "99cebe82e9a09163c3069dbc31af6f1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676858116, "uuid": "271a1840-8d67-4414-81c6-10eafb7ed215", "value": "49152:ACdrtT53V6Ltj0iGDcurhjvXbcAHZ5wq0YEZjWGeS6PCGE6BDjEYs4W1nWAPo8:9ptTBIahbb35Wq6gG2CB6B7wnWAPo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676858116, "uuid": "c157baae-5fa7-4e0f-be63-059190367340", "value": 2555904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676858116, "uuid": "3bc9e546-ab5b-4915-a363-fd48d99410d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676858116, "uuid": "c9262dbd-b081-4298-877a-9dc3be24d254", "value": "424243e32a86f3436c040f7edc51f724.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67dace22-b128-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676902261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902261, "uuid": "39606b33-d498-4861-99f9-917819d93ec2", "comment": "Malware payload (AgentTesla)", "value": "14da3b59ec36717a57857b14b13294ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902261, "uuid": "b812f602-ca77-4480-8767-41280f917fc4", "comment": "Malware payload (AgentTesla)", "value": "021cc1b5aad99d73e45c033692d7d4f458ae051b76d081130627dcef7e1a5203", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902261, "uuid": "6c85a15c-0521-4c12-b3aa-eea105d6f4b4", "comment": "Malware payload (AgentTesla)", "value": "56b3e2fdd2658a15b0f21b7c4d53d708149c1b50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902261, "uuid": "18f268e4-c969-4631-be0c-af1a87088f15", "comment": "Malware payload (AgentTesla)", "value": "efb17b0dbe2f2a7079f32603f164262afec9cce96407870d19544c162af29e4d7c6f3cecd7999b4b7989935a10882ad2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902261, "uuid": "fc3b9ab6-1569-4e49-ad02-0d2666fc3a11", "value": "T1AB8422006565523AFCE39B3265FD5E3B0EE2DC0668B4974FA3046A9E3E306539B0F361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902261, "uuid": "fcffbe82-dd82-4dc4-8083-c7234d96837c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902261, "uuid": "970dca37-1319-4d53-b190-0f9f49e32a0a", "value": "12288:/YfFXSuihZ3nwcp8ENCH5X2jlD3X8pzJh0Ggf0ziDL9d1uo:/Yf0FhZ3wTENCH5XslD3akGg8zivD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676902261, "uuid": "76f92f12-428e-453b-9608-d787b4e7691d", "value": 396964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676902261, "uuid": "71cea1fa-345a-43ed-8afa-296e196a12b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902261, "uuid": "c4917806-8c2d-4ad5-bc1d-a2a04f7b7431", "value": "receipt-23270100293.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7626c4-b114-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676893864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893864, "uuid": "273290e2-fdd5-4dea-8b5c-fb20edceccb3", "comment": "Malware payload (AgentTesla)", "value": "54696803ea251092d5a61aa76e3a8156", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893864, "uuid": "3e911149-bc6f-498c-8014-b67f523028d8", "comment": "Malware payload (AgentTesla)", "value": "03cc1856b4e2c56627ff010d499d89fa66b442cdb68ac0907f039ccaaaec9209", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893864, "uuid": "218d2aa6-7abf-406c-9003-cc2b367040a7", "comment": "Malware payload (AgentTesla)", "value": "9e75acb5f5308e33fbfa4179bbe7a0c8d13d23a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893864, "uuid": "c46063c3-f112-40ba-941d-094c7b2be390", "comment": "Malware payload (AgentTesla)", "value": "46e0ff4a7a3180ea7ad98c3f50a91af834d6aebc5de5cb2fe72e146325606dba42185c365bcb7d187ebfda5c08cece49", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893864, "uuid": "a5ca3240-480b-4110-b0b3-6c0602254d53", "value": "T1188423CBA35AF997E27F10D084054F6ADED2B8A84CD17D9663B4BEBDE04950A48D8132", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893864, "uuid": "cf13cfb1-69cc-4164-b758-4ddda0cf7f6a", "value": "6144:thaeRFd73G4Zrw4ypNZrBv2VlE/pTCnfVCl9JgMN7VzdKgWqaZSANjvH+xyR0H:CKd7WOrw4ypheasnfcl9/bVjOH+W0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676893864, "uuid": "2de93a03-d898-4ce2-bd5e-70137e2c63f3", "value": 378940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676893864, "uuid": "47d4de17-2ed7-413f-8bca-e6b6ab19baf9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893864, "uuid": "6ecce5fd-dcdd-448a-92a7-de74dce33186", "value": "PAYMENT INVOICE_10.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d9abb0f-b104-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676886890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676886890, "uuid": "5d64998c-ae2c-492b-9d65-0bdcf228cb5e", "comment": "Malware payload (GuLoader)", "value": "4afe4ae82e5bbeeb15815339eefeed15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676886890, "uuid": "4b89cb1a-b3b1-4636-99e6-93d616681b19", "comment": "Malware payload (GuLoader)", "value": "0421fe04566642bee23ce8e2c5b4f71a4bad7cc91eb8de96c6b756c81f8df504", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676886890, "uuid": "e0d88176-2f69-436a-85e1-a3a61a754cbc", "comment": "Malware payload (GuLoader)", "value": "d0b7381c8a576459546b538b98a49126ec486bb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676886890, "uuid": "df8c39b1-b86d-4593-b5c6-a0c6d23006c2", "comment": "Malware payload (GuLoader)", "value": "57a7798cb10485f0cf725253ed8d00ca252d8c30dbd882c6798d328019c647fb607dc2a0a0b087b1abf456ccdd907591", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676886890, "uuid": "748a8bc8-2980-465d-a8de-4fb3f94f4664", "value": "T1D8C412953965C43FCBD2493AEAA2B31B8ABC7D7024218A0727987F0D7A3D4C19D4F764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676886890, "uuid": "ffaab9ce-3174-423d-b638-d7d6deb42bed", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676886890, "uuid": "2f55672a-7d67-4f0c-b39a-3c2efb9753e3", "value": "12288:K7YaMPI+XCGRZPrXxDyQ3XY8r/GesoAJxHq:1mynJZJr/GesoAJNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676886890, "uuid": "b56331fa-9010-49e3-a10b-b423b2fc2d62", "value": 555754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676886890, "uuid": "606fb0b9-aa12-4563-bfb1-7ee27fd931c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676886890, "uuid": "6356ec3c-e32b-4b2a-8663-da41756b78c3", "value": "DOW\u00d3D PRZELEWU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c062cd96-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676882653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882653, "uuid": "0949e22f-7b53-4595-a91e-f05d06f5c507", "comment": "Malware payload (Loki)", "value": "c27a03b306ba45ed135d91f409a69f1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882653, "uuid": "b9ec830b-b7cc-4a04-9eec-c6c19b6a08b8", "comment": "Malware payload (Loki)", "value": "045867cc8ce236af408442596e85a31d3fafabe265f886ae0dedff559ddf2268", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882653, "uuid": "7d05c33f-18d2-4d71-bd0e-40d334bc19e1", "comment": "Malware payload (Loki)", "value": "800029c80aa1a54b1df8bae633c4a8e26ff2f2fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882653, "uuid": "348e4553-e861-488b-b2d1-35b20cc97ae8", "comment": "Malware payload (Loki)", "value": "366661ef8b32adc0d02401ad94d6321e321be4c2c405027754a227b5f7fb8bc496ec32023d4012f3b4a78a6a2f024b6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882653, "uuid": "28a7947a-c3f4-459a-b1e0-db7bb374dae1", "value": "T1F905A23CD9B82D2A8277E57AEAC5F413FA9048D7771D8D9F81C2AB420542513BC9BC2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882653, "uuid": "12aeac32-2535-4b51-8067-c40f03e633c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882653, "uuid": "6a912bff-5d4b-4ba6-9350-e2a9ccf1010a", "value": "12288:rSHnyJf6ojjSo+RLHCgWCBF4K/nFht7hS9Bus7Tf6TmeuS20WMdZa:rSHaf6ojjSo+NHCgDFtFw6Tn2UZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882653, "uuid": "881708bd-7f81-4577-9196-211300f2ee15", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882653, "uuid": "4db38534-fbc8-43ef-bc5c-7b5a9997a4a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882653, "uuid": "748676e0-2041-44bd-92cf-1517388032d2", "value": "045867cc8ce236af408442596e85a31d3fafabe265f886ae0dedff559ddf2268", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9fa1455-b107-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676888333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888333, "uuid": "a938cdb5-e746-48d2-855b-57a11903c3ab", "comment": "Malware payload (Formbook)", "value": "0d84005af71574a568567967e666cda5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888333, "uuid": "53c243e1-2238-4b58-9a21-22cd2e5fa06c", "comment": "Malware payload (Formbook)", "value": "05977847b0408ec1abb7b4cd05ad10b4004c97d5c949e579d695d47518f4f376", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888333, "uuid": "9458fc1c-a276-4811-a858-f6446225dac6", "comment": "Malware payload (Formbook)", "value": "22bd76803c3d004f48be0b25ba0ec1920ccc3360", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888333, "uuid": "6039ae73-849e-4a2d-a4bd-8df5fdc9a084", "comment": "Malware payload (Formbook)", "value": "2477fadfcbbb23ec63103860b16c8b5d7a868570a4a340b98a3e071d6d0c7037ea301c31c401dbc8651943ff70f68af5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888333, "uuid": "1bec1dc7-abf5-469f-a31f-dbc13622f1d7", "value": "T14F84231A6BE1A433FC5986316D3B57F398FFDB667166034E13A08A0C783E515CA0E762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888333, "uuid": "ab198ba7-db01-49c0-a3df-bb0e083b749f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888333, "uuid": "d55f4a37-5245-4146-80dc-950e9b0d2e9f", "value": "6144:/Ya6ucWe1LyolA8cR/2eUiYI5fCqz7bIMXomfP4lkqrohrNBprLRVdNjnzO59geb:/YYFSbl5GuezCqnUMX9fwlBrohr3RLRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676888333, "uuid": "41eabf1b-15c5-4b11-bdf0-3f506d86eb7f", "value": 377609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676888333, "uuid": "fdc09c55-cb29-40d9-8321-977a84932862", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888333, "uuid": "3c249ab5-2933-4faf-8374-499fa31af2d2", "value": "Halkbank_Ekstre_20191102_073809_405251-PDF.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ca5566-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676882711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882711, "uuid": "058b118d-eb14-4be3-b6be-a01073506f74", "comment": "Malware payload (AgentTesla)", "value": "2a81f36c30914acfa48573cac0a67b01", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882711, "uuid": "70893425-f7d2-4b3b-b90a-7b50b4c376bc", "comment": "Malware payload (AgentTesla)", "value": "06878f71ef3f3804bf92ee712d7c7619b19c7b3f87b97c27ff49f4726cd84a0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882711, "uuid": "5b0b06f4-e966-4a7e-b718-c5a7ef51db4f", "comment": "Malware payload (AgentTesla)", "value": "4e19fa79c466e2b184b851ab7f03bf2d92c0c72d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882711, "uuid": "04053b90-0a8b-49c5-925e-a95b45a87de4", "comment": "Malware payload (AgentTesla)", "value": "0609d5d727b21df262688f91fe7110dad5f3d9ee95673245a4199054b1d097a8aa501d9d891f0351653247bafc1805c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882711, "uuid": "ee05effd-6a93-48c8-a987-2f5fc13528b5", "value": "T1EA84120E16A1C487ED2607335CFF6727AADCB52115A4DB4F6740AE1D3433A92E90DB93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882711, "uuid": "9a207a2c-eef6-4cc4-8e98-fcc7f4b4c0ce", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882711, "uuid": "aaa0dab9-e58f-4bdc-9aa3-88ba9a041118", "value": "6144:vYa6dpHJ7W8fNWKL2wbZZeiREPdbG8NrIs4dpNiyTm9A3c8FFUGRAZdiBa2PCzSL:vYvTPtL2uZKxG8NrIs4dpNikS0FLAZIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882711, "uuid": "648990ea-2dcc-40ea-a9cf-81c20ada7be8", "value": 384328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882711, "uuid": "f3481749-069e-4bd6-898f-29f70d2c6f33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882711, "uuid": "8b11c5f3-36af-4ff7-9b5d-8bbed4185711", "value": "Payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77b3b3c-b12c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676904167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904167, "uuid": "f9dbeb82-c12d-4b37-b9c0-acd6ec80014e", "comment": "Malware payload (RedLineStealer)", "value": "8d52ca34e306c00b3368c8be1d6fbcb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904167, "uuid": "885c69fb-b167-49c3-a7e1-ebc07cca2db0", "comment": "Malware payload (RedLineStealer)", "value": "075e52e792e4579a29de5cae798a1ed3c09b1f1ecb8b776e8a873c2fa6a8b919", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904167, "uuid": "86e68ba9-9fbf-484b-9113-fff541c816c7", "comment": "Malware payload (RedLineStealer)", "value": "d1a8ec1be549a75313a17d90f7a8a5605424d8be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904167, "uuid": "e5e41ec3-24a6-43f2-9280-f0cf138d0031", "comment": "Malware payload (RedLineStealer)", "value": "1a8e783e83642fead68e83f60847594d96aaf73834d5734b419a4c3623262bb37054e874183b0c20b8502417a6e92e1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904167, "uuid": "65a2e7ce-62ba-44c0-8674-7b966f64f581", "value": "T11135238BD3D85473F8B567301DFA16C30A327D416A7882DA738BA85A0C736B0B53576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904167, "uuid": "6e1b8868-81f6-401f-a7bc-b3c81fbadfbb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904167, "uuid": "17d71df7-62b1-4db1-966a-f936f5a3a0b5", "value": "24576:OyqhS3PA8mTvNfHc1x6cCWtIQmAdydDWkm/U6/:d3qzNf879mAdydDUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676904167, "uuid": "f4f8da19-be1a-4d23-9bdb-9a8b862b1d39", "value": 1123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676904167, "uuid": "b9c59efd-cb99-44af-9a85-7215f2fc8fc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904167, "uuid": "f6fd0a44-d55e-46ce-99fc-fdf3a481474c", "value": "8d52ca34e306c00b3368c8be1d6fbcb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3defbb76-b134-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676907345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676907345, "uuid": "4318de3b-3aaa-4a62-99f6-c678997ed6c9", "comment": "Malware payload (DCRat)", "value": "3fbbce1e454d75ca1470bc1100003cb5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676907345, "uuid": "cea4bf65-4d8f-45e0-9537-065c10f8a64d", "comment": "Malware payload (DCRat)", "value": "07d3c78883588168510988cd90961879a2b718329b95b6e4e4595cd7a1b02c13", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676907345, "uuid": "f1fca155-a46c-4037-964f-86ca95d7c887", "comment": "Malware payload (DCRat)", "value": "135032b6b2d86f7ccf75bcbdd59abd50a2af38e6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676907345, "uuid": "1320e989-4ebe-492b-adb3-135e7eb2ffd5", "comment": "Malware payload (DCRat)", "value": "e60fae5a6e0a4d5dd424a33a13e0e3f6cccbd8580ed648c5210369962a1d35b8d34660baf93d6db9f59a005e3869be42", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676907345, "uuid": "a91566dd-e824-4fe4-9791-5bb8ae59d502", "value": "T192F533E7E671E233C5B23A36438F79CA7D5A0117E0D2418F2C365B904AAAE5DD786C34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676907345, "uuid": "9aa3dc8c-f49e-44aa-b807-dddd429776a2", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676907345, "uuid": "1d0c9ca9-14fa-4ed2-a35b-9e74f5582d4f", "value": "98304:NayDdv/LAh1lFqz/MuCY3Nq+0h074GSFD9E7PJqP4W:J57Ah1f+kuzZ00G67PMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676907345, "uuid": "bb058e8e-0226-4eea-8454-9a7af4ff3db3", "value": 3494912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676907345, "uuid": "b936dce3-0797-401c-85b8-d3d7935bd80f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676907345, "uuid": "7e6d6279-8955-4592-a3f4-2962513aa5c4", "value": "3fbbce1e454d75ca1470bc1100003cb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca22e739-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676882669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882669, "uuid": "243156dc-7911-4d50-b16d-b657ddd44891", "comment": "Malware payload (AgentTesla)", "value": "95de43771e2b28ae3a5182484a7ec802", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882669, "uuid": "31857d6a-9ee7-4d40-bc04-6a34af023603", "comment": "Malware payload (AgentTesla)", "value": "08a88a71d16740786c4153b75293c8a29daf6158b4052b2605a85854dac8396e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882669, "uuid": "a051805a-7934-4e0b-8bd1-3597264f073e", "comment": "Malware payload (AgentTesla)", "value": "33c60f1bd94fdd0b430e76490a59613e6238b42f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882669, "uuid": "665d577e-e259-4252-a498-30dca1a29781", "comment": "Malware payload (AgentTesla)", "value": "4cd22d5d630e0fcb5b50d37a6751c5787064414018d8291be85e26477ec38bdc70f037bd1a005ed4e86f3b014ca91b62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882669, "uuid": "26a7b25f-ad9d-4ab3-bf5e-9dc3ace92263", "value": "T130E48CCC90F1EA3ECB498EB9371035081FE056436A20DAE6E3E5FAC26F36563199D535", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882669, "uuid": "36c11b05-438e-4101-b438-d7d5dd92530a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882669, "uuid": "295ace87-4c6c-41dc-99b3-aeae9da93ee5", "value": "12288:wYaGqDSukDsv9tbCeufKb0HhCPsIWiEqkp+h87V0+UaA2Ll1RDsv9t:w9GqDSuzLufg0MPsaHkpXDUMLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882669, "uuid": "98ed7939-9c29-46cd-84f5-760feda9d659", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882669, "uuid": "cf9d39c4-1d03-436c-93ea-90f81be1f867", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882669, "uuid": "d0f6f892-709b-481d-8d4b-b97adcb90a23", "value": "AF-021623DB.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a787db6b-b156-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676922125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922125, "uuid": "e893bf98-d1c7-4eb9-b075-7dc3b56bf73e", "comment": "Malware payload", "value": "af6b000cca334405709a7a45f07b1788", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922125, "uuid": "9aa484ff-1448-485e-a8c6-6150b0e9624e", "comment": "Malware payload", "value": "0a03f7b518d5bc76cf58e1bfaad2b6840262b494553626c3727acbb8bd70cb91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922125, "uuid": "90a2d84d-4dfd-4106-a368-0ecf71c0ddd4", "comment": "Malware payload", "value": "57c2502d8ca01a6da5b7ab4e61f857e9e0fd40f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922125, "uuid": "cbc7306f-e6f6-41e7-b623-f75949abfbf9", "comment": "Malware payload", "value": "21da44183efb89b5374fccba8e0426b835f09ec4c8e409fa3487cdcb8e42744a930a61ec1e36a26332492269417d9c85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922125, "uuid": "8e36f781-26e6-4309-b0b6-1a244d4b8f28", "value": "T17DF6333F26F179A8C8BFB834CC14E85FB635D75E115269ECAF113623A405A2DD9B81B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922125, "uuid": "6b796900-ef98-4e3c-8630-865d59de09be", "value": "0a3459ac245ca78ac433e7a0ba4a11ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922125, "uuid": "92161ec6-7e2b-4f1c-bb24-fb7ea2d5eccd", "value": "393216:9FESY8FS6GWgq2pyqNqfMgpcbVTv1OGOSHC84uza:DESYUS6GPqqNqUvToGOSHC8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676922125, "uuid": "522ff319-f569-4058-90e3-87940315c116", "value": 16065536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676922125, "uuid": "fa5af5ae-cac1-4f65-80a5-5ea4bfee4e70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922125, "uuid": "daabf684-01a6-49ce-a264-309c5b04976e", "value": "modest-menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016607d3-b0c7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676860428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676860428, "uuid": "a9cdbfd1-4272-4fd7-bd0b-2584ad20ea8f", "comment": "Malware payload", "value": "917bd5d1ea0eae223c98ae8fe0893edf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676860428, "uuid": "44cdc171-0210-4453-a93c-b54476a4e234", "comment": "Malware payload", "value": "0a0d3debfe5bc35e4c508590909da10a48b017b5ae29cd0a64206aae677490df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676860428, "uuid": "e3e18bfb-085a-4c54-be6a-a53a7ac78886", "comment": "Malware payload", "value": "ddb273fd4762a1fca7888523a89ba2aeca8beca2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676860428, "uuid": "b3cd6e9a-502d-4f41-b3b2-2116d18d6fdd", "comment": "Malware payload", "value": "62ed79e8098aba21097766fd51886dd617f88350412e3fa99a73b7acc0c2076a7e2c2ee51b9f7aa325a9b3d9eb4f1148", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676860428, "uuid": "69faa066-f18e-46fc-93cb-0a13fae3936e", "value": "T18016330455480CFDEC502ABB330E92D48707AA599C9BD49A42BF433C6F6F6A87D7A31D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676860428, "uuid": "be5300d4-0d9e-4142-b4af-3aaae5b20ca4", "value": "65dec052e034a57828d0381d9ada2843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676860428, "uuid": "b524ccaa-9c33-4692-9fd1-2dadb36c7fec", "value": "98304:xpEo5KxbtGfPbarnqUK/qFWare6rC8Gnny6RIpn/92N:Io4g6nbK6d/rH12N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676860428, "uuid": "75bb779e-f098-498c-a27b-d48c44498f3a", "value": 4273680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676860428, "uuid": "24cde156-e0c1-44e8-9349-4c468e5bc56d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676860428, "uuid": "6ee4a111-eed9-4d17-98e8-137fe9ac0d99", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b208ed-b0ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1676862026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862026, "uuid": "c394b31b-27fc-4231-b0c8-cdc838dfb872", "comment": "Malware payload (RemoteManipulator)", "value": "61d9514cebec966ba845c3969d44d10c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862026, "uuid": "830235c5-02d7-452a-8892-574f3ac1b1cb", "comment": "Malware payload (RemoteManipulator)", "value": "0a54948420dcf901a5b89475dc02df021e0e6a49d81700f5ae971c7660e4d15a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862026, "uuid": "e16305b8-9c17-48f2-a577-d18e6512b5e9", "comment": "Malware payload (RemoteManipulator)", "value": "3941bfb1b5b463b8cbdfe4e423997c537dc6eb2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862026, "uuid": "121f0863-f69f-4210-819e-e990586a1a49", "comment": "Malware payload (RemoteManipulator)", "value": "8e76f0e38b1b871d42ef5e1bc639f897d31a0ed81255e1e695c25bd4b276bfbcd8e3036bcff47d6435174aa950c6d19b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862026, "uuid": "54680a7d-b60f-4165-84f1-57bd0bba671e", "value": "T1AE56332A2DC664F4C285D1352E613ED11BBEE72F130DAE479BB0B4637CE8758A437126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862026, "uuid": "daf3cb9f-14c0-40f6-93b9-366cfbf3c7f0", "value": "c769210c368165fcb9c03d3f832f55eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862026, "uuid": "5179a9f1-0ba8-4511-b114-45320d1a1c3d", "value": "98304:kBMgliJi4JhgiIVqskETxGaYequQ+vVNYENTGBxX9WVLE8zjNBumjiQcNOyfAU:kOglEZSeaYeqS8UYWtzmmUJAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676862026, "uuid": "17b265dd-57ee-4454-a93e-b7510001f7b9", "value": 6433424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676862026, "uuid": "eea9e15f-4324-4450-8b7e-c5ce4995885e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862026, "uuid": "81a35635-4e64-44ba-b5d9-771a9882b5d8", "value": "0A54948420DCF901A5B89475DC02DF021E0E6A49D8170.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315cadff-b13c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676910760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676910760, "uuid": "04265f06-a601-4304-a8e0-3cb24bfc3f43", "comment": "Malware payload (SnakeKeylogger)", "value": "a1609207870eea967f8bb7fd33ca1b86", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676910760, "uuid": "1d4d5237-6f24-4169-82c4-ddb975ae6917", "comment": "Malware payload (SnakeKeylogger)", "value": "0a964e70f2253b7358e9bcd75b837e0154f0e56a6061e729229246fb17aaa185", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676910760, "uuid": "cae27ea2-c06c-4ae0-a9d3-869c8041fea1", "comment": "Malware payload (SnakeKeylogger)", "value": "d4a82f6ab1eb4ebec82547c4027637a5f011b9b1", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676910760, "uuid": "274201d6-d1ec-4045-96ce-77fedae74d40", "comment": "Malware payload (SnakeKeylogger)", "value": "616fafb04e6a83c67f2c9b3c6c1cb4c076e57eeb1e74dc5021f3506bbfcb0cb552c6035c155506ef32d3b7046d376d3f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676910760, "uuid": "7a1b2158-1798-4085-a4c7-e51784d145f1", "value": "T191E4232E373DE96895842D1CEEFB66F43630D5626BC2D7B30045D94324E93A1623A7E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676910760, "uuid": "d51eb06c-754b-4e15-a296-a45b4d63cfb0", "value": "12288:Up6S/NMkKTDEhuK0NV5140WSLWaxQsE16jBD6r8CdYuFsGV8iJNy64B:UtNMlTDU6Z3asEEDy35LjeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676910760, "uuid": "20a0c70b-10fe-4602-ab74-9d6e84c240be", "value": 688929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676910760, "uuid": "960edc22-685b-46b5-a3ba-6a87bb19d5b2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676910760, "uuid": "3b47d48b-293c-47d8-aa7f-3a2f2f9821a7", "value": "OTP.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "547f972f-b0fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1676883760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883760, "uuid": "835ad800-a753-4125-a9d5-ec527291c2a8", "comment": "Malware payload (CoinMiner)", "value": "0451bda6456edc1440cb47a487010732", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883760, "uuid": "9db256a5-b22d-4f62-9a99-ab1d286995eb", "comment": "Malware payload (CoinMiner)", "value": "0c1cceaa4b42fc3edc8d321e6e46da41539a5d16eca59c9cc0bf1178658afec8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883760, "uuid": "f8b06c22-974a-4a9b-9045-3d813b513af5", "comment": "Malware payload (CoinMiner)", "value": "5fb5141dcabb6c8ec38f319bf164b8eabd33a1f4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883760, "uuid": "3ae3e9f8-ef8e-4cae-830a-6a93da210199", "comment": "Malware payload (CoinMiner)", "value": "c91cd8d7cea2b45dd9a8f59c907b6e9832abb803090310efeed6c13228918c7581b64ba44a7b968adb96a872a0b9fe07", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883760, "uuid": "78df8ea6-ce18-4b7e-b162-ca7592a883f4", "value": "T13FD53363D9BF6F8AB4951C5AE57120A1B60C002A5DD3D00CB791F3FDD7BBA8A8B05660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883760, "uuid": "416b4428-4066-420a-83ac-b4fbdca6c586", "value": "49152:aEzLFe9AlLnzzq3c/2znn250Y8lBk9Vl1NfwZ++jmcIQdgMbJ:aaLFe9AlLSnbn28e94ZV1IQdgMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676883760, "uuid": "9bcf52b3-ce10-4ec7-b5cf-ec3f809a23b3", "value": 2763708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676883760, "uuid": "70cc5a58-4f67-41d5-9406-3bdda2a70f8d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883760, "uuid": "0c750547-6969-473e-a92f-6fc8f2e913e0", "value": "xmrig", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd0ad23-b156-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676922085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922085, "uuid": "3a6ad619-d12b-4bcd-9397-634c3c02555e", "comment": "Malware payload", "value": "73eb1fe347f4570fa1fbcbd6b5130f54", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922085, "uuid": "6e067573-df80-4c95-a432-32ff6668beb7", "comment": "Malware payload", "value": "0cabd94f0a906814f15908d2349fddb421d3e15d4879f8cd993c7c518d954ddd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922085, "uuid": "8b9dc62b-c0ef-46b6-9fb9-59380afba634", "comment": "Malware payload", "value": "dc5df0f94c44ad73c16df705f042a88c21f641cc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922085, "uuid": "ad4e96b7-ab25-43ba-b9ac-8865096d248c", "comment": "Malware payload", "value": "c7bf2500488f58992176fbf7d8d80d61bd7dbd2490caf007164a8f61bacb4baeea4d5eb0e5fb6493700f1ec48ff65427", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922085, "uuid": "c96895ed-2dbb-4a10-b366-0cde8a7a692b", "value": "T16F228D6CD102BA2AC17140BCF01807B0F72F41BBF552B93A204573DC0AA13D787CAE6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922085, "uuid": "07339566-58c1-4d08-92e7-3639dfb7f560", "value": "192:ScIMmtP0xfUW70vG/b3kgOi4OLO7qus+1pReDnc37FSR:SPX+si10ni4OnyeDnMJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676922085, "uuid": "bb4cdabe-cad3-4ba3-a05e-9654f31bedc8", "value": 10374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676922085, "uuid": "dbaf71ab-9e69-4faa-808b-af9f61fec17d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922085, "uuid": "fcc27429-559c-4551-b058-8c36b6c1f803", "value": "0cabd94f0a906814f15908d2349fddb421d3e15d4879f8cd993c7c518d954ddd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c506ebd5-b0ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676877507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877507, "uuid": "55f23bb8-cad0-4e93-92b8-3e353e73c586", "comment": "Malware payload (SnakeKeylogger)", "value": "6ab62256dd286888d9e23bc0e3350d62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877507, "uuid": "bc32f9fa-9113-4f30-878d-8fed140c8082", "comment": "Malware payload (SnakeKeylogger)", "value": "0d2ef182ac4396342e041aa0891c6dfa28eca25b49bb59546f8eaecfc2a389a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877507, "uuid": "1189dc16-2dc5-4399-81ea-46abf9ef95a5", "comment": "Malware payload (SnakeKeylogger)", "value": "4390bab088c145e446f68401cfcfcc13d25b802e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877507, "uuid": "ab3eb407-bcc1-4500-8aa7-06f05e635221", "comment": "Malware payload (SnakeKeylogger)", "value": "89d15af207f1a09cba482514c0abefa0a8f3788f6784832d82a1e9fbdb0110058e05ac9b921b97721ff1b8ffd3552fc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877507, "uuid": "f519a63a-01d3-4e58-992f-79a08d7abebd", "value": "T163D48D9C91F0FB3ECA098EF9731036441BF495037D25C6E9CBA6F2C50B36762199DA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877507, "uuid": "d39ee81a-4658-48a6-bcf0-2a7634a6f7b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877507, "uuid": "20ba1f6b-178d-4490-b125-af291581b213", "value": "12288:vTZqO4qDSu1fy32seYc8MG27kz+w3OORZ/LOvWIbtYKx3jx/:bZqO4qDSu1qmseYczQP3OkLOvWIh7x3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676877507, "uuid": "4867c48b-10f6-44ca-b1af-8bd78348421a", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676877507, "uuid": "af55a54e-a02b-4707-8f5c-d3478394de99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877507, "uuid": "9304a63e-4d33-4192-8001-9307d9547bba", "value": "Quote=AHB23QA.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae1de4e6-b119-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676895937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895937, "uuid": "cf8357d7-3996-4ebd-8d01-3566223f1321", "comment": "Malware payload (NanoCore)", "value": "18c07c3f158951c36a629f5a1f33ffa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895937, "uuid": "17ffb387-4bd5-4b74-b2c8-4fbf05f6a543", "comment": "Malware payload (NanoCore)", "value": "0d362e37511bf0fbcd95762b16cfafed6d76c78e1abd22e04ac527c6fe167a3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895937, "uuid": "f125741f-e06a-453b-8f8b-ba012bad1632", "comment": "Malware payload (NanoCore)", "value": "dc257852ead408c31ea692621bfb189d1336d63a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895937, "uuid": "ff4d7bb2-26ff-4d62-93b4-d64b95c142a4", "comment": "Malware payload (NanoCore)", "value": "1ef77e44f92459e6fe2bed12315e4398da5259e25af92b81e331535595b53c1fc6f62f55ce57b4500544a91e03ed7de4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895937, "uuid": "7bab70a3-2985-46dc-8055-851b0015738a", "value": "T117B6339E87227CB2F2F142E9FCBDE5986FF45903097D025B92D191AAC83CCA8540797D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895937, "uuid": "45a45069-9acd-4f90-98b6-245d7995417f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895937, "uuid": "b1079396-91bb-496d-b548-737a8dacda43", "value": "196608:Rv7qXREWqCnFMIcLV3PxcPd8yZunWd+vlfaeVExNp6QMVUAlwcAq4SNV/Kt067s8:p2BEWqCnFAV3PxKe7Wd+tfaeiHWPt6o8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676895937, "uuid": "5396990e-ca90-4437-a7df-f6f69d3f9b39", "value": 11271168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676895937, "uuid": "c139e603-4246-4006-813f-13fb3de9ba3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895937, "uuid": "66821a19-7cc3-40a6-8924-686e385c55f6", "value": "18c07c3f158951c36a629f5a1f33ffa8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1159d9-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676908929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908929, "uuid": "960834eb-16c5-4b45-a849-7e424c0af49e", "comment": "Malware payload (Smoke Loader)", "value": "feb80d2275b2fd14c815716366a0b80a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908929, "uuid": "8fc62f8e-5dd5-4ef6-b9e6-1195ec73ed6f", "comment": "Malware payload (Smoke Loader)", "value": "0d7d7eb8307aa85cf97d60eb6a7ff3529b3101e2aaf5ab0ba434d508a6cdf565", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908929, "uuid": "194f57b5-af99-429d-9b03-e91d14c1d9e4", "comment": "Malware payload (Smoke Loader)", "value": "164cef49b701b7b87ebfeac7ed3f2c8a2c5c0aaa", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908929, "uuid": "9b3f1e7c-83f1-4d74-8c25-19ccd330328d", "comment": "Malware payload (Smoke Loader)", "value": "2a412f4e123f73dc828342a3abf8896d681c6cda1547a0bb659259a4d4376da9dd8b2f6dcd4cc789beb2deea4ba6670b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908929, "uuid": "34b2a97e-8640-443e-9ac6-7aa56165e7e6", "value": "T1D6F3FF55E7B1BC2BF5540778AAB292931A93BD33A911C95626C7730F4B73FA06C32E01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908929, "uuid": "00261acd-e72d-41cc-aff5-11a9193597cd", "value": "3072:NkZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAZN2:yZ+RwPONXoRjDhIcp0fDlavx+W26nAZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908929, "uuid": "27d865fc-2266-4758-91ed-cb952fa2bff8", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908929, "uuid": "acd4698f-132e-44da-a154-90c7738a2ab6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908929, "uuid": "f3d4707b-fcdb-4de6-95bb-323a18e022f4", "value": "Cif Inquiry Oakland.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "065d095a-b149-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676916271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916271, "uuid": "58948233-ce26-42f9-83d3-059a3624dff3", "comment": "Malware payload", "value": "bb135002251ed444c639eb2750d067e0", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916271, "uuid": "3d61bc62-f36b-46c5-bec5-e78e1a184007", "comment": "Malware payload", "value": "0d8bb31850f9d0c570739ee5bb43f49f0177b7ad99073ac318d96ed5fa913ef4", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916271, "uuid": "785f873d-5bba-41fa-b049-2f3ab9a3eeba", "comment": "Malware payload", "value": "20fd4446d8abac7b8c40a757f89f2b1f8610ca9b", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916271, "uuid": "300c1823-460d-4419-9a03-0105a602edd0", "comment": "Malware payload", "value": "202e118cfbe9159757f980e6a44ba6fe688acf739b66c8de576f04014fb45727fe1ed277dde06ceef2474dfeebfe200d", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916271, "uuid": "52ef20e5-a6e0-4d0c-80bf-358a555c4d80", "value": "T15692E1A8BEFA2AB5F1470346D28EDC07749E5747E052871CCA1D29BB84DC7697C13C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916271, "uuid": "1779e826-b1e8-4cd9-b57e-3916cf830c7d", "value": "384:vWYMVeHmtWA2+rPKxgaNL6TasOFWx7yXv7Re4lR39PlD2Xsc+CA/eDI9bBVa1DMZ:6VeHmtJyxgtaJUhyjReyR32cRCGeDI9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676916271, "uuid": "77abaf3f-b3e9-4d9e-b817-e78c9200d82c", "value": 20982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676916271, "uuid": "999aad36-c488-44e6-a355-c0e875cbb6fa", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916271, "uuid": "546c001b-094f-4397-8181-dc5a5a5fba27", "value": "e62e83cc-ed55-4147-5352-08db1325214e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f9d30e-b15a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676923604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676923604, "uuid": "3f46f9af-ad25-43af-9775-26c3bb034467", "comment": "Malware payload", "value": "c94062b9a586d15cd884246aefb0a75b", "object_relation": "md5", "Tag": [ { "name": "208.67.105.148", "colour": "#B6A27F", "exportable": true, "hide_tag": false }, { "name": "79.110.62.142", "colour": "#F6CBC1", "exportable": true, "hide_tag": false }, { "name": "DESKTOPgroup", "colour": "#6E57B3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676923604, "uuid": "41bffad1-79d3-49de-906e-738de777dfd7", "comment": "Malware payload", "value": "0d9a51628cb6ef7cfa6074d8c6e89f61e2321bfbb39b7ce9a2e2d1972e0e163e", "object_relation": "sha256", "Tag": [ { "name": "208.67.105.148", "colour": "#B6A27F", "exportable": true, "hide_tag": false }, { "name": "79.110.62.142", "colour": "#F6CBC1", "exportable": true, "hide_tag": false }, { "name": "DESKTOPgroup", "colour": "#6E57B3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676923604, "uuid": "04ab9b2b-99e5-4f54-9bf9-d96f29ab1dad", "comment": "Malware payload", "value": "22a13b5db65f00a9e91e8c37e496df25b5276e77", "object_relation": "sha1", "Tag": [ { "name": "208.67.105.148", "colour": "#B6A27F", "exportable": true, "hide_tag": false }, { "name": "79.110.62.142", "colour": "#F6CBC1", "exportable": true, "hide_tag": false }, { "name": "DESKTOPgroup", "colour": "#6E57B3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676923604, "uuid": "a3b9dca5-4a37-4650-980c-890d18ac4a51", "comment": "Malware payload", "value": "dec924f00adcba62331f0aec00c82209a194c95fa47bcff1e71d4969da7546c2369813ff39dd04ef2e1d6b4e0152fd75", "object_relation": "sha3-384", "Tag": [ { "name": "208.67.105.148", "colour": "#B6A27F", "exportable": true, "hide_tag": false }, { "name": "79.110.62.142", "colour": "#F6CBC1", "exportable": true, "hide_tag": false }, { "name": "DESKTOPgroup", "colour": "#6E57B3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676923604, "uuid": "b9297ed1-492b-427d-b96f-622d1cfea6e8", "value": "T153329E39C54FE460C972C578709912F6FB194506A652D22AB417E8D9C864877033EB8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676923604, "uuid": "96d8efe9-034f-4207-a586-193844400f42", "value": "192:CtNCWUyn0i13pNXqkOcPiYFLwzvdX6Ptpwjnw+umHBCusiWVd:aNxUyn0i13LROEiOLkX6Ujnw+3VyVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676923604, "uuid": "10377616-fab2-480a-bc39-1cf3cefee92c", "value": 11801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676923604, "uuid": "8237913a-3144-4ee6-b768-54a4ab7ec69e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676923604, "uuid": "553f7fbd-a32b-47c7-92d4-d40bc7238f92", "value": "PO-20-02-2023.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97cc50b-b114-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1676893862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893862, "uuid": "dfefaede-dcd7-4dfa-ba73-7bce745341ac", "comment": "Malware payload (Quakbot)", "value": "7997f61043ec2ae9defb269756fc461d", "object_relation": "md5", "Tag": [ { "name": "1676886180", "colour": "#AC9814", "exportable": true, "hide_tag": false }, { "name": "BB16", "colour": "#52982A", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893862, "uuid": "a6b62907-2fd6-4f06-9b66-5ec6a9856938", "comment": "Malware payload (Quakbot)", "value": "0dbc95d60b957669b5ae6e6977bae478738209fdb51dff780121320d6248b8e7", "object_relation": "sha256", "Tag": [ { "name": "1676886180", "colour": "#AC9814", "exportable": true, "hide_tag": false }, { "name": "BB16", "colour": "#52982A", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893862, "uuid": "7df928e0-3c0c-445e-934b-96d0f000fbe9", "comment": "Malware payload (Quakbot)", "value": "226341605f85d5b99e5961eaf97ec18b87af67a3", "object_relation": "sha1", "Tag": [ { "name": "1676886180", "colour": "#AC9814", "exportable": true, "hide_tag": false }, { "name": "BB16", "colour": "#52982A", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893862, "uuid": "a3478dd7-9f74-4ec6-a65e-03d6d8694f46", "comment": "Malware payload (Quakbot)", "value": "93218e61d7f4c29c617c6268017e6b9c94371f73bed0ca9b15a56d2a544b81729a03de5b95a46c6b0a8512dab90a7380", "object_relation": "sha3-384", "Tag": [ { "name": "1676886180", "colour": "#AC9814", "exportable": true, "hide_tag": false }, { "name": "BB16", "colour": "#52982A", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893862, "uuid": "b5852693-2055-49f5-af40-5434bf949a95", "value": "T15C12E82036B40134E44A0B37FFD7158B3A36F694EE909A9B208BD71C2AB7D0C07684E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893862, "uuid": "ff5fd562-b1ed-44d2-a6e3-58d0674d9f78", "value": "48:v4iR0KQRlEFlErlElB5s6ZrVCUibpF48jD7oP++CH6x8:vzRTTZCpbpFfkPH0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676893862, "uuid": "76a209e9-625a-43b4-98ff-5816a9af41d1", "value": 9757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676893862, "uuid": "cea01e93-7272-4613-899e-f22166449d86", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893862, "uuid": "6ff3b39d-b939-487b-be9e-c25a67c0c92f", "value": "O P E N.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5562c8c2-b145-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676914686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914686, "uuid": "df07df33-c8ea-4f49-af2f-197c81579a81", "comment": "Malware payload", "value": "94e22cef5172394b96fce949ef2646e4", "object_relation": "md5", "Tag": [ { "name": "1676886180", "colour": "#AC9814", "exportable": true, "hide_tag": false }, { "name": "BB16", "colour": "#52982A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914686, "uuid": "61f6c26a-8bf2-4302-a0a9-69370d5ef744", "comment": "Malware payload", "value": "0f893680d656b8347138fc26e9d9c4403f2c3b318eec73fda8124f50d041283a", "object_relation": "sha256", "Tag": [ { "name": "1676886180", "colour": "#AC9814", "exportable": true, "hide_tag": false }, { "name": "BB16", "colour": "#52982A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914686, "uuid": "5198a385-ba09-482d-83db-edf671f57ebb", "comment": "Malware payload", "value": "7237bb1069eba64bfa8e31836d277d4a17253e94", "object_relation": "sha1", "Tag": [ { "name": "1676886180", "colour": "#AC9814", "exportable": true, "hide_tag": false }, { "name": "BB16", "colour": "#52982A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914686, "uuid": "e221745c-a6c3-43b7-9949-77ddc2db847d", "comment": "Malware payload", "value": "f5b6fb329b309fcb9b6bff5879ab29398739a960f9de8a55a2a265d9be65753dd423ad003832a0f30fe430dd0b68f004", "object_relation": "sha3-384", "Tag": [ { "name": "1676886180", "colour": "#AC9814", "exportable": true, "hide_tag": false }, { "name": "BB16", "colour": "#52982A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914686, "uuid": "fd648bc9-fb43-40ab-9475-e17cd86ddc79", "value": "T1E0943B54FF4713F0EE0354F8814BFB7F6B381E1185658EBADBB14F68E5A1A69840E608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914686, "uuid": "854f9770-94ef-4221-9168-b2509d569687", "value": "6144:wNdLVrwwya0SU50lCtsDKxNNuNtrdO8xXB4LDhW7q4jr61bm:wNdLVrwpaJUKwSWxNs68YLDcq4jr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676914686, "uuid": "1eae1197-39f2-4e55-9856-dd59a8d36ed2", "value": 428216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676914686, "uuid": "0c49d0ca-2e7b-4dd9-88a0-ff1d5122efc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914686, "uuid": "9cf1cb02-7180-4617-99cb-fdbce0175867", "value": "aaSQMCd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2422e10f-b0ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676876378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876378, "uuid": "16f3f141-08fc-47d2-b182-5c6f83768187", "comment": "Malware payload (DCRat)", "value": "54a65d42620d249154a2ae07c6e35aab", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876378, "uuid": "a69d6a66-ae3b-44f7-a493-4ad5d0489567", "comment": "Malware payload (DCRat)", "value": "10642fef9dc2ccd62aa7c478fbeaf38ea90e91844428013d40fea41f65f0cd8f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876378, "uuid": "e7b4d850-f00d-4456-b1d6-038ab534aaaa", "comment": "Malware payload (DCRat)", "value": "fa3c49a5959fedf718711cc30a14eae590624f7c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876378, "uuid": "7f6c4f5d-8426-4123-8023-fd4b7cf856eb", "comment": "Malware payload (DCRat)", "value": "362abec48ff58d1f484bfd944743edb8ef17356f8c4a56b37daf1e5073a92d46f79ac19d7af1f6355ab665488afb5672", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876378, "uuid": "dc8b89fb-9fac-477a-a603-e6534bd291da", "value": "T18983096C97E78436E3664736D9F64581C537918B7847CB0FFA88053A69027A8FE060FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876378, "uuid": "916a812d-6610-4cf3-bc47-d048dae512e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876378, "uuid": "ed62e802-d13c-4e6b-9712-7a5aaebf476e", "value": "1536:0ckMJrOe6JN+/zb/MtQ/6M3CpH9o4D8qkJieVclN7:UMJrOdJ8/zb/hSvHFEYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676876378, "uuid": "b7cafb79-a1c2-4a21-ad7d-cfa2bb0a6b0c", "value": 84000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676876378, "uuid": "9315ac28-d34d-4066-9dce-2c97d2ecbb5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876378, "uuid": "e3fc9121-8fd8-4d2c-9b3b-f6b64a49b600", "value": "54a65d42620d249154a2ae07c6e35aab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22845ce-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676882683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882683, "uuid": "9c4d0a07-fe50-44fa-a17b-e12d8498d1d4", "comment": "Malware payload (AgentTesla)", "value": "af73da938745f485a801c26af1426941", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882683, "uuid": "f06d8b0c-eb27-487b-8d5a-1480ab932b81", "comment": "Malware payload (AgentTesla)", "value": "10f8faf6c3fb75c299740ad32f34196c552b9658c2f91e52218dbeea7a170546", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882683, "uuid": "a38738ab-5335-40e6-a9c8-8f0ee58a4b2d", "comment": "Malware payload (AgentTesla)", "value": "48f8dc3090c10edb9d9604a55af1fe758769b1b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882683, "uuid": "523c0969-9391-49da-9faa-4846a362cea0", "comment": "Malware payload (AgentTesla)", "value": "ca7b9934321ab857db8ba7193ec7f2a8a46573d3b9791114d7c2b9a6e6c66508139052cada3b657aa661bb0d3dc393d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882683, "uuid": "a84875bd-6035-440f-84e2-fa8496d14299", "value": "T1389423C07D6295A3D8E267716D7BDA2A7BB0F7180DA11627F330444A38A7782E5CE721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882683, "uuid": "65769d1b-d5e6-4dfd-8f76-fed0ed6245c8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882683, "uuid": "f77c7f22-83e9-4957-9070-6c669036a906", "value": "12288:/YuhU1du2SFJAU2Ju36ReSqGremGAVTWWR/Yol:/YuhU1dub/OupdGre5kTZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882683, "uuid": "a3013347-75c6-461c-9d27-708034dac8a9", "value": 409776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882683, "uuid": "0280c103-f273-4f97-b690-d94d8b2e67c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882683, "uuid": "c1319c4a-ce2d-4088-9d56-3f27b08b6be7", "value": "carty.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90927bbe-b156-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676922086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922086, "uuid": "18c69e0e-c105-44bf-b3d8-88a99b86a369", "comment": "Malware payload", "value": "0dde13582231ec6ad2f59da240066026", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922086, "uuid": "f21569e3-9cf7-466a-ac8e-09b5ca851f34", "comment": "Malware payload", "value": "1136a76ea8184a8fe4c075b839cc3b1cd169351d0f3410a741b3719059e89e9f", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922086, "uuid": "42c1cc44-d8a5-4c7a-83af-d4534177ce7c", "comment": "Malware payload", "value": "089e01fcd775d7768788917c6dfc595f3b0a23c7", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922086, "uuid": "553f83a8-aacf-4936-a246-314b0e152bf3", "comment": "Malware payload", "value": "152bc2e3164d897e2190a3e86e0aeb5d12889a0e752f4c45f3fdca02a0c27a131984c9bd602013f297fe9fe5747c361e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922086, "uuid": "7f30df82-0f73-4b7c-b06d-31c08d750e32", "value": "T18FF26156B696C886E95627364CE2C7EAB336FC416F6743073249B32E2FB1290C903717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922086, "uuid": "c4cd32c4-ea97-4f4d-8033-64b3ee171f6c", "value": "768:O2o9MUlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0LYnrwHz/MZGSK:OFDlYkEIbSkKBEqEXPgsRZmbaoFhZhRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676922086, "uuid": "3fc4e343-2f4f-40d9-a207-18631807e30f", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676922086, "uuid": "7572049b-4455-4a21-a164-8c12166181df", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922086, "uuid": "8dee3fe9-a480-45fe-b05d-872ba252b24b", "value": "1136a76ea8184a8fe4c075b839cc3b1cd169351d0f3410a741b3719059e89e9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f599c6bd-b104-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676887037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676887037, "uuid": "26406b66-009c-4cb4-9249-e7d1eaa40d7e", "comment": "Malware payload (AgentTesla)", "value": "74918395c6a9352de73eb8039366ac59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676887037, "uuid": "9a63884f-911d-4d0f-b45b-dad02ebbdf19", "comment": "Malware payload (AgentTesla)", "value": "11f4870cd0e6fb7ca821b95e19c90dc7def655d2e1e9a56abc81fd2f245119f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676887037, "uuid": "9f2a0554-55e8-43a4-aa7b-b7c585401e4e", "comment": "Malware payload (AgentTesla)", "value": "d24b056768d304a3f0d63b9d88e38efe9ff7aef9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676887037, "uuid": "f5188740-26d6-41c2-86c4-d6748e2ceceb", "comment": "Malware payload (AgentTesla)", "value": "910b106411573eb5c14a0426852cd0a8c20becd1f86a16b2bbc40a0c99e0da34dae048955d1de6b0ea1cf22b96284ffa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676887037, "uuid": "d356283d-aa1c-41e1-bff9-a7c7018d4bc8", "value": "T131F48C9977B46473F4CB01EE583827CC2E2066537609E22FA777BB91A2719FB72C5201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676887037, "uuid": "76b7a836-9429-4658-91db-c44e32ccbc47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676887037, "uuid": "7459ebf6-f7b2-4460-8d57-fda72caf3297", "value": "12288:wJd+gc4jIe3ma79+qC9jLZJRbFueVjBfU31gWybr2ay4eaIXSPJcHKx:w7+oIe2aZtC9j+ejBM3mWy7ILq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676887037, "uuid": "46ca9176-039d-4f3c-b569-ffea88a324e7", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676887037, "uuid": "5f40bbbd-0440-4504-896f-7c3a4434400a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676887037, "uuid": "e079edc9-8f50-491a-a7f3-eb3d6279369a", "value": "74918395c6a9352de73eb8039366ac59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd4c65c-b14a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676916931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916931, "uuid": "638af98d-a8c0-48b7-9fc5-8a08bf703516", "comment": "Malware payload (AgentTesla)", "value": "9be72e4e897f9c982810454562aed142", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916931, "uuid": "9b3b2535-e5a2-4c1c-b7a0-d1d76a329420", "comment": "Malware payload (AgentTesla)", "value": "1283438598f854513cc5486567c3b41d64064ee7901b30db625704f956a5d633", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916931, "uuid": "2ed9842a-d45d-450c-81ae-3fc5a734c1e1", "comment": "Malware payload (AgentTesla)", "value": "4c36dc267c31fdb700c5f882ea1a188802f0b3cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916931, "uuid": "3b80815e-443e-46c0-9a15-f0ac4046683b", "comment": "Malware payload (AgentTesla)", "value": "77f024ad95e122d39be98dec833b8d4bd093b0ce35c7efd3cbcb3c96af9e2e5e8c0eaeb5100c987e49e78a12bb58e69c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916931, "uuid": "a34e6d1c-bb05-4e60-994e-71e8c33ab741", "value": "T16525BE49A7B0D6B7C58B01EF1838574D39A435837609E22C8FB77FD292749BB35A9203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916931, "uuid": "8b5f67cb-57d8-48fe-8725-c45724434bb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916931, "uuid": "0dfa739a-a942-4135-8cad-5847b65343ec", "value": "24576:KxJ4yZ127cDpsxM4Y7c5y42xqLchs3vr/c1rYE:61mSsxycz2xwfr/cmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676916931, "uuid": "f477312f-9b65-4de5-825b-fb6e2612708e", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676916931, "uuid": "b96fd866-6ee7-4800-bdf8-dfa9782e6d4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916931, "uuid": "e47fc809-1fa6-4d5b-8549-f0999beb9be9", "value": "AWB NO.3522849002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c3336dd-b0ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676877009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877009, "uuid": "6e9baf82-4e90-49b3-a505-c37438cf1fcf", "comment": "Malware payload (AgentTesla)", "value": "d3e650f0f23e54a6505072d5d000e67c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877009, "uuid": "b8da7474-4c65-4fb2-8fbe-4076439b6f41", "comment": "Malware payload (AgentTesla)", "value": "12a5e00bf4e4962f6141dd3f67ab06ce45d608e500b13cd009cdfd0b60d2ab8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877009, "uuid": "20732e97-86bc-4048-b87c-4daea5a81c95", "comment": "Malware payload (AgentTesla)", "value": "2d41dff392ce7e290d7aa5e8336b42c0178aa41e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877009, "uuid": "06505aea-6925-4b05-9373-5778a9550103", "comment": "Malware payload (AgentTesla)", "value": "5fe0fffc1a1d7dc629db973d66f7ef39011b82a871abcae0c6a808ed594b42515ef5c1bf1f4b20dbb22b010da881c8f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877009, "uuid": "70065942-2b9f-4e58-a493-cdd54f3c7bac", "value": "T162135E5EE78F02A5CF5112B3521A0E8996FDB33DB35155B178AC833433ADC2E42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877009, "uuid": "621b626e-1ff1-49b3-a40a-3f27900b61ba", "value": "768:2Fx0XaIsnPRIa4fwJMlGA2rhfbJS+pKO360E4MmKdEC22RvSDf8nU:2f0Xvx3EMlGA2rtFS+pK26B4MmKR2GGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676877009, "uuid": "01acf1ee-72b6-4f6b-b67b-0cef2fcb627c", "value": 43320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676877009, "uuid": "b712fb79-1f33-4fe9-9340-0c72bffaa4da", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877009, "uuid": "3fab764d-6484-47c1-9f70-c8a8217f5f79", "value": "ETAXCargo2023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89a53a3-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676908920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908920, "uuid": "b42b7130-594e-4228-9d8d-2d680509a606", "comment": "Malware payload (Loki)", "value": "90668d2907c438bd0eb4a7047510d13d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908920, "uuid": "267c3744-a0a6-4eb5-9a8d-15f96c3eeb31", "comment": "Malware payload (Loki)", "value": "13d4fdf58e85297bb41a22e87d15a2ed4040e65ed321bab04acbb335a9c58200", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908920, "uuid": "33287d0e-0f3b-4a09-9347-c48bc03ad13d", "comment": "Malware payload (Loki)", "value": "be3fb76c3c261c56c87e7df2560c941b13173fa8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908920, "uuid": "3d1c6c4d-5352-43db-9152-703fdf857c42", "comment": "Malware payload (Loki)", "value": "1f248e9f0f3d81b5adef695eb7ab2a13caa5b59924332784e575bd28c456d7b06f1b89a816bfcfd949189697123ebfaa", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908920, "uuid": "81fcb297-c5ef-43ff-9919-9a326f566a14", "value": "T1F803D35AE79F0264CF511277271B0A88A6FDB33EB35055A134AC933433DDC2E4666ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908920, "uuid": "92b11648-d35e-4759-bd25-3e57409b2067", "value": "768:3Fx0XaIsnPRIa4fwJMtvt+Mnpo57E0tvOmKhuTn1SHUa:3f0Xvx3EMj+Ip+pvVKhuTnMHUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908920, "uuid": "b0c13212-b68d-443b-9641-85211c2f667b", "value": 40252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908920, "uuid": "e070c8aa-e180-42af-b798-2e4eb2cf513b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908920, "uuid": "f2f0622a-d804-430c-8331-ed5305f4df45", "value": "Data_sheet_CRI22SN033.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d9c02e-b109-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676888969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888969, "uuid": "497cf891-37fe-463b-8c06-e9bea6065a84", "comment": "Malware payload (AgentTesla)", "value": "0d61295fe2cae597e4f68c5b29191cd3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888969, "uuid": "54eeb80d-0015-4bff-9139-422c85048b12", "comment": "Malware payload (AgentTesla)", "value": "14b77f6de099b2a4fce6f4ab08d32caccc23a2f0714dcb44e24d69cfed964dcf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888969, "uuid": "337e5289-c4f4-4230-ac9d-7ad936e39478", "comment": "Malware payload (AgentTesla)", "value": "6b1824b85b5068f1de3ca9cb481f4eb8d54f6317", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888969, "uuid": "fa512f8b-489d-4f67-b5c1-0d309a6d181c", "comment": "Malware payload (AgentTesla)", "value": "a9cd0f0538416fb58c8ef0b34104ddaa669f484163d061cca41fb722047cc3a95a32eddbd0c82bcf6f1cc238890c7997", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888969, "uuid": "6213112f-a05c-4066-acb5-73190c2621cf", "value": "T1DA0533F384833B04B475DCEC3DAF9C2D5551E2752AE25DB4D9918ECB2E234388E8259E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888969, "uuid": "f381b31f-e9d6-40d1-829d-00b4d7868ac6", "value": "24576:oDGcF84Y+Bc3WNYe5QPrtG9VjwcE1dl+n:po8Qy3N2ArtG9V8XlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676888969, "uuid": "302b4f5d-5443-4eca-a878-f2c98b9fa9ad", "value": 854670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676888969, "uuid": "4cf9de6b-4015-41be-a14e-c9efe3373907", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888969, "uuid": "3906da1e-c930-4286-9539-a8cd3f3a86ae", "value": "order777665433_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777bb2b9-b0ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676876947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876947, "uuid": "421ca636-cde2-4afa-a762-ea76e6197961", "comment": "Malware payload (Formbook)", "value": "4222391b2cc33b85ef90c1beb0ed9a51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876947, "uuid": "2673a742-47e1-4774-a404-231e876e8226", "comment": "Malware payload (Formbook)", "value": "1583037e8ed80b3e80955da8e0138cbce6faf0fd0df77f50c7551d290ec67f2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876947, "uuid": "06fa3a33-421f-4cde-9ced-2b27ce94c522", "comment": "Malware payload (Formbook)", "value": "c0ff444b9dc5c480d9c01487148c94f7065b512a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876947, "uuid": "38b89413-4745-47b3-82d3-6ba3a8d11399", "comment": "Malware payload (Formbook)", "value": "9db71991f7a3637a535d65c03262ea84eb19dbe7205c22ca37d23359bc328138dfeb527ead07216c2cb00dc3eaeb1c56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876947, "uuid": "5fadccc0-6b8f-4754-b254-326366b2998c", "value": "T126D423D41BB282AFD04355B106B4B77B5BF3EC1267B1960F27E59588249BB40E08FB72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876947, "uuid": "266df0f9-a0ec-45b5-9771-c240717212e5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876947, "uuid": "0ec0ca5a-7232-4bc1-adb3-154ff958bbb6", "value": "12288:vYcPGi4x+IMZT1/+QP5KcvHVLkFiHT7cv81gm9QxWDZf:vYcPFBv7v+iz401p2xK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676876947, "uuid": "4087fd6b-18de-4539-adfa-7a6853491846", "value": 642616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676876947, "uuid": "78e37960-b4ef-4ee4-b9b4-3f1adc656b51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876947, "uuid": "08b9a85f-a4d5-49f2-bf2c-04342e1eb928", "value": "DocXpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187994ac-b118-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676895256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895256, "uuid": "604685d3-8288-434e-b4a2-96b99646b83d", "comment": "Malware payload", "value": "e74eb9bcde3ee9376b601434b23cf36a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895256, "uuid": "39aa1529-1468-45c5-9c6d-65a9749147d7", "comment": "Malware payload", "value": "1645cea69e1bc7b2e9c9c2c0b5dfb666b204005a2b62da86e2b3d5dd4a15f930", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895256, "uuid": "17e2f441-d33e-43cc-980c-09e913059097", "comment": "Malware payload", "value": "162786e2728848a0f8b793ddd2f985fd76b35cca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895256, "uuid": "1422f16d-3ca5-463c-b761-808aa04f9bef", "comment": "Malware payload", "value": "eb8962b1151d6b65d6c416af822842209ea1532c75b5d13dc1e9d06ec5c403ac348e10ba625a1c0b3727643503eb67af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895256, "uuid": "0e947c09-e792-4624-95f3-d13e4d426d10", "value": "T132D21B01B30C0997C1736EB43A3B2FD3F79AA9D122E4E680367E9685A173E315585ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895256, "uuid": "114f64f1-7e0f-4836-bc03-92bc8e8effac", "value": "384:vG6OmnBxH9RfjvHg5XgaFP6O5/6sTDBT+HaiDVFJB6tuDe/6FkKGGbtK3BkePQU:vGyZ9RfziRxaH3FJotrOJbIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676895256, "uuid": "2b52dd5a-034c-4894-ad24-2fffa40ae5f8", "value": 30544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676895256, "uuid": "bda57c55-1fb5-474d-a94b-64640ecd4d1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895256, "uuid": "98eca142-288b-49b4-91fa-f40d19fa64b8", "value": "e74eb9bcde3ee9376b601434b23cf36a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aec7e36-b138-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676909058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676909058, "uuid": "109223c5-74d1-4f24-b083-37bc2b37e555", "comment": "Malware payload (AgentTesla)", "value": "6445e4f1ba6188d6d765f9894fba27f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676909058, "uuid": "27e17655-d5dc-4301-90aa-f85c54fc7f86", "comment": "Malware payload (AgentTesla)", "value": "1687b404e85c3948ee8926241c4304188a7a9e26c1d095f0c3cb674bd2f54d54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676909058, "uuid": "f301cdcf-1fbc-469f-9a11-cbf7e1e2b500", "comment": "Malware payload (AgentTesla)", "value": "8054de0208de6c5776575eb39946375e9f7bc0d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676909058, "uuid": "0fab2a0c-2939-4d62-9eb9-d8fba5f20db7", "comment": "Malware payload (AgentTesla)", "value": "5a1f1e8626ce860919288f732c45e2dc8386ca475f946509dc297e8b5ab907a4fbe66880c8c628acb25a7876903175cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676909058, "uuid": "6d0938f2-6940-45ab-a05c-dadd1c8288dc", "value": "T1CB13C25AE79F02648F5102B3271B0E89AABDB33EB3559171346C837433D9C3E46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676909058, "uuid": "3018541c-967d-4ebe-a85d-aee652652d58", "value": "768:9Fx0XaIsnPRIa4fwJM6LqURj+G/hTA1MybC4oiLbQUNjw3j/TG:9f0Xvx3EM6L5ZTmMupo28Kw3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676909058, "uuid": "d33752ac-9ac8-42d5-9a3c-057a9e62b4d8", "value": 42557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676909058, "uuid": "60b0ca58-595e-481e-8e5a-a6d59c904e1e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676909058, "uuid": "20af7825-f4e2-45af-b5b9-0bd8cd14062e", "value": "AF-021623DB.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11d291d-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676882654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882654, "uuid": "2920fd51-74c6-42a6-9c68-bb77a1af639b", "comment": "Malware payload (SnakeKeylogger)", "value": "db0fb6c68944e133bc465887606e7531", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882654, "uuid": "12ec9bf9-5543-447f-9622-a41a64c4ca98", "comment": "Malware payload (SnakeKeylogger)", "value": "16993cc3cca685ec8c8ed3c2acdcdc70377d4cd15972d1b1c5316f40ae3530b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882654, "uuid": "9f7cc02d-5abd-45ba-a5bd-70aec2b1eb8c", "comment": "Malware payload (SnakeKeylogger)", "value": "9bd8f0c046a8148799761c08f630396b8a3989a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882654, "uuid": "7c784914-0999-4f1d-9580-b29586295260", "comment": "Malware payload (SnakeKeylogger)", "value": "e75a1b81648c61dd273d844606b49ce89ee450dc93e43f392b8cef78f77d97707fca9e8a930a0a1eca7744ba9e7571d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882654, "uuid": "66891c16-0d17-4ad6-8901-31ff93a3d822", "value": "T110D32A1D2BF89800F5FF5A7305B15112C776BC52192ACE0D4AD2F55A2A7CA90CE1BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882654, "uuid": "9c85eac3-43da-466f-b91a-de46b5388ce8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882654, "uuid": "88958bb5-0b05-45e6-8103-44ea04dde5ab", "value": "1536:aAgzEJRCRjTZ1ouJjuBYHj0I+vBUFrlYYLDkrwsDQau8IzR+MFINfvqNiPOb/Ufq:aAgAEkoHj/LDdUp9Ob8CKv+wBj2qFbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882654, "uuid": "52750c4f-24fc-4c05-90ce-f4748fd957a3", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882654, "uuid": "475104cc-7c33-4ae2-843b-de9fde2240bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882654, "uuid": "6ffd4b45-ff54-49dc-ac53-21820528d56c", "value": "16993cc3cca685ec8c8ed3c2acdcdc70377d4cd15972d1b1c5316f40ae3530b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1dbd20b-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676882655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882655, "uuid": "97af83df-7d81-4f1c-bdac-7d5fae0cc74f", "comment": "Malware payload (Formbook)", "value": "97e99452a2604c88ef48cd5afe66d344", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882655, "uuid": "2e3cadcb-3e64-4875-a276-95fa2caa4663", "comment": "Malware payload (Formbook)", "value": "174c2904793e6a3ede4df78ac04da6569ae44df52bf5508f2ade208d67f69d14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882655, "uuid": "b49d313a-f01c-4753-a125-e16e58e7e06b", "comment": "Malware payload (Formbook)", "value": "48cf6002c29b38f789b67c8e07250a90f885f7d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882655, "uuid": "d7da4758-e6a9-4f51-b02f-0649637e39f5", "comment": "Malware payload (Formbook)", "value": "47c83791b5b243444596c2e3d3248000450924eb382468e2524b3af82df3ab37fb54be3c6375614c5aec8d2a023c187b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882655, "uuid": "585b5e9c-4d0b-4841-976f-2de4fd0bde7a", "value": "T14904AF76D642C031E2B251B5F6BC0B7B4C3E0E343255A0AAA7F216E06EB4995F52D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882655, "uuid": "56982fa2-3d60-4007-a069-823608c5f1f8", "value": "3072:agTsIkmchQ6Cez3bIbOy/a9DVAqUOwp0iTGVoddQqGYGODaj:YYV6bmLa9DVAqwtTG6ddQqeODaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882655, "uuid": "1a32ca39-8851-46f6-b54b-7f47a4955a9e", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882655, "uuid": "c5297a0e-a3bc-4ca0-9c6b-8d70a64c1310", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882655, "uuid": "5310a387-85b6-49ff-9810-e4d491752bcb", "value": "174c2904793e6a3ede4df78ac04da6569ae44df52bf5508f2ade208d67f69d14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf311298-b0b5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AZORult)", "timestamp": 1676853016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676853016, "uuid": "e22d5ab4-82dd-44fc-8fdf-839fb4b0b986", "comment": "Malware payload (AZORult)", "value": "2fc09f6799bcc5eddcb96ad4fc515355", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676853016, "uuid": "3153a13b-c794-4e0f-9808-35afadd87f8c", "comment": "Malware payload (AZORult)", "value": "17ea4ff28a39d36f7da5f9196231241b66fb10caf723a48dadc95121bb7bc9cf", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676853016, "uuid": "8c970f5e-c96a-4254-bb20-af7c137c8c1e", "comment": "Malware payload (AZORult)", "value": "7ba2005e6eb77d85dc258c8914d6e0222d9876b3", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676853016, "uuid": "a9fd724a-26a4-4798-8c14-d621f46f124f", "comment": "Malware payload (AZORult)", "value": "d62aa1a4045fc8b39ce6f26057ed94224db3f165576000be4695c2c2f6c7cc04c658c13c58b2be3692790006ab8b8dcd", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676853016, "uuid": "7f7a4d65-55b4-4862-810f-263186905277", "value": "T10E9423166761E723C8B55671393F5FA1BBE23F170B34AB0B97415F443A22660B86EF08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676853016, "uuid": "35162560-cb69-496f-b2fb-466d90cacfd7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676853016, "uuid": "354cf7da-ba22-4ec1-a37c-549a7a420de5", "value": "12288:lYJdkD4lR7lhf7QnTDsxV0rpTIcPzi6oBlIK1Vih:lYJ6MlZv7A0xwpTIgGlIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676853016, "uuid": "13a09afd-3b40-4d8b-a5ba-b5e52c184ba9", "value": 433304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676853016, "uuid": "eb7a72a0-7ffe-4861-8689-57fc220ffc92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676853016, "uuid": "2503112b-76b1-493e-a64e-adf8f9d0beca", "value": "2fc09f6799bcc5eddcb96ad4fc515355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61321a12-b168-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676929738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676929738, "uuid": "66299d9c-f8fc-4b16-8dc4-7e6838fa8c82", "comment": "Malware payload", "value": "a0637f11f853be8f538885daccbea677", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676929738, "uuid": "0e4b46ad-e195-46fb-b41e-561f74110f4f", "comment": "Malware payload", "value": "180a541d61bfa4fda318457b0f16f159671b14305b5993e13b4d63c649eed2cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676929738, "uuid": "19424a02-86cb-4196-8d4b-64883e55c886", "comment": "Malware payload", "value": "d970b69bbc89f1246e46907e0fdbaf5392e4d4da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676929738, "uuid": "2781df3c-50ce-4b29-85a8-415a2a7294e1", "comment": "Malware payload", "value": "33a697d09c2b50cca52514572344ac6618817e33ff7437675739fb562c35e947e7e3b21258deeeea5076b08506a7d096", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676929738, "uuid": "9c92369a-00ab-4311-a89f-76ef592594f7", "value": "T17525BE09A7B0D6B7C58B01EF18385B0D39A435437519E26C8FB77FD292749BB76A8203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676929738, "uuid": "023a070a-d306-43ef-89d1-a8e96894a7ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676929738, "uuid": "c9356185-4362-459e-8fa8-26ef53f91d5a", "value": "24576:Sws4yZ1ArYENAGCUdyn9vMJD/TrKl0EgmBCEruOQrGI:rAhE789vg60ElBCMtU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676929738, "uuid": "856daf7c-170a-4564-bff1-d9e85f62593b", "value": 1001984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676929738, "uuid": "0c7b8462-fd1f-48dd-b930-247c8495ef03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676929738, "uuid": "26d8701d-39f0-4738-a715-f120939aed27", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6976c889-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676908706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908706, "uuid": "1f595d44-03bd-48ff-bf9a-18899cbc0d43", "comment": "Malware payload (SnakeKeylogger)", "value": "d07d269af45c7314805fde7fe249f316", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908706, "uuid": "9c65d319-30f2-40bf-9d3a-f96d1ff8f333", "comment": "Malware payload (SnakeKeylogger)", "value": "18311b1f149ce81be89dee6abd84e0813b965c208aece7e77df6222340efa38c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908706, "uuid": "699441be-c973-4734-8352-5e920aa2e6a9", "comment": "Malware payload (SnakeKeylogger)", "value": "70d3ee39fb459e7c33ad2f0ca42469980f242856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908706, "uuid": "a445f070-fb91-4f1f-ba68-388834c7b470", "comment": "Malware payload (SnakeKeylogger)", "value": "b9f459aaabe925f92dfd8ba2cb27da4c8931e69ba6b17ce55f6bf80f2cdbc7975f0ad1ddf73d3887eaf41b4c6644a5d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908706, "uuid": "f86c7569-b96b-43a3-8b24-9d0a1772c945", "value": "T151C402983864C89FC8990B708D92F63D4724BCB11C999D423EA63F1D78B2346245EBFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908706, "uuid": "31ed1a7b-f1b6-4b21-98e9-4174178a682a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908706, "uuid": "356588c8-5047-4b7c-9886-226f1f47c4a5", "value": "12288:OYwMTy/BU/oRleVnRyT1ppfeQNwpsHt3NrGnoiymchH/3vt:OYxTysomVRopV2SNAvFI/3vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908706, "uuid": "9996d17e-b988-4579-9e6a-ef5b3468afa9", "value": 570560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908706, "uuid": "d71b8b5a-8788-4fee-9858-a771ef71cb22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908706, "uuid": "f3445cdc-1622-4199-a95f-6858b9446821", "value": "Bank Advice.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b9d262-b0ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1676877322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877322, "uuid": "7d0f9ae1-449d-4849-a829-55565378d516", "comment": "Malware payload (AveMariaRAT)", "value": "adf18ad4666b7657bbc52c6c8e3c1c09", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877322, "uuid": "2edde56a-7cc1-432e-912e-473184e34551", "comment": "Malware payload (AveMariaRAT)", "value": "18907cffbcc21b02f7c7fc3cce6e614f4ba621226deae9498b40e1d47b233ec1", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877322, "uuid": "a32f5847-d6ab-4b81-80e3-6dcca428b86e", "comment": "Malware payload (AveMariaRAT)", "value": "d9e16f4fdab9791742b14bae032fc8df9bb95e0e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877322, "uuid": "87f11566-2a4e-4824-a3f5-283b8eb5d86c", "comment": "Malware payload (AveMariaRAT)", "value": "db6962fbfb3b30a7dabf07ec6439edeb95c525956bf101b5dc7f2c93f99e31838259a25c3ca02059a34ede57f00e8917", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877322, "uuid": "daf47431-0228-4937-88e9-5bd8512d2e44", "value": "T12303615563FC6F22F9BE8BF92676281417F5282E4DB0E7190DD2A0DA2832F005791F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877322, "uuid": "f6b53e9b-4230-4817-a365-ec58523abc7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877322, "uuid": "31811315-9151-487f-b442-6de9dfd78be0", "value": "768:QLpLjuLGWudBhnpIlkjQ11+b1tGCIanxfA/oyP810SajE:iyaWudBhSl088HfxEoyP811t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676877322, "uuid": "f131a988-1937-4d0b-a55e-4b5d4122ee4a", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676877322, "uuid": "748855ee-041d-405e-8570-5b2ce1c35b45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877322, "uuid": "8bfe6e4b-7fcf-43f2-beee-2677bf0a7184", "value": "IMG 02-20-2023 Order 45678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116e858a-b118-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1676895244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895244, "uuid": "5f44cc2d-9cc1-4811-b6c8-c5c6c9bb880a", "comment": "Malware payload (Gafgyt)", "value": "86acf6912252184814bb1faa50713264", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895244, "uuid": "592bdfdd-e294-4701-8ec2-34ac97f0b63f", "comment": "Malware payload (Gafgyt)", "value": "1934f2423957a55b90cafd8b00c771a39a038846175e37d8156450b176ed9efe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895244, "uuid": "7c5993de-edaa-40be-abcd-ce5d7f9fede6", "comment": "Malware payload (Gafgyt)", "value": "a1ec41411ad5a195951f8b283ec0039aafa62b5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895244, "uuid": "aa0faf36-dfd2-4878-b3ab-93bf079e6aa6", "comment": "Malware payload (Gafgyt)", "value": "01bb68db14202e25212894b35a427cba0d25f604a6ab97937146683ed60b7944744f19f68ed9020042750c3c062d8268", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895244, "uuid": "e7a7d42a-6458-4b09-a012-578e2ee05068", "value": "T12303A50AEB918EABC86FCD3306AD0F5339CC94C712A57B363174D528B65B94789E3C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895244, "uuid": "4cc125f4-3f07-4f2d-aa16-9f75f3a9b5cc", "value": "768:qIDe9mMe5gZ9kw+yYTlw28ZXiuwueDem3xMYI/:1QmMe5kuTlBAwueR3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676895244, "uuid": "6aa4997a-b017-4a77-bcac-b16ffdc8c2e3", "value": 39056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676895244, "uuid": "326dcec3-8e7b-463d-aa3c-1f5189a2259e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895244, "uuid": "0948ecbc-7715-4c5a-bbc7-f74193d0185c", "value": "86acf6912252184814bb1faa50713264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eefa7c6c-b0eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676876289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876289, "uuid": "7120ab18-aa83-4dbc-9d97-c5e4cc668650", "comment": "Malware payload (SnakeKeylogger)", "value": "74ba9b8614fa6b9ff8046c12e0340965", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876289, "uuid": "2d5091cc-9218-4017-ad35-e5f5596ad60d", "comment": "Malware payload (SnakeKeylogger)", "value": "1a3b63d42048910d4c7bb52b335019b31f6a08442d95fa8b7e39c15f8d881202", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876289, "uuid": "55db3789-279c-4b8f-bff9-49c2908ba919", "comment": "Malware payload (SnakeKeylogger)", "value": "31255d1cdad4ec78d92621b29a5788df4dd23e38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876289, "uuid": "73a78659-9127-45d3-a091-d3d790f71dab", "comment": "Malware payload (SnakeKeylogger)", "value": "c1f09b43fd554c4aaa63f13c5ff35cd875baeb2b003876012de2c87eb717d0dc127bef8da22005d54c2d0e9d30809be4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876289, "uuid": "4933c554-8ddc-449e-aa8a-91b25a41dc0c", "value": "T194F44A9CB1F0F67ECA0ACD36AB103D14ABE065536716C592E263B6D99F3D4538E1C0B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876289, "uuid": "7151c043-38fb-4f8e-8350-6e90283dec73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876289, "uuid": "aa214d1f-3d73-4a85-943c-2469c5377287", "value": "12288:cD5OqDSu1Dsv9t0oexFo1zVbXBKjy6fUnRv7jMt+GQ8mfDsv9tZ2VEZ9tJfNM5uh:cIqDSumexFOGr8F7jTVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676876289, "uuid": "d3dd3100-a78e-4d3d-8c7a-4c2ec6e9ffda", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676876289, "uuid": "3f6b1ec8-a12c-43da-97f1-ae73d8f31e21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876289, "uuid": "5dc47e81-3557-47c8-8a0f-4b88c1936994", "value": "74ba9b8614fa6b9ff8046c12e0340965.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04295d7a-b12d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676904241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904241, "uuid": "c0ba1285-1f70-4ff7-ab3e-d0dc6c1c6e9e", "comment": "Malware payload (AgentTesla)", "value": "25c7110f841ae784adbc3b04602681b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904241, "uuid": "d250f71e-a1de-49b5-9565-745b6317aff9", "comment": "Malware payload (AgentTesla)", "value": "1b80f87a1e29c1ffeb8a3651659234ee8785963927aa7ed66d0d21fc3cbe4733", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904241, "uuid": "04314ea5-0003-4b87-9324-5ee427c688cd", "comment": "Malware payload (AgentTesla)", "value": "6d7fe422279446219fb954be872b82582ee5222f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904241, "uuid": "57e31034-f231-4a1e-9fb9-920db891d2d2", "comment": "Malware payload (AgentTesla)", "value": "6aeb1b4945c3bfb4e58f4f9a9191e042c1f63e317d3f729b574c62d8d46a98f6cb16917a587cf96bfcfc140300d36f30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904241, "uuid": "44290241-faa2-488d-9e52-98b62566febd", "value": "T1D85423229FA9DC394546600ACD0F34724C8C2B11B5DC5BAB3253D298B5DBC58ABDC7EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904241, "uuid": "3fb132cc-0bea-466f-bf97-46e10a327875", "value": "6144:j2CBOu94JIqCYyZolD346WwdSg4dFW6R9ARbSPo4:iCB3yQsDRWuSgCFt9AdUo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676904241, "uuid": "90f671d9-c99d-4e47-8b0a-6652aab04ea8", "value": 304535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676904241, "uuid": "5d00ae74-25ba-4309-a674-f7ee080605b8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904241, "uuid": "2d12a9dd-314a-43a3-be37-07fc550eec3c", "value": "A.GBIN.23.001051.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37af56c4-b11a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1676896167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896167, "uuid": "c99bf349-65dd-4613-8538-9e9c2d493359", "comment": "Malware payload (Vidar)", "value": "69df9998a42524225a5b25d2e8a5bd79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896167, "uuid": "f0e2a6d4-29d9-4e30-9757-45e9f813caac", "comment": "Malware payload (Vidar)", "value": "1bf1a0cbe61b5693903760d0bff9c3cb53a7c43061437e367b19a77b55aaadfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896167, "uuid": "2c36bd0b-b153-4a6b-8abb-20591abef5f6", "comment": "Malware payload (Vidar)", "value": "08d01a8d0a17b6d565eeb38e003a79cda4608ab2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896167, "uuid": "3407207a-4cf6-4ade-9bcd-0ceb4543d8f0", "comment": "Malware payload (Vidar)", "value": "df959d288f385ecb8eda3db6adf5d53edba45ad71f698ad2859fc95306341903c7d5ff788ee9ede7096dcb321aa58a32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896167, "uuid": "1af3a6ab-408f-43a7-90b5-1aaad7aeeacf", "value": "T160F53356378659D7DC681131F6728BAECDB0EC411EE4481830CBF1AF97F2D62189FA1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896167, "uuid": "0d50dc95-ea42-4cca-9850-0f744a8409e3", "value": "ba682b08474414ef441da52664156d0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896167, "uuid": "cce341b8-1d5a-471e-b74e-fc9c98bacfb1", "value": "49152:9es+BvKs6POj/T3K2Umsv/kd2BEmgNVfDdv3n9RIZqpCatWuOnqdEb+RPz:ksOFVrTa2E/VEmgNVfDx3nTTrEbQPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676896167, "uuid": "5dd6dc6e-cf0e-4168-91c9-1a2c56669dcf", "value": 3419656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676896167, "uuid": "aa314a19-a61c-40a9-aa96-25790d269e20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896167, "uuid": "627e7233-0340-47b4-8389-d9132f430c47", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8449ab-b0fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676883771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883771, "uuid": "16eab98a-f15e-4e31-8304-93e6b6de744e", "comment": "Malware payload (SnakeKeylogger)", "value": "72677d78bd1a2e33a2e58bca7a539507", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883771, "uuid": "9bb12ec7-5999-4628-aa84-ddce3c6b8862", "comment": "Malware payload (SnakeKeylogger)", "value": "1cf6ec5af4e2cf0c7bad29f2735a2db25584b153969866a74bcc323cf59a7875", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883771, "uuid": "edd21d21-3b51-44cc-99e2-8a49dd1cbad4", "comment": "Malware payload (SnakeKeylogger)", "value": "80368966074b4c95e941274254b5f4f1a85d45bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883771, "uuid": "eb37800b-501b-47ab-b039-7d175b837a62", "comment": "Malware payload (SnakeKeylogger)", "value": "a74294f48689e51a606c72b18c1b4458e7c664aae2c62dae01b20ab5c92aff6229e0a3aaddf4b897e67f682ba584f287", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883771, "uuid": "650b5d48-b3a1-4b64-b6ef-40813553ecf0", "value": "T183557D85F2B0C8B7D99B01F66C3A562434A27D8E6454911C4FBB7F5662B2373309EE0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883771, "uuid": "cc1a6e1e-b20a-4e4f-b3d8-3cc21445db8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883771, "uuid": "ffcc191b-0a2a-49a7-a592-5086b7d9ff61", "value": "24576:DJ14yZ1MdFAE2zL8KPW4V2mAOMVQ8R0rYE:tR4Ff2P8QW4VX8lE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676883771, "uuid": "5eb9344d-687d-4aff-b91e-7a78d5742367", "value": 1297920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676883771, "uuid": "10a52f93-adff-44f6-bd5d-e42e3acf0142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883771, "uuid": "f4f84408-1d9c-4863-a08d-afcceda9f72e", "value": "PO#8754302.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c5fbbf-b11c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676896970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896970, "uuid": "a1b95a7e-de6e-47e0-a98e-a9bd14e39bc8", "comment": "Malware payload (Smoke Loader)", "value": "887b5cd6d6c43d6685bd07170298dc2f", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896970, "uuid": "2bb2605a-e7ba-4d7d-b16e-a65f94621ceb", "comment": "Malware payload (Smoke Loader)", "value": "1d78f4ae41497a4e34dc805ecf671d62ba08bd094d04d8f80eadb40fdbc357c3", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896970, "uuid": "e927104a-9903-4003-9cf4-4d36ae4373e8", "comment": "Malware payload (Smoke Loader)", "value": "5c8cb2b29989c9a68fae5b7359c488b6cd67e6e5", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896970, "uuid": "795088d5-fe77-4b47-bf7d-26454b37ecc6", "comment": "Malware payload (Smoke Loader)", "value": "0bde9445459af71ec1b942c32aa26ad03e23fe41083fefd3658db7d44d35a09683a132a988e2cc1b141ccc4425da30fe", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896970, "uuid": "dcf031c7-1304-406a-8f51-23f5429295ee", "value": "T1CF14D010B5E0C472C59A0471A871EBA85FBEB9116271859F37AC2ABF4F303D2877635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896970, "uuid": "66f89ff9-2dae-486d-b748-31bad5837a39", "value": "91260fbba24856473635dc78b8d8ea46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896970, "uuid": "bd524426-e50e-49b7-890f-0fa66ded2014", "value": "6144:5/frx5LcvS+1mKENlQYXTZ2B9o/0VTmm:5F5QvUlfZ2jo/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676896970, "uuid": "71e6897c-155f-4f10-bfaa-02edad3a6098", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676896970, "uuid": "e2611a8a-e5ad-4cc4-828d-e6294db1bde8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896970, "uuid": "64b2458e-bbcb-4019-8c44-fb5ee23fbce1", "value": "887b5cd6d6c43d6685bd07170298dc2f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91949284-b156-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676922088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922088, "uuid": "b1b46251-2acc-4fa2-93d9-7178c67de404", "comment": "Malware payload", "value": "ea09ae5a53e9b4f038060986d539f399", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922088, "uuid": "9afc2ce5-4067-4e0d-8247-a062c071688f", "comment": "Malware payload", "value": "1d81d40e7c25a2bc83dd91ef3412fc639feee08ecdaa36311411909ec56681db", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922088, "uuid": "59502d43-ab9e-4d41-a577-6431a7eb9f40", "comment": "Malware payload", "value": "5f576e6b75e3d25f2d86b9bc40f7dae9e0a709c8", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922088, "uuid": "4cdc265a-58e6-4100-9fac-e506197c4a41", "comment": "Malware payload", "value": "0b8a07cd10f625456733624f36f3aefed7566b6184d448e24de5a59c9c06cf1932b04728d6b30e87145b83cf84bbe8d9", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922088, "uuid": "b200da39-9653-4445-911d-f936ff6b5e63", "value": "T1E944D7EC7812E4D7D69D0E77D1AD3AE532742D1AE68917CA1060F32F2DBB700EA2D944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922088, "uuid": "d118a106-8ccb-457f-aebb-8385380fe17c", "value": "6144:7k3hbdlylKsgqopeJBWhZFVE+W2NdAc8iha7+QF4SZ2VQpPh5Mt:6Bh+oQhet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676922088, "uuid": "48caa1a1-3bfa-4c9d-8643-1a4b3979d71b", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676922088, "uuid": "322283c8-4e0e-4d15-b854-370d2a38ef01", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922088, "uuid": "d08f00f8-7d2d-4aaa-b2aa-4be8959fb576", "value": "1d81d40e7c25a2bc83dd91ef3412fc639feee08ecdaa36311411909ec56681db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a7efa14-b0ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676876389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876389, "uuid": "1db6c3f3-6341-4f0b-9b71-768256109230", "comment": "Malware payload (SnakeKeylogger)", "value": "27fdbd22f99a9f740ee13fad48233bde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876389, "uuid": "8e0f6e24-5921-4a4f-b617-71b2ca31e51c", "comment": "Malware payload (SnakeKeylogger)", "value": "1dd0293245d2df36d66d73579885b4390b233eb5d745ec67e849c7683f5f06d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876389, "uuid": "ae1a1808-927c-4aa8-8b7c-68764ae694ed", "comment": "Malware payload (SnakeKeylogger)", "value": "4c559f86439554237d7ed090fe524084a811422b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876389, "uuid": "8df67919-30d7-448d-b284-386022e1a435", "comment": "Malware payload (SnakeKeylogger)", "value": "776ee0810534f703a61de1fb27200750a8e86a1159d5b0b3212451060bbb84240dae220eacf617342b05881630ccd454", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876389, "uuid": "b82cbc9c-003b-445c-b005-9b37f403d5d9", "value": "T143159C5977B4A173F88B01FE6838278C2D3035177619E22FA777BB91A2719FB7294201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876389, "uuid": "ccf39533-7de5-4d63-82fb-daf024333f3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876389, "uuid": "69528d25-ce0d-455c-8582-1cda03c3d21f", "value": "24576:HKMSLAGK9xrDE6bH+kDf4AMdrwXwd2Huue2mWy7IL:SJKrrYeH+kDf49drwAMHuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676876389, "uuid": "fefa31dd-ea38-4a92-9b63-16b37af0348c", "value": 953344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676876389, "uuid": "2cbf8abf-6d68-4e7e-ba87-f0722af64d22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876389, "uuid": "9dc90255-c0e6-482e-993d-e9955d2b4b45", "value": "#90031-8OkkR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de52576-b0f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676879428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879428, "uuid": "d2066039-2408-4415-a724-4a51b1b4f887", "comment": "Malware payload (RedLineStealer)", "value": "b1de04e954eb77d68e4f7c25dd7ba8c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879428, "uuid": "13ea23a3-18d7-4b3f-b079-53c4586f7595", "comment": "Malware payload (RedLineStealer)", "value": "1e0ad8cf6e716ae54e58580a9a9a97bc131f3131723cc0b80f85163943ed8ad9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879428, "uuid": "2aa1a5ce-4b79-49e0-a187-d9232c4260b8", "comment": "Malware payload (RedLineStealer)", "value": "42a61a2aa0757f09509c60c2d3593247afc4c4c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879428, "uuid": "13759bd7-9f18-4679-ad3c-d8f25cc876d9", "comment": "Malware payload (RedLineStealer)", "value": "7a3496091acbcdace1a83976daea9bd9b25e41f7cb2220d900a9a3ef384725f64582fd2d0af7f8aa80da8d6fc3d505c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879428, "uuid": "42ae46c4-ae46-46f7-8ae1-11a41fe00e19", "value": "T11014D012B1E0DCB3C0DB6434A470DBA06DBEB9314267D58B276416EE7E707D2A376316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879428, "uuid": "6e5ba972-21a6-47ab-9162-8a350ce9a5b8", "value": "c33891a90cc721ae1c38ffdfc19c51ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879428, "uuid": "292d8222-df30-43b5-a80b-fbdef2d5d0c2", "value": "6144:9sUfMYLct6PzkkMiwA5KNIcCvR3bAL5Kb:9sbYgt6P0IcCSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676879428, "uuid": "caeeeeb5-3582-4f11-810a-c453bf88b35c", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676879428, "uuid": "91ff839a-abee-4a91-b8a7-e17eb791099a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879428, "uuid": "7204fbbd-3a16-4b70-81b5-f328a7b7ad5d", "value": "b1de04e954eb77d68e4f7c25dd7ba8c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da6e406-b0dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676869978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869978, "uuid": "27863efa-2215-4262-b32c-d14862975423", "comment": "Malware payload (Mirai)", "value": "676ceeb3f330a4b02c7be924258e1778", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869978, "uuid": "16b315cd-faf5-4ccb-8529-2598a9ec1947", "comment": "Malware payload (Mirai)", "value": "1e8e7a5086832b931e8d1c834c9e0dae158834744abbe73dbaab56206702ca35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869978, "uuid": "2cd9d696-7c14-4d01-9291-56d68f85b66c", "comment": "Malware payload (Mirai)", "value": "9927a66cbeeedec7354e0f35c984f1e8b1ef15de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869978, "uuid": "610597e2-cf1b-44c4-8ff0-4155dcad3636", "comment": "Malware payload (Mirai)", "value": "dae664a6e1b3dc8165d6111d75d2cb5fbe1743c70a8f72bbbef50a9baed331ba834bfbe4ccba3c33ed0d68eb8d66459e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676869978, "uuid": "cb7f156c-0b64-4ebe-82e4-5dd05707455c", "value": "T1E5539FA9C5B8AD99C7698678F704C4399723900465A33DF6D741CB96D00BEECF10DBB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676869978, "uuid": "182e4b07-9ec9-49ba-a5db-3fbf9f9e2251", "value": "1536:V/biduhunmaywt4wZucosUz59S1/6Pfs3QV062119jClO2U:VjiFmRGZGz59rf+KS119j2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676869978, "uuid": "92a7e075-5847-4674-9db2-0b3613a8e76e", "value": 66368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676869978, "uuid": "2b98fd31-9bc4-4494-ab77-f0058833dfb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676869978, "uuid": "6f37679d-d500-4a61-bb9c-b29936cc99dc", "value": "676ceeb3f330a4b02c7be924258e1778", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0baca5e4-b160-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676926158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676926158, "uuid": "869af5db-9282-4b3e-b1aa-4c4e26c00487", "comment": "Malware payload", "value": "a685e87c7bd895694deaf82b4d9dcfac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676926158, "uuid": "994bc742-f39c-42c0-991e-1fa172811670", "comment": "Malware payload", "value": "1fbe552d47b6b7a2ec61243244ffb26c31851caa79343e6317a3f123c9640b0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676926158, "uuid": "ed89b1c8-7d53-4d31-b005-59140d88b238", "comment": "Malware payload", "value": "821754693a64c0aee25f4244e4f54a9064f24040", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676926158, "uuid": "4874ee45-3b09-4be7-b70b-e92fd5ea1a2a", "comment": "Malware payload", "value": "f47b992c2e6034df07843ff201cf436025f60a41b81c75a7f1bd484cf301c90a5be8242ef1ce0ea09cf776e6351a0e9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676926158, "uuid": "a9af0100-8f03-4c59-8ea9-18d86cfeb98e", "value": "T1D13501546EA88E55D63B43F4506243500FBADA3A9511EE4C2EF7B2CF6873FE181C16A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676926158, "uuid": "053a9844-d09d-48a8-90b8-992706064d73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676926158, "uuid": "26e3aded-60eb-4f36-a30c-86e7034ab2ce", "value": "24576:d1QwWeJnAcfN6cbz77l+OKPb/zOQ2LOjWrIFrYEB:dxzNcc3709LDtSrIWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676926158, "uuid": "8e7e4faa-da32-41bc-bb76-2e142b657515", "value": 1098752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676926158, "uuid": "16e29171-3a39-4f7d-af1b-3f76303bb3f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676926158, "uuid": "422fdf6f-09ef-4af4-b07b-0a1e274e8dbe", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0fe375-b0f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676880039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676880039, "uuid": "11ee9d8f-cf9c-48b0-8a3e-553fab1dbd09", "comment": "Malware payload (RedLineStealer)", "value": "fd693b6a13f4ff5f621cd5944a3fb047", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676880039, "uuid": "58de9cd5-f512-4d54-ac9e-cf7cb4148d78", "comment": "Malware payload (RedLineStealer)", "value": "2055132738e70e6401b812697c3111beb6a7e091e1cbb29b5cd7dbe23f7df068", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676880039, "uuid": "c7d2b842-fcf1-4fc9-ae32-eb2eb02464f5", "comment": "Malware payload (RedLineStealer)", "value": "128fe54acd2921e44e5b9dbb2f37d82f890cd62d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676880039, "uuid": "1cc3a0fc-940f-483e-a139-db5c3c194ffc", "comment": "Malware payload (RedLineStealer)", "value": "8125b3022ffe897dd424662fd438e7dfa565583c0840e73d59a380cb514e2ead085fbdb46041596dddadeec51a0198e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676880039, "uuid": "6a1ba90e-cc89-4647-b87c-5901178aec8b", "value": "T11B14E01AB5F0C0B3C55B5078A4A0DBA05EBFB9321770559B2BA8272E0E347D197B731B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676880039, "uuid": "029f80ac-9b46-4e58-8889-89a20b796515", "value": "c33891a90cc721ae1c38ffdfc19c51ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676880039, "uuid": "b52ee22b-4938-4556-a0e2-c705595af7b6", "value": "3072:11URNENcaLw1fcFP4UMsCPZbwYV67izjY1SXntC8WivFEtNZqPjgeL4zztBS:1aENcaLbFPzCPP67KjY1GtCj5UPUzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676880039, "uuid": "449acecb-00a4-4b48-bb38-f7fef5f7f4b0", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676880039, "uuid": "5e469832-f691-4368-9cec-3fab12eced89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676880039, "uuid": "55925d3d-b3ef-4e45-acf1-557a0d22f6c2", "value": "fd693b6a13f4ff5f621cd5944a3fb047.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee672ac1-b114-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676893897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893897, "uuid": "896e0b41-f450-4d2c-b806-27ec947639fb", "comment": "Malware payload (GuLoader)", "value": "68701beab3e2c1b933d03d42faabfcda", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893897, "uuid": "81deed89-0bf5-4c10-ac96-ff4b0570adb6", "comment": "Malware payload (GuLoader)", "value": "21300065a6a1af05ff83ef575b6397ae756d2c4de0fbffe5195ec73b2a5a1ec2", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893897, "uuid": "09b83159-8685-429e-bc8c-bada96bd14f2", "comment": "Malware payload (GuLoader)", "value": "da4d0e4f85debfa8aba90475975d8d10c1e95c3a", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893897, "uuid": "ef2b8202-c239-4e03-8e27-30fe9f25bcef", "comment": "Malware payload (GuLoader)", "value": "6f1c0f3e89a2c26e8596624024a5725b4dc5e7fadc248dc43d4d34700ecbbd8f69982f0c845e486857da6501ed1bb64f", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893897, "uuid": "0c708ad7-d54a-4064-ba33-64eb3084f7c4", "value": "T15DA423FF9DFD5F6E4258D843098DFE5B5A789CFE22685E73084D051E7A22420940BAF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893897, "uuid": "e9f2320f-4961-4ca0-a4e5-dc184eb32266", "value": "12288:968DbmRX7ZrtUQcnYcr4GBlrXhVzLKtdFdm5:968nmp/OlrXPIHdm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676893897, "uuid": "41e92139-7655-475a-9bb6-62b16531687d", "value": 456127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676893897, "uuid": "b9898b2a-1059-454b-9959-032c3cdb850c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893897, "uuid": "5cc56d37-7588-41c8-927b-3c06c0ada416", "value": "SUPERA\u2019T SANT ROC RACE_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12313a71-b144-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676914143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914143, "uuid": "093a8ddb-05c4-486f-af79-64118edd391f", "comment": "Malware payload", "value": "759d318a050b6c76fde3263640604559", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914143, "uuid": "e4beffb0-e847-41f4-8bd7-db65a14303ee", "comment": "Malware payload", "value": "21f969b6030a00e4a0cd7bfceb3b4cd79f151d5927a63d3504b1bde980838a4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914143, "uuid": "fd75056a-7228-4cca-98fa-c22a4566af9f", "comment": "Malware payload", "value": "1b4eef994aeb3aa0cffb7ede3a4a521a705c036e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914143, "uuid": "3fc5d64b-786a-4656-afeb-0fa769d5e434", "comment": "Malware payload", "value": "139c88256ed1a33faacf9761f8cbdb17d7e45fc590c3497ba43a5641822bc175af300006af90489296cf9682e279bc36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914143, "uuid": "39e4b09c-2112-4475-ad76-2f013b5a9a89", "value": "T1E4545B21B5C08032D57334314624E7B38EBEB8301A656A9FA7DC497A5F74681AB35B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914143, "uuid": "3df0df2f-ebbb-4475-b44d-515d5e04a7d0", "value": "13dd3ce53141e37fd4aec99d2b6c6f40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914143, "uuid": "907cbe5f-2c68-4f1b-b87f-92348ebcd638", "value": "3072:2XbyWZGMLdl9NymIoOMYLLdzQnDO2CnaiPkff348wTTqalttzh5YA/oYiagFF6TZ:2jZGML+xY3LwTTRDgVYiaqcdJoc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676914143, "uuid": "fcdeca9d-db24-4275-8e1b-2c1d54121406", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676914143, "uuid": "bbb50297-eb51-4761-b7a5-b9e8aca51ffd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914143, "uuid": "bd4cb4f0-0135-4d52-8e16-a3f13aa1305d", "value": "SecuriteInfo.com.Win32.PWSX-gen.27358.29538", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6788d37-b0c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AZORult)", "timestamp": 1676860812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676860812, "uuid": "d79d45f8-72c6-4ca7-a45b-51dc9a4ca893", "comment": "Malware payload (AZORult)", "value": "591d27cba331998bd10c439eb9b9bff6", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676860812, "uuid": "31175245-8496-41de-aeef-b045758faec4", "comment": "Malware payload (AZORult)", "value": "2478400260643c60b4fdd52aa2492e4bcdee59ebb8b1587e0c46cb6c9442de61", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676860812, "uuid": "a2a52a2e-5d64-4a3a-8e46-28a06e1de105", "comment": "Malware payload (AZORult)", "value": "0b0d21d5dbda1897c3d15968d6740ffd96c3b565", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676860812, "uuid": "a76ff3ce-8a04-4259-af57-8c77df54a2e3", "comment": "Malware payload (AZORult)", "value": "d1d7c2e4f43206cb9e1da6e57017880d2aa66c9e4637eb4145c9e4ac50979754ea5594e505b3c5d9da5b999cba104b01", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676860812, "uuid": "ecdb1b0b-271e-4227-b300-af1e32058492", "value": "T1E33402803759C0F7ECD326312A3B5E4519EBAE232069250E1791BF9E7E73242A91E717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676860812, "uuid": "568b2ef3-9744-45db-878e-8f2e5a088d2d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676860812, "uuid": "e576b319-a2bd-4f44-a7dd-f1b286e43f1a", "value": "6144:wYa60BcLtB9yf+9cOV2WiTr9u0Y7bdB8y:wYthX1SO7if9u0Sbr8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676860812, "uuid": "f2eea1cd-fd77-44db-be54-e75a13694b21", "value": 235288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676860812, "uuid": "a4562d75-e46b-4ff8-9468-c8b7015fd9df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676860812, "uuid": "b22cbb87-5112-4ff1-afbd-598675d23695", "value": "591d27cba331998bd10c439eb9b9bff6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a7c77a-b0ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676877216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877216, "uuid": "9d362e95-d487-4223-a7c7-f88576da33de", "comment": "Malware payload (AgentTesla)", "value": "b5feb67f622e1572bdac818e8e53ea37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877216, "uuid": "f9446902-df69-4756-b81d-b8d1dde284b7", "comment": "Malware payload (AgentTesla)", "value": "249dc777ba06394d03cd265b4fb1f0fdc5063af5434102c2e23daeb752d59cda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877216, "uuid": "b9cd4865-0eaa-4f29-86d9-98bb1f388a15", "comment": "Malware payload (AgentTesla)", "value": "89a7f7d20ffb3aa2a7ed2e65343dadc0ec095160", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877216, "uuid": "8dff614f-01b2-44a7-abd3-173a0c70f085", "comment": "Malware payload (AgentTesla)", "value": "bef806f31820fead6e9f85d27e6d1a32341006f6e89bea71fad3c9098d9c8d71c77cad9d540b573e275ebc4a33a25454", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877216, "uuid": "662f501d-36f7-4096-91a3-3948717af775", "value": "T12E329D3DD54EE420C972C178709913F6FB498616A663C13AB867F8E9C8645B7033EB8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877216, "uuid": "48874130-1ded-4698-b50e-62a06b298ff6", "value": "192:CtNCWUyn0i13pNXqkOcPiYFLwzvdX6Ptpwjnw+umHBCQS5VJg9:aNxUyn0i13LROEiOLkX6Ujnw+3Y5Vk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676877216, "uuid": "d42d74c9-b7f7-4bd3-8830-bbfa07cd7488", "value": 11801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676877216, "uuid": "7bac3eba-76c7-4b8a-a119-bd105eb0fa61", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877216, "uuid": "186b2f87-3dd9-40ec-b77d-222155af33cc", "value": "PaymentXAdviceX564302.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55759e9-b112-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1676892915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892915, "uuid": "64a9530f-ce8e-4d94-b3c9-d4b020000c7f", "comment": "Malware payload (Rhadamanthys)", "value": "4f201081c84cff8d1da121e9bd663081", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892915, "uuid": "112889c2-9c61-402d-81e5-e0ffa5baa6b0", "comment": "Malware payload (Rhadamanthys)", "value": "259a26dbfb9e5e37b078e007d5cf4a7552cba457646c3c7da6a506f99fcbc2d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892915, "uuid": "dfe09475-eecf-46e7-9d6e-7f0aada1089e", "comment": "Malware payload (Rhadamanthys)", "value": "c58a44b848ad53c371ea6064ab9e84d12a8c040d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892915, "uuid": "04dc99ff-7d24-4e9d-9786-2c259fc52918", "comment": "Malware payload (Rhadamanthys)", "value": "39b2718b73693de2a9f39afad108a5aa03b5efefcdcb9f163a4af2d6edf54482cbbafea02a7bd9922a597e5396ba0018", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892915, "uuid": "12f065ca-2e90-4821-b513-128eee6da86b", "value": "T11965F19AF863A519C237AFBBF42453C0F1585DA5F75E99DA33C614321C2F4B328A1293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892915, "uuid": "adf7597a-fc14-4c70-bb56-ad0f479af68a", "value": "4a43ef13050d45ae61812b2997033821", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892915, "uuid": "551355f7-ec5a-4778-9b22-517ede7aa206", "value": "24576:u3cyHN7H5jj7nr5SRmKyIFH2CZCT/xDQv5tBhqfDVGNClrbI54Bj:wc0Rlj74Mc2I5zEtJbg4Bj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676892915, "uuid": "95be1003-f9eb-44af-9b79-81a32e41d52f", "value": 1428512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676892915, "uuid": "b7461d0f-186b-4205-bd9b-e3a36e748727", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892915, "uuid": "1640f297-c406-4bab-b7a0-291d62e50126", "value": "4f201081c84cff8d1da121e9bd663081", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2080ea-b0da-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676868689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676868689, "uuid": "7bf830d3-9c5d-41e8-ae13-239e37c148fe", "comment": "Malware payload (AsyncRAT)", "value": "8451dd0e08063bc87557a211e161b5eb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676868689, "uuid": "42184977-4f76-4baa-bb4d-f87fdae01961", "comment": "Malware payload (AsyncRAT)", "value": "262dcabfeea27988f7638430379c17d78144f20f1b0ea6695e9a209b16ae2bbd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676868689, "uuid": "0a1445f5-3858-4aa7-921c-89367ae68ece", "comment": "Malware payload (AsyncRAT)", "value": "ce63c4d872e34e88442b87a63e751c095b9b9bcc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676868689, "uuid": "ab077091-abbe-4a96-bf2e-3f718276e2f8", "comment": "Malware payload (AsyncRAT)", "value": "e75f96af1967d773ab3794724c16434e79628a006fa50b9c507b48b11937ed4ff234edda05f6f93d14ee12b8c1125b84", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676868689, "uuid": "26e01f39-27cf-4f0d-bcb2-15856ba164f0", "value": "T18A14DCB5649AC99AFE1BCB40B2BCFFA154F171B399C91E20133C5504CBE9FA52E4814E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676868689, "uuid": "a40b925d-3386-4da7-869f-ef2aed0f8730", "value": "1536:rO2D/5qj20Bgq2NlqRnr+KWhfes/bpJXEXtXX8XZXnd6I8p85NjxxDb6Kj/EfbOC:rO2Mj90a1SebvCowmGcAe3Ap0Yt/QIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676868689, "uuid": "9b428f8a-08a7-4910-8dd4-13cae84b262c", "value": 206749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676868689, "uuid": "dbde786d-3d7d-4536-bea7-d98c4e3383b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676868689, "uuid": "c9d73f30-53d5-4f98-8e81-0607720a4f84", "value": "uni2.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc970fa-b109-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676889009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676889009, "uuid": "13974188-cf4c-4e65-9254-80b14b6697d9", "comment": "Malware payload (Loki)", "value": "bebfe80156455464fd3d296dae2e55b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676889009, "uuid": "0dc9757f-63c0-4718-8abb-c5ddf9a9aae7", "comment": "Malware payload (Loki)", "value": "27581ab44d1ea9116059d6d244296669e618e9d82b85d3b8fc699401ee244bc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676889009, "uuid": "364decd1-8f1b-42f8-b977-81a49be4f33d", "comment": "Malware payload (Loki)", "value": "6414860f3b334684fefbc8a8f08393368367ad25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676889009, "uuid": "d7911329-db1c-451a-b210-8df7a9277250", "comment": "Malware payload (Loki)", "value": "a6fbe42316f65c2f4722c7ac90bc4951ccba9b49c8facd26a7b8131cb3a94ebe3d8b59a70e385d3f0d6609cb1b70609b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676889009, "uuid": "0129f9de-fb7a-495a-b678-757c6a88255f", "value": "T1B54412066765C953C8F20B31CE388D6E9FF1BA2E35A1974B3704094EBE77682D55E702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676889009, "uuid": "1a768df8-05de-445f-97f7-54d92378648d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676889009, "uuid": "da28b638-ea4a-42f4-b4bf-a7b5e88b6bb8", "value": "6144:/Ya6zCz6TUhqri7HjLSQyEvAkzf9Op9CHK1C:/YZCmT0qrOfSzEvcCHKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676889009, "uuid": "b48e77d0-e79f-448a-844a-980b88293ab9", "value": 273683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676889009, "uuid": "11838af9-f1f6-454e-b94f-937590f55a6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676889009, "uuid": "b0d9b960-c9f3-4439-8f50-7a9ce8d69766", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.15914.21189.18233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c722f6d9-b13f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676912300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676912300, "uuid": "475b40fc-95ff-4ed8-8da7-8ec03eb62fae", "comment": "Malware payload (AgentTesla)", "value": "0a2fae4893137c16d7a313604842ad14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676912300, "uuid": "aef257ad-c8a9-4809-abe7-a41274a2c193", "comment": "Malware payload (AgentTesla)", "value": "281bdfe292c51e9d9141698bc95cac545d7f83c908ac38d1e9f69b76357c8d81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676912300, "uuid": "672ff148-8ca0-42ab-8571-32432c0c8353", "comment": "Malware payload (AgentTesla)", "value": "921953a143b5271894845c7d597dc257c04d4070", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676912300, "uuid": "ec14976c-0138-4023-99a1-4289a387e662", "comment": "Malware payload (AgentTesla)", "value": "95fda6d59b502254b58289f9151d3925e361db170fe6508627a381c5cfc3986a86f9070a586f9e48ad901991943297ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676912300, "uuid": "f99a919e-1c3a-43c8-8af0-46bca07eee3f", "value": "T12D25AD9973B45473F4CB01FE683827CD2E2026177609E22FA777BB92A2719FB7285141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676912300, "uuid": "abd5e178-8a0c-4a6a-95af-1a204209f185", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676912300, "uuid": "59e13f43-9112-43d8-8c1c-5a0a00009f37", "value": "24576:IpLJec9I6pr2Jb85dmszSzEI5MnmWy7ILQ:IpzFRdb+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676912300, "uuid": "fbf69d3a-e629-400f-8891-ca9433622ce1", "value": 1050624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676912300, "uuid": "ee667de7-89a6-4daa-b25a-eb2b58350301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676912300, "uuid": "e6a191dc-dfd9-4f1b-bf59-ec652836c446", "value": "0a2fae4893137c16d7a313604842ad14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3429385-b100-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676885181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676885181, "uuid": "fb74f0ca-9420-4529-9618-f4e565020801", "comment": "Malware payload (Formbook)", "value": "d8c0a87411ad78db78b7eeae4944d0ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676885181, "uuid": "5638822b-a71f-4c10-af5e-837cb92ec978", "comment": "Malware payload (Formbook)", "value": "294a6483b66178781dd80269ed44df06ae73e3703edf116e0a92889250725c84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676885181, "uuid": "26470344-fd39-4eed-991a-f1801f96c4e4", "comment": "Malware payload (Formbook)", "value": "d5dfbdbde0e5c7634bbb0182ae6e378f17da38ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676885181, "uuid": "f92d3fb4-a758-48b6-8ef0-6bf417a0e98e", "comment": "Malware payload (Formbook)", "value": "1aa48349ecb5d6da3e4c14aa176dd95bb930503f0cbdf9c42b9828f5bbdffb4b43bb8f6f7bdd6bd253cef3e53c052f7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676885181, "uuid": "fdb8e7f5-e5bf-4d69-a95d-8f4f74a81528", "value": "T17C35AE19A7B0D6B3C58B01EF18385B4D39A435877619E22C8FB77FD192709BB35A9203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676885181, "uuid": "c1fbd1d8-3452-4988-9338-92e635466c6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676885181, "uuid": "ce168c28-eca3-4c94-8561-e07d6d463e0f", "value": "24576:cze4yZ1jIe0g6KA8jHxRiDOTv/xsmJZSN7wrYE:6+t8lKJjTiDcxs1hvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676885181, "uuid": "46be7aad-ee9a-4164-9238-fff8a8b8bb3a", "value": 1070592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676885181, "uuid": "c5f0445d-675e-4275-9ea2-9996c853b5de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676885181, "uuid": "57bc98ff-990b-489f-b2c1-a06c98f2246e", "value": "20022023_06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d490987-b0de-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676870514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676870514, "uuid": "2a05095b-d554-4aed-8b26-20a4e9d146c9", "comment": "Malware payload (Mirai)", "value": "6f7ac2f150503a938155d1b31648237e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676870514, "uuid": "b90f2037-c53f-4eb0-b1a7-3c48c3d92fbb", "comment": "Malware payload (Mirai)", "value": "296d43803e0582a21fc17938e407c877b8cf0be360dff08ef290767f7d7aa1b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676870514, "uuid": "bff7bbbd-5e34-4210-b883-a210e193ecca", "comment": "Malware payload (Mirai)", "value": "bac66c29708953aa75bf505cc977fa4df2d83f2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676870514, "uuid": "124c2ae0-b062-44e3-82bd-b04aac3c3d42", "comment": "Malware payload (Mirai)", "value": "847b99e33e942aa52b8eb0b6fe5861204ce06ef9a09f00a761b8ab507a68bab8194368fe395f91b096d1053b4b9caab5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676870514, "uuid": "b9bf0df8-f9d8-4926-b0d8-8319c91336b8", "value": "T12AF2F123923DDBADCFF51CB3F4A18E435E392AB8C0BE792A184501486D975872E94DC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676870514, "uuid": "04c5b57c-9ca6-44ef-8308-4d120a776894", "value": "768:EDkZSMYAP/UuPBLqB+3wsuey4IEUA2CH39q3UELCf:EiSgfLqog7evlUA2sGL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676870514, "uuid": "ffa938a0-fd65-46eb-84bd-9c831d94e0df", "value": 34724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676870514, "uuid": "0633d26a-30b4-4494-a315-16b59cd33189", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676870514, "uuid": "9fafb9a6-2886-4a55-8c93-48a4f82819a8", "value": "6f7ac2f150503a938155d1b31648237e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5362c4f-b11a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676896485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896485, "uuid": "7e3fba26-cf25-4021-9697-236ded579a12", "comment": "Malware payload (SnakeKeylogger)", "value": "5322d36b63fd50e9a49ebf45f786c501", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896485, "uuid": "e396afd1-e514-41a7-a9cf-8bbe07e594b0", "comment": "Malware payload (SnakeKeylogger)", "value": "2a16f2ee7eee4dc583d3d36d3b119d4b10000dc7cbf7d76650558bf6c9448dcd", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896485, "uuid": "01b8e1b0-5ebc-48d5-97c0-ba1d2a8ffc80", "comment": "Malware payload (SnakeKeylogger)", "value": "09ca91f9ef51d9102eac3b9d828a6975174dc9ea", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896485, "uuid": "aab8c700-a479-401a-8d69-30ff9ff6017f", "comment": "Malware payload (SnakeKeylogger)", "value": "b2d67af031d296a5c0722928114a5f832211f64f2fb49d52eb16b4fa4444417507b9a4f3303cfb295561f6148a249570", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896485, "uuid": "5520e911-9937-446e-879c-9476004bdfa8", "value": "T1AD259D19A7B0D6B7C58B01EF18395B0D39A435837619E22C8FB77FD192709BB35A9203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896485, "uuid": "27bccaf5-894f-4a45-9d21-51df3155d421", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896485, "uuid": "549f21b0-7d29-48ce-a881-8d966c527a5d", "value": "12288:ym8De4y7raeyUUH9wvZj2iNqaTOEoCdKtoiN6trHHZdyBxnWyIIdRO1OAlfxnXuv:yzK4yZ1J6EbQo2cZMnWVIOHdlrYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676896485, "uuid": "cc554ae2-72a6-4de1-9db8-1be41315a326", "value": 1008640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676896485, "uuid": "1d2909a5-7373-402a-810b-27cb34e076c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896485, "uuid": "f32a35d1-7a78-4168-86ef-3f98500d836a", "value": "DHL-AWB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb852bd-b13f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676912287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676912287, "uuid": "f9d1e124-1a5f-4cf0-a6ca-944469d2169e", "comment": "Malware payload (Loki)", "value": "4dde4a9712c7dbcdf14364de49cc587a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676912287, "uuid": "34ffb5a3-ce9b-45b5-9795-d40c7fd96935", "comment": "Malware payload (Loki)", "value": "2a25f858af11a6daf29dea208104dbf8e20809ef495a66514a2b842edf7a6b5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676912287, "uuid": "a44e4749-66ad-4d95-8598-f0eddc9e98f1", "comment": "Malware payload (Loki)", "value": "fc783a7fe92c3fb55c656d180e305f3d28bacdff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676912287, "uuid": "58459207-2fb7-4ff7-b1e5-bc2f4f6dd259", "comment": "Malware payload (Loki)", "value": "e359b9858f919eed62dbfd39ed444771713fc4a022b4c13d2734fbf8a566104a85bc86e04fe28fcabd3c4df35e208780", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676912287, "uuid": "3fd81779-b8c7-4fcc-8c95-373d5903185b", "value": "T19C259D59A7B4D6B7C58B01EF14385A0D39A435837608E26C8FB77FD292709FB35A8243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676912287, "uuid": "1350c223-2fae-41e8-91b2-9420e711b76c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676912287, "uuid": "b3963ff9-5c99-4615-9ee2-422ece67dff9", "value": "24576:mg24yZ1B1xhDvzB+2u1TZ8gpn8StL/X552w+rYE:TmL1xBvFMZ8gpn8QLX5IwZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676912287, "uuid": "aa022d28-8314-42be-9282-b5c0b1d5b50a", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676912287, "uuid": "6b897a36-bc15-4e5d-9348-5b60be1f167a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676912287, "uuid": "65fc59f0-d559-414c-b190-47b0b0e7af88", "value": "4dde4a9712c7dbcdf14364de49cc587a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918b2a5c-b12b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676903620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676903620, "uuid": "6b71c14e-03d9-492d-ba5b-eeaff88bc64f", "comment": "Malware payload (AgentTesla)", "value": "4a74936569d06df7ea9e8de1edfd2d27", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676903620, "uuid": "324fd956-378f-4044-bbd9-95269e81580d", "comment": "Malware payload (AgentTesla)", "value": "2c45c336dbc1249e8ced653664d34a55e0aa0c8ae834a397d78a8db20316e376", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676903620, "uuid": "801d12f7-7100-4c7e-b70d-93c074dc9670", "comment": "Malware payload (AgentTesla)", "value": "41e3c9a8f5a4b9eb829dfc97cccf011cef4d1e2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676903620, "uuid": "f098d2db-017f-4362-ba38-8ad1d7397543", "comment": "Malware payload (AgentTesla)", "value": "4d47a9b041795ef3841cf5670dcf7a2ee85d54625efa24e57e9fd816dae5ba2ad502b8e051ead25eebf6e659ff6d9737", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676903620, "uuid": "295cf3c7-4673-4360-ac14-eb6fe5bb03a0", "value": "T1F825010B7D6C265BDE2C46781C066D94A3F2AE1119B0E5557CCDB2ED03FAB81CEF2660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676903620, "uuid": "c92f12a2-fe2f-458c-b2b3-b18b4591fe31", "value": "12288:jkiA388/T9JmfA+J5iEshz2gGArwClB5RfGHJs6WtAihYFBW1uJK480gWlG2VGxr:jA3BWVQ3GALl31G6ztvhsgePJPVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676903620, "uuid": "0d3213f6-3ebe-44c4-9a1a-6445649a47c4", "value": 985088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676903620, "uuid": "3f2dbc74-e0be-404b-ac92-da91db294840", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676903620, "uuid": "f3b11c8f-488a-4fd8-8957-6fb652105f80", "value": "nOrden de Compra 20_05_2023_OC-2726_pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf851d1-b14c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676917624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676917624, "uuid": "f9e6af50-1160-4e88-b9e2-d4f782afb333", "comment": "Malware payload", "value": "c3c0999b81e0c2043c8637c23173dd12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676917624, "uuid": "76a816fa-ccd0-4d01-982e-468a567e4d3e", "comment": "Malware payload", "value": "2ce8accd471d756bdae68b6a47ccdd8dd88953ed7e45dca1794e329286e92ec0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676917624, "uuid": "bdbdce4d-c8bd-4e3d-96db-4b7553092c9a", "comment": "Malware payload", "value": "58a3505b7c32a8956dfe595afec15d663751a2af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676917624, "uuid": "bd4f5dba-590d-4d68-a7a5-21159f2907db", "comment": "Malware payload", "value": "157ae0146ef46a45b3cea58873169f719c34f25a1dfb09f2387aa3d5fa5fa5ed85a1c353924b464e6964343a2702639c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676917624, "uuid": "6b716436-5ca9-4119-8d29-2fb23860ffa9", "value": "T19075BE5ED9B35F8FD6295A38940E0E023026C7C598BDDB496A9BED3C319058FE379231", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676917624, "uuid": "f7730ee6-5689-48df-876c-fe9d79342ddd", "value": "24576:qb3z8Rb/vfR0T7Gz2JWXBWTAcCrnAS7HaCV6ZPh/wFWyXG6Cw5lKudy+:DZnmT7iwZKnJ6CV6ZRwA015Tdy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676917624, "uuid": "51ef1c0c-8deb-41b7-8074-c16da02511c1", "value": 1567232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676917624, "uuid": "e4334360-ffcf-4439-8b1e-68625374469c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676917624, "uuid": "af9f2af9-5fcb-4050-bbe4-832aa04cbc63", "value": "PI160256.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe33e88-b0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676859916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676859916, "uuid": "64753ea6-7be8-421c-8d10-02eb3ffa7341", "comment": "Malware payload (RedLineStealer)", "value": "44455c6a40f63cfcb7f855f15bdfbd91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676859916, "uuid": "964963ec-4e3d-49e9-86cc-5c22237db245", "comment": "Malware payload (RedLineStealer)", "value": "2d4b90a306bea6c000b93106d5d831999a39ff693f608504ad4197c1b720aadd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676859916, "uuid": "0e76b666-1565-40ad-abfd-3126246a22ce", "comment": "Malware payload (RedLineStealer)", "value": "8ea560a29d689bbe4c9a25a14ef14c09eeb25e68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676859916, "uuid": "cb384b53-6993-42fc-b7f1-612282841dff", "comment": "Malware payload (RedLineStealer)", "value": "768232edcb52dd290bd9fd25d767e99b0d191f73b149b8caa8ab65eb597b08990d2d057d328cb490047eecf5d3ca4247", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676859916, "uuid": "ba4edd02-6d04-4b92-8e2c-b16d4aa6f1af", "value": "T128D6233FF1146B2EC63A8A7709B786202C7B6AA6ED474E0B13F4180EDF615512D3B527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676859916, "uuid": "980024dd-b6c7-4427-8500-c396190e7e3e", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676859916, "uuid": "b95a8aec-e2df-4f8b-9da1-888485c4a3ad", "value": "196608:wRsq5pwrR+j3J3p7CfaohovcWTNOPpSOU4FlK3rjofNx3edZi06H8yQ7D2pe6NHT:mvi4V3p7waoVgO17Ej03gZJH7KpNsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676859916, "uuid": "4f3571cd-abe4-4f1f-8e62-c7da8a49e759", "value": 13481041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676859916, "uuid": "35a5e715-ed13-4908-a35a-5e47e1840ba4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676859916, "uuid": "f7a9b1e5-3e47-431f-9136-1cd2e8dcc5e8", "value": "44455c6a40f63cfcb7f855f15bdfbd91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3111852-b14b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676917527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676917527, "uuid": "954ad099-75ef-48a1-95c5-a70f85ecc3bb", "comment": "Malware payload", "value": "dbdedb94a0084d768a2c3f0552ae0384", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676917527, "uuid": "2e2f7221-3a15-453a-bf40-fc3544d76f72", "comment": "Malware payload", "value": "2dcb9b38743ec00f0b9b7e7056641270d4467ceabbb30553e00da7ce3d67e552", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676917527, "uuid": "868fd75d-9b48-4761-8556-841372a34121", "comment": "Malware payload", "value": "db314f6a0a2a2ae9c0c8d3b79d19ad01593bff26", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676917527, "uuid": "5fb39bbc-fea5-4c24-93dc-3f30a87c83e4", "comment": "Malware payload", "value": "e3898a0b91517e20a9c59dc9a45011c66fbe055bbd4aefb1eee77e49b7c47a398f0692b186559b4bc5254909fc5b61a4", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676917527, "uuid": "dff86f96-2cd5-4a4f-bc51-8f3d4631ce1a", "value": "T14D1533421D3F4C26EC170678DC7E0767484B06EA399D7FE9DCA578B06AA3159B086CF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676917527, "uuid": "698be50f-8819-453f-ae9c-1ee684cf1dce", "value": "24576:6ZlVDO15mqU1FnaoRlXbUEwtzhDd8u3jW7YAMXPC6n/r:WdO15MFnaobXbxeRr3jllPCq/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676917527, "uuid": "137f3afd-f8da-44df-a9f9-0b057e5c880d", "value": 930092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676917527, "uuid": "e6dea4ff-005a-4a3c-8638-efeb72d9fd33", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676917527, "uuid": "8fccb79b-da66-44a0-ae64-66417179aaa8", "value": "INQUIRY DOC.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c96b2ed-b150-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676919449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676919449, "uuid": "1f93c33d-75fb-42a9-abb9-abf09f5099f4", "comment": "Malware payload", "value": "cb46f6416d81e8b6a10f7109eed913d4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676919449, "uuid": "b604aaa2-c72d-4190-bdfb-814ab918616b", "comment": "Malware payload", "value": "2def3d93ed12bff31512449e684022591f743ad5d2f9cff198fda7620223c5d7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676919449, "uuid": "51fe859e-1631-4cec-9e26-d00ce1eeb4d1", "comment": "Malware payload", "value": "abf31e97105f38f60adc842de68dfa3f499b8975", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676919449, "uuid": "6b4c4972-348e-4347-8a6a-acbc3b919860", "comment": "Malware payload", "value": "b0c7e55461afdae5d66fd81a4f82bbad863a80f1675df3a6a645bc6798700721119b64a401f7038df0ca39152cc95eba", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676919449, "uuid": "838f0a13-bbb4-4ea6-ac29-52a5b9829814", "value": "T13294231DBAA40C05C07637365E61C834E9C9AF5B800AEE4AFE2363BDD7567045EBBC19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676919449, "uuid": "d3a5d3c7-e775-4d73-94d7-5153ea797b40", "value": "6144:/fBw9k+tq20Llst7viqtbzNdO4Y3Y6bdqKt6fs87FGuJUStC0pRpNKtAaXWZj2:Bwvtq2yst3tbznO3xttZmFGuHc+NKXX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676919449, "uuid": "72e105c8-8ee4-44be-8e93-2b763c64490c", "value": 414111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676919449, "uuid": "c0a11bde-0a4d-451a-9096-cdf080df333c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676919449, "uuid": "0f5461a2-d2ad-4888-aa71-e157e4a32a7f", "value": "New Order Product.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b9ce19-b14c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676917616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676917616, "uuid": "5a791b13-d047-40a2-835e-097964464f16", "comment": "Malware payload", "value": "6c4f2cbe3cfdfb4f4516f940e1530422", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676917616, "uuid": "efab899e-d10b-45a9-9dcf-c211246e14d1", "comment": "Malware payload", "value": "2dfec91f8d0c620ef825d07e70832ece3066d2b7395c03db9ea6f2c6a9f66b2d", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676917616, "uuid": "1a46ef42-0b7a-4d98-8257-2d3c618d292b", "comment": "Malware payload", "value": "6ca6fe753b436f6deabab52583dd6e179ca7977b", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676917616, "uuid": "eac4a4f2-6176-4f19-8746-f4a2ea8ff2c7", "comment": "Malware payload", "value": "08fbac2da3d1a5760e00bf56973f6f1bb0e2feaa268ec5f85a44cd6b407df963382a71f9126e8afd2a55f4eebc189632", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676917616, "uuid": "69be4c13-7a81-41e7-a67e-9866b3922817", "value": "T1AC45333B116430AE1F6DC79E198C6A01126CD5D6E0768767654EF073D2ACDE36EE0B0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676917616, "uuid": "ffaece74-ebf7-4a60-85c0-1f18bddb7454", "value": "24576:Wh/C/rT8dNNt8TBG1BUBw7a9QdwmpWegvr+UZgx/0jpKWgEyeCLx8bh+RcY65iIJ:Wh/C/ch+TB+BUq7a26r+yA0KWgEes+RE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676917616, "uuid": "72d10cac-59f0-42ed-943a-b8bb8a2c2f79", "value": 1223479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676917616, "uuid": "cd88fa01-b9d8-4f13-abae-35dca14de926", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676917616, "uuid": "14476e08-528c-430c-9d81-101c4661fc6a", "value": "PI160256.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a195ebc3-b112-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1676892909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892909, "uuid": "4899fea2-8396-47c5-be7a-a58fb78a0101", "comment": "Malware payload (SystemBC)", "value": "584e1b772abf47e40b94652be9117be8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892909, "uuid": "1e305cff-17b6-4ddb-a325-6eaa9a2581ca", "comment": "Malware payload (SystemBC)", "value": "2e08b9cd0e2bb7ca4a8fdace85c5e80ebab87986ed6541a056ff31bdc272f173", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892909, "uuid": "a2897829-6644-43ea-8504-cdab19a7d764", "comment": "Malware payload (SystemBC)", "value": "b41f90962e9c53617d93be473914364d5a180c6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892909, "uuid": "ddeacdcf-00aa-47ee-ab3d-066c2f4508d9", "comment": "Malware payload (SystemBC)", "value": "a3f8e08ad805d9e3fb42159f15acfbe5d7fda4c933d611178f0486815a9d9d6f92536c15006a359c7b5ae40232284b7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892909, "uuid": "e143eaf6-e5bc-4553-9067-8b4a7a0a74fb", "value": "T1DB25F1545CF874E6D787C6F6C844EA6014326EB02B8647D6B09A8B070D78FD15E3EBA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892909, "uuid": "efeac000-80f3-445d-b8ed-4cbdeef8610b", "value": "4a43ef13050d45ae61812b2997033821", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892909, "uuid": "92c94828-2396-4634-a1b3-616f59490216", "value": "24576:j0YP8i28caNN64mX1LRJIv48/sUmBfHZfunQi:VitXBR2v48/sNBsQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676892909, "uuid": "05783c45-9d55-4655-8e83-fb9cf9fb638a", "value": 1023720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676892909, "uuid": "97cb0994-3683-413d-b1bb-fda6ba90770f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892909, "uuid": "0b938d40-bc3c-43aa-b2df-7e4950f21784", "value": "584e1b772abf47e40b94652be9117be8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d005e9b5-b111-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676892558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892558, "uuid": "328c17de-1c56-41ce-905e-2caa4b9504ac", "comment": "Malware payload (AgentTesla)", "value": "457aa9d8dd3d9db67bfa2e1c679669d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892558, "uuid": "62d13edc-7ea8-4035-aa10-c92d39fc9c2b", "comment": "Malware payload (AgentTesla)", "value": "2e20c341545ea4e2471b61ff7d421644145c21ddbb27623718a45fffbd902dd7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892558, "uuid": "b6a74a0f-81f6-4269-952f-797f5e0b0135", "comment": "Malware payload (AgentTesla)", "value": "8171157e78d214ae69f7c431582ec8b4e8309cbc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892558, "uuid": "d1ecfe5b-0d10-4f85-bda9-aca3dc3eb0e9", "comment": "Malware payload (AgentTesla)", "value": "bdc06bbd45b53848bfa1179c19d6e2b9bac1760d3fb55ed6117be49344a97db032968eb57bedeeab3dec05d7311c3f2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892558, "uuid": "63defff9-48e5-4f1f-b6dd-1673918d9b93", "value": "T1C2F4238AB3715793DDE567F80CAD814843B47A364900F39F8CC936E77966B382630A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892558, "uuid": "93f84bea-7ad7-4f12-ade1-19371778b082", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892558, "uuid": "0b312c82-4260-4502-89cb-52ad5ab71af6", "value": "12288:uGXdHh+rjAx+jKVt961CBDrflKaQ6frpVqg2yaauiMk3MYl1u0QE2aWLH0Yc2l:XX5S88jKT9vr19flVqg2NYsYlnZWoLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676892558, "uuid": "f4cbd49b-6cee-482b-b4fe-4ad4bf9ea678", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676892558, "uuid": "322b656c-809c-48ff-b11b-833f65f76c92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892558, "uuid": "175eff9e-089f-4a92-aa6a-a1fb44f08bee", "value": "P0-9876378-Copy_DOCX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d244970-b0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676859616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676859616, "uuid": "03e2c35f-d415-4103-a89a-b02275fcc82b", "comment": "Malware payload (njrat)", "value": "5c3f86b25352636a923aae1f301f76f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676859616, "uuid": "2fe00b8a-fcfd-4007-9a2b-4cc1c577a74f", "comment": "Malware payload (njrat)", "value": "2ed7940cbe98d02b2bb6b9b2e4099fd41d3a6f0c6adbd07012fd40b721e4597a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676859616, "uuid": "049ac128-46ff-4add-a103-91d7277d186c", "comment": "Malware payload (njrat)", "value": "fbe4186f10a627869e6418d03d112c9563c8940f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676859616, "uuid": "0ac1b958-00a9-48b6-a2a5-95f4da50584c", "comment": "Malware payload (njrat)", "value": "f4ed77312663c9b55f23a067aea532bd531027e806d3cd25883fbd2c5aabc6241a79dbe596f61b8a36704ce981fe65fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676859616, "uuid": "2cfd6ca5-17c5-42da-8a7a-997d5410ff09", "value": "T1EBB20A4F3FA98856C57C177486A5965003B4A1870423EE2FCCC564CBAFB3AD92D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676859616, "uuid": "e31bb14e-3a50-498e-b5d4-41b78b931d4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676859616, "uuid": "422c1984-234f-4e0b-8c32-052b5deeb656", "value": "384:AcqbCK0l4h7o9SVyDGvENuh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZbc:/30py6vhxaRpcnuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676859616, "uuid": "cc869313-d3d0-4ff7-9418-ce59a97a89fc", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676859616, "uuid": "42821f45-63db-425a-9e8b-014ba80856d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676859616, "uuid": "d2a1ef2b-9e72-41b9-bc82-a3aa82d7207d", "value": "5c3f86b25352636a923aae1f301f76f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2c4779-b147-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676915692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915692, "uuid": "7352ec08-ca17-4fa7-bc2a-8cea2f68a17e", "comment": "Malware payload", "value": "20a5c126989ed6ff4f1a7f2a0d9b3a38", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915692, "uuid": "f748e2aa-748e-4429-8247-049a96c1ce95", "comment": "Malware payload", "value": "2fa53b971aa2996f8558abc5e8cf54591f270d20d7ead669251053efc3719580", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915692, "uuid": "1c007001-b81b-438d-8d90-085a2fee18b6", "comment": "Malware payload", "value": "46708caaa753fed399582d6a854c376e76db97b4", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915692, "uuid": "3ea075c1-419b-48e2-906d-a943e2ff66d5", "comment": "Malware payload", "value": "38d65001fcfb19c67051cebb6dde8990243cb72a520d51953b09fcf1b1fdbd995eaff6b84744f9b9ace398d14ee95f73", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676915692, "uuid": "6084a308-eb6e-4087-a8bb-16fe21f495a3", "value": "T1D652D12D9CB55650E7206DFCA9AB8C05EFBB7D00EBA900ED175841242CCA8585339EAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676915692, "uuid": "b58433fb-e929-4f12-a7f1-8268e107631a", "value": "384:YL5XtiqAJGoWboAOwcXjvnyQXsNjsLkuA:YN9nUGoWboA/cTvnOowuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676915692, "uuid": "610fb8e9-e74e-450c-a494-3a3f1dcf2d57", "value": 14391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676915692, "uuid": "1b1a6e55-991f-49dd-a1e5-0ebd46cd7320", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676915692, "uuid": "13ae4ebc-b9a9-467b-9a17-0d3fbf770cc5", "value": "54fc9cc3-c0f9-4dae-9613-08db13189311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637a00ca-b105-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676887222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676887222, "uuid": "7673782e-920d-4460-80ca-ccd0b7454d4b", "comment": "Malware payload (AgentTesla)", "value": "25f85c69d6b5a454ba28b108f3919031", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676887222, "uuid": "6e35c27f-5d40-4505-990f-7fef789175ca", "comment": "Malware payload (AgentTesla)", "value": "3007c86b3b1fb2d50e6aa269af0d74c93b355f1f077fcca665b6e8599be4d7a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676887222, "uuid": "3de06261-d817-4c24-a78e-c9f2f595586b", "comment": "Malware payload (AgentTesla)", "value": "5dbc656b8383bd9ed68aa96e67cc472fe68ac5d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676887222, "uuid": "3af182d6-d225-4e5d-b826-9ed0996dcb21", "comment": "Malware payload (AgentTesla)", "value": "f8dc5aa2d67116c5ed4828991de59cfbee29e11b1f129aef31b28f2d9987ed3e72ee7e72cdb334214d35a42f838c0e71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676887222, "uuid": "d0d5ef6b-320d-49e2-86f4-c79ee51ae6c9", "value": "T11684230A7ECCC003E563D8325A392779ABD88A5565606193E3209F8FFDE1263CD2F365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676887222, "uuid": "c5fede8e-ee50-4551-b9c2-10484afbaebe", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676887222, "uuid": "d20a64ac-635c-4fb2-bb6b-977f60be9c98", "value": "12288:/YHtR7iIwZprtWkO+Jx/LxH5leiFyJbmbc9v:/YHLi9NWkOCx/FaiyJbmav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676887222, "uuid": "d41f4382-84ba-4334-953f-0b8f47cf073e", "value": 394600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676887222, "uuid": "a2de50fb-e627-441c-97a3-d61bdc1c6e71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676887222, "uuid": "a2ce06c2-52fc-4d4b-8d38-be7340210c6a", "value": "rPAYMENTINVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd70d1c8-b111-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676892553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892553, "uuid": "ffb4afa3-fa91-41a2-861d-1364a180eb30", "comment": "Malware payload (AgentTesla)", "value": "f5f68ff87fa0f40efacc9aca5e7c4e5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892553, "uuid": "93909470-53cc-4d66-8f0e-b74fcd794065", "comment": "Malware payload (AgentTesla)", "value": "30085efd7d52bcb852e4c94dc3481fdf8d54d1dfc1b6761027900c8ee1711a5a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892553, "uuid": "9170604f-5e73-4f2c-a472-1b57e584dc1a", "comment": "Malware payload (AgentTesla)", "value": "4b294ad0f74cb870d16585bc84cdd0b67609cc0c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892553, "uuid": "5e860cb6-8171-4786-b504-691208ed64ab", "comment": "Malware payload (AgentTesla)", "value": "72b0dd3aa731be08016147fe24ee28e5b8715003998eff6ed7c060fb33bfd66d13865ddc4e23fb9280e2d6eee096b8d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892553, "uuid": "6267edee-1c97-4250-9033-c4c8a40e9ee2", "value": "T169F4236E746FC3502B1A4D842AF89F9E56647D6C53F84E97137A4046EFE0AA40F33C89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892553, "uuid": "e7f24eca-a4ac-4083-bd1e-dbb110e213f6", "value": "12288:oiaIXfs02gHT8JcOH1Ppw/w7/dp536ZDk4FZkxhTVrx+KKn8CkRd2Do3/va/dPxD:hjXbh8JcOVPio7lqZDChx1+KWLUd2DoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676892553, "uuid": "c6e39195-d4da-458b-a1e7-930ea8e4c6f5", "value": 732385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676892553, "uuid": "150d06f9-06a5-4262-aaa9-18a0ef449236", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892553, "uuid": "e5fb3612-4ac5-46fe-bdc9-b41fc7cc5f1f", "value": "P0-9876378-Copy_DOCX.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5e7863-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676908899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908899, "uuid": "b56d3994-1458-4e4b-a5c2-8349b569fc68", "comment": "Malware payload", "value": "1b1744216fa974f3048f862a2e6703ec", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908899, "uuid": "9c5d9632-91e7-48cb-bcdf-e3e730b305d4", "comment": "Malware payload", "value": "305d7962894c83ebfcc863fe129180f20e6144f1f59d70971249d14e6d178fa4", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908899, "uuid": "962b501b-8b30-4619-b8d4-a26416ab6a35", "comment": "Malware payload", "value": "4f649e144599c7f4d94ea40333be4895565dacbc", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908899, "uuid": "19eb54f7-10a5-469a-b315-556bde1bb87d", "comment": "Malware payload", "value": "3276b98af0abca6fcc7fb5a9ac6ba4c469e1ccb62180363e6801bf8ceb10fd41ae1f49f6d14b695d163dd97272e47726", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908899, "uuid": "bf84158f-fc19-4b03-a6d7-426469756f55", "value": "T1A3034B0932A08216C1BA96324EF3DB565726AF5271501F2FB786171F4D72380FA60B7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908899, "uuid": "0615394c-1702-4906-9513-aef600494248", "value": "768:d+jfR8y7I+X4CRZM7MSaC8/kQ9nMSaC8e:dMg+X4CD/kQ9MDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908899, "uuid": "e7a31eec-a614-44ca-bdef-f7dcdae0448c", "value": 39104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908899, "uuid": "d960a4bb-76dc-4d0e-bb87-dad904095b8d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908899, "uuid": "1f77ba9d-fbea-4cfb-bc83-53d0a01d85dd", "value": "SHIPPING_DOC.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d2d4a7-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676882719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882719, "uuid": "86651e9c-8e9f-410f-af6e-89813dea9345", "comment": "Malware payload (AgentTesla)", "value": "df15743ca5634800426e11375a9bbf09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882719, "uuid": "79353f6e-bbda-4f2c-84aa-4b6e8a611dab", "comment": "Malware payload (AgentTesla)", "value": "312c831df98ef57278421e11e203a30253c591572845ca61a147cb3c80eb707d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882719, "uuid": "3f9e07fc-09bd-4be7-9c27-7012aaf376a1", "comment": "Malware payload (AgentTesla)", "value": "aed486d46369d2cf41056d9dc3d277870cced26e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882719, "uuid": "d152a819-51ae-442c-96d3-1dfe58c75011", "comment": "Malware payload (AgentTesla)", "value": "524cf793d137b82a8e0e7cfd555c1ec3da01a29460a720e7ae736e852b484f494001e8f9bbbd08003e70c9008c5e8a36", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882719, "uuid": "c5e71a6c-62e0-4047-a6b7-2c7408f0d77d", "value": "T196C42257135863ABC3BC2EB668B111A22336779E7931D20F5C8E11D71E63B01A851BBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882719, "uuid": "bba13510-686f-4ec9-b6e2-97589751b05e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882719, "uuid": "53e75e54-4df0-4584-85fd-1ff84e1e8ae6", "value": "12288:sFFZ64PQdJ+BdDHtRQSIsxemnVjJ2vPQqABmPAD//WzHi2vTc:m67UdDNs0jJ2XpPS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882719, "uuid": "1f11e0bf-7905-4a0f-bfcc-bfee49476efb", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882719, "uuid": "0d30f88b-f4f2-487f-b9c1-c7e546d8ca0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882719, "uuid": "5cbdac64-d963-4466-a26a-c3a3a7cdc906", "value": "RFQ 5609000-4465.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7c134b-b0cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676862916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862916, "uuid": "e553c2ef-effc-4e64-bea6-c154bdf168e1", "comment": "Malware payload (njrat)", "value": "632808633cc4fd6b5071fa2be3e094f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862916, "uuid": "5fcd2812-bc74-4535-8a67-9a7b6c2288cc", "comment": "Malware payload (njrat)", "value": "31707d6050ed77cdbb3ca596a32b46760ddb65bf7c1f00f2e191a743e27b605d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862916, "uuid": "d2e24f89-1294-46d9-943a-d18b884c1891", "comment": "Malware payload (njrat)", "value": "7ee94628bb5f68dbac68a2d87dac795708b2f060", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862916, "uuid": "c3138d3e-0292-4382-bdf9-8ab75fec4ce8", "comment": "Malware payload (njrat)", "value": "1f58fc6d50eb97f61d5413c42ef827dcc732b1375726b721fb649a92b4defce56fd5533f1d435fca0d00ba53a629a77f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862916, "uuid": "d3cbaa1c-9d37-459c-a3ab-f2f5e8a697ba", "value": "T189F2FA8DBFE24194C2FD5E774671D2220376E0071E23DA6D8EF884B65AA36C48E5CED1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862916, "uuid": "f324f836-472e-48eb-8ac2-9edde79b5349", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862916, "uuid": "fcb7074c-ce60-467e-9735-e7c7dcf2beeb", "value": "768:6gSQnFBq3DEnLVRXocU+Ujkx9Ehq5lxOBcmZPtLWjC:6gSQFATSLVRXocURj05lxOWmTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676862916, "uuid": "1e922fa3-9f67-4c14-9a84-87bcab7f9f10", "value": 35840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676862916, "uuid": "f25951db-02bd-42a2-9b46-45d7991aa243", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862916, "uuid": "d060a984-bbb9-4134-8140-0125ee1db4e8", "value": "632808633cc4fd6b5071fa2be3e094f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa5b9aa-b144-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1676914166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914166, "uuid": "70e7163b-12ec-4f3c-83fe-c8538cb65d56", "comment": "Malware payload (Quakbot)", "value": "bbe23ee1cf3e39459b4ea7828d69b259", "object_relation": "md5", "Tag": [ { "name": "1676367197", "colour": "#4B8A60", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914166, "uuid": "6fd15d4d-47f3-4d88-830d-fe2de3c12e64", "comment": "Malware payload (Quakbot)", "value": "31aa9669cb55c8c91128d47fac44fbebb108eba03d16748727beeec49c6b173d", "object_relation": "sha256", "Tag": [ { "name": "1676367197", "colour": "#4B8A60", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914166, "uuid": "93900251-ed55-4b81-a833-8b5786b9a80d", "comment": "Malware payload (Quakbot)", "value": "d19b0ae297de924de9d651756f15da7f311fd031", "object_relation": "sha1", "Tag": [ { "name": "1676367197", "colour": "#4B8A60", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914166, "uuid": "3744fd1c-81c0-4dca-8c4c-0e407ee3018f", "comment": "Malware payload (Quakbot)", "value": "7793d45aaab69e05b0a069bff047765ed9922a60b270e29a9c4f7a87f80de8c5613f350545be67010ab90f9e8847cf1f", "object_relation": "sha3-384", "Tag": [ { "name": "1676367197", "colour": "#4B8A60", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914166, "uuid": "2255cad2-5529-40c6-a733-af14d6f9c7a0", "value": "T14EA47D2BFD4F50F9ED1B04FAC047F77F6E3C53698A20CCA5D8580E59ED656A6400AB0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914166, "uuid": "64c1f4ec-9014-4394-b8d6-08660df06c7a", "value": "4160b8ad2228905966ea106c1f7681d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914166, "uuid": "811b3325-8a54-4acd-a4eb-ec2a035741be", "value": "6144:cJZRRRe1q7wXT1BakCSLdzOr2ewln8V7zDaVtfCvVBKR7fh1TiIBNYrIIg0a2MZn:cJZ701nXT1BaB4Irm8VGfn1N2g52MSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676914166, "uuid": "70435f0d-1afb-4ae4-b721-66555556c607", "value": 460112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676914166, "uuid": "d6b8d147-f238-4fe7-b3d7-176944d927be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914166, "uuid": "1fe6aeb1-2e6d-43b6-af9b-4d700849529c", "value": "aJ1vC.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f829be-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676882657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882657, "uuid": "e0ce329c-fabc-4e8a-a2b4-2f12c2e32ad9", "comment": "Malware payload (Formbook)", "value": "b22367729df121ea6a0116f27c6adcf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882657, "uuid": "799e676a-614c-44d9-8862-fd18b6cb3967", "comment": "Malware payload (Formbook)", "value": "329e042c8065adacdefe2fd6469637c0f2a4451e8c575ac53263e9115858af6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882657, "uuid": "64354487-003d-486f-9f9a-cd48cee5a762", "comment": "Malware payload (Formbook)", "value": "431f58fb0b99fd1ce5b1e9789fd5382362d19e4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882657, "uuid": "dd93ca99-2b99-4b32-b9d5-7fcc03d58675", "comment": "Malware payload (Formbook)", "value": "231fd3ac2f1f656afc12470709fec45e2a4cb00cfd45382d36496c0a5cee9ea44f15ef03552f50e17b728c9de255680d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882657, "uuid": "1430cd7b-62bb-44c1-b141-abe5de85b7bd", "value": "T1BE04AE32D601C031F2B251B5F6BD0B7B483E0D347295A0EAA3E116A06FE55A6F57A31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882657, "uuid": "d65fae27-9cfc-459f-8658-7cdd88e96fc8", "value": "3072:tueNWkFE3SqMayvyF03+gj+JL9afNaTKZ2VcMM73AKlNDfMMf0:dM5yca+GYafgTKqcjlbMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882657, "uuid": "0cbbaa77-4afe-40db-892f-cdc4d2653790", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882657, "uuid": "a06c8270-c9c2-42ef-91a1-6eda10eee025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882657, "uuid": "6175859c-8b88-4bb3-aa2a-4e9e90abee57", "value": "329e042c8065adacdefe2fd6469637c0f2a4451e8c575ac53263e9115858af6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9542e1-b151-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676919773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676919773, "uuid": "fc6e4c6b-3ceb-4d4c-856e-4eb2f30fb239", "comment": "Malware payload", "value": "4cf1139265fc7dd2cb126009703da8bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676919773, "uuid": "23476a17-b925-4524-9d65-82ba3fac2708", "comment": "Malware payload", "value": "32a350288f637331098059bb79eb72eff864d406f264189023f17a9054d6e5e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676919773, "uuid": "ffccff02-947d-40c0-ba2a-ff7fe5ee083c", "comment": "Malware payload", "value": "7b5afae35de8896ae7ffbc377b2c7d787642aaa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676919773, "uuid": "2e14307a-fc83-43a7-b1bf-09501001fa92", "comment": "Malware payload", "value": "c0f4c14466c1e5999b3eab12fbbc7c2b0dd5e8c78e0cfb44f47d302dcf0ba4c801e7d4ca1686ad8eb46ca68f72d8cb52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676919773, "uuid": "8b700303-55b3-415d-8de6-2e39f497db61", "value": "T11125122066F4C797F768C3FA56A6808093BD652E5110E31C2ECEE2DF3D72B5186126B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676919773, "uuid": "421ebc8c-ffd7-498a-a579-b616f4a98f91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676919773, "uuid": "8fac334b-a470-4458-ab5c-19bfdaa913fc", "value": "24576:W1QwN5eQLktJM1PyOuJHxE+NWbX+3a/gJy/qBrYE:WxxkbM2qpO3OHCaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676919773, "uuid": "3bf2ffdf-5569-4537-83f5-46bf5beb2d94", "value": 1029632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676919773, "uuid": "cfb20d1a-0e41-4f2b-950b-28393f79f52c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676919773, "uuid": "d700cf73-7c5e-4cc9-aa5e-b2fc7ca10f10", "value": "5HR9Ly3Mej5Nu1A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a2100f-b0e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676872755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676872755, "uuid": "3b768dd2-8f49-4e8e-aceb-d5e7779701d0", "comment": "Malware payload (RemcosRAT)", "value": "99e19c4a4a8a972005902bf6129867e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676872755, "uuid": "8065d688-69d9-4302-b2d4-66b6117df15e", "comment": "Malware payload (RemcosRAT)", "value": "334c23c94f9c6587e2afd0689796daa8791fda9b823b23836893b86f5cce849f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676872755, "uuid": "acafd64f-95a9-4dc2-a1ab-fccbf9097161", "comment": "Malware payload (RemcosRAT)", "value": "6f77809c678265c7beaa9bfd7f8eabffc78513e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676872755, "uuid": "87f308e6-b9f3-467d-bfb1-2dec1f55c97a", "comment": "Malware payload (RemcosRAT)", "value": "2edf06d9e4ff7f20f8f8fe92113f4a187dfc6830ac5c59cd4591833ba5780d887b2b2c37a035d9963485f0592d5c9105", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676872755, "uuid": "670e4c92-09d4-49c9-b3f3-8b370c56b03c", "value": "T1CE93C713FA4AD0B2E42591F146426F32CEBCBC3636492173D38FCA419D79892D456EBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676872755, "uuid": "8f2927ce-4890-4cd7-b132-13e8d8ad09fc", "value": "d3a62971944197f0701c7049a9c739d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676872755, "uuid": "47b17cc7-390f-457f-a6e3-cbaa8176bacb", "value": "1536:FhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6:7hzYTGWVvJ8f2v1TbPzuMsIFSHNThy+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676872755, "uuid": "d0ca953c-5ff5-4d69-bf59-7def1d045fb0", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676872755, "uuid": "4a23914f-a362-4f2a-80f7-f68128a900d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676872755, "uuid": "ba54c7db-3366-459c-8f5c-2f7781091127", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8862f039-b0ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676876976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876976, "uuid": "16d08a33-a5be-4d16-bb8e-f990097eb6d1", "comment": "Malware payload (Formbook)", "value": "dbe7454c83d1c2242e718ed80e8e3cbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876976, "uuid": "eb31dbd0-48ce-4881-b796-789248f38f8b", "comment": "Malware payload (Formbook)", "value": "3353243680817a9543a9cd91723d5452591805ff28f458d740c0f94e85ea62e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876976, "uuid": "8c797740-5b3a-443b-85ba-93bbe6957964", "comment": "Malware payload (Formbook)", "value": "448931c38410c04d7b104dbc562495a580364d9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876976, "uuid": "aa3205b9-806c-4753-96cc-50cdfe8004f5", "comment": "Malware payload (Formbook)", "value": "ab688a8a552d22e33f5f249d2bc26fecee4aed8a0f15318ea6d5e080733c88566ebbebeec92cf6829c17834621390f0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876976, "uuid": "17d333c4-19f7-4ad5-bc1f-e484d56f64ba", "value": "T1F2842343A362C1B7C572033549355B37BFABE63A74195A1B0360018EBAE2B91DF2B357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876976, "uuid": "fe3d88ee-90ea-4613-a75e-05ffbd49af22", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876976, "uuid": "07f764e1-4942-4b55-bcba-5d0c1712ee4d", "value": "6144:PYa6Bwhjc73sB3r564QbN9BhbpAjryDxp9RLL9yXG3cGHA6z6gPSvEknFCFRyDz:PYzMwbC3c/brBDAjrW/91xyXGPLzAXMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676876976, "uuid": "8d36cab8-f1f3-4c1e-a271-33c73520dc9a", "value": 378649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676876976, "uuid": "db21be74-3d4f-4505-80df-9e909076b400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876976, "uuid": "7b802a9d-539a-48b2-9936-a4961f3cdab6", "value": "New Purchase Order#02202023.Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2e7c23-b156-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676922129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922129, "uuid": "1c49d15d-c3eb-414d-8644-15eaa44f1306", "comment": "Malware payload", "value": "da6e0ca424e217e73b9e98889d75815d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922129, "uuid": "754393b6-8b17-44e5-9c84-6b53248f11dc", "comment": "Malware payload", "value": "337977847bd866316a89ee35b4f5d3eda062e4964f2792d0c3ef6ff2198e9419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922129, "uuid": "6bb765f4-7f7d-4048-8014-d888dde55697", "comment": "Malware payload", "value": "80bbbffa887771bcc62ef83dc8a79af032138ff7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922129, "uuid": "d7839c2d-3b06-4db8-92d1-d029e56f5d40", "comment": "Malware payload", "value": "208f7274ac7b102f117b0ae67ce916b0722f0d0670e7c199fbf8deae66108f03b4ba68a828d89babce0bb9178c7b8f9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922129, "uuid": "4a21ce0e-c036-41b8-a902-5483b65d9409", "value": "T19C444FCFFF685512D053CD799373CB228B15E6A22D1B6747672E02A9CDE02C19E1A2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922129, "uuid": "faa7eee1-9820-464b-9407-7c1e0a1b9dd8", "value": "0d2bc4f44be56e5f23a4ed8ea9899cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922129, "uuid": "b60fd95d-cc25-4830-b2fc-bd91e052ca33", "value": "6144:NKMp3oYeXabZa104B9DwNFhSjMZKqHBbQ:NZSdabZYybjKqHBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676922129, "uuid": "89c1b84e-96ed-4005-96fa-9105813d34a7", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676922129, "uuid": "b69ba080-97c1-4c51-bed4-5573c22bb0b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922129, "uuid": "aa5d03be-05e0-4295-b19d-26d03973d2d6", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064372db-b129-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676902527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902527, "uuid": "00cbc782-61b6-447a-9971-e1adfc3617b2", "comment": "Malware payload (AgentTesla)", "value": "5831ef459b47952e4985667c56a99cfa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902527, "uuid": "fb0b1ab8-fdb8-4db7-9b5e-092efccd368b", "comment": "Malware payload (AgentTesla)", "value": "34a6cb7776062b6a981d8f2b1fd7e6e7fc6fb9c5253f57a06cef1903569fd532", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902527, "uuid": "9610302d-6c88-43e9-8006-b2a01158ef89", "comment": "Malware payload (AgentTesla)", "value": "cc7a576aa29f0bd905c8bbd420cd023fe38133c7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902527, "uuid": "f03c7ea6-0b3d-44fc-b281-7ca77740f7a1", "comment": "Malware payload (AgentTesla)", "value": "94b3745c283f7ca2983947bbfd44b4a392f10956004c09517bc8f7f0180d26cba6eea766e11221de88af26729a914177", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902527, "uuid": "0327d249-68e7-4d04-bb2f-e63681dec089", "value": "T1A275BE5EC5B35F8FD6295A38940E0E023026C3C599BDDB496A9AED3C319458FE3B9331", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902527, "uuid": "d7bf5857-3231-46a8-8efc-11404498142a", "value": "24576:yCNVktDxqPRhVoQAvXBWTAcCrnAS7HaCV6ZPh/wFWyXG6Cw5lKudy+:mtEPHyQtZKnJ6CV6ZRwA015Tdy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676902527, "uuid": "40c27700-1b10-4ec4-8c50-089c1ad7b127", "value": 1567232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676902527, "uuid": "2b80b907-c650-4771-928e-cb1556d1f7e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902527, "uuid": "b1d3b2f0-6dcf-4409-a374-c135f6fbc122", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bec0d2-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676882659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882659, "uuid": "cf9b4c64-1cc0-472a-b633-4aaf7da6a83c", "comment": "Malware payload (Formbook)", "value": "330e50456117379e07d0eba36a249d32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882659, "uuid": "806c0850-008b-449a-be31-58e7be68062a", "comment": "Malware payload (Formbook)", "value": "34b13a0e4c1c0226e821fa78d0a32e797db1329f3ab0d16e41a413968c274ba7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882659, "uuid": "6cba6c0f-189a-45bc-8274-d0aaa09a3346", "comment": "Malware payload (Formbook)", "value": "a52f899385eb20d03980defaec7c8c5c4bbf146b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882659, "uuid": "415be22a-89ce-4d7d-87fa-090f95165e9e", "comment": "Malware payload (Formbook)", "value": "1572dcd89f5dc1a9b3923993e6dfee2efbf3583a816f5e59393b0cf633dd5dba797f351a7a2852371a3ca07b7fbac665", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882659, "uuid": "96580aad-34cf-4d6e-a735-bac32a91fd3c", "value": "T161049E32D642C031F2B201B5F6BD1B7B4C3E0E343655A0E6A3E216A55EE49A9F17931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882659, "uuid": "d49bfa19-4430-44e0-b2cc-b7f96f952080", "value": "3072:3qXONkOlwpno75f3esylwb6y1KNHsTv6Z/mZjiLBGm:jjfe7G6y1KN/Z/KGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882659, "uuid": "a7bd616d-a89e-42a2-94ca-b6e5f1d62b1f", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882659, "uuid": "8cbb4770-4f06-4ed4-96c6-a4ee8aa32f9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882659, "uuid": "9a0c431e-0bf3-4f73-9b8a-75a08459d9c2", "value": "34b13a0e4c1c0226e821fa78d0a32e797db1329f3ab0d16e41a413968c274ba7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5e595a-b0cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676863987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676863987, "uuid": "7128baa1-1a5c-459b-a767-a63ad2bc5ce8", "comment": "Malware payload (AgentTesla)", "value": "4743132bb6c0de63297f710d70831b07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676863987, "uuid": "adcb2f1b-62f3-453e-aa8c-ea60a57628de", "comment": "Malware payload (AgentTesla)", "value": "34b51359ad6122847ab773704dd928b28eb69382bacc7575278f2b25af583ac5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676863987, "uuid": "4ce09263-0dd0-4085-aaa2-50f99f9667bf", "comment": "Malware payload (AgentTesla)", "value": "552880cca87d15e043b0d4141b4b8cb492a49161", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676863987, "uuid": "b0f008e3-99d6-42ab-b0c3-df7fd0ed4db8", "comment": "Malware payload (AgentTesla)", "value": "0c437f32875f8c4bd8191220b6aefe47384433ef23ae5034f0f076cda356ac8feaac343b7e2e4a7f7af54a9c87d7148b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676863987, "uuid": "703932e4-26ff-4de0-9a1b-03e1574d879d", "value": "T1ED251259B3668A12C39B2A34E613002A6772D1D32273F79F2F5C53E4AA133F65D447E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676863987, "uuid": "edc03a56-dbf4-42cb-8cf7-44be0398bb7c", "value": "24576:kvZ/TvnRi8Gx8aeZ7ZF/1ahhTlSIIV4rSk:S/7nR0G7A1JeeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676863987, "uuid": "680629a4-1f4a-4eda-91a6-cdcfbf8e717e", "value": 980480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676863987, "uuid": "30b32c16-166c-4615-b966-33bb5b19670a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676863987, "uuid": "551d7dca-e7be-4769-8291-a0296bf84f64", "value": "SecuriteInfo.com.Variant.Tedy.228780.19809.28066", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca86b21-b156-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676922268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922268, "uuid": "ec8ecc5b-54e3-4b7f-ae95-82b1f3adf51d", "comment": "Malware payload", "value": "1b56f2686007e6e9e31ce0f690b43d98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922268, "uuid": "8d0f1194-e224-4bec-97c9-0aa5459ea4da", "comment": "Malware payload", "value": "38ea9257184dc10b4d90f1f0053962de23139c5cf8a27a6654d8c586706a1b27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922268, "uuid": "339fdfca-b3e9-400d-93c7-612123ae42a3", "comment": "Malware payload", "value": "fa6b4d0106d298ac660b0c3c386c6b93b3b25996", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922268, "uuid": "413ebaef-bdfc-4a58-95c6-877b6908baed", "comment": "Malware payload", "value": "b5ed00830c54c93703da6a79e50e64eb21227f2c7cb14ff0923ee8f680a0a07ad1b3b3db678ffe43c05d4902eef4ae7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922268, "uuid": "8e13f407-49a4-4b56-bb61-85b32c150f15", "value": "T1794623A325E06191C4E688B96D37BF86F172022B4B41D8B8708D7FC62B739E6D717613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922268, "uuid": "791637c7-53c5-4e8a-a2a7-af89819b9262", "value": "a76c012d2a75441ea9da353b7b587ed2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922268, "uuid": "47204e28-ab2c-4746-816d-2ff8502102fd", "value": "98304:K0urFiE58do5h+GCbRAXB77/I26vvxg+nAskaAZ3VUc6laPh0B6kMqGW9CjPpHw4:K0u5iEO8UsXB7OXxfn4VDr6U4atW9F4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676922268, "uuid": "7cd1ce19-f003-40a5-b046-2154e6c479fa", "value": 5855752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676922268, "uuid": "f425b2b6-e3b3-479a-b097-294418cc811e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922268, "uuid": "defdbc9e-1ec1-4f97-9000-14d64988230e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87bb3036-b128-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676902315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902315, "uuid": "67a6dc22-608c-4c13-b00f-f27c13aacd29", "comment": "Malware payload (AgentTesla)", "value": "f75abd8cb5539dbd5099f15e017e6144", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902315, "uuid": "d42d8d82-40ae-4013-b12d-e81e8720f473", "comment": "Malware payload (AgentTesla)", "value": "391808a3df6727121d1514ae29fba555e8a0e127d12f9172e367676075021b67", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902315, "uuid": "f8787e0f-1ae4-4db3-af7e-48d8fda95427", "comment": "Malware payload (AgentTesla)", "value": "2f09b85f792ae8fa561f81937fe0054c6c27aefc", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902315, "uuid": "7c09b5dd-d53e-4608-9e84-21435f7be75e", "comment": "Malware payload (AgentTesla)", "value": "ea11520970c03cd6369f45a2c8014a6f631612a2863714da2606e5c16b987055d6bc774a0ef9bb8fab0af026996edac3", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902315, "uuid": "673a41b4-dfef-41b5-aa85-be4c179a87ca", "value": "T1AB84239CD06086DEF74A9AAAB0562315DD3C8D3E598800DEEB38053A650D31BFF153AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902315, "uuid": "90f9d653-3c51-4d55-b7c2-b435a8a4c05b", "value": "6144:k9IzG/EKn1/wlXyoShpczL90tOrkQVYvV5btmrzgVV9k3Berc6lGK:k9Iy14lN00rkQYrb19hr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676902315, "uuid": "2a109c34-a9dc-4792-a1a8-e46bfc20c9c1", "value": 380814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676902315, "uuid": "a0844472-6df1-428e-87f6-2f2cd58e5e89", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902315, "uuid": "58363fb7-f45d-41d7-aa6b-d479d36850aa", "value": "P.O_6652023.exe.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1831c36-b11d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1676897741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676897741, "uuid": "739769fc-63aa-494f-99fe-105e725903ca", "comment": "Malware payload (AveMariaRAT)", "value": "94aaf99194581a21c2131d6d82942891", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676897741, "uuid": "5a84f6e1-52d6-4ecc-a8e0-e64d1577447a", "comment": "Malware payload (AveMariaRAT)", "value": "3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676897741, "uuid": "c80a65e5-9b92-40ff-a555-e057ccddb439", "comment": "Malware payload (AveMariaRAT)", "value": "8b014947be45252a09119e66723910a575bf7899", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676897741, "uuid": "98d51d3d-3638-4ded-a302-152179de9f10", "comment": "Malware payload (AveMariaRAT)", "value": "6ee5db72a0de50b30ce42bc4f5f742045fd4f942f5a44df851a32f9102fd084e5aa588e1f55626d6e83e7e86c91e6169", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676897741, "uuid": "8ded3479-948b-478b-91b5-6cd6ce7b1788", "value": "T12664137136ACD087C41745F02D77DBA2732AFAA23042570F17A93F7BFA21651CA0E566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676897741, "uuid": "3d54df1e-f937-445b-8f2c-17f440e6ff2d", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676897741, "uuid": "60fceab8-d169-4c79-8dfe-c4f741a7665e", "value": "6144:NwK5v3HlqvqK/inUJG2f5ps0PIPjYEdwQ3f6Q5XumSztpWKIpl4Fen/cD:Hflqv1AUM65ps0PI7zLfQpoKIpWkns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676897741, "uuid": "07205eba-108b-4c80-9fb8-423b00136e76", "value": 332784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676897741, "uuid": "2a22eeb0-c6c0-42f9-a294-2c0b99bc167a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676897741, "uuid": "ff8c0fac-9c00-4904-9ac5-dd7f96fc694e", "value": "FV-083471-23-02-22-269407\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a15399-b150-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676919456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676919456, "uuid": "470cf034-ba61-4976-a6ce-527d38cc4e7f", "comment": "Malware payload", "value": "3a0f1c8fd4aa32115c5108417aaffabe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676919456, "uuid": "5399e930-22ae-485f-af5e-35af55afafaa", "comment": "Malware payload", "value": "3afd0a870dd4b3958c0f094a5e3af352500cc051c30deff8d35df45bcb956eec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676919456, "uuid": "de9b0118-07f7-41e9-b0c9-75f88496e140", "comment": "Malware payload", "value": "8d9a65cff96e0146048c55142fc38a9a03bc0916", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676919456, "uuid": "c6aab2df-62fd-4e0a-a153-2237baad06e1", "comment": "Malware payload", "value": "c768783d45b9d402af5a1bb5dbdd03100b5ccc55901426344605f0e5e84384f9adceb214a5df6b288e3b73bc164fe55c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676919456, "uuid": "678c7060-6db1-4d95-a849-1235b052a795", "value": "T1DFB412097BE4C813E6A20B3491A3E716FB74AF416916174BFF60B79D3DB23406E4B129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676919456, "uuid": "8bdde9ae-af61-459d-bb65-b51121e81a94", "value": "f677acae05efabe7411a40902b2d88fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676919456, "uuid": "059259cc-44af-4169-970e-bc92fed48154", "value": "12288:ZATvzWnSgwVl/UKkVTZbzpQ31PtJmF64H40NK5pN:ZA7KMwVxVQ31PtJmf7Nwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676919456, "uuid": "cc085332-b598-47ec-adcf-0b3b647b82f1", "value": 495408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676919456, "uuid": "e3b173ae-d5a2-4303-a3b3-bc294ad2687f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676919456, "uuid": "4aab37fb-d826-40f6-b560-776bcb446ba7", "value": "New Order Product.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e81f76-b0eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676876292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876292, "uuid": "54fb5228-13e3-4fb1-86c2-871574d33d8b", "comment": "Malware payload (SnakeKeylogger)", "value": "294c9fc2f7319b839d31639ce2f16946", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876292, "uuid": "8147d50f-df10-43e6-9ca0-1b771b513ad0", "comment": "Malware payload (SnakeKeylogger)", "value": "3b51a20bbfe8e24d86c98d61f15a5c71360f210c26dff92a786451ce0f1e81a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876292, "uuid": "aeb6d869-cc27-43ac-bbd4-122c8ec48527", "comment": "Malware payload (SnakeKeylogger)", "value": "567a1844786fe5e784b835d8285a6d6efb21d5f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876292, "uuid": "83c7e883-7453-4626-8319-2c3b43629fd0", "comment": "Malware payload (SnakeKeylogger)", "value": "9cf36cb62a5a10e196319f65a5d9102a9a5d1d670d05f9b63eb8d5053502ad8cc46ecc42f42aed37240c28187d129d95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876292, "uuid": "f02374a6-683c-4ce8-9c83-a4cb4761935d", "value": "T1230502D2F11045EEEC6A2732642B0D9219D32C7DD5B9D11D61F936223BF72A3801EA9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876292, "uuid": "974cbe0b-b579-45e8-b7cb-74362fae913f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876292, "uuid": "f7ad6cf9-0d91-45d0-84e8-2a25d47136a4", "value": "24576:5Y1hU3+yFOQylFYvrhbYpWebTGwSDqv6Pit:G148QLZYpWeb6wSWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676876292, "uuid": "2ef78e3b-94c9-4d18-80d5-d44a35278c17", "value": 837735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676876292, "uuid": "37f9a4b9-e966-415d-846c-4b0bbe607fc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876292, "uuid": "4cbaa023-fb53-4b8c-ac8f-26fac31b2165", "value": "294c9fc2f7319b839d31639ce2f16946.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284f45a4-b0ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676876385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876385, "uuid": "b96a64ef-adfc-456c-9a47-00606b1b7384", "comment": "Malware payload (AgentTesla)", "value": "142d9ac7864b4b82008159878b1ab275", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876385, "uuid": "940151fe-2f9c-4e2f-b6d3-d2ed7bc768b0", "comment": "Malware payload (AgentTesla)", "value": "3c95ad2e565262c2324a40bb1778e70a197d6452a9a7457d0fd639befa1466d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876385, "uuid": "825d2158-558f-4d30-bea9-bff6f3b6b2ab", "comment": "Malware payload (AgentTesla)", "value": "5a86f1de8302cfc9ba37dee234670e085043ecb3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876385, "uuid": "185e0987-bb68-4a33-ada0-90fbd7679e48", "comment": "Malware payload (AgentTesla)", "value": "9fb8c5b0eaa241085b8ee50e2a7147fcc3e6355c8ce01c809864a3af04a5075138fbf21806c500a835b411926b368798", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876385, "uuid": "700a22db-06ce-42e8-b99f-043739f35fc9", "value": "T169D4F11B397C1B99FBBD473C28086094E3F5BA015B91DA1ABC85A2CD4AF5B8047F1B35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876385, "uuid": "5587153c-8914-4cfb-984a-379c275816a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876385, "uuid": "deb941a0-7a1e-4b23-86c8-0a69c74df6fd", "value": "12288:HkiA388/T9JmfA+J5iEshz2u/E9hPKc0ohhQ7OfJ+6bhwfK7:HA3BWVQWhicFhhQ7OBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676876385, "uuid": "817f8565-fd05-4793-afc0-84164c98c2c1", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676876385, "uuid": "a5a14a00-a504-40f1-8f9c-c23230901ece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876385, "uuid": "ce937bdd-fc43-4e63-9ce0-9507db18e79c", "value": "Quote=AHB23QA.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de19f848-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676882703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882703, "uuid": "31f4cdd6-56f8-45b7-9191-31dee57d9057", "comment": "Malware payload (AgentTesla)", "value": "20c0d96a62339b8d40592c4556d43732", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882703, "uuid": "9f692950-3614-4f7b-8720-796f3218d38b", "comment": "Malware payload (AgentTesla)", "value": "3d1285b76fd03646cf99dc0eb26d0a4a0feb8726f429553f5a7329d942b969d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882703, "uuid": "55fd8cad-7255-4497-8169-50226e8f6d70", "comment": "Malware payload (AgentTesla)", "value": "4a05e1fce3ffee24ccf223b10a9530abe4063218", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882703, "uuid": "4972d0e3-cfdb-449e-9b63-3ac5d168c8bc", "comment": "Malware payload (AgentTesla)", "value": "ee5f18601b99760179d361c6887768b5c708c1e2db600182ac931c09f489e3248474668b018d73b278ab6f4723634fea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882703, "uuid": "bf477323-3425-43cc-84ca-ea9c13bd7e6d", "value": "T1F4C4128066F4872AEDBF17FA25701922A7B2316AB932D35C1CE571D50F33B808551BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882703, "uuid": "7f1284ef-c552-4705-936f-41306d6002f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882703, "uuid": "07c89608-a98e-42fa-8ba7-4c7c6b64b34e", "value": "12288:cU0eB2gw+uI3m9rvW5hs/rNR1TIUscqpqzH1jN5+ZUZJ+:cU0Y2Tq3+vWTs/xRpIBcqp8H35+ZUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882703, "uuid": "660ecff6-0508-4fbb-9118-9169ce451bfc", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882703, "uuid": "1f05f8db-1f15-4997-ab6d-c8fb25d3ada1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882703, "uuid": "5f97bc83-1c51-4a77-b9ee-2641a7a651ae", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b510906-b0ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676876336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876336, "uuid": "b7723c86-cf6a-4758-a5a2-50b8325cf02e", "comment": "Malware payload (AgentTesla)", "value": "331007cb55dcbec8c50e0aa44dcdac4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876336, "uuid": "8aa255c2-fbf2-4b76-ba0a-914f6ba3ddce", "comment": "Malware payload (AgentTesla)", "value": "40f43d4d079cb90519490abdedaa2ac5bdaf1a1487738055d832825f1f08f074", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876336, "uuid": "09df3443-c056-4d68-a9f5-29e24f34497c", "comment": "Malware payload (AgentTesla)", "value": "73e1f9e0c0d195a12f18f5d2fd345b5edcd61050", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876336, "uuid": "bd45557c-c3e2-4850-b2b7-cf8914ca77ad", "comment": "Malware payload (AgentTesla)", "value": "7edc8d87faeaef7809ac3cff10a08c54132c9e1768de6d1b6ad642ddb1e044a0eec80ce1c8262d6793e3ac1d6b78b589", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876336, "uuid": "5bc25132-56d3-4359-b20a-10b0d0884a5d", "value": "T1AD046042F7A77C3BF6550738AAB2924B1A93AD337911C9166186734F5B73BA07C32E01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876336, "uuid": "8d64cef6-d315-4497-b2d4-adb88d993efe", "value": "3072:aokZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAGFkSlwN2y1zH4:aFZ+RwPONXoRjDhIcp0fDlavx+W26nA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676876336, "uuid": "c8762a32-0e5a-4d00-b385-1cacbdaff164", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676876336, "uuid": "9188fa17-8602-4f8d-b9b9-305d9ddae4eb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876336, "uuid": "f384c8d9-916e-48cd-811f-270b12d25842", "value": "2023-02-20-SHV Holdings-Contract Proposal.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290a4ebb-b0fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Babadeda)", "timestamp": 1676883258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883258, "uuid": "69d75d1b-138b-455f-bce3-e2c56e2733a7", "comment": "Malware payload (Babadeda)", "value": "3a30d48a3a024646fcce9c8625f7d343", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883258, "uuid": "d556172e-d9ca-4920-a6c7-e0a0d6d67a1d", "comment": "Malware payload (Babadeda)", "value": "4265da988658800f37c41dfdefe6469133e43203b45e47751588600f779d3afa", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883258, "uuid": "385529ac-3c6a-4eb5-9b47-75bec1e52e64", "comment": "Malware payload (Babadeda)", "value": "17f696c1c51cf5e7ad1a6280d80571849f2b971b", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883258, "uuid": "d0ed6fd7-968e-4317-afeb-5de958058b60", "comment": "Malware payload (Babadeda)", "value": "958487e0d2666f15ef4094785e890fb030c49fe24b26fe363a7c08a2bb2704fd6bc885ecd63c576ea79a2887b0c7efc0", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883258, "uuid": "728864b5-05d1-4442-9013-669e9c759cbc", "value": "T14727333BF3A8E03ED9AA173209B25360DA777A61656A8C4E07FC744DDF721600E3B645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883258, "uuid": "c4eb5fee-29cd-494b-9cc3-2e5b37675d07", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883258, "uuid": "3e77370f-e3bd-4a16-aa99-eb4a692f40d6", "value": "393216:WUuAZ1IwUF3NnsQ6W9eZB7/sMmkNw02St4yQJUuFe2HiuYpIsjPq4NJVeq/:WUrZ1IP/nsWejVNVF255dCRp/j1yw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676883258, "uuid": "23096807-39be-4951-b6a9-0c6ccf37f439", "value": 21355904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676883258, "uuid": "de45ad62-21fd-4dfa-9f6a-df51bce00aa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883258, "uuid": "d85d86ed-e303-439b-afaa-538630269ba9", "value": "3a30d48a3a024646fcce9c8625f7d343.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb425e18-b0ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676877141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877141, "uuid": "f72a421d-fadc-4c2a-b9c1-7f5d3d3f7d36", "comment": "Malware payload (GuLoader)", "value": "ce8f118eaa6495846d3cd03c94e9f0b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877141, "uuid": "1f95da1b-968b-4080-b61e-e33d3769e4d4", "comment": "Malware payload (GuLoader)", "value": "43287a87b8b36a8f32ff41c7b7c08a574378d20b2e59baa137fe1fe4b97c2519", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877141, "uuid": "6c339b31-4026-4f4e-a037-2ccd45d96a17", "comment": "Malware payload (GuLoader)", "value": "a83fa5243b9e92d7f7d09d7b116bb626c4a4a57f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877141, "uuid": "9a00bd1e-47a6-4d90-9f3a-1873c7c2159e", "comment": "Malware payload (GuLoader)", "value": "d389334a405f260317dad74cac5649a943925428a16e1ef9ca69974aacf70dee7f59a9c54b649b8fb60216fa2543c22e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877141, "uuid": "2304193c-9dfb-438e-ad2f-aef6fac410bf", "value": "T1ED9412435750CDBBD86E8273E57051F2BE018D20ED284A5F57A47EE93AF62850B1E32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877141, "uuid": "3602b8d4-caa4-4834-8a55-b87adacdc5a6", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877141, "uuid": "9ea68ca7-8272-4788-b3f1-dd70f8105938", "value": "6144:z1ssjgziY4DYWZvx9CxNWLERD4XfTBpbPxr+Bv2l6s6S5buwiO14:Ss6i1DdZ7CSLGDcFpbda2kNvzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676877141, "uuid": "2748e5f5-291f-4861-8b54-2fb33a89e3b3", "value": 412605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676877141, "uuid": "815a0b6a-c0c5-4c59-b365-a1d3d23c16c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877141, "uuid": "f62d9251-07b2-4ecd-b68a-79e5fda8480d", "value": "RFQ-F-LJI-0622D003006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6311236-b104-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676886984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676886984, "uuid": "bacd0a13-1f5c-4f52-8cf9-02dbf1be18b3", "comment": "Malware payload (RedLineStealer)", "value": "d8f4eaafcc4c1c1e72dc2fe00cc02b6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676886984, "uuid": "15d2ba1a-b01f-4d32-a238-71117a79f582", "comment": "Malware payload (RedLineStealer)", "value": "448f71facff90f355308916d8c05f76b11e0c95cbd3e7144562809d9a2c18cee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676886984, "uuid": "be3528ae-2c16-47db-8f9e-7dc8e1dce52b", "comment": "Malware payload (RedLineStealer)", "value": "af7e69c37d040d7d36818970fcf93055c7372e50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676886984, "uuid": "b0f0ef72-48a4-455c-a7f5-5ab8d6811d36", "comment": "Malware payload (RedLineStealer)", "value": "8a37df6ec3fe31b6c57979158e40fdacf618f0d3916688b4c9795154d5145c5c40f8e62c849caeb06c249236519a0a22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676886984, "uuid": "4f8864a6-87d0-457f-bed6-b046cc03e28d", "value": "T1DC352387B3E95171D8B5537009FB03D31632BE916F38834B160FAD5E5CB2AA0A934B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676886984, "uuid": "d19760a7-fa03-43cf-bc33-61e0a2ccaa1a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676886984, "uuid": "2d14e1ff-39f5-4d3f-9750-83d45798e402", "value": "24576:hyrxdzI91QXWi9pEVJ5ifILQWb5/bokmVeypYeGKXr545:UrxpICWQaQcQWb5TMBpqKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676886984, "uuid": "c0d94470-c8d9-48e2-a8ea-8196caaefbf7", "value": 1116672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676886984, "uuid": "1cd90fee-4564-46b8-9def-111073483edc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676886984, "uuid": "37021347-eaf3-4520-b0a7-8ee2de7909a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3397a3f-b0ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676876645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876645, "uuid": "627b0eb5-c73e-46e8-a375-97175a908eeb", "comment": "Malware payload (GuLoader)", "value": "3b5c6306e0f0b7a6ac93d4b9a1ab7c1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876645, "uuid": "92f0fac4-f08a-4f4d-b77e-2c83e383a9d4", "comment": "Malware payload (GuLoader)", "value": "4562713102f34b97721f4dfe1bb62f25779b046c0111946103beb39cabea6a97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876645, "uuid": "cf1eca7c-f5ce-49de-a242-f23ec65df0f6", "comment": "Malware payload (GuLoader)", "value": "b12ccc629c77a85d4f5874b3dcc30face9aa8751", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876645, "uuid": "e7c36f33-6c12-4bda-92cb-af04d9fa3c14", "comment": "Malware payload (GuLoader)", "value": "ba5a589b574ac0893eff0ca486d206b8d532a4bed6110af9f20a061c00f073b84620b695b164ccb935cae5ac9ebf5098", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876645, "uuid": "4d6bbc08-c947-4965-8d68-a19c34bd8689", "value": "T18E841283A710CEEFC4364273E57185FAAA42CCA9D42D47479B907FA43DF22918B1E257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876645, "uuid": "a660fdc3-f28b-4f65-889f-b91dc60c56cd", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876645, "uuid": "8e7989ad-a09c-4452-a877-1f4da716f110", "value": "6144:z1ssjgziY4DYWZvx9C3ST7OW9dKee+cx8qNOmMOV2vt5mYl:Ss6i1DdZ7C6fZpcGqNOuI5mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676876645, "uuid": "8bce1d41-ca71-49f4-a7bb-62fcbec628cd", "value": 407117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676876645, "uuid": "e35e49d0-ba7b-4725-bfc3-c76e134c6f4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876645, "uuid": "b5a84097-c5b6-48d1-84bc-9f37aef25cb0", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c00be76-b0dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676869949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869949, "uuid": "7d129823-a020-49ef-8061-84a8fab86e6d", "comment": "Malware payload (Mirai)", "value": "7be9a2421be17f41ca13667d017aa247", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869949, "uuid": "7515181f-95ce-43c9-bd52-12aa1ffc82fc", "comment": "Malware payload (Mirai)", "value": "458084029d4a84f56c5fb1f97656988871bd07c31d21b35f8cdd5c256584b116", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869949, "uuid": "fe7130b0-a99a-47ad-8a79-a725d76dcdbe", "comment": "Malware payload (Mirai)", "value": "793628bcc03077a54a9f8c8f23d76d91067f810a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869949, "uuid": "c6dfc340-572f-4a40-a9c1-e66fef0a686d", "comment": "Malware payload (Mirai)", "value": "4fa6d5dccd0736d803bf7a993f6a2a346b9bf563ba153c95976468ff71f3b6e5e9a8d5ea24b87a97a5b596a270a9a139", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676869949, "uuid": "f65c65da-f7ae-4945-b1ec-2e7db6c1df04", "value": "T1EFE2D04EA37C1D67CCEDB836D0C932B06E74A28074B98F7E1762DCC696D36267C45168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676869949, "uuid": "607e0cc4-9b04-48a1-8410-8ae10f807f95", "value": "768:yuRaW0oLcr3wZ2QJGbiHd3BAmP021dL4tZ7Uw2AhRWW8:yuRaWpLeADTHd3VP08UtZn2AhR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676869949, "uuid": "7f68372f-6d34-4bd1-b5ca-884cb2c202c2", "value": 32232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676869949, "uuid": "f3676b01-fd63-49c1-beba-6bc86bc5fde0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676869949, "uuid": "049f2e42-b8a1-4aa9-941b-5ee98a692b07", "value": "7be9a2421be17f41ca13667d017aa247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a2b701-b119-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676895867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895867, "uuid": "264f1f40-37db-4d45-8e24-e993a483073b", "comment": "Malware payload (Mirai)", "value": "046bab9d8f718d983604e592af88f93f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895867, "uuid": "657466a3-2bfb-463a-859e-f7a63257fdf5", "comment": "Malware payload (Mirai)", "value": "4607c876432e0ee4bfd2741128e79190edd675f9d63619e3bba5e5b339b9c426", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895867, "uuid": "abb28ab7-17c7-459e-b129-58f35f05f2b1", "comment": "Malware payload (Mirai)", "value": "78a5e3dfa79e40a2ad924d24c79e6d1e13a317eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895867, "uuid": "8a3903b4-1ef8-4fcc-ad52-1ffd7edc6ef5", "comment": "Malware payload (Mirai)", "value": "5194a5bc091ea3c142cb2a419cc80a69b6f009f655f242a5593b901aed3b29354e5fab10f10b90aee680853e51abac6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895867, "uuid": "de46c089-da7e-487a-868e-f58b5170b243", "value": "T15563C506BF740FB7E8AFCD3749AA1705258C650A21B83B757934D828F64B64F49E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895867, "uuid": "33449243-5e7d-4b06-b128-c675ed05b578", "value": "1536:s5KqO60Cg3X1L5HILvTdt38K8ZweT4Qg:sYqO60CgHO8/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676895867, "uuid": "d3a0d359-9bb8-4280-b609-2be6cbd01826", "value": 69104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676895867, "uuid": "f305456a-457e-4fe8-b45d-f31e54d3691c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895867, "uuid": "56329a41-f418-4da3-9e91-ca1ff2e7c098", "value": "046bab9d8f718d983604e592af88f93f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290da518-b142-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676913323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913323, "uuid": "19f0c2f7-0493-443b-84ca-377a16099f1d", "comment": "Malware payload (SnakeKeylogger)", "value": "f856d71c717e9fe89196d34ffa175bbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913323, "uuid": "e72547ce-827b-491b-960a-0bfe3fbd6426", "comment": "Malware payload (SnakeKeylogger)", "value": "465ae47eaddb30a5c73bc629399fa34845f1ba18a8fc9e5a55765064b2910b37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913323, "uuid": "6772e755-c4c6-48d2-b88f-c2a8c14ef4b2", "comment": "Malware payload (SnakeKeylogger)", "value": "962b6844cfcd52a3ca399d9e344a7036ee6d4517", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913323, "uuid": "767b5207-9a9c-49cc-8d1a-3253c4d833d6", "comment": "Malware payload (SnakeKeylogger)", "value": "4d867216a85e3a59570ab1d355b9a57b540e3ddee633fabad83442d5653b8d8d04c2df57d0ffe1f2bd248a1431d8fd35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676913323, "uuid": "91bed993-9b71-4ca7-aaa7-a872cd488494", "value": "T1FBD43981DA447994EC4A8B77503E78008D2EBE7A7978A43D7B59BC553B732C2206BC1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676913323, "uuid": "8330582b-7895-4b0c-a859-e6add393db71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676913323, "uuid": "4c09a9b2-1400-430a-9bc3-1f258d6ba5bb", "value": "12288:dmu5DqZ6bb6duHKLoWYb4/+zd4If/AlfioZ:rcMWYb4hIf4QG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676913323, "uuid": "31dc8cb8-22e1-49ab-ae23-89d160bf9d66", "value": 633856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676913323, "uuid": "db512301-0ce7-4372-8e64-9462fdc14aa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676913323, "uuid": "1c0acabd-b9f8-43a7-ba56-e2a1682b2b13", "value": "XBSC150918 DPL-0001-B07.pdf - Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff154a7-b12d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676904449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904449, "uuid": "57959411-a701-41a4-b16d-a8d2b5a1d616", "comment": "Malware payload (AgentTesla)", "value": "c684ce8368f9fbd228c2b1cd58bded38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904449, "uuid": "fb1566cb-5c37-4bd7-a67a-a3813d06014e", "comment": "Malware payload (AgentTesla)", "value": "4660c50d37beb17ac6b8ffac913bf73f5bc8a43f1b26b1afa269f835d84d1eb3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904449, "uuid": "a67b167a-755e-429a-aed2-f9dd5ac150db", "comment": "Malware payload (AgentTesla)", "value": "834a54f90d19cd76b787baab86bdb38576d9d16e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904449, "uuid": "9944c772-7885-439d-b68f-ce26e3e67297", "comment": "Malware payload (AgentTesla)", "value": "3912bcd5baa02f6aa0ae4b94d302d485b88b6e465562c494d955533a3b2eddb403ccbf4c8fd987751ecf944e49709142", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904449, "uuid": "475275c1-e17b-45d9-870c-6d4fd0e898d8", "value": "T19605173A39B69BD6D139F72342E7E120B6FD90937313D858ECE60AC40F419426EDA61D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904449, "uuid": "e9dff06b-79ca-4a56-af92-8be1c4cf9b5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904449, "uuid": "bc3fcb54-3735-43f9-b550-8d51247b20cf", "value": "24576:LnF0NTxLeDfjlhpLj9w7hNDDjFeblt/1BlhlPdATsIBMNjnNNOhAe/S0Xl1NF1+t:RgTxLeDfjlhpLj9w7hNDDjFeblt/1Bl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676904449, "uuid": "350611e5-69c9-4ab9-90b6-3337b3b67a87", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676904449, "uuid": "8682382d-b973-4c33-951d-1fa9b8d193e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904449, "uuid": "4ebb7e06-9250-4340-b49e-bab9de2223b9", "value": "Request for Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444a04cb-b142-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676913369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913369, "uuid": "96aae2ce-5d9b-49f9-b9f6-6ebde587fc05", "comment": "Malware payload (SnakeKeylogger)", "value": "d4b8ee2804b4c2b80619996ddf5e75af", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913369, "uuid": "009140b7-6e41-4ae3-bd2c-472821f5c826", "comment": "Malware payload (SnakeKeylogger)", "value": "46fcca896a77ad7d01f1004dba225624126e9519f52c9fec35fdd41c5dab67e9", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913369, "uuid": "8c29d3b4-2ae4-490e-9114-f7528f6b5231", "comment": "Malware payload (SnakeKeylogger)", "value": "368e437593807a22ada26e4d0e11f34aed5793e6", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913369, "uuid": "efe39eca-a024-4ca8-801c-dd0c90c63a6d", "comment": "Malware payload (SnakeKeylogger)", "value": "cae4add1b6ace7e8c2a62598693a7160cceeb8446f9c80dd334765b47744d64401c9ae59ca47e77108b287406351f42f", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676913369, "uuid": "e5d893d6-69a3-441f-bdb0-c50866330642", "value": "T101742322CB77675DED0D07867923D38AEA9A4C04DF6A85F48E45428F2FC09C13BB1966", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676913369, "uuid": "51256aa6-6efc-4adc-8bcb-59273690f8b6", "value": "6144:2ugynTe+aVDlMZVWHukZQs4FDCx3M2jAXWASpLRR8L22zzD:Yyy+4DaZBwN4JCxkWJpLOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676913369, "uuid": "008106ab-a676-4a3d-8ccf-abafbb26c7d0", "value": 338068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676913369, "uuid": "2ffb0ee1-7116-4727-8b2d-70ecdf6fedd4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676913369, "uuid": "3bc1aa9b-4585-4ba5-8f75-502d1f141c1f", "value": "XBSC150918 INV#-B07.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960503d9-b112-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676892890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892890, "uuid": "5d541e01-202e-4f47-9425-2636978881f6", "comment": "Malware payload (Mirai)", "value": "3f87794caff4b7ab47e80e0e37d8bf3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892890, "uuid": "002d537f-edf2-43ef-8124-685e98195f41", "comment": "Malware payload (Mirai)", "value": "4870326e8d8673b78c9bdf715b1e99bd1fe4e481832a33fcf2c7e7c153b283dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892890, "uuid": "bf981cef-3a43-47da-bd21-b6da518893c8", "comment": "Malware payload (Mirai)", "value": "bb9986f160b7387a066c2b1b9a92ee0c0d94a533", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892890, "uuid": "88544a5c-a26f-4753-aa67-1c37bf288797", "comment": "Malware payload (Mirai)", "value": "8e9d5a62cae97b97a4eafb5d9aa3a103912ccea7a7a1b73652924a56f7c2b3ef2bdc48ddeee8f77caee7d6b6809e5bfc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892890, "uuid": "2b4c5cd6-f2ad-4140-8229-686f0657f3e5", "value": "T1C8431895B8819A17C2D022BBFB6E408D332663ECD1EE7207DD212F15778E81F0EA7655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892890, "uuid": "068420dd-b978-44ba-a413-ed4b7bebd4ac", "value": "1536:mcIFar6Wp+IKXB2N9bhi9tQIt5lxEHFhMdNlg:mcIFa2B23detNbMHFqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676892890, "uuid": "73a1b452-d8ed-4744-bd53-93f8e37ba6e2", "value": 59140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676892890, "uuid": "c8aa0a18-99f7-45aa-bf3f-47136688f287", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892890, "uuid": "7ba89723-6adf-43d6-abff-5f6e2a807e11", "value": "3f87794caff4b7ab47e80e0e37d8bf3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a8dc68-b148-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676916139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916139, "uuid": "165bc9ea-9a9f-47c0-878d-c76c7bad0da5", "comment": "Malware payload (Loki)", "value": "cbe88e0b9eb9d71b969ebcb19d82231e", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916139, "uuid": "2e522757-5b8e-4d5c-a542-5e3d9405e5d8", "comment": "Malware payload (Loki)", "value": "48822ad616aacef1f830308bd61345af4b091ef4fc15a54725e352ab89bf8d05", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916139, "uuid": "6fd76dfc-cb0b-4c88-b12d-49265eed4900", "comment": "Malware payload (Loki)", "value": "2616545bf22ccf220e742af99477d42317f09cda", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916139, "uuid": "cafe5055-77df-493d-81dd-ec9fd44f90d3", "comment": "Malware payload (Loki)", "value": "1400499af14f3d282d4787293b8afe1998fe651b8b91e372658fee4f2f597dcf19c1d879e34b44e0836a105b6dabadf4", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916139, "uuid": "ac36fc2b-8a47-4890-a2b9-2013e65f3680", "value": "T133442347491749818AF14D31CE38DDBD9FB0B7BEBA62AB84750C400C4FAF98AD599E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916139, "uuid": "a536d59c-4949-4724-9218-ea10ec14ddf2", "value": "6144:TStQu6TUhqNkDrjLi4y6vAkxl9OpvyHF1w:etQnT0qNofiL6voyHFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676916139, "uuid": "b2c12f7b-01e7-4a98-a605-bb9baea30888", "value": 258887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676916139, "uuid": "538d2b3b-5f8b-44a0-ada5-06f4c8c3262f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916139, "uuid": "e92ba6b7-86c7-4a34-b467-def07f6d7cd7", "value": "INVOICE 10076.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63bbce52-b12b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676903543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676903543, "uuid": "4e207631-f7a2-484e-b724-e9e5ddba76d5", "comment": "Malware payload (GuLoader)", "value": "45bbf843b6cfe5c9a58d36616098f5f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676903543, "uuid": "81368ad4-3091-4796-9251-4b4272741464", "comment": "Malware payload (GuLoader)", "value": "48e93693d74276876c042200c63085698360132663e726f775c13d9eeeba57d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676903543, "uuid": "dede75de-1e70-4d58-95e2-4ca72fc71fd7", "comment": "Malware payload (GuLoader)", "value": "e3e2289de83ff5bed9987ab3e547ec3247063b1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676903543, "uuid": "3c3fc357-b3ac-49de-a661-16657e6a1ea1", "comment": "Malware payload (GuLoader)", "value": "23cc060becb48c252bf0ea9747b60c69a7bba8128c73b30eb926b1cfd7945b12b68b926d71bc9e6ca0eb3e1c357b7f59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676903543, "uuid": "6e023340-a1f7-49ee-be43-3b5b5486c381", "value": "T14DD46C227EC3DB68DE0F90BC69FCC3578BAFB5AC9D434D0653156168EDA58AC390142B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676903543, "uuid": "6a449b95-e98d-48f0-b02f-de20a91664f2", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676903543, "uuid": "0f6d609e-a09a-4617-a78e-5d63baac1010", "value": "12288:OXoFiKCv4IJpjEKTbuDWrHru5I01ZhtTaeSBDssAYn7:OXosKvIJpjE8buDWrHru/hBXELzn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676903543, "uuid": "cf733116-2dce-48ee-ad65-06d6f06d704d", "value": 634178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676903543, "uuid": "6e6a418f-466b-4317-9996-f0a0771bdf1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676903543, "uuid": "de217d34-edc2-4041-af9a-e9f37032fb48", "value": "Pepsico LLC RFQ Information.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1fecb9-b0ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676876638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876638, "uuid": "cbd56c65-6820-436b-8d91-0ea8240d6f58", "comment": "Malware payload (Formbook)", "value": "10f81f6895ce58821af23f9701874e3b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876638, "uuid": "44ff7a3b-402e-4974-b1b3-3f555eab1d2e", "comment": "Malware payload (Formbook)", "value": "492ea8b208ed5163bcf11754cbb8cae5cd7bb4b9e6b2556129d8b9e371b75c1b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876638, "uuid": "6da46ea7-3cec-4fec-a0bf-608d792525ca", "comment": "Malware payload (Formbook)", "value": "24b02f36190e408c3dfcf42b78da4fef13738e8b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876638, "uuid": "e5dda5d2-cf5e-43b0-b150-7a182882df60", "comment": "Malware payload (Formbook)", "value": "ec860c1f8c104a07eca99b996e2b9189ed53f8bb890e985f7b30cfde1e4958552c5b970af3f57058fc9039eb097791bc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876638, "uuid": "cf7f16bc-297f-47f0-862d-ed08c445d18b", "value": "T10135AFF8B6047DD6267F476BDA96ACDD03B626629ACBA4CC806477C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876638, "uuid": "eea71d0d-053a-45bb-9a21-4a13c49e1b06", "value": "24576:fC6YN4ZaFK8ASuNpvLYs8WUSmJFNaCXxsASs3C/qwLyDHhGYlb1DOQ5qwPyG9T3N:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676876638, "uuid": "0177158b-8fa4-4426-bf40-5f7f43d21080", "value": 1073694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676876638, "uuid": "27fba53c-8818-4d09-9611-cc1c88be3e70", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876638, "uuid": "afe48f74-f522-43b5-86a0-d22c398c5795", "value": "MBL OBD-COAU7243048140.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c853aba2-b0fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676883955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883955, "uuid": "6fe3794c-8495-4382-b908-33315b412c44", "comment": "Malware payload (Smoke Loader)", "value": "5c16de5a16ef6f852cdda88797fcadfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883955, "uuid": "c4e1c837-f6ae-40b0-a2f1-38d9f268556e", "comment": "Malware payload (Smoke Loader)", "value": "4c9c65c2399e6dec22bbf1a84a3289ea5dbce81676511fdb265f06f479f7da22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883955, "uuid": "bed17ebe-a809-4559-ae4c-ef1e7eec60f5", "comment": "Malware payload (Smoke Loader)", "value": "40cb0e3db979147c3ca9ffb2a10d9f42c4e1addc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883955, "uuid": "ea34e2f8-b513-4e79-a4fc-0a462ae095ab", "comment": "Malware payload (Smoke Loader)", "value": "faf0a4deaf23d390bc6917c7981f971af1468c247d4576fabb95012ccbbfda58f30ac8e609a0b1fce0ac807698b03ab0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883955, "uuid": "999864d2-cd97-4cd7-b707-616653d5e302", "value": "T14014E12075D3D1B6F45709B894A0DBE8A9BAB96016E5C48FE7A4136E1F303D23B76307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883955, "uuid": "0aeba214-8927-4cdf-bb70-8874acc8a545", "value": "91260fbba24856473635dc78b8d8ea46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883955, "uuid": "83c2e257-992c-499c-95e3-519de333f9c9", "value": "6144:M2AbLqLyn+I5HoIkI8YFRes7hQK9eV619:ePqAxtoIzDFRgn419", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676883955, "uuid": "e8354876-24de-4b5b-a11f-75e036b3afbf", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676883955, "uuid": "aa305765-e1fb-4399-9386-511fcd35a55b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883955, "uuid": "0308360f-5585-438f-a923-5bf61b55f8bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aefa51e-b119-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676895878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895878, "uuid": "258a2d3c-6bcd-4b34-86bc-347674525dbf", "comment": "Malware payload (AgentTesla)", "value": "7ce90ac0bdc6b44b538e1196f41de730", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895878, "uuid": "24f24124-79cd-4f77-8ab5-b1130c475df1", "comment": "Malware payload (AgentTesla)", "value": "4cc43b3af7bd903ff5edba267c126237c7cd9c0e7ba706f019a30d0af3f4a5a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895878, "uuid": "49d5fe9a-07bc-4b49-96f9-158b0463a1c5", "comment": "Malware payload (AgentTesla)", "value": "beb39e21507c5b76b2c1bf63dee06e987d0cb422", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895878, "uuid": "750354e3-330d-4e4e-8961-83c7b0b8a682", "comment": "Malware payload (AgentTesla)", "value": "78846223644b573b2f78ae4ba52c308c3ba4b508076a4fd67948c283bb4166bdef8ecda0544331892a764dcf69e05edc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895878, "uuid": "80f5eb8d-f312-4609-8202-9d99be5c7662", "value": "T1C05229011B8EA4F6E258E5335226A41D4ABDA0BB355318E9708DF49133FC61EAFF50F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895878, "uuid": "4cfa6f08-3b70-497b-9959-a86fe0a7d739", "value": "192:+n/8WPAf9LFQhORKiW/ps87QGrRR1n2uJ6QrE5GuFOm7MoM3H5J+D8q2uq49:w/LPAfJFQhFi187hv12+UGYn7zP7D9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676895878, "uuid": "83565a65-672e-4742-8dbb-e0083076e7c4", "value": 14364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676895878, "uuid": "33c2d26b-f2cd-4873-8998-964085ed768c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895878, "uuid": "bcf63610-a2c4-4576-b669-3f495e51b97b", "value": "7ce90ac0bdc6b44b538e1196f41de730", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c50fe9e0-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676882661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882661, "uuid": "2e3cf23a-a540-4fd7-9807-db270a34fd62", "comment": "Malware payload (Formbook)", "value": "383bad522ca8192856866d5e5e8182fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882661, "uuid": "32b3b3da-512e-4b26-8d7c-94029ab2bd6e", "comment": "Malware payload (Formbook)", "value": "4cdfd3ac195a3194d4a4ad72a3d3aeab0009f8b8bcdd73f7664ebeafd0023bae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882661, "uuid": "93c50657-46b1-4b51-97ab-051cb9609b96", "comment": "Malware payload (Formbook)", "value": "385236e960b184ab7f1d588c625ca95a56191e3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882661, "uuid": "09b54f92-5f3a-4785-a5f2-6feeb91e3bf7", "comment": "Malware payload (Formbook)", "value": "d0db7a104738fcd0fbb1e5ce65839a9b7a49258ac903a434f28565fff2f42295bc159b47251c10582645bd07bf8422e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882661, "uuid": "724779ca-14ac-4e94-801f-2c1826bc0150", "value": "T14304AF76D642C031E2B251B5F6BC0B7B8C3D0E343255A0AAA7F216E06EB4995F52D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882661, "uuid": "66720fa2-aff3-490b-9c42-fe3306db659a", "value": "3072:ZgTsIkmchQ6Cez3bIbOy/a9DVAqiOwp0iTGVoddQqGYGODaj:bYV6bmLa9DVAqmtTG6ddQqeODaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882661, "uuid": "2ff7547f-4b52-481b-b67a-9c8d6dc3768e", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882661, "uuid": "120b4240-3237-4df9-b605-25ab8575a6d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882661, "uuid": "71ed1e61-b8f7-439e-959d-c7c4140bc6b3", "value": "4cdfd3ac195a3194d4a4ad72a3d3aeab0009f8b8bcdd73f7664ebeafd0023bae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2edbb67-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676882684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882684, "uuid": "7bd76935-d427-4308-ad5e-aa597a5981e8", "comment": "Malware payload (AgentTesla)", "value": "75de744c7b75a177547504b417016d7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882684, "uuid": "ec210cfe-f4ec-4fe8-b548-f59346d3e9ec", "comment": "Malware payload (AgentTesla)", "value": "4cefd40aedf94e6be305b9954aaf2fef090ca8a21bd6059a318628d716b852c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882684, "uuid": "6b5e6713-4b43-44b7-bc4f-e72e8eafc3d0", "comment": "Malware payload (AgentTesla)", "value": "4b98dcfc6925614fa969bdff9640b12e4b609da1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882684, "uuid": "487d62f3-1457-4ca0-91b3-db1cb3d9a5b1", "comment": "Malware payload (AgentTesla)", "value": "9d393e79f2a52663017a4df32df200095bdc45c1fce3c64c105371073c7aedd3255dee43814f277f1c06847ffb46f548", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882684, "uuid": "782b76b5-4293-43ed-85d5-4c62835d5c00", "value": "T19FC4129466F88B16EDBE2BF52970196147B1742BF533E72D1CD0B0E52F12F408960BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882684, "uuid": "30858e98-5e71-4193-b38f-f9f913168a2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882684, "uuid": "e1c54e5f-6637-416b-ad60-84221e0dda26", "value": "12288:ImxoeB2gdupJw1LqqlzavA/LKnwwDtbMZBr/Rni/ebYvES1EJ:FoY2oupJeRaYDKwkbMZBrtTYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882684, "uuid": "6e9dce26-7316-4eed-b597-90dddbb68a32", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882684, "uuid": "586c3482-718d-45ca-9bf7-1d5bc42a43a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882684, "uuid": "2566396b-42fb-4df3-9be9-d3a71f4cc704", "value": "confirmation of payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb9ed12-b0eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676876312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876312, "uuid": "432b72e7-340c-4f6b-b45f-1902f1370cc9", "comment": "Malware payload (RedLineStealer)", "value": "55a73026582ec6302b480c4211c45fb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876312, "uuid": "89bbc4d2-f8c4-4890-8510-ed8d7d780c0c", "comment": "Malware payload (RedLineStealer)", "value": "4d02e2c75e0c1a93f6b2285a7964385cebae63fbd8e49f59095808de24faa09f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876312, "uuid": "75be675a-c351-4e80-b5b7-785671353b98", "comment": "Malware payload (RedLineStealer)", "value": "57440d1a801582f1d138c1bf67db9cde69f8ffe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876312, "uuid": "0d6dcd24-eccf-4877-ae78-39f6c745d7ed", "comment": "Malware payload (RedLineStealer)", "value": "2d3b1639c7a7e0f829b7b307c352d2e84c6ff168a957f03e0750cc7aa69cdf9f01e66ec6aed0a91638973b3066df7cf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876312, "uuid": "9fc8dfa3-a9d1-4aa8-9efb-d89ec0298bbc", "value": "T16BD41217B6E85432D9BA1B3058FB02D30A3A7EA05A35935B239F6C1E1C336A4F631757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876312, "uuid": "e4f38d57-618a-46c4-93c3-8aae745498d2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876312, "uuid": "97d2a1ed-5678-46ee-90f5-fa34d8d5739f", "value": "12288:VMrxy90ivxfrT0xxBeZ9aqZx+Yi8rtIcynxm2ER3RxRaU:cyXxfroxbepz+Yi85IBnxm3RBxRaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676876312, "uuid": "8ceacdfa-3788-4893-9d88-db7459a7b130", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676876312, "uuid": "fa6d0695-2d7b-485b-b5f0-8f0118ab9733", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876312, "uuid": "75067236-3b84-47c1-a1d9-05a7500cf31c", "value": "55a73026582ec6302b480c4211c45fb4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b2c32ce-b129-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676902562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902562, "uuid": "0e8ddcf8-8822-4d0c-9e3b-a6c340948fbf", "comment": "Malware payload (RedLineStealer)", "value": "38e0d026ce1edf5dae72c45aa06171e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902562, "uuid": "4911512b-91ae-4e9f-b00a-d0b1dd673de5", "comment": "Malware payload (RedLineStealer)", "value": "4e5b4a5228345693fa91afaec484587a10c8156576b49225be0364373b6a45f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902562, "uuid": "f3a4b66b-6e84-40c8-959f-aaa89636d1c9", "comment": "Malware payload (RedLineStealer)", "value": "7faadc8b955f8516b1c3159b4872e4b6c83aabca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902562, "uuid": "0ffc536b-eca1-459c-ae42-097748bf8ee8", "comment": "Malware payload (RedLineStealer)", "value": "08ed6a2459f625832ef262c1322c25e87e5f94ce8f99042d67b29a3c2ba7da2ad60bcca4af8f2380cfce9de4ab456e4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902562, "uuid": "3f121942-1d76-4f3d-9027-69b802cc66bf", "value": "T181556C0069C3B031C42916F332A4B27E59F6369B0E348E9FBB7405AD6E287B35AF155D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902562, "uuid": "c6143dd8-ea58-41b2-947b-af526b56e8ec", "value": "6386803ce5b01926df5975d310d21789", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902562, "uuid": "64a89b15-c25d-4cca-9545-d9d599b05cc6", "value": "6144:/trvJ0yyaWKflkIe1kD8O2w/AOrKdm2QSH7IW0/Ehc:/trx0JKHBM29/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676902562, "uuid": "ab96114f-743a-4319-96e6-0764e3cf1b32", "value": 1379344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676902562, "uuid": "82b54623-0459-4981-8c19-01fb146f7a17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902562, "uuid": "2d2aa330-4d25-4ba7-8e23-80d68266654d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4b8e58-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676908790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908790, "uuid": "90f685f7-220a-4ab8-b604-79017e7b50ad", "comment": "Malware payload (GCleaner)", "value": "bf95195158c35f86e02b79e36ad26a20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908790, "uuid": "0855331f-c22e-47fb-a05c-56334352964c", "comment": "Malware payload (GCleaner)", "value": "4f3b3a58cf917cc065473b644107bedf72121fa1591335bccc4b95f331c4ac9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908790, "uuid": "14ede2b8-1d43-43aa-bd1a-36fdfcff0e70", "comment": "Malware payload (GCleaner)", "value": "9de96a91426ce90152d708f144c5a2af1564c337", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908790, "uuid": "1dc7ba38-f2aa-476c-9119-b9ea0410c56b", "comment": "Malware payload (GCleaner)", "value": "96910e8ff971bfd51b42c3aa63492d15fcbe2d7dcad432a4589ee3b1dd54c2b8a68b9bb56996b96e1f9653ddafd8e01c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908790, "uuid": "b9695836-3f9b-4bf7-8a57-bcd6f9150666", "value": "T1AD44F111B9E08932C4A770708472DB902EFFFD022764594BA7B82BBA6F317C15A70797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908790, "uuid": "20014268-ef4e-4b8e-879f-a38bae0cc344", "value": "95990319cda68ac8cf2d8fb872345073", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908790, "uuid": "6520c2f2-e776-43cf-a475-d0b1283b5da4", "value": "6144:1PWLW7qYt4wTp5bR4PgdDWho5+DT1wZlMGtlC+:BWS71t42TbR4aCVT10a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908790, "uuid": "119ba0d8-d78e-4d12-b785-cb99c26affc1", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908790, "uuid": "96777bc4-5740-4e5e-8485-0d0ba8251d11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908790, "uuid": "411c2178-fa33-4f11-80bc-c46daabdd02d", "value": "bf95195158c35f86e02b79e36ad26a20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abcd3625-b119-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676895933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895933, "uuid": "50933667-0998-40a9-b456-8542ec64d671", "comment": "Malware payload", "value": "8b840aad1c521638ea37ac240e274ea0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895933, "uuid": "2d1dc98d-41e2-4b6b-a0c4-9148a7b0c11b", "comment": "Malware payload", "value": "4f3b7651a758e9086c8bfd12ed5e5672557178be9ee44aa93885679af21f0669", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895933, "uuid": "1373461e-7ef6-42a7-a61c-4f239d2396f2", "comment": "Malware payload", "value": "9ce3bc43fa1139418d57aab80eed55f72a44886a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895933, "uuid": "24a09242-f092-4a74-b179-77c834fd72fb", "comment": "Malware payload", "value": "0a196c7be609519975b28b82b9d5157d11119464821e0bbfb670de9e0bf33939354b00d45d39328e243346a6965e526a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895933, "uuid": "b28b7839-ce86-4bac-bcca-824c6fc2bb54", "value": "T13E529748D051536FC3E163BBD39A1F8F7E3B0ACA6B9B531AD13984902343F887995D28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895933, "uuid": "fc252baa-600d-4e62-bf08-7d703ff863a9", "value": "384:Nsi14yLxCv1JOh3KZgFVlY2nnnnnnnnnnnztKNTovL:34yLx26lbvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676895933, "uuid": "a5154548-05bf-4313-aa5d-986bc297cbc2", "value": 14203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676895933, "uuid": "0ce04890-b7b7-4489-9e8a-8e4830bbf701", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895933, "uuid": "827a30f7-0711-4eeb-875e-39fcaa5efe3d", "value": "8b840aad1c521638ea37ac240e274ea0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558777b2-b10a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676889346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676889346, "uuid": "6b3f378f-77e1-4207-b0db-8474956b1afd", "comment": "Malware payload (Amadey)", "value": "13bf2ca81bc2d765d3161a014757fc4c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676889346, "uuid": "361db3ad-235b-4bf8-95df-55c6e974d64f", "comment": "Malware payload (Amadey)", "value": "4f5f2a0d5fc97d3c4b2a6f6096387ee0ff7eff1974febe635e3dc0f09a2abb92", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676889346, "uuid": "4af24a76-0b98-4427-8e27-f3199fd4b3e2", "comment": "Malware payload (Amadey)", "value": "5ab6e5a55f3b31098bf1a855fc75b7203b244507", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676889346, "uuid": "2c29d9c6-fc7a-4395-baa9-9e39c205a87a", "comment": "Malware payload (Amadey)", "value": "a482b34153fcb18cae12e56f5f9aa0e4d4e8c8687c190daa8f4500f2e4c7a5721a066cd006f5e16ae49b743c33cf0b23", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676889346, "uuid": "36067974-bfd3-42b8-841a-5f889e5fc8c0", "value": "T1B935121BFBE94120CCB90B701DF602C316B6BDA06B358797270EAD6A0DF2164677536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676889346, "uuid": "2a4ca4f9-7b87-46f2-b03e-eb11c2327ec6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676889346, "uuid": "e27e95c5-2303-4cb9-b4a3-bc834b72ae3a", "value": "24576:vyRBJ4bWfNF+iuJ46gD5Bgq/GbfR4K0L44cw4EKs:6z2Wfyiu7i5ebY4o4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676889346, "uuid": "3014cdeb-5c55-4c9c-814d-3f15479a0726", "value": 1114112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676889346, "uuid": "062994a6-6ca7-4d67-9241-f4274ece4189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676889346, "uuid": "4134cd6e-6409-481a-ba89-aabf5b91d152", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8abee2cb-b14a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676916923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916923, "uuid": "7f989f08-45ed-42cd-9597-12566c286de8", "comment": "Malware payload (AgentTesla)", "value": "cfda948f57563c6c807b47ff8d17d0fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916923, "uuid": "24f01adc-dd80-4f15-b2d1-a23fdb496c93", "comment": "Malware payload (AgentTesla)", "value": "510f6c7a4a9f1b223557d85a775ed62fa86044197764fd19c8d11ece6f6a8c1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916923, "uuid": "d6c96b09-878e-4c74-abf7-83b82c5a944f", "comment": "Malware payload (AgentTesla)", "value": "fb3e0fdb31749814d2dabc09a556f8b31841b7fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916923, "uuid": "df38ec3a-d210-477d-9dc4-e243996ee17e", "comment": "Malware payload (AgentTesla)", "value": "fde685f949c78dfb4d5d9e8fd2e96ba1795a7e4cea48060344feb1ea8b8693d19710f6df5ce655c300ddb0a0c00ba705", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916923, "uuid": "0fdb49e2-cf83-4e51-bc76-2a6354813a89", "value": "T187153384C82081AC7DF13B86FF7481F485A68AE7864F6B166C37A5BC71D06602D4B3AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916923, "uuid": "4407ee96-8294-47bf-bd9d-5c63ea7c2bf8", "value": "24576:LPm14czkDhGpS6Y1aHMMsxqLMhK3Nr/sEXwN:bmNoG92aNsxQdr/sEXwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676916923, "uuid": "9dde02d4-5008-41d5-a7a5-e2a422a0e6cd", "value": 907738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676916923, "uuid": "73f50381-d184-4617-bc03-5be843c6f9b8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916923, "uuid": "fe71c4d5-4137-434d-9f37-95df454b1ae4", "value": "AWB NO.3522849002.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92685cd8-b156-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676922089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922089, "uuid": "aa62bfc5-92c2-4396-9e7c-b0e2759d8981", "comment": "Malware payload", "value": "134d9003c05978f3192c8159c219be00", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922089, "uuid": "8b7feeea-cd1e-465f-b82f-940b817acef9", "comment": "Malware payload", "value": "515f5b1e6ff8a44a06fa70ca3d0cd212516ec8bc0f029e3642fd2c7e303b9826", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922089, "uuid": "4e53115f-b197-4f19-b6b8-a03ba08ccb32", "comment": "Malware payload", "value": "709628edeebd4fa3604ef2a614ff375efdda534e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922089, "uuid": "fd41c8ed-3f62-401b-965f-4fdf82ea31cd", "comment": "Malware payload", "value": "d76063e46e218ab636f9618bcb37a5a3c308a5f91836e63180e9a1c1ebe3f45af62ca97a225b8b8374180a1418b1a31e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922089, "uuid": "547eb014-e561-49ea-a5a5-b2b28dce1e5d", "value": "T163631D82EE528906F5415332C9F7927967ACBC40BF6A9F136145B31A0E75A802F3FF16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922089, "uuid": "5b9ff61e-067f-4f9e-8f53-279aa79fd9c1", "value": "1536:oF+xEtjPOtioVjZUGGnwfDlaGGx+cL+LIfnAc7IfHcr+mciohoQ:oF+xEtjPOtioVjZUGGnwfDlaGGx+cL+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676922089, "uuid": "e2ba4e0e-454d-4398-8552-d3bf6c2bf840", "value": 68608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676922089, "uuid": "56046721-97b8-4046-9dd3-6d1ee35544c8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922089, "uuid": "cd035284-9fda-46ef-bebf-c57cd224dbd2", "value": "515f5b1e6ff8a44a06fa70ca3d0cd212516ec8bc0f029e3642fd2c7e303b9826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76c7936-b10f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676891738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676891738, "uuid": "a47733f9-7cc3-4294-b6ee-dab869a2c71e", "comment": "Malware payload (RedLineStealer)", "value": "a7ea7b7d6112dcec9f2784e9ac5fc5b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676891738, "uuid": "071d9caf-e1dc-400c-b96b-aa04b8ea43bc", "comment": "Malware payload (RedLineStealer)", "value": "53ae05b08fee241dc3b6925fa631b50e81f3faa4ecdc9090dabb1b871e7f90dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676891738, "uuid": "2a58c8a1-2be9-4f89-ba19-a898207d6cee", "comment": "Malware payload (RedLineStealer)", "value": "a06eb23e8874d108b113eed4ddc58e0dfac750a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676891738, "uuid": "22a6e348-ded9-4a54-a427-2cfbbdfe3b88", "comment": "Malware payload (RedLineStealer)", "value": "e60e86e6c03247bfcb052b3977ddf1569f34cd13464a78cbde416681b6e02ce59124449e9ce108e975cff3ec0660c141", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676891738, "uuid": "d5427a85-92e0-4a03-8a24-229f8e03dd92", "value": "T1D63523877ADC4476F4B49B7108F702D322367D60AA35835A538E5C9B48726F8EA3137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676891738, "uuid": "9041c749-a3fb-48e8-a656-89ab3360903f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676891738, "uuid": "bbf8ccec-7a71-4b28-af42-076b0e7ef127", "value": "24576:7ynUeVFp5+d47ip3/Fs6A3VNZp7mAsgo0mV1roYvokwjEepvDFsJO:uUevj+d47iw6s/m5ymXvwNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676891738, "uuid": "096ee0f1-8431-4e7f-bf2e-9e1845091ff6", "value": 1109504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676891738, "uuid": "abde792a-7b46-41bb-946d-8fe454028552", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676891738, "uuid": "d9af149e-0ede-415b-bc49-2682ccc8c239", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a70f92-b156-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676922092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922092, "uuid": "d22f68f0-027c-40d4-8a87-7d1cc5383625", "comment": "Malware payload", "value": "41206c2e0552d76e962428f00c51f05e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922092, "uuid": "4e80c238-3363-4e0f-8ffb-6a0f4590d870", "comment": "Malware payload", "value": "5466728290bb0e39fc5057e8062e6861faa86e7cebdba638977abdb297f3840b", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922092, "uuid": "522a5932-eca3-43d5-a66c-3e8b88b224bf", "comment": "Malware payload", "value": "a4d1df2fee5464fb5c7d42b10fa44b09aa38687a", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922092, "uuid": "f1724666-8d7a-4b79-9074-522d5bbd8ef8", "comment": "Malware payload", "value": "00bc07a2f7ff30f7edcc4af0406aa2e06d609678cea4f744cdfa29b31e86258d23d84ea07c1a30e4b444673699932378", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922092, "uuid": "dfacf7ba-a86b-47d3-86c9-9a723fffd02c", "value": "T10245A151E613CD8AED25C37D30A38BA03331E84C66A1DB1B138DB66E7DD5900AF93799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922092, "uuid": "a613981b-397a-4dc1-8c64-ebaf1f5a7615", "value": "6144:nTSWoCs5CrKvnSCDSgUes2Tp57K8lO56k7pu/0F6LTmm/rF5XHxFJbz/Gskdo4zv:mWWKhPyEVYgjDmAxoOs1wcQBLGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676922092, "uuid": "59a04999-bcce-4739-ac99-e2a3fbabc29c", "value": 1180160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676922092, "uuid": "5d18a14c-c1b6-4b3c-8ed9-04212f43cd56", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922092, "uuid": "67559aa5-bb01-4d10-876f-52d0cf9cb884", "value": "5466728290bb0e39fc5057e8062e6861faa86e7cebdba638977abdb297f3840b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07d747b-b0ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676877499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877499, "uuid": "5bcef851-40c2-44d4-8e9f-132c64043de3", "comment": "Malware payload (AgentTesla)", "value": "a1f82780353f543a7ac3f9fa6190a49a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877499, "uuid": "53a51274-0e41-4840-86c6-b513a20ab5d3", "comment": "Malware payload (AgentTesla)", "value": "550eb45e78579594755261259ff1cc31f442f2d572a8c94c7b73d9b63770d6ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877499, "uuid": "66563b65-1702-49a3-b3f2-d34f93ea7b34", "comment": "Malware payload (AgentTesla)", "value": "8fbb03b98cacca34e69afbda44d910b3c901e7d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877499, "uuid": "96e4a83b-10bb-40c2-9831-de3e42690ef8", "comment": "Malware payload (AgentTesla)", "value": "09eac3d1e49fe6f58ffec7bd001784027793bae90856fdfde5abc3df8932cf576e25a9e2ebebc3ac28ca5eed94dc9a97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877499, "uuid": "b87b5314-9b5f-4fbe-9cba-cc460f495fec", "value": "T1C9E49C8CD0F1EA3ECB498EB9371035081FE056437924DAE6E3A5FAC22F76523199D536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877499, "uuid": "c1290c51-bb62-4e27-9ce5-205751ee03a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877499, "uuid": "3ce9219f-ad58-4899-b740-21250ae8dbed", "value": "12288:ALvFqDSuqDsv9tIZVdwYWzIAvZ3Up1QCr6CLOpUDQohYZCHFV0McNPvWQusbWDsT:ALvFqDSuEwzzIC3UpbXO6DLhYMyhO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676877499, "uuid": "60dff314-83e4-4ee0-a97d-46790fd7e151", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676877499, "uuid": "291fff3d-bdc7-4a8e-bb1c-998dec4907b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877499, "uuid": "84f3669e-caf4-442d-9317-57501202460f", "value": "2023 TENDER LIST FOR LUNIOUS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d380f0-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676882691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882691, "uuid": "59ad033a-df19-4ae8-b80a-8803b74dd52b", "comment": "Malware payload (Formbook)", "value": "282a15096d081462bd66a100cca0ae18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882691, "uuid": "29b08694-35ab-46bd-a9f8-2a2f27570b5f", "comment": "Malware payload (Formbook)", "value": "5835c8fb4418534842cea83e0e2119ffcad63ad665064be9ad9f355a92a8b723", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882691, "uuid": "ce269d38-274d-4cba-8d9c-0ecb0876a310", "comment": "Malware payload (Formbook)", "value": "7e22c47a208cb6cd8543b8c58e602db8e03a530c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882691, "uuid": "bd5bc156-ecb8-4c11-80cc-9e97645b12a4", "comment": "Malware payload (Formbook)", "value": "e378ec1ed14c9c65785e4f79a63d5eb999a042adc43b33dc538b5d56cca8877fb6a88b04be5c032715e26ada6f946471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882691, "uuid": "fdb38d0c-ba4d-4d54-897f-56d75c9633dd", "value": "T15784120D7599C9BAE47217B15F3E5A45AF7A3C22A544970B23C0391E3EB2290DE1E327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882691, "uuid": "c8d0515f-f007-4191-b6e8-2cde8b588e27", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882691, "uuid": "1ddaa387-50e6-41b6-816f-22b9f3a527d2", "value": "12288:SYi+qpO4ARr2HwZu7caI8Coy68DsXgov7ix:SYi+qpOB12HCCcaIVp6wsXPex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882691, "uuid": "135fe9ba-fd6f-4c60-8e1d-6fb5acb3c17f", "value": 403800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882691, "uuid": "9f36b001-1596-4d15-9947-d79d4ebb0289", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882691, "uuid": "af8d3696-1c92-43d4-8786-18d6d8937c85", "value": "dutch_94854_0293_invoice_30495.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5e1d07-b146-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676915239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915239, "uuid": "16aac446-1783-49af-a331-abe718863d2a", "comment": "Malware payload (Mirai)", "value": "2c645ec8e7c7b4a11d6456570a6e4b56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915239, "uuid": "c17602f1-7fc1-4e34-976b-785dfef4b4ab", "comment": "Malware payload (Mirai)", "value": "585cb09e7e916460ef762a48a2ebe5eb1f3c184c5d4d7ee98e5529d70b0205a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915239, "uuid": "fbdb1a77-205f-4d07-8d5a-73d17fffeb1a", "comment": "Malware payload (Mirai)", "value": "a5139417ee656f89a6de40c840fa7e92c534d7c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915239, "uuid": "7fd897b8-c867-4fa8-b1f7-6a8748a8150c", "comment": "Malware payload (Mirai)", "value": "0dec7418944cb31a24c05a581f0b94ed42fbe443ef849273a7bccd6dad34585c1ac4ac6bc7601e3e9637da972eb71d98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676915239, "uuid": "871662fd-9a2c-43ac-8d28-9ac97a4af8e8", "value": "T13A33013006F21CF1D2A176F6F23F4456EB0A0F6592FC902AA53D431936E6462E2F4DD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676915239, "uuid": "3d7dff12-d3e0-475a-b96a-06230499f698", "value": "768:7AAXFHMN0ZRskSr0LynBe8D9vNqqqkvWfNKorr9q3UELvS0FBSY+gtz98U9JL23q:7AA1HMVxlEkR0xKsKLvSmrBL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676915239, "uuid": "02af8278-8d31-4601-a9b5-c917fc268d9c", "value": 54016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676915239, "uuid": "8462ebb5-c8ba-409a-87a7-f5af872e856f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676915239, "uuid": "55e3e179-46d2-45b8-81e1-01d80f9f1674", "value": "2c645ec8e7c7b4a11d6456570a6e4b56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56473d6-b11b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Babadeda)", "timestamp": 1676896835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896835, "uuid": "f93d042f-6498-4ea2-865d-b516d6ce0b70", "comment": "Malware payload (Babadeda)", "value": "74fc503e1100f6c092cc42c3d747fc31", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896835, "uuid": "b8f9b98e-f63f-4f7a-b9d3-9af464935dfb", "comment": "Malware payload (Babadeda)", "value": "591a2d0da6253f59300d647ef5847187e0250458187a10675f6699b7e1ba484b", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896835, "uuid": "e80e55b1-df93-46ae-8671-7a28b54411ed", "comment": "Malware payload (Babadeda)", "value": "b342925f66bd36e486fee9e44a67c2b9c02776a3", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896835, "uuid": "a0f7870f-e506-4930-885c-fad72ac5025d", "comment": "Malware payload (Babadeda)", "value": "74cf5c1e2f9ebcc51d84a5328276150fd9624c5cf019b3572f6e7765f4f35839fca76c842457dad8bec18d5bbe74aceb", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896835, "uuid": "d36d5ac0-c534-4e07-af7c-4fd13e31f017", "value": "T18C27333BF3A8E03ED9AA173209B25360DA777A61656A8C4E07FC744DDF721600E3B645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896835, "uuid": "4bd8c0f1-a80c-47d8-8d3d-911283f18d1c", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896835, "uuid": "88523d95-f3af-48e0-b8d4-d56e7801c3cc", "value": "393216:2UuAZ1IwUF3NnsQ6W9eZB7/sMmkNw02St4yQJUuFe2HiuYpIsjPq4NJVeqi:2UrZ1IP/nsWejVNVF255dCRp/j1yJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676896835, "uuid": "32b9ca21-8438-48e4-90aa-f3592c682373", "value": 21367112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676896835, "uuid": "4e8a2b4d-70c9-4c1c-986c-27340ded775b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896835, "uuid": "b91533ea-b572-424a-b1a8-1d252a8731b5", "value": "74fc503e1100f6c092cc42c3d747fc31.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc538f7d-b0f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Lu0Bot)", "timestamp": 1676881895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676881895, "uuid": "7e7665f1-b58d-45bc-9516-507372c05e79", "comment": "Malware payload (Lu0Bot)", "value": "8d3700a6bd7f83aad136993a3b9984ae", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676881895, "uuid": "c33b7ba6-f208-408e-a2aa-662bbc3d54d8", "comment": "Malware payload (Lu0Bot)", "value": "5920894ae997b61f27b53c9f6e598df5f928acb11a5dc09f4fa0627747f1312d", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676881895, "uuid": "3639580f-742a-46ad-b46e-42ea3b5c67fd", "comment": "Malware payload (Lu0Bot)", "value": "13cb7fdd0006f540425f5da3ea937544215ac286", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676881895, "uuid": "2091fe21-e669-4482-8327-0392cd3da4ce", "comment": "Malware payload (Lu0Bot)", "value": "142c85c3980df1933962315c4e74c5fc227780f61c311cb89284ac87ce0b95aae59dc60f38999ff6206ca9e39111c667", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676881895, "uuid": "90121f7c-a19b-45d9-b6da-e16c67694dea", "value": "T19BA52346D7ED8823C67423B62DE206C71F3E3C509DB0867F2B8556146D73682ABB2772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676881895, "uuid": "af4059f3-0baf-43a0-b228-6b018b11344e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676881895, "uuid": "de034400-7685-4d02-8d34-2c75a1247f05", "value": "49152:2kh9ck+SaWDhfaTz016bPGUsaZ99zDOYcX+ryk9D0BLS67LG50:VEg1ibuYcX+V0eQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676881895, "uuid": "14cc98a1-cff1-4399-b309-b2d31ccacc12", "value": 2191360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676881895, "uuid": "60facb03-6ddf-4477-a31a-b148b196d8d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676881895, "uuid": "fd66ca7c-5ba4-401c-afdf-d4eb9c883c08", "value": "8d3700a6bd7f83aad136993a3b9984ae.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9d6eb8-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676908717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908717, "uuid": "17cc6aad-ac5c-4b98-9102-ed5fd9e86562", "comment": "Malware payload (SnakeKeylogger)", "value": "810af0725fe04b2534f0cf035ece394d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908717, "uuid": "ed4d129f-cab3-47ac-9ec9-80ba151285d9", "comment": "Malware payload (SnakeKeylogger)", "value": "5a5a1af62d3fd9105907ec56de43f7115d108723569231054f4d0d27c91f8819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908717, "uuid": "76bf6928-a899-44c0-9eec-3254d30d7a72", "comment": "Malware payload (SnakeKeylogger)", "value": "cb9e3f7e3d4b505b662595bd9f71defc43f689ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908717, "uuid": "5a5d0841-363f-4e0c-ab56-5f3d6782521e", "comment": "Malware payload (SnakeKeylogger)", "value": "6b09de800038c9d6fd75d9c545edb9d8dfbb1a9ce00227bd13042d2eca57b33030388da5d7ede932b8a449a4089150f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908717, "uuid": "06a38947-1c32-40db-80a9-283caa388308", "value": "T1FC25AD19A3B0D6B7C58B01EF58381A0D39A435437619E26C8FB77FD292749FB35A9203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908717, "uuid": "85dcdae9-d76e-449b-8952-79dc401d804a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908717, "uuid": "42c886ff-f3f8-4382-a39e-c36d68271197", "value": "24576:yqT4yZ1XuffPggnfKv2R037bK5wVN0KIZwQprYE:N7sXPgN+R037bK5wV0ZwQyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908717, "uuid": "d7784e4d-88ef-4676-86fc-c17ae9521006", "value": 1002496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908717, "uuid": "e7687df9-c17e-4600-bae3-e1ae799cd7a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908717, "uuid": "a49e4150-e01e-4dfb-86a1-337d8ed8bee4", "value": "#90031-8O.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d34e20-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676882722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882722, "uuid": "e01954a9-173a-48e1-91da-969707e02ac8", "comment": "Malware payload (AgentTesla)", "value": "25cc5316df82d69e1cafe3d3a7023300", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882722, "uuid": "24c2bb58-f8f9-408c-8c02-0a79426c50a9", "comment": "Malware payload (AgentTesla)", "value": "5a600d2062f35b10175dda7e20783626ec76bbbc54986ac4a4669d0e8763897d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882722, "uuid": "b714ba3a-5727-4ac0-aec7-e2ac38304f9c", "comment": "Malware payload (AgentTesla)", "value": "cc8ac2546e29d478cc808131d65baafa9aab3f3d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882722, "uuid": "5a09aa51-eccd-49e8-8b6b-66c75d6041ed", "comment": "Malware payload (AgentTesla)", "value": "4e51b3773234e2b7f99a2e5cbc197e6d238c992c2278ef299cd8b9fc7910929ee7075e0bf2fe76b2974ceb4e5f10440c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882722, "uuid": "d97b5196-4674-434b-bab1-7eb1f2887684", "value": "T1E0C4D2A8F2E1E279C80782313A3DFC7347F50DBCD871D915A9ADF8A1C530EA61B62546", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882722, "uuid": "cbf409d3-3549-4b01-9f11-ae2302db6beb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882722, "uuid": "c735c43b-52a2-41ff-977d-6b8d2d2982fd", "value": "12288:16I779bnh7+FQ52007cmlvSzaL8JiQK4:Q89bnhgd7cm1cbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882722, "uuid": "555656ce-764a-4ebe-8c5e-5e53fce5527a", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882722, "uuid": "7836ed16-b6ee-4f52-ab74-71280f0d4fa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882722, "uuid": "0c8b0c5c-7a30-4d85-9e83-e86cec7531f5", "value": "SB-71108-16300doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a82c127f-b128-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676902369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902369, "uuid": "c42ce864-9557-4438-8133-6174f527101b", "comment": "Malware payload (AgentTesla)", "value": "03a9591468dc710d83f40441441b823f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902369, "uuid": "c949857d-c53f-4810-b412-e4a6417e1ff7", "comment": "Malware payload (AgentTesla)", "value": "5ab1b0331432b81a28182c2d38fd0c1ed9c5eec7f7aa847bbd2b75fa1a88ce77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902369, "uuid": "2df8b4ae-7850-44e3-b5a7-2203d6782807", "comment": "Malware payload (AgentTesla)", "value": "f7f216dfecfb5176772602d6b4a06fa697dc424b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902369, "uuid": "b9d0db63-4c9f-4fdc-8124-ee2297c0b73e", "comment": "Malware payload (AgentTesla)", "value": "3df02915e0115f0047c45bc4089988264ca87c309368029e3172909fa20d42dc61eab5b28b3d8b48e23cb6e432f35f0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902369, "uuid": "bf0f584e-7779-4b2b-99cc-14732101e758", "value": "T1AC84125CA0B4C9DFEB834A7365772316ADBDA92D5498028F5720093E7D1A306FA0E367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902369, "uuid": "9519d1a4-7f6e-4ed1-9a14-b0ef397bab3a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902369, "uuid": "d568c256-ce0b-49d8-bd0c-3a4ce923d88b", "value": "6144:/Ya6nLHDt4/EKxEswlKyo/HpczO90tOUNQ9YvV5btmrzgtVLk3B4rc6TGG:/YVLHEELUV00UNyYrbtL3rX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676902369, "uuid": "5a273966-42ff-47f6-88d9-4290b2e57edd", "value": 397936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676902369, "uuid": "c1f22eb0-7369-4286-ae69-874af3ea5ffb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902369, "uuid": "4702ba57-8b50-4699-8600-a0834bffa7bf", "value": "P.O_6652023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b655e255-b145-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676914848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914848, "uuid": "b8ce3e18-010d-4225-a2a9-a64c85f0f915", "comment": "Malware payload (AgentTesla)", "value": "aa83cb8e9964973ccfb9902bb0440a5b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914848, "uuid": "12d5b9a8-b595-422b-9bd5-0f4bbb003303", "comment": "Malware payload (AgentTesla)", "value": "5b4c337c8278f3ab74d88f54644ab8a9761d4d6455bf53cd5f3caa8d30eef5f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914848, "uuid": "c3ebe5b0-dd3b-455d-b340-540795666494", "comment": "Malware payload (AgentTesla)", "value": "812cd095d4f5f8dc8179b82dddd8229d658a60aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914848, "uuid": "9ea47085-902c-43d1-a11d-a97e8ddf9013", "comment": "Malware payload (AgentTesla)", "value": "97ce5117902c8e5479de8c13d756671e0561bf837ddbca6a0aa928b2e322c73491ccf992faeb9be3a8f67854aa62c06d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914848, "uuid": "71d426d5-e4e4-4b64-a10d-4489e3dd5854", "value": "T15B84123470C1E567F9810E364AF52FB57DE14817286E4B0F2B404A6DBA36D218A1FBB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914848, "uuid": "083f0433-ff83-465a-a5e9-87fb6500bd2f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914848, "uuid": "6e62219f-e5fa-4623-8f2f-8d1f712ae148", "value": "12288:/YxMYTWxdHRes4NjzhAcZnb7RyXp+WtJid:/YxMY5VAcZbo4oO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676914848, "uuid": "ad313843-d026-4645-b254-bbd435f530be", "value": 395349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676914848, "uuid": "57bbd7f1-f5fa-4bdb-9407-0bd7a657cca1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914848, "uuid": "bb313bb9-25f0-4cb2-9537-20857cb0993d", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6854b9e-b119-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676895951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895951, "uuid": "53e0d30c-ff59-4469-8833-b0d8eefc5b3e", "comment": "Malware payload (Mirai)", "value": "e1a8ec7d65f35c19e68b9cab85e42538", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895951, "uuid": "3faad09a-27e4-4b78-9b9c-480bd2a9c69c", "comment": "Malware payload (Mirai)", "value": "5c2f25e89d175c87337b3b912bc94c808baed7e8134004e65383401e7fc588a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895951, "uuid": "12e2b6a9-7d01-4ba0-8d69-3c1f7deb18e8", "comment": "Malware payload (Mirai)", "value": "8b785bd02b60aeec57dd72f7b0663f9b1f724a8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895951, "uuid": "daf0f41f-f2d9-40ee-9dca-a2931f42bc7f", "comment": "Malware payload (Mirai)", "value": "22f8d7e2f310f549a02dd04c935dc3f6159fa231e4986d752d823b4a924871e3d83488d073d1122c5cb7b41a56c1800d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895951, "uuid": "39b39221-3cb7-41f4-a8ff-9f55f8618b7b", "value": "T1B2827070A458F2B8D4EA007E94462F33AF8945C9796DF3D7D43D0A12BE87F882DA0E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895951, "uuid": "b7b23735-963e-4972-9433-4b6119f4c1a3", "value": "192:QltwkvFCTiBkslKrlk6C6YJfgltuXp9uIglq4PaKtKNTM0a:QlusF+s4rxC6YJfg6XpBGq+tKNTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676895951, "uuid": "2bcb4e25-ec2a-47e5-b2c7-616400c264ca", "value": 17976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676895951, "uuid": "5df98082-6624-4b4c-9627-0dded3a806dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895951, "uuid": "a7c8a5a3-a519-4e54-b39a-273affbe5318", "value": "e1a8ec7d65f35c19e68b9cab85e42538", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c628cf74-b12c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676904137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904137, "uuid": "61ed3ecc-8536-4a4a-bfdf-1798579c82ee", "comment": "Malware payload (AgentTesla)", "value": "bcca7d1ac1412c62768c3ca53a13acbf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904137, "uuid": "d2751b78-8205-46ac-8d4b-b528705ebb32", "comment": "Malware payload (AgentTesla)", "value": "5ccdd65a75638b7f78ca4eb59b8efa79ad84798d9f6aa2d27e4c6c712ebd8766", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904137, "uuid": "49823e86-925c-4e37-9843-c75f50e54a8b", "comment": "Malware payload (AgentTesla)", "value": "491de7ce633a8e2c9b4008c7ebd7ea749d31a33e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904137, "uuid": "2ec785e0-ef5e-4d02-985b-70aca8b356b9", "comment": "Malware payload (AgentTesla)", "value": "904da7a1a974c055fe429c0e1fd782c4744e909a6b653d557bc4bf609bb005c4545accedb10d241085dff1c293377dfe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904137, "uuid": "9f7ff7d7-37d4-4441-aae9-434d32aaaa36", "value": "T1055423229FA9DC390506600ACD0F34724C8C2B11B5DC5BAB3253C298B5DBC18ABDC7EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904137, "uuid": "93c27a34-a201-4ca1-9857-f6cb114b5a8f", "value": "6144:z2CBOu94JIqCYyZolD346WwdSg4dFW6R9ARbSPoI:yCB3yQsDRWuSgCFt9AdUoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676904137, "uuid": "ab2baaf5-e9a5-411a-a2eb-b8782a51eaa0", "value": 304535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676904137, "uuid": "5243b2ab-7d41-4aa3-a9f0-91cf9d47d82f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904137, "uuid": "8bb03850-4284-4a36-ac3c-e128527d4914", "value": "INV-JRH250119115.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661c033c-b12e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676904835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904835, "uuid": "40bd5bd3-6530-4b96-8529-f42324d1d719", "comment": "Malware payload (GuLoader)", "value": "cb2f2179f3a215c1f1a1f5988aa5bb48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904835, "uuid": "7be12ade-ee23-45c2-b059-eed3c9cce4f8", "comment": "Malware payload (GuLoader)", "value": "5d0c88af4fe9438facc977b77ca0e791eee35f88049a6be27030377e315eb7ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904835, "uuid": "52aa93de-a0e4-462f-812f-ea2177dcba0e", "comment": "Malware payload (GuLoader)", "value": "9c491652db8fb69132bda2f90a5ef7aee27ef577", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904835, "uuid": "c3dc84ce-4a58-42db-bcab-2a9e8fdb9358", "comment": "Malware payload (GuLoader)", "value": "87814e8d66ab11f407745f00fc08df89b0efc2f0c68c71b57d5029f8fe2ece3b0b3bb9915e728c6834ca9ae884c9bab2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904835, "uuid": "9fad8561-25d8-47ed-a209-91995fc18cce", "value": "T1F754124699A081EBED610B71157B6E3ABB737C6965703B0F13587A103F33593A32E34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904835, "uuid": "ab8a1388-5e86-46e7-b36a-a6f3523350d1", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904835, "uuid": "dcfb6c90-6174-4765-8004-e09aa158b71d", "value": "3072:yLuXzXwYyr6Dooc0ybUoyu+VeW9JJqthzDp7ApGGLJTeIY8UMb7KakFcvlt3Jppo:ypXqu+kkJuZWJTeOUa7KaT7pj2N8hSQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676904835, "uuid": "ee245018-6ab4-4ff7-a467-13488ed7ff2e", "value": 289944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676904835, "uuid": "5d90d962-5f97-472b-9b7f-1d032d96c6f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904835, "uuid": "e5abe0d3-0c29-42f9-b31d-73205e381309", "value": "DISCHG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1e8e4a-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676882726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882726, "uuid": "575103a0-5cd3-40c0-bb74-25f14967f46b", "comment": "Malware payload (AgentTesla)", "value": "3ffc2ca17dbb83db92ec14cf947146b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882726, "uuid": "229ce47f-d3c4-4ed7-a112-9cf8d7761203", "comment": "Malware payload (AgentTesla)", "value": "5e2059fde117e7f9a94d987c4e4088fe97586ca986d52851e83388fae34c36c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882726, "uuid": "eb0ed804-bfb5-425b-94b8-ec2db30a4401", "comment": "Malware payload (AgentTesla)", "value": "b7913fe856cb56bd027e6f2b9a2cf21afcc6c731", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882726, "uuid": "44d6d375-8a35-40ff-8491-6fdd9aa939ea", "comment": "Malware payload (AgentTesla)", "value": "ba3e04c81060d0379ec7eeee8763537be00e138f0ccac501ad742ecf308d07da10b0771a986eabfe14918ab5e05f3f71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882726, "uuid": "5eccf1f2-ca96-4890-8810-96d8f40fd631", "value": "T1A425BE09A7B0D6B3C58B01EF18385B0D39A435437519E26C8FB77FD292749BB76A9203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882726, "uuid": "97683a22-5d81-4c5b-ba55-0ce49a375695", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882726, "uuid": "1c90e1ce-ea8e-4e3f-a79e-d8d10e9dc961", "value": "24576:UVX4yZ1arYEK3YtFMwkyO5Mbgyj5BH4jq9eyv7JINDR7R1smk15:A/vEKMMxh5YgyFBKKeyTJI77R1sh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882726, "uuid": "16713558-54bc-4589-8448-4b2a9eb1ec9b", "value": 1051136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882726, "uuid": "4c696a03-619b-42b8-871b-ccadbf55596b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882726, "uuid": "2e07c150-8053-423c-a397-6cf460b0363b", "value": "SPECIFICATIONS 20230220.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "859eb66b-b11f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676898446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676898446, "uuid": "caed726e-0427-453c-b48f-3aab5f749965", "comment": "Malware payload (Loki)", "value": "894ebe041d7580e494ed9c158ab59e47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676898446, "uuid": "08c7f3a8-96c2-4b05-b589-189932594ab4", "comment": "Malware payload (Loki)", "value": "5ebdd970919074345053d4cd4d16f52efd564e9b73515c0688192cb37f325169", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676898446, "uuid": "c39ea6aa-d99a-4688-a035-c0b7e305eb02", "comment": "Malware payload (Loki)", "value": "85a829f1ee7e1332887d490629d9e4b8156f1c31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676898446, "uuid": "e58d9f43-7723-4c0b-a721-efcdf181562e", "comment": "Malware payload (Loki)", "value": "129ec9bdabc7a0b7913023472b7d3b1293849191cb3d30c51d05da82a493d57e28f80b8fd1cb89755a4c4d05c0546246", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676898446, "uuid": "b2af70bb-5286-4f9d-9089-1c5bff2d9c6f", "value": "T10644120863E0C1DBE0E226720E760BA83AEBB63215BD532F17547A6D7C37581B51E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676898446, "uuid": "ccd10d03-18ad-41d6-8724-4e6fe30dcda0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676898446, "uuid": "d64a9c80-59e9-4e74-9402-4523a33fb2e5", "value": "6144:/Ya60SaHcFaJ+9xpulIs58aAl/430D31pJyc0yWcr8aImK3Ls4p:/YytccJ+9xpulIs5K/43iVVvvuLss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676898446, "uuid": "aab8fb5f-1c07-4c13-bbf0-a88bebc23f30", "value": 273233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676898446, "uuid": "1c667172-195b-439a-8e1f-89a361aa1c2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676898446, "uuid": "19239e12-6e63-47d8-ae4f-d24cc8553c8f", "value": "894ebe041d7580e494ed9c158ab59e47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1812b0e-b149-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676916531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916531, "uuid": "8490c34a-8330-414d-8437-acbec3618fc7", "comment": "Malware payload (Formbook)", "value": "ea2fe31865517492cb6cfad4b575ac6c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916531, "uuid": "84e6343d-d650-463b-80e1-41aeec714ab1", "comment": "Malware payload (Formbook)", "value": "5f901f3ffe7fbab466983a4a942b2c18137b37ba7bbad083311eb4e2c6a785c0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916531, "uuid": "aeee5633-0fbf-4380-af61-603a663e86ca", "comment": "Malware payload (Formbook)", "value": "6a8a9d147ebac4e2a2048829b17c43cb9faf87c6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916531, "uuid": "f44f1798-ff5a-4e47-b356-f0a24f3673cd", "comment": "Malware payload (Formbook)", "value": "246508fc1cdf291797e2f9fbcc7238fa19473b8c15a98de1e9bac06c8f3fbe7eeae53434c8b8508cfc7d654362e2a336", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916531, "uuid": "02dc0e2c-a4fa-4e0c-8159-1d2b42f796dc", "value": "T14CE4234DDEE16F09C105CC92262DC4521A537984244FAE1CA63F37F729EA7E9CF87868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916531, "uuid": "86591615-c364-42af-8cde-2b482f27deb1", "value": "12288:1WD4NkDg2Bmi9VNMNtOGyYrdAh7q62OJ01jExOT9ACFoBd17+ffxzFLj:1lMBZWOGyYBsPJ0qxJd17U5Fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676916531, "uuid": "62a6f38a-b605-4f81-9f44-a41bc1c55e81", "value": 691040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676916531, "uuid": "dc97f8d8-fc22-4d76-a945-ba10c61a5b4c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916531, "uuid": "7a6a8e1f-bcac-4645-976b-8e3af07ba1be", "value": "sales contract-876 & New-Order.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab273009-b0f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676880040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676880040, "uuid": "e6c70ebc-c65c-44b3-b15d-9cdae2a30249", "comment": "Malware payload (RedLineStealer)", "value": "dd450b8cd29046444f8181570fd8901f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676880040, "uuid": "423e9464-4332-46e8-8d56-b2ba57715d0b", "comment": "Malware payload (RedLineStealer)", "value": "60a9b2c51e2cc25003cb1edc5698e0aa7f1081f874648459fc3dc672c2e36224", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676880040, "uuid": "33086d40-0567-4665-ac34-2b91b2499fe4", "comment": "Malware payload (RedLineStealer)", "value": "4d56d35a3a300aef08eb65467f4e7287286e161a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676880040, "uuid": "bac8280a-752f-429a-94f2-bea208644a83", "comment": "Malware payload (RedLineStealer)", "value": "7fdb4b48b5124fe8e1ac2bde18366ba8d0d33bf413ebbbe6c647a9cda28149e62854d33821d90ca6541932e7afa818a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676880040, "uuid": "c1e6644b-65f5-435a-b11b-6feab5d31ea1", "value": "T104349E03B2E17C93E9164A72DE2EC6E4765DF6604E59776B23384A6F08702B2D373721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676880040, "uuid": "d3a66318-a087-4969-a078-f2798f74c586", "value": "ed191fd45aaa30104c7d529493e68118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676880040, "uuid": "dab20d3f-e1aa-4abe-b67d-a5e784f5ca43", "value": "6144:yRkoaLZh5lx6O2pq5KpdYf32I6q4ns4H2:yRfalh569ZU32Xh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676880040, "uuid": "83c89ab0-37dc-45ba-b8a7-1ec0ee687b8f", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676880040, "uuid": "a6d688a8-3891-427b-8dcf-7fd6d46dbdd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676880040, "uuid": "864c71e2-3236-4fb3-9926-da4dd6ec661e", "value": "dd450b8cd29046444f8181570fd8901f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0801ec-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676908739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908739, "uuid": "2efffe7c-d91f-4279-bedb-83238eeae32f", "comment": "Malware payload (SnakeKeylogger)", "value": "5fb19ffbe21817b34afd3e83bc18dbac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908739, "uuid": "90777d70-e18b-4f12-947b-a4bb0dd18db9", "comment": "Malware payload (SnakeKeylogger)", "value": "620802b5556c52ea9c30611c67e1bc56fe53b968e5af80d6b01cad7dd4e554de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908739, "uuid": "a43cd63b-af33-4a6d-85b3-45e3670d180d", "comment": "Malware payload (SnakeKeylogger)", "value": "365ad6b516332f96f67566bd8174e67b9533b9d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908739, "uuid": "787d32f9-d42f-4433-b7a0-2d459f052aa4", "comment": "Malware payload (SnakeKeylogger)", "value": "9f10107eaebf6f7497606f1f389cf597d93f99d9aeb1b85d2f0b398090164bf5866fe88b2c03f82a81d845afee695636", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908739, "uuid": "e297072d-5f96-4052-b90a-3897f89e6009", "value": "T15E4423085B68C9A3DD2119715D3B33697EF9BA260120530B2BD8662EBF336C1D11FB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908739, "uuid": "51d48619-1238-4bd9-acf4-632cef83f6ce", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908739, "uuid": "eda0763e-0605-4e93-b41a-b590d55498e1", "value": "6144:vYa61nAWCEj5SW+NJNXPEzLD2L22QATZZQRJma/:vY3nxerNJGXmQAT8Wa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908739, "uuid": "51336360-7878-43db-b4c2-f8e963ea8fca", "value": 277256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908739, "uuid": "8e0bc742-b9e0-4d48-8f62-d897a8a798a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908739, "uuid": "2c7be021-c9c3-4ac2-b0e8-802acfb0d3cd", "value": "Swiftcopy45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f20233-b0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676883036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883036, "uuid": "09346c5b-706b-4156-bf95-938b81cefde2", "comment": "Malware payload (RedLineStealer)", "value": "5b951e28ab084ff83e918df1c4dbf0f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883036, "uuid": "5729cffd-a8f0-434a-8d45-34e8d2853765", "comment": "Malware payload (RedLineStealer)", "value": "6283a4ff144bca609f2d2889eb27c1b5ecc81f1ac85a3e20de1875be80d58f92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883036, "uuid": "8e6bb2ab-716e-415d-a1fd-0ba9a563bf43", "comment": "Malware payload (RedLineStealer)", "value": "67bd1761182c4ae00e5ac9812a640506ffe51a0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883036, "uuid": "2d2380d9-9e39-430f-af8e-e58fb9c0f6ed", "comment": "Malware payload (RedLineStealer)", "value": "a426fafc2f19e1baec9cb3dba49e049ff93df7e1a498047468070f099703e2f63a639dbec88d263c49e30dfdc2c795f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883036, "uuid": "e6fc1373-9433-4edc-be6b-f033eb71e135", "value": "T16C349E03B2F17CA1D52A4B729D2E86E4765DF6218E59676B3319D62F08702F2C3B3721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883036, "uuid": "4026a39b-5065-406c-aa68-a512e2693a85", "value": "ed191fd45aaa30104c7d529493e68118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883036, "uuid": "54bce4ae-b8cb-45de-9af9-c3ea7508c291", "value": "6144:Hv2f1Ld+LlRNs4bPYBgN5insarGPAeo/H2:Hv+1x+L7hbagN59arGPw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676883036, "uuid": "ce8f4821-7ff2-4809-97da-edc8459c3182", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676883036, "uuid": "847e56b1-2cd8-4d40-8760-973924252c56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883036, "uuid": "bd95bb9e-a646-46a7-8332-2b38c214a377", "value": "5b951e28ab084ff83e918df1c4dbf0f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f51de04-b141-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676913038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913038, "uuid": "d7803f06-105c-4910-ada8-a5392bc5eb25", "comment": "Malware payload (AgentTesla)", "value": "0aa732059b8a9e15812de2d0c70e17ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913038, "uuid": "cbcecf97-c5f9-4e82-b0be-b24243141a1e", "comment": "Malware payload (AgentTesla)", "value": "6325561e02ac75148b61bba9c677446e3ad1c9dadd35e1ae5d8b3cdc1f6ffbb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913038, "uuid": "c26f53cd-a7fe-49f9-acde-6a0c05c32a89", "comment": "Malware payload (AgentTesla)", "value": "d02e8544b5a24642d1b5577a5058b14c78af4c1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913038, "uuid": "44ca4a03-e34e-49f7-a56b-e05f98330075", "comment": "Malware payload (AgentTesla)", "value": "6e5a2656c0e0ae4cb119df98e3505936bdffbe0f83fbdbf8189770c9f6b76555aa8f6c1dd11f9b5a525a663b6dabdebf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676913038, "uuid": "66d6bce9-15d0-47b0-86e8-137b2886c005", "value": "T159257BF201537F9C277F0CA9E64836B28CA5B187A365C05CBDC80EEA3695574ED648BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676913038, "uuid": "954f21ec-3304-4d5f-9128-e0b121ad18a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676913038, "uuid": "4934bd3e-175b-4532-b685-6211b84fb2bb", "value": "24576:E3+Z9hZpN/6tUlhOV1UqyyXUQ2D59aXJiaVGWiL/IxzTYYxY/zVNUliMzV75P2xW:ub1/Jk6b9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676913038, "uuid": "b7c6e9b2-76ab-43f1-aa01-e5c96a0115d9", "value": 991744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676913038, "uuid": "24dcee30-32df-4137-9bf4-37b17c114b85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676913038, "uuid": "cac1c0fe-c324-4993-9d61-748f67fdaad7", "value": "0aa732059b8a9e15812de2d0c70e17ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9311995-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676882695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882695, "uuid": "0068c672-969d-488c-88e5-97c64920a01a", "comment": "Malware payload (AgentTesla)", "value": "8194d32f65953598a1f6ef6d84d9912c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882695, "uuid": "18b552b8-3e5e-44f4-b13c-80685a7bc582", "comment": "Malware payload (AgentTesla)", "value": "64669ab287ff7395d4ff8bd3680d15907b9818d476dee8e7007286b2984b2cf7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882695, "uuid": "577ad1fb-8955-4e2b-a236-be35e76d7f41", "comment": "Malware payload (AgentTesla)", "value": "9c78c83c1cc65ae0ea78b24fad8e18ddf11043b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882695, "uuid": "01ed4704-8c66-48f1-b214-919d8166f696", "comment": "Malware payload (AgentTesla)", "value": "496a9ce8cf6816418fae6e395bb0612b56d5601636ae2439a1ab67c793ff6804236d70b2e927caa32bf39dc2bfd8c11f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882695, "uuid": "cc1ec3f1-6067-426c-8111-1cba6d2623e1", "value": "T1D125BE45136671AEC1C6BCB188C9AE86DCF14E963FE1AC11950323CD9FEC0BD6909DAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882695, "uuid": "147f3a02-d516-44c0-b4bd-f018d6da46e0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882695, "uuid": "e8bb8831-1ca4-4fa1-a06f-697f4640a610", "value": "24576:cY8qtNaStDDYpGoWXd2ngFLGhWAComnlp4dvfgUu0Wln:Vfrt3Y0oWX8gRGhW81dRuRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882695, "uuid": "e10c7af2-ffc1-46b2-9200-dbd407382695", "value": 963636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882695, "uuid": "95c4c91a-372a-4bff-a0f6-01575c6d8278", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882695, "uuid": "9d57d497-9c63-4ab0-b998-6f4d64480a38", "value": "Enquiry for Pipeline (HDPE) MR no_SJEC_DPPLCH_ENPN_RQMA_0026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7299c53-b13f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676912326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676912326, "uuid": "baf85a9b-c064-4b69-aa48-dce9b5d7f81f", "comment": "Malware payload", "value": "0241c4ce81f166b2d150395c33de6bc0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676912326, "uuid": "eb4eff73-4496-4cb5-b5da-4dfda93443f6", "comment": "Malware payload", "value": "647e39f441013552972e4ec5edbb53cc10fb3c4e026eb634a736a97a41253064", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676912326, "uuid": "adcf955b-446d-4c2a-ae19-698a99df9ae6", "comment": "Malware payload", "value": "fd16dd54c1d9cd83251628c6bf205763b1687df6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676912326, "uuid": "87abf568-3da1-4f43-bad4-039f32450732", "comment": "Malware payload", "value": "c9999c79205c806531288e6a93f206702adc9acae769e5738ff64d4a03e9ad0cfc8bc2ee185648db46f4bba10fe24f81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676912326, "uuid": "c315c10c-b1dd-4a9d-82e9-a51e83a85805", "value": "T1A025BE09A7B0D6B7C58B01EF1839674D39A435437619E26C8FB77FD292709BB35A8203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676912326, "uuid": "c4ec4068-27d3-48b1-9996-a5cea0295e87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676912326, "uuid": "bc8c062e-06ea-4c50-9374-77c20a6ec0f6", "value": "24576:suU4yZ1IrYEeT9C5m2GwAI/+u6LGMyn9udoILML6R:vYVEeV2GwguVMy9udoID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676912326, "uuid": "8afcf65d-460b-4ecc-a8e8-ab800d5e0f41", "value": 1004544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676912326, "uuid": "f9472504-3f89-4403-ad09-175429882624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676912326, "uuid": "ec22109b-38a7-42a0-b399-d15a3d371e78", "value": "0241c4ce81f166b2d150395c33de6bc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e16a95-b167-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676929501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676929501, "uuid": "3a2b6b41-0543-4051-9e87-fcea48118415", "comment": "Malware payload", "value": "7ac147ffab23481724ecac11c4e81acf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676929501, "uuid": "13313740-2002-471a-87ff-b2a6d28d6779", "comment": "Malware payload", "value": "65664a51ce820349f70735c1ec9e5d1134263c911c858308a61aba0c6d8ec227", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676929501, "uuid": "92cf28ff-6e36-48a8-a138-f1d0a28876a8", "comment": "Malware payload", "value": "26fb820c55b5f58528cecad293eae5aac5f8433a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676929501, "uuid": "c03de595-0291-433a-b2c2-bd561b7f9dc2", "comment": "Malware payload", "value": "48a81d9a0835163235dd5f357541b65a964dd4b7446f970da16254c42eef17447d4160831fcf1ddd7d68133a00080187", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676929501, "uuid": "106d5b6f-488b-4cef-be78-da1ee5a7fb7a", "value": "T1B0D6330E2A997AF4F5C92830101B9D8B66F6AEB7CD508830FAD177FF6176DE8405109E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676929501, "uuid": "0a3c6954-851c-4b4a-8032-87397c51cd0f", "value": "3b9cbd6df4e5b395344be05e4c3f9c49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676929501, "uuid": "6f0e1bdd-2f7f-486a-8247-9330a3c75b2d", "value": "393216:X3XK3jPzFh71BIfQyWTTQqWBT28dV0hG1:X3X8zb1BuQAqX8dVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676929501, "uuid": "687200b0-75cd-4ce5-9938-004ff07ef556", "value": 12675648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676929501, "uuid": "5e74f964-1956-4327-b8fc-749f0f4ad485", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676929501, "uuid": "ab29b351-465e-4460-9369-7b8fdf5123b4", "value": "7ac147ffab23481724ecac11c4e81acf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2929afb3-b111-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676892278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892278, "uuid": "f5698ff4-291e-4237-8cbc-4159968ed188", "comment": "Malware payload (RedLineStealer)", "value": "a7e164a2c533ed6fda90039711591b8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892278, "uuid": "b1e14066-176f-4a48-8e0f-fe2b8919c55e", "comment": "Malware payload (RedLineStealer)", "value": "659c330844f219ac0e3fd86bbeffc6d5d4756811854dbdc917698a9dbc27f498", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892278, "uuid": "c866b8c0-4f5c-468d-8d6f-d9f6ad3457cb", "comment": "Malware payload (RedLineStealer)", "value": "622ba4b0fe3ef8673f6862f10e92362e8430a163", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892278, "uuid": "e7ca9eb9-ce1b-4b59-b0c9-32bc5580d772", "comment": "Malware payload (RedLineStealer)", "value": "02faca9764364991c09c379b15776aedd853e075d4d07f99550f10f0d353863eba12cad83d558544bcec8d2658a78bf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892278, "uuid": "45b736df-7e05-42a4-9d85-0370df52d075", "value": "T15755380239818C32D523EC360DA596AF7EED6C600DBD95AB378C1B6B3E2C6F09523755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892278, "uuid": "53747cd8-50c2-45fc-b6fb-a7eafb680280", "value": "6386803ce5b01926df5975d310d21789", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892278, "uuid": "66a56802-c97c-456a-8b5f-a27e802030e4", "value": "6144:E1JRrSIMaMeX5mICLpeDQOk0rAOJhiHGwTD6AHhz2vNBVcmz18ABsm0/E:E1JRrSneIQwmwTDLG5+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676892278, "uuid": "e5972fd2-6556-4d8f-bc4f-7d9287ac052c", "value": 1288704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676892278, "uuid": "84ddcd83-b486-4af8-9062-08754835f2ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892278, "uuid": "1c6fbf95-0c5d-458d-94a3-1f7c7a01ac49", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c473e0-b114-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1676893856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893856, "uuid": "0a75fdb4-9fe7-45f4-872a-eee199e63130", "comment": "Malware payload (Quakbot)", "value": "63314e909cb6681bf0960b734c33a838", "object_relation": "md5", "Tag": [ { "name": "1676886180", "colour": "#AC9814", "exportable": true, "hide_tag": false }, { "name": "BB16", "colour": "#52982A", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893856, "uuid": "e602c748-03bd-4c5d-9af6-018cc87d40c1", "comment": "Malware payload (Quakbot)", "value": "6778c59a29e25d722230163bea272ece58d2d3696fbce4347c20104e8fb735dc", "object_relation": "sha256", "Tag": [ { "name": "1676886180", "colour": "#AC9814", "exportable": true, "hide_tag": false }, { "name": "BB16", "colour": "#52982A", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893856, "uuid": "9d544cd4-e3bb-4bf7-826d-735cb24cfb4a", "comment": "Malware payload (Quakbot)", "value": "93623507d7147f01a11d4af9d6494a8d2497e94b", "object_relation": "sha1", "Tag": [ { "name": "1676886180", "colour": "#AC9814", "exportable": true, "hide_tag": false }, { "name": "BB16", "colour": "#52982A", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893856, "uuid": "83d336bd-4711-486e-9431-9a1db93d4ff8", "comment": "Malware payload (Quakbot)", "value": "bc47964f1df50ea0fb28e475d10fbb805f37a18b6ba164348fd72357ae85fcd45d8b7715ba350bf296b46710c656bd8a", "object_relation": "sha3-384", "Tag": [ { "name": "1676886180", "colour": "#AC9814", "exportable": true, "hide_tag": false }, { "name": "BB16", "colour": "#52982A", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893856, "uuid": "ee4b28c2-c4ec-4f89-b625-05be7e8234a9", "value": "T1BAF3F25267E45211E9BF9B311BD2DFEB1607FAA06A27837725C6220C4DD27C0DE5828F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893856, "uuid": "2600652f-bd1f-4b6d-b3de-ff9dcd764a0a", "value": "3072:FhGtY6enoukFuaYXtfAO2eZMJiE+uSPHRORiw3Rj:FhGtvBxFuXVd2tijTPHROscRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676893856, "uuid": "54b69e06-530e-4422-ab8d-b4c5014580cb", "value": 169867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676893856, "uuid": "1966f6cf-92d0-473a-8808-9bd683aa4899", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893856, "uuid": "e68f0806-6ac9-435e-960d-9d42c81ee8ac", "value": "Item.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e40f2a-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1676882707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882707, "uuid": "69200447-67c9-4887-96b2-649127b10b31", "comment": "Malware payload (AveMariaRAT)", "value": "e6b63377bb28430cb57f24bc4d7d06ac", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882707, "uuid": "4c85fb75-63bf-4db6-878a-3668cf76fc4d", "comment": "Malware payload (AveMariaRAT)", "value": "67c3ff85084673708de653609b8da8e577c894d0670c16e4c5cb757dc40e5d50", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882707, "uuid": "63f5f808-87ae-40eb-80a1-8927e6bc5d1a", "comment": "Malware payload (AveMariaRAT)", "value": "a59219579c3075014930fb25b9086ab26d3eb219", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882707, "uuid": "3ff2506e-d89b-4c92-9240-51869116c5d2", "comment": "Malware payload (AveMariaRAT)", "value": "0f56142382099a95db841646af98c92fcabc9c95e4b95ce41e8f580ae7dc9cf99dd43a771a134d0a9785f4a877581106", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882707, "uuid": "bf5575d3-d3af-4639-888c-942718295da9", "value": "T1C3D4E10B5EC62FF2C8B58A34E7A5549C57F1861B2025FBD73DCC01F5DB89B8927022A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882707, "uuid": "55957551-b325-4b4c-bc4d-8ec56425b7f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882707, "uuid": "87cd3abd-db66-49bb-bcc1-90ba11500a87", "value": "12288:eKFQmymXknLaxx0CFTf7/kow4+F5IBRKYWTHnLU4:eKb5nMERurU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882707, "uuid": "0612dae9-89c8-4ac2-a141-2cf3f456f4ec", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882707, "uuid": "369c39f5-fcb7-4d4e-8396-f6a53d08ac63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882707, "uuid": "92edbc16-1224-4593-8b40-f0d57e5f1822", "value": "MEDX02213.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c68306a-b0e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676873573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676873573, "uuid": "f71802ac-31bb-44fa-8ebc-426fc8ceebd8", "comment": "Malware payload (RemcosRAT)", "value": "148264565031a8ebb6887a1395a2247a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676873573, "uuid": "9cde732c-642c-4985-afae-e710e5c4346a", "comment": "Malware payload (RemcosRAT)", "value": "683fa1e449da9b71d0cafefb107efd97f0f8163f844dd837d12c354c2b901b93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676873573, "uuid": "e08073be-f7f6-41f2-9fbc-9d304ab25e68", "comment": "Malware payload (RemcosRAT)", "value": "3e4238c2f8e69b5c692ef034b6ed6d4ec7673919", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676873573, "uuid": "9165ed48-8da0-4fff-a02e-26ab62b1f0c9", "comment": "Malware payload (RemcosRAT)", "value": "913f5256aedecb19c52fa19186a438cfcf018b34ddfb87831b92af41c754d9654e3f35c1e1d16757d71c00a5d267345b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676873573, "uuid": "eb9605cb-264f-4a25-aec4-1eb126978118", "value": "T15AF2E032775A7CBCD4B7EB3708099B59B4AD0512239817CF8BAC294D3E7A0372925F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676873573, "uuid": "4536fa3a-b40c-4a31-92c1-7e211f81c99c", "value": "32f055b3583e9a8cd8bff60972c9f006", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676873573, "uuid": "2b8a5e4e-84a6-4784-89b8-d63fab95b6dc", "value": "768:U5PHyCjmhFdWfLubuZ1kvIaEekM2Q0KbzssZr1:U5PHfjGPAKbLV2o3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676873573, "uuid": "528d9195-08db-4a3d-8767-4810133c2694", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676873573, "uuid": "4e3c6a02-6d07-4ec6-b745-2034b7bbb02c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676873573, "uuid": "7a6fc5ac-1136-4adc-815a-51970aa958cd", "value": "xsvchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11a0d20-b10d-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676890788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676890788, "uuid": "94be5b25-9fdc-4ef8-b6d0-2b0d967b6d96", "comment": "Malware payload (SnakeKeylogger)", "value": "a3ada97483a888670363d0b2588753df", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676890788, "uuid": "e59a5db7-de86-4ef7-8fb1-5e9d6dbd059a", "comment": "Malware payload (SnakeKeylogger)", "value": "685c0fb8d2ad5a84d0bac0182c873e95958591e392ade3bd5cf45415b9e401d9", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676890788, "uuid": "b7cc04bb-170a-481f-afc2-f5579b0c1af5", "comment": "Malware payload (SnakeKeylogger)", "value": "118aa78a912154e335ec663ff16d46e2e913eafd", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676890788, "uuid": "dab1d6c8-d356-4fd0-a429-d3069f7dfec6", "comment": "Malware payload (SnakeKeylogger)", "value": "bb61845f1679bb06bcf35d6c05322b42971cd6290725c3cd4d3b3eeb9565ff9cf02988c6ca7bd2c3c535da4c93e0b817", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676890788, "uuid": "62b0306c-0d29-4f3f-98d5-48c625238c0d", "value": "T10B053329C810C1E86615F732ABEA453D60FDEFCE592411206AA9F719F3971F61EF03A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676890788, "uuid": "c6124104-a12a-491d-bb5a-91fead2adacb", "value": "12288:K71zsg2iXcR6WEYCdOvSwNItrxHZFkj/JWA+Idt8FGAztxdNsrUbdXKEDHlSbXiD:K7Jsg1sRlErMSc+TaJWZI8PvxK6Cq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676890788, "uuid": "036b9e59-9571-4699-a928-19c9e62b10f5", "value": 868828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676890788, "uuid": "eca2a3d5-e07a-438f-8510-63742926d9c9", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676890788, "uuid": "b55df13d-ff78-463b-8e13-13ee217277b7", "value": "DHL-AWB.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6233caf-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676882663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882663, "uuid": "27fc65ea-b632-4010-a9cf-92816199dbdf", "comment": "Malware payload", "value": "0480219d9eeaf1768a047b56ed3c4346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882663, "uuid": "a1f02c95-51aa-487d-a8f0-3450ca266448", "comment": "Malware payload", "value": "68669f294733a20ab7436013a0e9354bcd0009eb9c7ecd00d5671a7607b36db8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882663, "uuid": "e5377989-d55a-4b02-93c9-3c16b296af56", "comment": "Malware payload", "value": "ec8ce1ae517c97a4a67a7cd353f87b2cd01ffb49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882663, "uuid": "4e99d92a-94eb-4903-b60c-b32cf8245f60", "comment": "Malware payload", "value": "58aa2304bbbb604c3ed8182aacce3cfe28568cd287db9490c3e2beea1adbdf60a04bfd92d46873f87f32fb39f48874ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882663, "uuid": "51e372c0-e79d-4342-9aa9-f23e58ea0014", "value": "T140933B2D64935036E8A33030196D73B6DDB4AE340919AA477A14EAB9ED3D8C3D73CB47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882663, "uuid": "fcf6ec23-839d-4de1-8ad3-7fe801477071", "value": "768:eHLEwMsYGquKWD2IF8AVCs/IrDsxm/ktDuLvkCO3wBz6FPVD:e4wM7G0YOAV9IrgxztDuL8CO3iyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882663, "uuid": "a125ea62-45d2-4584-8fe6-6c5915e02740", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882663, "uuid": "b764b6f0-dbac-4009-9653-66555cb5bb3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882663, "uuid": "b3e6927a-2a69-4f13-a90e-25c8215baa5c", "value": "68669f294733a20ab7436013a0e9354bcd0009eb9c7ecd00d5671a7607b36db8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3a8962-b165-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676928577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676928577, "uuid": "f5780625-f8e0-45df-9226-44dfc5d1056b", "comment": "Malware payload", "value": "c936b4f432c1b9814d77d8717758db4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676928577, "uuid": "c5bf13fe-6319-4e2d-8d4e-cfab05bcf296", "comment": "Malware payload", "value": "690e07388b7f6aff8f276c7c44001a5aea4cae4c7918619b7a759d8fd25fc169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676928577, "uuid": "abd4b188-5591-40aa-bfe1-3df2c002e1a4", "comment": "Malware payload", "value": "ad63ad2a3a5fa271121c9345b31075128ef395fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676928577, "uuid": "4a484fd0-97eb-42e0-96ff-967a9fe485b4", "comment": "Malware payload", "value": "657cdee9b292dc93fc134c8fff21f76d4625751b45f5f15128b3b9084bba4a5c7e3354fc9ef1c4cdd153fffe5ee388b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676928577, "uuid": "2e4f7cf6-dfad-4f32-bf1b-5bcbe6658d2d", "value": "T14D547C11B9C48032C57234324624E7B389BEB8301A646A9F67DC4D7A6F74682F735B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676928577, "uuid": "1c6f5561-922f-480e-86c7-ea6815c05e2a", "value": "7f3bc5cd4e261413587836d5fba3e47b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676928577, "uuid": "40bb146d-43c7-428f-9705-aa8a6e10659a", "value": "3072:JQxfgGjGX0zRSoMqBn70YLLLAYd7/a7+ChY4U8mKQADVIZqX+oYjss4QMfJy+ETb:0fBjGX0vMq/+mZADVaqDS4QMBDyWQJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676928577, "uuid": "9fe2b02e-84f7-4cd0-9e51-23e5d5a37439", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676928577, "uuid": "b2a935ca-678a-4e49-9b10-15e4999fbeb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676928577, "uuid": "dcdaae6b-3d4f-491d-a702-b6cc651a8eb7", "value": "SecuriteInfo.com.Trojan.Loader.1311.12793.26063", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef1b7c6-b0de-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676870490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676870490, "uuid": "9745f945-2146-412f-8ec3-7679ba6e556d", "comment": "Malware payload (Mirai)", "value": "9e16d5d68f0ddb118716ff71a3d1baed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676870490, "uuid": "f166c761-e027-406a-a843-76ccd5f5103b", "comment": "Malware payload (Mirai)", "value": "6bcf22dfd40726223b2018f30a9796d2599b3998f9e761d8d0eaf49fb409061b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676870490, "uuid": "4cd10809-dfba-4173-b30b-261e37524480", "comment": "Malware payload (Mirai)", "value": "212489a2d3db75aecf40d048789b78af0c099af6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676870490, "uuid": "ffb43cb4-807d-460d-be81-5500c9bcc0a9", "comment": "Malware payload (Mirai)", "value": "18c4c91c7eef119f16fd98991047c24eb7a55c6ca3924ee16790225f3594716fec457884446ef2f09f4e7d5b931a66cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676870490, "uuid": "0c7f4436-6a96-4e46-b50e-7ee54e470a82", "value": "T1DA735A24A93A2E27C1D4A17A62FBC325F1F6220E25B4961D3CB60F4FFF2465464162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676870490, "uuid": "f78c782e-4ea0-4147-b24b-d206db07fa49", "value": "1536:OYCPkTSo3BOIqS5av+Dc0feR9QUMOj6vN7lKefWFRC:3mcjav+DcseDnOvNQefuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676870490, "uuid": "22de7a9c-2d0b-4781-8b23-63b610d45479", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676870490, "uuid": "67476934-0bf4-4967-a621-10fb29321347", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676870490, "uuid": "5cca1321-b299-4b2a-bac8-3f833d5fd791", "value": "9e16d5d68f0ddb118716ff71a3d1baed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729bcf16-b131-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676906145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676906145, "uuid": "502227fc-c1f4-460d-8339-a0489b082daa", "comment": "Malware payload (RedLineStealer)", "value": "1c6055e9bca5afc2b56f44fedaab0030", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676906145, "uuid": "22da2d3c-3a43-4833-8438-42547875ee7a", "comment": "Malware payload (RedLineStealer)", "value": "6c73992dabf2563e61398199b6c5ff4f87577c3a671a9e04adc72be414dd5f79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676906145, "uuid": "ad1411cf-72f0-47f9-8be5-62f91b0ce07a", "comment": "Malware payload (RedLineStealer)", "value": "0787ca6a8b6e7d7f978840a7375a36b50b35f1da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676906145, "uuid": "1a554a83-85ff-436e-a5a3-238825abf765", "comment": "Malware payload (RedLineStealer)", "value": "544175e83cf37cc253c613f49f3a81176f9ae2758fd3a62d641f03a646b32899ce4a829ef83677f509bd8d037214198f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676906145, "uuid": "d30b6c01-20ab-4c0f-b196-fa8ad0e03832", "value": "T104763386955500E4DCC92B309A37DDB532B73EEA5C784C1C79CD7E4B7BBBAA29029403", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676906145, "uuid": "2957cd14-28a4-42a8-a925-1b0bf75b784d", "value": "7007929576eec286d477c8effcb4eaef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676906145, "uuid": "e04fb66e-a541-4305-98cc-d2158d27205b", "value": "98304:0xVOEjMGXwZZxS5WyKeYIJGfX0aGMpoX6Nw5zLIkPd4KNNcOr6Vm3qt8WJwdQ6+2:0xp78XS8RuaVoX6NwFLTZ9WzGNpmpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676906145, "uuid": "04b430f1-d1d8-4027-bc95-e8d72cd110d8", "value": 7803904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676906145, "uuid": "4889c2af-78ff-4ba6-83b5-aa69c7e70291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676906145, "uuid": "6c822bc6-a647-4d7f-b819-053a6773e842", "value": "1c6055e9bca5afc2b56f44fedaab0030.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e439ee61-b107-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676888297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888297, "uuid": "3ff141d6-cfd2-4348-8312-bd1166476337", "comment": "Malware payload (AgentTesla)", "value": "fa6ef5c487c9df577931e5c77f3648df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888297, "uuid": "71d65c14-155f-4d9f-b9d2-4589fe6e0bc6", "comment": "Malware payload (AgentTesla)", "value": "6c95900f9e4213ee9957b3b7c8dc2af84c198b35b64c0de4cf2cb4fc0b613d7f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888297, "uuid": "9603f56f-c1cd-4cb7-8b45-e4c72b958e17", "comment": "Malware payload (AgentTesla)", "value": "d8c67a2533ee451f0d04d24ebc06ceecd35a29f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888297, "uuid": "a43f1ae8-8bb6-4ccb-8a73-618b628ea720", "comment": "Malware payload (AgentTesla)", "value": "ab5304042f24fbbe7ff5e04d5d678ed83d7550e4bdec2fbae997b9e00331d95120bee71f56840810ddcb1bb3885c725f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888297, "uuid": "7155fda0-86e6-43de-9ca2-9d75fecc6c44", "value": "T1B0329D39D54EE420C972C5B8709912F1FB0D8616A663D13AB467F9E9C8645B7033EB8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888297, "uuid": "8ce8ce48-1988-4206-b323-b1593d0922bd", "value": "192:CtNCWUyn0i13pNXqkOcPiYFLwzvdX6Ptpwjnw+umHBCFYBVy:aNxUyn0i13LROEiOLkX6Ujnw+3aWVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676888297, "uuid": "c1c15500-a90a-448c-9149-38767dd07433", "value": 11801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676888297, "uuid": "bb3d7381-845f-42a3-848b-eb455b4e5844", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888297, "uuid": "a7265d02-2607-4f43-ac8d-cef522679e05", "value": "PO feb.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f736ba-b11f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676898438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676898438, "uuid": "0c1da118-eac1-4432-9fae-abfb99a971cf", "comment": "Malware payload (Amadey)", "value": "379bff6a04fb71d37e1ad616e5d88aca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676898438, "uuid": "bec11c64-dab8-4ee0-9dbd-16a7f928046d", "comment": "Malware payload (Amadey)", "value": "6db5e32e091fdd7c90d23b0b7c1fe59ca40088af4f131aee697bd859f978101b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676898438, "uuid": "ccd88472-261e-4d9e-831f-57d7547e538f", "comment": "Malware payload (Amadey)", "value": "8463db365110a5bc6111a093c9d10aec46b11654", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676898438, "uuid": "122f83e0-d88d-4ecc-aa7d-8dbe5f88f8ae", "comment": "Malware payload (Amadey)", "value": "b8499bc2c5eccebc01eecbfc17651cc4e2632610f6865b94f2841f9e2e3ef1611dfd14e849d3d3f4b95aa7785c85c25d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676898438, "uuid": "40eb0054-dd1b-47f5-9fe3-b315e14919a3", "value": "T1FC352387A5F89172E7385B7049F402D31B3AFEA29B3D43972A4A5C5C0C336656A32737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676898438, "uuid": "2ebec294-abed-41e0-a8f0-5d192488cab3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676898438, "uuid": "56464fe3-0d74-4683-a308-715c7d056fd1", "value": "24576:4y9T6clfali2H+pu9mqi8cOtOGZbtA4G63dtCWkK:/9uq2eimqirSOGZbthVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676898438, "uuid": "c6193564-8417-4a8c-8fbb-7f40dd31d2af", "value": 1120768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676898438, "uuid": "1d5e2aa1-9474-43ef-a960-c32acc389026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676898438, "uuid": "4ce15cdf-8235-4f55-a41c-faf89bc0bfdd", "value": "379bff6a04fb71d37e1ad616e5d88aca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4b53e3-b14d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676918165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676918165, "uuid": "884a31cf-a943-4036-a046-67df9f03e03b", "comment": "Malware payload (AgentTesla)", "value": "34b7de89fd40f9285d3d6ecb1749db40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676918165, "uuid": "f7621eb9-07b3-41dc-8d17-147253c44615", "comment": "Malware payload (AgentTesla)", "value": "6dcc76e1ce4e81cec3e7c5aed3c363f659ab5b496c2772e13da12ec80302f920", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676918165, "uuid": "a8c1f0b6-50df-4bed-aa3f-26eb16f7fd78", "comment": "Malware payload (AgentTesla)", "value": "4bef74a5faeedfcc6daa56f78493f59ae4120111", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676918165, "uuid": "c9168ee9-00fd-496d-a552-2228231ddde5", "comment": "Malware payload (AgentTesla)", "value": "5edb729a8308503baaca61f5dec60bd1c58fdf0e4312952eba23c2c9d4fedc824389685596752eca1f00010f455032ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676918165, "uuid": "5cefd45d-d06e-43dc-8ea5-d08db6d70bf8", "value": "T19A8423A4C8AA13053133DEBC567206869CD66F5807EBC655D2F362B88351C23FACE95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676918165, "uuid": "eed234b5-862f-4991-a3af-2df35d92e4eb", "value": "6144:8St7pJMU19NSCoTBsWpUtgG79aDB5DnXsJRWU3lMsV6CpgAMuIV1GkqOq9c4Jw:FtgU1nwzpGV79aLDn8HVMK6c7MuK1Gkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676918165, "uuid": "c99518e8-e06a-4da4-8010-a3117c920881", "value": 380635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676918165, "uuid": "3498ce3d-dfff-40cd-9e60-44f468422e0d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676918165, "uuid": "bbb350f1-a8dd-46fc-90d9-ac6aaec1b332", "value": "SOA#NEW.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61f1cf7-b147-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676915680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915680, "uuid": "47934a9b-5c1b-493b-967f-3d544032fe6f", "comment": "Malware payload", "value": "0f1ec4ef7616f266de8f2d524fbe9e8b", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915680, "uuid": "9d130ccf-5b29-4a03-9b0d-301930a36276", "comment": "Malware payload", "value": "6e087f1cd21e2d350d54f1c34321d3f2d24bcd275c8d15a3c197990e4fe40b8e", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915680, "uuid": "0c08e37e-bc37-4f57-b919-4cd29320b860", "comment": "Malware payload", "value": "a86d38357ccf9b486975db06ec067e18589b7de8", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915680, "uuid": "ee5a6143-374a-40cf-83b4-057439f7c39a", "comment": "Malware payload", "value": "d68fe651ce87f98631fbdae91fc820fdcba2d8fe0f38a320f3a221074a0e32bd736004b56ec28a252299d0ec76d78a6e", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676915680, "uuid": "1322a318-6dbd-4e03-84c6-e512cef49a69", "value": "T1B462D14A3F708A4DB237356D7160535D51FE60802967E5B86CD986BCCCF59FA2806A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676915680, "uuid": "b57e8466-73f3-4e3d-bde6-591403a95160", "value": "384:hJerxd7RSxy3a6ioV5iXfAnV0Nt3Q4noJ9DEp:hU9d7RH5iXfAVUVnUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676915680, "uuid": "9cbb9150-479d-444f-8240-957c2d216a79", "value": 14539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676915680, "uuid": "8fc46750-a48d-4b52-88a8-962d662d2446", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676915680, "uuid": "61ae4d6d-e648-40d0-bbac-4b223418d4fc", "value": "d315d1be-699f-4247-e327-08db131860d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c407a19e-b149-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676916589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916589, "uuid": "be646974-0f2a-4c87-bdd8-8fb01ee03160", "comment": "Malware payload (Formbook)", "value": "c83ca7e7e14659639d4c77440171951b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916589, "uuid": "fbd99f18-0046-4d5a-bd0a-b71bc36af2bf", "comment": "Malware payload (Formbook)", "value": "6fa059f48f1e2a8cf4296bfa3a5c584c949874dc26f2079d2acc5ea46cb6edb9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916589, "uuid": "e1194caf-a7eb-406a-889a-7928933362d4", "comment": "Malware payload (Formbook)", "value": "35e4d9c4cc89ffbfa1e4c8d8b6e62d5e9c22c9b2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916589, "uuid": "f0345a9f-77b4-4c7f-a758-08da3d4ae9c1", "comment": "Malware payload (Formbook)", "value": "ca47623c8cbb48283acc8117f8fb1e3ddfb97da25e9e59fac650b4729c3e942e846c6575f4cd0907cf2af6583eb5edbd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916589, "uuid": "70fb22d8-a435-43fd-a9c4-a756d5cb80c0", "value": "T1FCE4234DDEE16F09C105CC92262DC4521A537984244FAE1CA63F37F729EA7E9CF87868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916589, "uuid": "f9f05309-c86d-43b3-842e-7bc2c13fe21b", "value": "12288:aWD4NkDg2Bmi9VNMNtOGyYrdAh7q62OJ01jExOT9ACFoBd17+ffxzFLu:alMBZWOGyYBsPJ0qxJd17U5Fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676916589, "uuid": "cdebbb2d-fa9f-44a8-bee0-075ddbac6d98", "value": 691002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676916589, "uuid": "29a64049-d3af-4fdd-9847-03f3b7b6aa4d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916589, "uuid": "0772c9e2-b0ca-4bbf-b7dd-2960814d2143", "value": "Quote##-PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0712f2c5-b0f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676881054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676881054, "uuid": "758ad696-4656-4982-a0e0-4744916f0e91", "comment": "Malware payload (Formbook)", "value": "17f6df036368cca2f2edf4b44295bb02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676881054, "uuid": "2d49eac4-0856-4591-b652-223034936919", "comment": "Malware payload (Formbook)", "value": "7211851b3d55127776d0ddb7f8da0847bc8a453b86015bc4d21f7298cdf6a265", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676881054, "uuid": "2b746f9c-0215-4f21-b80c-6294fe08dcf2", "comment": "Malware payload (Formbook)", "value": "756912267d05cb2fc418573ed1e4e9d07cefb519", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676881054, "uuid": "dc12ff4d-325b-4973-a0ca-7dbb0f7a183e", "comment": "Malware payload (Formbook)", "value": "026b95a8ca8af187307e8d828182269a568c18f8be786c23b7587a6c83be9f0cc1bcc90508584e0610a0c09ca69ea02d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676881054, "uuid": "00ea1adb-a253-4ddf-abc2-9cb8eb77dc4d", "value": "T15C84120A70E4D422E4B106722D3AEB7F55BDBD119CA4654B3BD03F9F3538681CA0E762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676881054, "uuid": "3b008258-2974-4494-9698-476f81c2c517", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676881054, "uuid": "37eb7690-1eab-4134-a56d-24a3d42d2e6e", "value": "6144:AYa6t6QihHpG3dXjT05qGJuheeiCJjvNoe+GKVJHCpY4W+GOnuuSh9FJkgNhz:AYn6/G9m8dFvPqHCA+vuuSh9fDhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676881054, "uuid": "9519360b-0c89-4ba9-bd35-5af0fe042aa9", "value": 392170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676881054, "uuid": "afb98e19-6a63-47cb-a8cb-a8cb14d5c993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676881054, "uuid": "1fe82234-1f6d-46f5-8aff-6d1cefb841eb", "value": "17f6df036368cca2f2edf4b44295bb02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4eb3b2-b11a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676896229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896229, "uuid": "59f65811-0292-49ae-8a80-96fc980d572f", "comment": "Malware payload (GuLoader)", "value": "69aac0292e605441b2796468791f75b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896229, "uuid": "97e5bd55-89c5-41f6-9b83-2f23feb24b90", "comment": "Malware payload (GuLoader)", "value": "723e96648d7b03910f1ab0a540c4e40fefd88f4460f4937a0dd3e142b5ccc244", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896229, "uuid": "fca854a8-011d-4713-9a34-c84fb0698fb5", "comment": "Malware payload (GuLoader)", "value": "78a739cbf94f20c50e68ab4419658435704153af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896229, "uuid": "2b3b9b06-bc9b-4069-9924-e80c9ab83292", "comment": "Malware payload (GuLoader)", "value": "48765c2c031120ef93943713caa5c152fe3d6582d6234dc39a3a6609bb61965603002a9f9c6ae2e240cf1052f8fabb4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896229, "uuid": "6ed13ac6-728e-4f75-9871-4d463c1b7e8d", "value": "T170C4129577A5C53FCBD29A329762F60B4ABE6D602811470767C8BB4C3D3E8C18A4F760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896229, "uuid": "7b99c359-74d1-4a1c-8ff3-36c525f91b1f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896229, "uuid": "dd74928b-082d-48f5-a0f0-bee35113e975", "value": "12288:K7YaMPI+XCGm00bNBgIgRaPoLCz5YatrzXpxHE:1mykbNQg5z5bXpNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676896229, "uuid": "11ccd5e5-82b6-4751-a0ef-a042a9d2e385", "value": 554455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676896229, "uuid": "d70b59e2-7187-4a81-9820-eea105c36fad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896229, "uuid": "77e3a5ca-5eeb-4972-9a24-8d11bf7260f3", "value": "Elektroniczny formularz zg\u0142oszenia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6df0d45-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676882664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882664, "uuid": "f5c35447-f0ac-4bbb-ac53-34d5eaba72c1", "comment": "Malware payload (Formbook)", "value": "6ef72004465836cbb503bbe61a48dbd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882664, "uuid": "46f01599-11d5-4fc5-9195-c7a23dc54310", "comment": "Malware payload (Formbook)", "value": "73ebb7a09698155fa4a55057e36c5ffda58b30940670955cb7e2ecff5a348b15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882664, "uuid": "626afb61-7260-42dd-8a51-58a2416d2595", "comment": "Malware payload (Formbook)", "value": "0a7f8bf41a2c8118c0887be3d7e4d41df826c8d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882664, "uuid": "c95454fb-5e0b-4baa-8340-803bf402d88a", "comment": "Malware payload (Formbook)", "value": "6acc1d824dcc2b731854b9ce699b0e6ca2b315fb6eb4d189d9e0be60e717362a561d4a1453145a5ba17ad97e26cdd659", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882664, "uuid": "6880a27d-9624-4419-8ea1-45dc045e164c", "value": "T1A9049E32D642C031F2B201B5F6BD1B7B4C3E0E343255A0E6A3E216A55EE49A9F17931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882664, "uuid": "3432368c-6fad-467a-9fe9-3dcf115c3a04", "value": "3072:oqXONkOlwpno75f3esylwb6y1KNHs8v6Z/mZjiLBGm:Yjfe7G6y1KNkZ/KGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882664, "uuid": "b70b09dd-9e8c-4367-94ee-a773236a9a2a", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882664, "uuid": "df49bcfa-026e-4276-b768-0365997871b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882664, "uuid": "784f1096-fb7d-4a2f-9e70-c2f419e076c6", "value": "73ebb7a09698155fa4a55057e36c5ffda58b30940670955cb7e2ecff5a348b15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e207d597-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676908909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908909, "uuid": "e222ed33-a359-438b-937d-4621c5fe7916", "comment": "Malware payload", "value": "b8d5538fb414cca7a79aa0469a5c7a90", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908909, "uuid": "317d24cf-1e4e-48b7-97bc-7b6ea4a034ad", "comment": "Malware payload", "value": "754167414afdaeb50e1024fd3055bda3333ce9b4d9e50ffadce95e5156e1f5b5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908909, "uuid": "5310c3b0-d5c4-4775-8cf4-e2dcbfe425d0", "comment": "Malware payload", "value": "99e1d06cfb8662e7404cc1bb86d3fef3b7a1cad3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908909, "uuid": "4b38b601-9e37-44bb-b9ad-d4b6e31d7102", "comment": "Malware payload", "value": "301f32ef55b27876514e4e9990545a5144a718cd20803c325a74e6256b7a62a62d5082624e113bb6e4031bef6903d6c2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908909, "uuid": "1547525a-7442-4948-82f2-5790a492cc18", "value": "T1C2F3AFB8B6087DD6666F176BDB96BCED037527229ACB94CD8064B7C20463736FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908909, "uuid": "11e03cfd-b566-42e0-a29b-4263d5b14701", "value": "3072:pZ1nO+Q5QF0v3Ktu7uNVkd4TmhxMkBgXeBqY3t0Yf7CWALU+FU+YTFExaBew85eo:pdsQFE3gGUy++Bg+ykwLU+dYTF6GzVcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908909, "uuid": "3016d228-64d9-4620-9e6d-3699f1852e0e", "value": 161012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908909, "uuid": "a01a0d9c-728a-4ae5-9391-f52c998c62ef", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908909, "uuid": "16973c48-d12b-4184-a7bf-5db8b2f62b7b", "value": "BLS-4020845.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8547cf-b103-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676886462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676886462, "uuid": "6f4f464f-9f0d-4e58-ba53-820586cd8fe5", "comment": "Malware payload (Formbook)", "value": "822e04d01976758fde626715bc7088a2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676886462, "uuid": "b165ac53-db6f-4838-ba8e-6cab73811016", "comment": "Malware payload (Formbook)", "value": "758babb4a9a5fe4b8c01249407865b66d21151853ef0d89cbcdb5c4094381c27", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676886462, "uuid": "e08b2171-7a35-4359-a8f3-24228517aad1", "comment": "Malware payload (Formbook)", "value": "a5207fd96dc218a708320e10e4a5d80a015c9ec3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676886462, "uuid": "d461c887-11b4-4907-b89f-2c272f34972b", "comment": "Malware payload (Formbook)", "value": "945d80781f37c7d09d8abaecadd605019a6485ac487472e86b263278902bdeafc1d16b6ce7a71056d28141d0abe9dbc6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676886462, "uuid": "9e0cbbbd-414a-401b-80db-b9eadfa1342d", "value": "T1E015334833C52F8D187A070255412E375275FD42C952168AFCA8C2EF62D7979B8EAF2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676886462, "uuid": "ee9b4e79-161b-42fb-99ea-d2f0a3bb1fd0", "value": "24576:EQewRaHQt/yAlrf1bFR/Dh1uxNgDTAOl+lD+DjDwZtRV:EMgHQtD3PwGNQ+DjsZt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676886462, "uuid": "e5049bcb-3d83-4d1d-aeea-706c18dc6aae", "value": 894571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676886462, "uuid": "ccadf865-3762-47e9-a390-1161fb97898d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676886462, "uuid": "00b02b40-407a-49c9-914a-5558ef4764a4", "value": "822e04d01976758fde626715bc7088a2.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5a639e-b116-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676894462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676894462, "uuid": "06025c4d-1033-48c1-afce-05598a07fa80", "comment": "Malware payload (RedLineStealer)", "value": "8878ceeb7646cff75e66a90d250b7627", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676894462, "uuid": "cbca63d5-7dcb-427b-a496-f869dcea7b23", "comment": "Malware payload (RedLineStealer)", "value": "75bf369db5c49e62ca1cfa8337902de9830f73ab3e7d9a636513c078e639c042", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676894462, "uuid": "ed59e4e4-3b46-4fdc-a8d1-7c6a5fdff559", "comment": "Malware payload (RedLineStealer)", "value": "f1dba71874e58418ad4425a65e6527955db18fc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676894462, "uuid": "7a924331-2674-47df-b2a6-722783d6e694", "comment": "Malware payload (RedLineStealer)", "value": "11f54bd341c82358c9c0e1a0ddd7c8fde39159d9a8b5dbfa13de1f35dc8ca0a0999841048a569f8e4523d995ea82f0c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676894462, "uuid": "bd496fbc-ac78-4e08-a9b1-ebe79ad56908", "value": "T11D35230BB7EC4062D4B467B144F302E3113B7F615E64875B3A0EAEAD58B21A4A53637F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676894462, "uuid": "bc3a60f8-72ed-4490-906d-7b256949728b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676894462, "uuid": "17dbb708-1dd8-494d-b4ee-ac000e36628b", "value": "24576:cyh+3TEickKij4bbyFa9tvlgfFFraaAA67yBIrp:Lh2EOyoaJEF+LRGyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676894462, "uuid": "6b975a41-e29b-4811-99f5-aec8242604d4", "value": 1107456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676894462, "uuid": "a697d636-772c-41db-9e0c-39afac748f4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676894462, "uuid": "66eb0545-6178-4b0e-ade1-74f6c1366c78", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca80d58-b11b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676896901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896901, "uuid": "b40cb049-7121-4307-b407-d10c1d00d286", "comment": "Malware payload", "value": "52bb6fae3cf64f3bbbbe3a0fd67b3182", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896901, "uuid": "729692ab-4b3a-4fb2-b163-1bd264a77e1e", "comment": "Malware payload", "value": "7610e8ab7974b024c726e57a7b7f56d65b5f992c58b2bd1fe40721e3905b22b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896901, "uuid": "0c7cdfcb-13a9-4c8f-b9fe-8dbdd6f9b2a7", "comment": "Malware payload", "value": "f8a0f4924f434fca5abbad1fefbc262c12b4d30b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896901, "uuid": "53feaf9a-1e4f-4395-9d4e-1647c9e3bf34", "comment": "Malware payload", "value": "65dc94ea794c4aa175a33d33096c4b1b62244c650ed5feaeb53d5497560561f4a0ad7b6da154b0beaa07a819c9cdd101", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896901, "uuid": "520d1038-a989-411b-9d5a-216181daef8d", "value": "T161545B21B5C08032D57334314624E7B38EBEB8301A656A9FA7DC497A5F74681AB35B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896901, "uuid": "0c3fa360-59f3-4593-a61a-ef3f8ef752b6", "value": "13dd3ce53141e37fd4aec99d2b6c6f40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896901, "uuid": "74d8956c-20b3-4475-876d-5cbffe8e13a2", "value": "3072:9XbyWZGMLdl9NymIoOMYLLdzQnDO2CnaiPkff348wTTqalttzh5YA/oYiagFF6TU:9jZGML+xY3LwTTRDgVYiaqcdJjc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676896901, "uuid": "a5aca202-cafa-423c-9471-33529dad9612", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676896901, "uuid": "fffa277f-adc8-4823-9875-3cf369a30095", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896901, "uuid": "7abd4e3e-4a79-4d49-94d7-c201daec5f92", "value": "SecuriteInfo.com.Win32.PWSX-gen.16845.15579", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcc00b6-b15b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676924145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676924145, "uuid": "762e6dbf-8876-4484-87d4-7796de2c663a", "comment": "Malware payload (Smoke Loader)", "value": "5441c3d3300cc1bd9cf3ad9277b148d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676924145, "uuid": "7ee8c1bc-5c5a-4e14-a81a-8fdc9128d40e", "comment": "Malware payload (Smoke Loader)", "value": "76ada160c9de1605419ffc09b2c91716b975da0cf9be53a4ed12776cad0d174d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676924145, "uuid": "41fa12a0-2585-40a1-9943-946d87ed09ec", "comment": "Malware payload (Smoke Loader)", "value": "76bd564a9aa0515cb6ffdc4a2394076538879b47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676924145, "uuid": "533a2ccf-dcf2-4bf9-a6b5-b714b298241e", "comment": "Malware payload (Smoke Loader)", "value": "d75408cf2768edc35cdfa943c9440837def0a226518ca05cf459b0e7337569fc6a0f5b0816471d2d6c9a55717be122ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676924145, "uuid": "a6e2e313-ddc0-4277-8113-984a3cb83700", "value": "T11814D02035E0C072EA5387B58474DAE2ADFE79611665897B37942ABE0E306C153B733F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676924145, "uuid": "e1929e25-bffe-4bb4-b820-657fdf92dfeb", "value": "b7b66070cf182b2615019a5dbe522294", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676924145, "uuid": "b66ceefd-a8dd-4b1b-8548-e37c8deb6cfc", "value": "3072:Dlrj0jePLvA2velimYAXB5EgIxTrIsE5ohcqqqe8798yWAkM:FjMQLqiwuxxDE5ohcqj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676924145, "uuid": "c5314d5c-028e-46b2-ae5c-7659e87874cb", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676924145, "uuid": "0d8e5011-dc39-4ae8-9dca-dcfcf62334c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676924145, "uuid": "eb099584-8eed-4193-8c1e-04136eeb521c", "value": "5441c3d3300cc1bd9cf3ad9277b148d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65c51fc-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676882717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882717, "uuid": "f645b8d0-befe-417c-86c5-76f3aad82931", "comment": "Malware payload (Formbook)", "value": "0db5075e5222e059d40996383ed6242c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882717, "uuid": "83be9005-61b8-4062-8172-36b0dd214e9a", "comment": "Malware payload (Formbook)", "value": "776da205cc0aa18abd7fe68c234bbad03c9e0a420db8d51de997a4741d1b4028", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882717, "uuid": "186dd046-5d32-41e2-ad71-19248846790f", "comment": "Malware payload (Formbook)", "value": "ff872b552194b8e943b4e4bd9147549afc8ac8c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882717, "uuid": "cb83a4de-8c88-46a1-9c26-1e3a40581b21", "comment": "Malware payload (Formbook)", "value": "f9dcff59edbc83ec92ebc3905fa54224059f5ff51bd80a827a5dccc54e8ab92a42f3088f5c268f9f3ce8f7f5c66500b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882717, "uuid": "883d3e1b-a09e-4e59-b2fb-cc2b5296262f", "value": "T1C35412093AA4CA67E6D306724AB64F732FFADC1610B4431A17603F25B932723861FF65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882717, "uuid": "73517b71-e5c5-43fb-9f44-ad95a59eade5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882717, "uuid": "058e4794-e1f4-4a42-a05f-48d7709f3c93", "value": "6144:PYa6WkgH7Ms2moiGUAfFYxyBcrjzMC+ofMMlLztad:PYgkgbMjDBUAfIrfgQMALztG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882717, "uuid": "94b6a838-eb95-4d32-b798-f7c527e78e2b", "value": 290588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882717, "uuid": "689f7b32-1e96-4a62-9ba7-3c2a1f275e82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882717, "uuid": "8aceb463-e1eb-430f-9f13-69093be4c5ba", "value": "RECEIPT TELLER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd66649-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mydoom)", "timestamp": 1676882699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882699, "uuid": "e67942cb-8c0d-4aea-adc5-89c813f39c2f", "comment": "Malware payload (Mydoom)", "value": "a3b23357f518a7b2f8180585d512df94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882699, "uuid": "815eca06-4781-41d5-9104-63a6fa485c64", "comment": "Malware payload (Mydoom)", "value": "77914ecc60f5bea2153e6c6d8a148742902af5c160eb01ee2e92aca05802a225", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882699, "uuid": "41e7d626-409f-4383-8e3d-69ac309c6ea2", "comment": "Malware payload (Mydoom)", "value": "07926a2239463879fda1d3bb071bc37f3715072b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882699, "uuid": "49c465e1-6c70-46ae-9e64-487a814f1731", "comment": "Malware payload (Mydoom)", "value": "c60d035a82a707e1fd34bca9f4740aaa1caa926cf87dc2ecdc2668bf8631318fa6c1a4fb7902211c2da0c9b8fc0641fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882699, "uuid": "ab72f502-1ea4-4f27-9022-33baf13209b5", "value": "T19EA2C0827717ECB2C2681A723583CBB841D26F9C1F50E25777AE7A1D39F961C3880649", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882699, "uuid": "21f3d417-d833-4c6e-a00b-f10a691b9904", "value": "09d0478591d4f788cb3e5ea416c25237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882699, "uuid": "8ca5f370-f635-48f3-bc7d-582f332b15f7", "value": "384:EXU9ccc7UJPckKSB+Ir//avobyWblunkd1SHVbonWNDiRHfJb9JR:h9ZclSB+IDaoLluI1SHuWQfxDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882699, "uuid": "fe770f28-2e1f-4237-9c2c-771a77285845", "value": 22017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882699, "uuid": "51d47321-f069-49ab-a266-c2aae21a1e23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882699, "uuid": "ac97510c-afc8-410b-b73c-a2e7a8dc812e", "value": "Important.txt .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf9bb2e-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676882671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882671, "uuid": "f0f92032-dd28-4d55-9ee7-3064da9f0100", "comment": "Malware payload (AgentTesla)", "value": "edab838a9c2af487eada7b7934f486e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882671, "uuid": "9a9941d3-1532-425f-b7c6-9f02e641e3b7", "comment": "Malware payload (AgentTesla)", "value": "77954aceb0ce403be86b14588e57bba75c06e9a0b65d4ddc01b1ca6e55770102", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882671, "uuid": "2f23b0f6-48db-43a2-87db-d29a9bc467b3", "comment": "Malware payload (AgentTesla)", "value": "fd555583dc5538b13c0ad67b12462fad8960be79", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882671, "uuid": "e936b166-3ab5-4da5-8d19-22fd6698a1af", "comment": "Malware payload (AgentTesla)", "value": "4b327bfaa4b09e572e46353f01b71c2add513ba06701239c82463f596fe46537e8e446edff423abad3740843287f5bcf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882671, "uuid": "fa4a4ebf-76e6-4e41-a137-2e609aba53c3", "value": "T169258DF24023FEDA27670DD9E54437B24CA8A147675EC048FDCA0FEAA6DD150ED258B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882671, "uuid": "109c598f-1aa2-4129-90f3-72ccf68009a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882671, "uuid": "5c7ae024-5802-42c1-8863-9d720c2a56db", "value": "24576:ULgP0Fg5YCJE1AdmmGvsPaCZ1UeC+6NU1v4J2/CLA7qBT6cw1RFTg8hg7:6SMTaH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882671, "uuid": "02bf7978-bf45-4e52-97f0-81e180f89463", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882671, "uuid": "85bc03c5-68be-4ce9-a726-f870bbd67b49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882671, "uuid": "6bad54cb-56d5-4e1f-9988-bf293646cfa9", "value": "Al Wasl Trading L.L.C Quote 260550878.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e47a19-b0cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1676862320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862320, "uuid": "5eadc3da-2fd6-43f8-b222-41ba29de9615", "comment": "Malware payload (Stop)", "value": "61f1a0f55ca1db48d6e80dcc974ab167", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862320, "uuid": "0230cf46-328a-4d4b-a6c8-e67c5b72cd06", "comment": "Malware payload (Stop)", "value": "77cb5f8727bb7b89294b8b09caa61e285acaa620f6c01f69cabb3ca91ad7c4e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862320, "uuid": "b85249d7-926e-4a77-9642-1d525866dc9c", "comment": "Malware payload (Stop)", "value": "f7f9c70d295a6b73d379130d58d94fcc533b33a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862320, "uuid": "d3566088-495f-4cea-8532-f5061f4b80b9", "comment": "Malware payload (Stop)", "value": "eb8d0b776a879924c9b39ee18c1746279d96d3d0f3208d66c43ee22f2637b027621f58f6e931fb955f897185d1c4be33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862320, "uuid": "3a12fd22-e01b-47bb-aec0-d2c09092d5b9", "value": "T1ADE4122272D6C0F2E11744365D158BB197ABB4F08975CACF2B8505AE1FB67A2DB2C307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862320, "uuid": "0ba00da0-5548-424d-a34c-3d6a2726f420", "value": "9d64e6a2a7bb4f74b24f7b7e42936433", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862320, "uuid": "eda1a145-01f1-4fcc-a43f-4a72a2272fea", "value": "12288:iZY5o7xia1gkOGsHd0fTBGuH6p09K4cVrT/4n5Upx9NCC/G8mlcFemCtEpYjnfIB:iZYYC590fTwuHO09K4cVI2NNCC/Vmlc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676862320, "uuid": "3ec1edf0-7ed3-4b51-a01d-c0d4dab0814d", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676862320, "uuid": "92c8ba50-a544-4814-b4b0-96a4433734bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862320, "uuid": "da9110fb-abc1-49f5-a1cc-1b23dce5ba11", "value": "61f1a0f55ca1db48d6e80dcc974ab167.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245ffaea-b142-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676913315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913315, "uuid": "b68c0d23-efb9-4aad-a1f1-10e07e28bf96", "comment": "Malware payload (SnakeKeylogger)", "value": "e5bbdb5d2e74fa0f93ea80b56c56cccf", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913315, "uuid": "f77256be-fa8b-4ac7-a71d-98872addd4ab", "comment": "Malware payload (SnakeKeylogger)", "value": "77d513e1735511fe248de4a4aecc94860f117cefadca291221a165b8341b01dc", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913315, "uuid": "43f448dc-b64e-4c42-983e-48aee45d51f8", "comment": "Malware payload (SnakeKeylogger)", "value": "aa5d48686563c6af47d18ddfa46d39964683f04a", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913315, "uuid": "29292ee6-acca-4b11-93ef-9e5903b812ec", "comment": "Malware payload (SnakeKeylogger)", "value": "8373ef4ccedab2ae09c309e19b24c89436453f3ed6a8410216d87f79ec96e09fa738e8a4cd8ab77c3eafee9ab576b63d", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676913315, "uuid": "98bc8726-112a-4562-9474-0252f2536dae", "value": "T123742322CB77675DED0D07867923D38EEA9E4C04DF6A85F48E45428F2BC09C13BB1966", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676913315, "uuid": "d21c68b7-8c43-43ce-a4c7-b9774c6c8c18", "value": "6144:7ugynTe+aVDlMZVWHukZQs4FDCx3M2jAXWASpLRR8L22zzY:pyy+4DaZBwN4JCxkWJpLOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676913315, "uuid": "7cec8c47-cda4-437d-8704-a7be7712cd40", "value": 338090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676913315, "uuid": "2ed66ed7-31da-42e7-b745-a8abca9fd63b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676913315, "uuid": "459261f7-5251-46e7-804d-7137d95f8ec0", "value": "XBSC150918 DPL-0001-B07.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea534648-b0eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676876281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876281, "uuid": "159b054b-4e52-4b79-93e5-a4a34d5d9fa3", "comment": "Malware payload (njrat)", "value": "34932818e61e12a93dce81690474795e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876281, "uuid": "75f12fba-fba5-4eb7-8565-860dd862a846", "comment": "Malware payload (njrat)", "value": "77d850a32095ee418ced21dd374bb82cc9a5f9f3f056870ea64672bc8a849804", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876281, "uuid": "b908f0de-1aa1-4e85-9919-340ed8017ccc", "comment": "Malware payload (njrat)", "value": "3a29f6e5218c209633f7088d5291cab2cfa7e4e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876281, "uuid": "2e8e64e6-2638-4bb6-9618-615e7f3476fb", "comment": "Malware payload (njrat)", "value": "e345da465f91c8517fb886bb234e3e6d851836479b01bf2c783354789d5be61605ed916aed4cc1fe0931b01998eb3b9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876281, "uuid": "47cf2771-a953-4080-a9a9-b716f92a29a4", "value": "T1EB67330253DAB227FE67143F3AA9E30A723EAF6A0463405F86442F61FD319B5735B116", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876281, "uuid": "422d340e-e926-490f-940f-46933171bb4e", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876281, "uuid": "0c35498d-f0b1-4459-b16d-fd88c7211611", "value": "393216:iENElkJJ8SZwwdgRkzzIKWz12TMvY7H6r1YhU6k5u57t/tlPx5T4UgOxY/4irO9x:JNxJ8rMPz0KWhPg7a1F0bR5T4UNA8+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676876281, "uuid": "4084a27a-b1f5-43d9-bb4b-6e9045d4ca96", "value": 30566912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676876281, "uuid": "64860dfc-ac49-4439-ab60-2d0d0c14ede4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876281, "uuid": "65ffa451-f11e-4094-ab16-07b4171f25cc", "value": "34932818e61e12a93dce81690474795e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89750398-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676908760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908760, "uuid": "b508b8f6-c3f4-41d5-96d4-f90c76e9148f", "comment": "Malware payload (SnakeKeylogger)", "value": "e537f7f92dd8def92a4188109b308461", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908760, "uuid": "a6a9ee0a-0743-4427-8cf7-c6227ccdc575", "comment": "Malware payload (SnakeKeylogger)", "value": "7aec24add55bcd98a2653bbc7814f8e7cc51f3180b20f45e4c22293802e1c648", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908760, "uuid": "c34e3d09-cf29-4eec-8f7d-27bb679f5b1a", "comment": "Malware payload (SnakeKeylogger)", "value": "753fb97dad3db1b584ba9c4d2cbbe0db59ae0f90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908760, "uuid": "3fa18432-827b-4949-a33e-88f748a6c853", "comment": "Malware payload (SnakeKeylogger)", "value": "ce62fb39c9152c9f164dd3c95cd514f28f6be72ebb08488c092b7143683c3b94b20d4498421aa26dfb0db0c053481d85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908760, "uuid": "2131409d-e775-47ea-8d63-20f63734ebce", "value": "T109F47B5977B46073F4CB01FE58382B8D2D2036577619E22FA777BB81A2719FB7298201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908760, "uuid": "f0fb1e5b-238f-4c81-8ca9-73265df221a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908760, "uuid": "fab8b916-21c1-4c79-b0f6-6b7973d913b2", "value": "12288:snnKEaXXq/csxvaCt6JGW4NH8hxWfU31gWybr2ay4eaIXSPJcH:snKEEq2CthWlWM3mWy7IL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908760, "uuid": "0690e570-ee68-4e26-b760-8e4a072151b0", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908760, "uuid": "826c7358-45b5-4610-b4cc-e69e78305a80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908760, "uuid": "0d0afb99-abc7-4d2e-a857-2dca99e5098c", "value": "Fatura (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b256f99a-b119-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676895944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895944, "uuid": "76a6fdb0-20ba-45a5-aaa0-aa07a1ce3505", "comment": "Malware payload (Mirai)", "value": "17137c714cf8ef2c255c612fd958c19d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895944, "uuid": "0d40aec5-f8ba-44d2-8463-a022b525365a", "comment": "Malware payload (Mirai)", "value": "7af5505a86bb0848327b244d14253658294b382750387cffc7661c882b1aaba6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895944, "uuid": "f93a3320-f348-4470-a31f-7e6f14c58206", "comment": "Malware payload (Mirai)", "value": "5b45429ee0649b605a693b6af1abfe01bc8c44da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895944, "uuid": "0a0d30ac-307d-4adc-867a-61809896c4dc", "comment": "Malware payload (Mirai)", "value": "215e97724d79d72b53f63d05c623655669bf634ea59ec5fbdd9b0d725e7fbd4c0044b815beeca0464219c266b33ad490", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895944, "uuid": "63463e57-6bc1-48a4-818a-abc781454fdb", "value": "T14C83B709BF650FF7EC9BCC374AEC1B02288C515A26993B367934D858F64B25B19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895944, "uuid": "729fe278-77e9-4a88-973d-7a8b7125c055", "value": "1536:qtPyZeKnJayJDWSHAD5HPAU5islvNpzZOCzl:qtPyZJJayJDWAAVvFNpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676895944, "uuid": "73a40021-1a93-4c23-8d4c-0f5e5b8b2576", "value": 82780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676895944, "uuid": "a20244d0-91ff-415e-9329-acc7e3c9f800", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895944, "uuid": "a85af945-1b40-4402-bfc3-3ad3a80b3791", "value": "17137c714cf8ef2c255c612fd958c19d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04708adb-b121-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676899088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676899088, "uuid": "b2036721-4184-4b5c-a37f-1dcacd0bbf40", "comment": "Malware payload (Loki)", "value": "9770f68ea5c7402f7b346a18ea35dfa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676899088, "uuid": "b511bf70-7552-4132-b192-1068f6311f45", "comment": "Malware payload (Loki)", "value": "7bb1f948a7ebfd360adb08b4cb886fb7290ab32ce979148105621a60f7806c02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676899088, "uuid": "98bdd0f5-a95b-4c09-b8eb-aee8afc54c28", "comment": "Malware payload (Loki)", "value": "493af9b898d5af1e80b396d4ddc663b2ee6489c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676899088, "uuid": "693d0f00-517a-459f-9eec-beea1876cabf", "comment": "Malware payload (Loki)", "value": "438a9a45f98671ec5db1b7b08fab8b5746bee49ce2a7ee8bae07e2a1ce4f483d91c2ee780f3005332ce4abfc698b9493", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676899088, "uuid": "d1feb38f-db54-4e68-8553-cf49a66737e2", "value": "T1BCE402C1DA5CBCC6E56312F4BDB5DB96710FBCAE5060894A316BBE11E2230936A37713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676899088, "uuid": "7fdb061b-78a8-4114-ae7d-dca3b25ef7c0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676899088, "uuid": "323d4454-96d0-478f-97ba-a58d477010dd", "value": "12288:yYJM89pSbLmxyXZqHC6OAizJ24G0ZLFDw7BW2ATxC/9:yYy6pmLmgXZuOrVVNpag9C/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676899088, "uuid": "3605a699-0afa-4db6-830a-686bb8dcfe5b", "value": 662178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676899088, "uuid": "47184ac6-af8d-49f3-bd7a-0c2c464099d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676899088, "uuid": "6978b8ec-40fe-43b3-a267-a588f8392015", "value": "rHSBCAdvise_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953370b0-b156-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676922094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922094, "uuid": "a79537de-8fa1-45dc-9628-23b65f6b0498", "comment": "Malware payload", "value": "7ca61457c514a8eb397d61cba816b0f0", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922094, "uuid": "e5488210-c3e1-486e-971f-994ca158e2d1", "comment": "Malware payload", "value": "7bd39f350e38ac3bb9a768659bb5e85de32f3dc5ca4ca61125f2a874b00cd4de", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922094, "uuid": "752d2a5c-f27f-4554-b6b8-a02edfe53b6f", "comment": "Malware payload", "value": "c839d6f3fc7be9fe0b68819b1aae1752bdaac51d", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922094, "uuid": "d1d9810d-d42f-4826-b209-33dd93be21d6", "comment": "Malware payload", "value": "b5e91c43de83a8ef11b25a2ac9b8e5b1cbd640926019552446336ef6df8812dfaf7d6dd7a727f7c154530d1c09c41517", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922094, "uuid": "f592a02d-4d18-4188-8922-a41059c61393", "value": "T1D545B351FB13CD8AED25CB7D30978BA03331D80D66A1971B138DB26E7DE1900AE93799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922094, "uuid": "fb95694f-4416-4916-9fef-72c8f53afaa2", "value": "6144:pTSWkCs5CrKvnSCDSgUes2Tp57K8lO56k7pu/0F6LTmm/rF5XHxFJbz/Gskdo4zB:YW9HTPNK7zUho2kRe0R/dLne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676922094, "uuid": "93764544-f8d5-4077-864a-da5cbcd640f2", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676922094, "uuid": "18e9ed9a-b2ea-4b16-8f27-7a115eb1000c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922094, "uuid": "68dde228-de2e-467a-a608-f5b279ebd889", "value": "7bd39f350e38ac3bb9a768659bb5e85de32f3dc5ca4ca61125f2a874b00cd4de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3fadb4b-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676882686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882686, "uuid": "e1a3f6f0-a7fe-47e2-a397-72bf480683e7", "comment": "Malware payload", "value": "8ab0772b14ae7ea2d56e97a0e294c373", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882686, "uuid": "6cb49bcf-8d00-4678-91cd-e3933bc33065", "comment": "Malware payload", "value": "7c2ccf179d0eb0c02ec40819b12b747970b720f0137c2952427a1914b1310084", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882686, "uuid": "b00055ec-b2bb-486b-9722-c2af4247971b", "comment": "Malware payload", "value": "e1720c9c7e99712bdc13cbdbc0340308b252a693", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882686, "uuid": "a18e18d6-b9ef-4e4c-973c-5efd1dd18cdf", "comment": "Malware payload", "value": "36195f7ce0e4920a6fc741817f99d2b05e8af97f5a0b92bc99fe62d28eb323670f8c89243fc913cdb0ca4c1d0368e008", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882686, "uuid": "9975a375-a2fa-4dfb-ae76-500b7214df16", "value": "T136541254B7A4D12BE47227705F7A3BDA2FF6E4018569075B2340AEE93E136428B1E393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882686, "uuid": "b48141e6-9969-4c71-a4c3-bbefc9b936ca", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882686, "uuid": "ef9042cb-6009-4073-b541-bb2fb56decd0", "value": "6144:/Ya6RZ/e5LErvVu2cFwcqJI5GEyLJu2a80g3rNdOl8U2FS:/YjkErQdSNi5kLJu2a8PbNdO0FS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882686, "uuid": "f45a745b-63c4-4f67-b98e-df403f66191d", "value": 302699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882686, "uuid": "1d301254-bf45-4a85-9201-101daee339f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882686, "uuid": "8aa9767a-b9a3-46df-b383-8562906318db", "value": "DISCHG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386573ac-b138-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676909054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676909054, "uuid": "820e1a60-028b-4dd2-80da-8c014d915932", "comment": "Malware payload (Loki)", "value": "b8e3faafbd8cbc11fce31a201d4c8a1a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676909054, "uuid": "c4ddbf8e-ed49-413a-af20-8f6aeeab41b4", "comment": "Malware payload (Loki)", "value": "7d1854dbe78f3b7b631f6dd84168b88d20b8ac12dba2ef4c7fc0693e826f2dfe", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676909054, "uuid": "3ccc0b95-e709-4276-b71b-d59555210bd4", "comment": "Malware payload (Loki)", "value": "0fc8229cc5c9f25746de4f85f36d1332793032bc", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676909054, "uuid": "77e1739a-cb04-4cd4-aa8d-b0f08a76e562", "comment": "Malware payload (Loki)", "value": "283c36c6e29e7eb8674b75b978227e1a9c26b337a054700333a6ff579946ad5e354fa761fc97e3084bf84ea7f41269b1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676909054, "uuid": "6e0c5309-eef6-4c4f-aefb-4a5ab3397a3f", "value": "T1DC23905AE79F02A4CF411273531B1A8996FDB33EB35151A178AC933433EDC2E42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676909054, "uuid": "341d85ef-8191-41b2-811d-35f544700204", "value": "768:CFx0XaIsnPRIa4fwJM9QjhC63LzrpbY2+Wh1UbZ6THJIGHHMKvIloniU:Cf0Xvx3EMq9F3frpbSWg96bqGHHMh6iU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676909054, "uuid": "206e21d7-f06b-4d0f-9656-77d4a20550d7", "value": 48784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676909054, "uuid": "bd1088fb-1579-4fbb-8018-6199afbc2464", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676909054, "uuid": "a376c287-d29f-4ff8-846f-138f7482b8f4", "value": "Order Confirmation Signed.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461cf23e-b112-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676892756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892756, "uuid": "25294ccc-2441-4ac4-b815-553b70f8b3f9", "comment": "Malware payload (Amadey)", "value": "f0cc2470cb5c9b6262dfbf08620a2813", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892756, "uuid": "87fb8ca0-79ed-4ffd-89fc-553eb3217000", "comment": "Malware payload (Amadey)", "value": "7ead88553a0e5cd16bf07cd5938ad5d4dd7ff68c9221091869bf97b888d2ac0f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892756, "uuid": "b3c52e1b-f20d-4c70-b895-f29c3939d104", "comment": "Malware payload (Amadey)", "value": "c43800f4124be316b3a79295649cef468ea8ef31", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892756, "uuid": "0d46d388-585d-4683-81c2-78a4f70817d2", "comment": "Malware payload (Amadey)", "value": "ff264c4857084daccbcb13f404bd4eac3558aaacc5c10f7ff182ac2aadea2d05fb2d7ace663bdfab415b950d23de71fc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892756, "uuid": "c1008fd9-9348-409c-9a5a-bab7eb369a38", "value": "T10E352213BAEC9061F8B10B7149E706D316367EC0267547A6434AACDB1DB39E8B63077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892756, "uuid": "d7f877f2-1404-49f9-8ea2-e641bf583834", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892756, "uuid": "bfaa9159-c25d-4552-887a-f45fe4f38450", "value": "24576:ByUg6pF8jtLawWf7Ar2y5NRopgtAV0r94FBrzHBQKsQK6e:0U2ZSgNuQAyiFtV5sQK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676892756, "uuid": "e9926a84-3222-4813-9441-63b931d71cde", "value": 1115648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676892756, "uuid": "5f192d0e-a702-42a0-83df-f712d4c0c41d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892756, "uuid": "37f9581a-0f01-4312-8bef-d066beb93191", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe81be8-b114-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676893893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893893, "uuid": "daf8e778-13cd-4ba0-964f-0cef12022188", "comment": "Malware payload (Formbook)", "value": "c567f96478c2d2574bc5d8a348612c68", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893893, "uuid": "af508f84-98a6-4d87-ba38-626a6684228e", "comment": "Malware payload (Formbook)", "value": "7fc2a058ef1746bc494c7372f6b1b1293093616af2db4b20168743c5cea156e4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893893, "uuid": "4b8bcaec-81bb-4f6c-ba41-f7713e7e234f", "comment": "Malware payload (Formbook)", "value": "3b9ebf6e61f9fc06183eeec4b870c20f6501b6dd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893893, "uuid": "bc9800cc-52d2-4f91-9b38-a7b072744c6b", "comment": "Malware payload (Formbook)", "value": "fa93e30ea2df4ddd55f328b221443bb16b944b9b939e1ded3f346f4993276cbd7ed354e020e41ad1a6c8806271a87941", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893893, "uuid": "0eb2f528-cf18-4b38-8655-cc9ba1c1ae60", "value": "T1C3D4331E6E12C278649B585478124B241ECBC3FD3B69135BD9736D9F3B4A01AF23E8C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893893, "uuid": "98e7fe93-cd8b-4edf-9fbb-b610ae368193", "value": "12288:6oSWr1Nb9fklsv3YXA5OWOPNRQXWNl7VAgwFOID4QPy6t7RMVNlALW:fSWrbbdkO/SdPCW/70FdDztlsALW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676893893, "uuid": "87f4265b-b0be-4ec4-8f32-914b09256a53", "value": 624826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676893893, "uuid": "b5cc2991-ac7b-4f6c-9815-e948d48f8861", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893893, "uuid": "0b7d5c46-0910-48c3-8ec0-36ea01575450", "value": "PO20230128.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac209b98-b165-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676928575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676928575, "uuid": "7515d1be-69c0-4b0d-9799-325b5d014d76", "comment": "Malware payload", "value": "cd2688a58ccc7667a0706840e3f5ac0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676928575, "uuid": "6856f475-1f31-458a-ad3f-fd5aa5d09a67", "comment": "Malware payload", "value": "8074b0cca621b7577a840d71304a66d46f1b109e9ee5e67a23cc9e49d8cde229", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676928575, "uuid": "aff11229-6142-47c2-80bd-31ede3dda8df", "comment": "Malware payload", "value": "bfbb0dd371eb27222357f22802921708b1184fc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676928575, "uuid": "49e689f0-c9ae-4e49-8110-fd1ca6e8c5ca", "comment": "Malware payload", "value": "a6af83951d123101bd610d11f8bff140d73d7c130077fe25e334c692d9a9ccdafb3a0b9b25af0551f12ad1329bfdfe81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676928575, "uuid": "1f4c8ad4-6692-4e9e-938f-d1c4e974c4fb", "value": "T120547C11B9C48032C57234324624E7B389BEB8301A646A9F67DC4D7A6F74682F735B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676928575, "uuid": "3d08b5cf-37a1-462b-a313-af0169270719", "value": "7f3bc5cd4e261413587836d5fba3e47b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676928575, "uuid": "cd2d3a2e-023a-471d-865b-b2d99a3b41b7", "value": "3072:gQxfgGjGX0zRSoMqBn70YLLLAYd7/a7+ChY4U8mKQADVIZqX+oYjss4QMfJy+ET2:dfBjGX0vMq/+mZADVaqDS4QMBDyWDJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676928575, "uuid": "a3535074-8fab-496d-8ff5-6e3d0fc1949c", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676928575, "uuid": "18f2c294-54cb-4ec8-93bd-9dceb2b9c07a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676928575, "uuid": "20779db9-4128-46de-a99d-b1364d40a246", "value": "SecuriteInfo.com.Trojan.Loader.1311.31977.12267", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2945dca-b0f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676879731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879731, "uuid": "e9ee742e-891c-4605-87e1-a330cbc7f33d", "comment": "Malware payload (RedLineStealer)", "value": "20917d3c628efdf6c1b2989497c4748f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879731, "uuid": "da78dfd1-12fc-47ce-9e29-32f8b34f59a7", "comment": "Malware payload (RedLineStealer)", "value": "80b32995562218ec4f0a67742f2f52e4222d8f00b057470e1d34bc0cd3d3dac8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879731, "uuid": "95c01369-05b2-473b-b6fb-b294337e57c6", "comment": "Malware payload (RedLineStealer)", "value": "132444e84ff81b124dcdbeb7c49cd795a06630cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879731, "uuid": "bf1461bf-d9e1-4a5a-bc3d-cf72e5be509e", "comment": "Malware payload (RedLineStealer)", "value": "325b24fab8ab72407870d5eb7acd347ff51eaacf64a3d79cda5d74acc75a3d1a0bc96a1a174d3dfce7dd37e7f10d20e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879731, "uuid": "1aa5da6e-8807-4dc4-9967-1e312e3e5cc5", "value": "T1F614D012B5E1D0B3C45B4870D4B1FBF41EFEB93106A4888B37A427BE5E706D156BA31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879731, "uuid": "d70d3973-de89-446d-be58-bf6cee12aba1", "value": "c33891a90cc721ae1c38ffdfc19c51ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879731, "uuid": "13b0ba7a-423d-463f-9daa-020d3548fc9f", "value": "3072:CXEgPEOvVLD1fK7P4UMsoS+wGMECOCPznT8HdScJkY/K/QwXLz/tBS:CHEOvVLY7PzT/+CrOdScJkYOP3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676879731, "uuid": "55a39aa7-c16b-4c99-94c2-1b8e3589c1fc", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676879731, "uuid": "d4b21f26-fc78-4e04-9213-449746ceafbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879731, "uuid": "e862ccca-7d23-456e-940d-5daa659a95a9", "value": "20917d3c628efdf6c1b2989497c4748f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3662d859-b138-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676909050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676909050, "uuid": "b5cf47cb-9b44-4355-8592-da1733537d29", "comment": "Malware payload (AgentTesla)", "value": "da0142e7578217f9a1f57080d6786e15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676909050, "uuid": "14d6b882-39e7-4f33-80a4-c9c8c060f630", "comment": "Malware payload (AgentTesla)", "value": "80edba90001d842c718755c7bbdaf39a2ae795b9f0315a3c3e110b466013e4e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676909050, "uuid": "adb8a3d3-5b0f-4c0e-a7f6-1b6e6a24bf8a", "comment": "Malware payload (AgentTesla)", "value": "b8e72c2e56fba262a1ef75a2089146d6e5134724", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676909050, "uuid": "7b01cfe9-68f4-4de1-a6b4-adf47ea85a66", "comment": "Malware payload (AgentTesla)", "value": "1dbb6540f9eedfbb5fd1695183452d7a5b43d803ae9a6c1e1b7462b8e2ad9799a376f78a7843bc9197fd9ca99ace3d80", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676909050, "uuid": "b020f78d-a101-4604-99c1-2ac25f45f5cb", "value": "T19CF3EE51E7B0BC2BF5540778AAB292931A93BD33A915D91626C3734F5B73FA06C32E01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676909050, "uuid": "b7283fd9-b686-456d-8542-6d57b6d73aec", "value": "3072:KHkZ+RwPONXoRjDhIcp0fDlaGGx+cL26nA+N28:fZ+RwPONXoRjDhIcp0fDlavx+W26nA+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676909050, "uuid": "96388733-e42d-4efe-ae5a-33a3d728f912", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676909050, "uuid": "43197a87-d62c-4231-8fb6-527a3a0bfa92", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676909050, "uuid": "aac16a9e-f2f5-4f0d-a5a4-6c67a4969983", "value": "BL AWB 5331810761 invoice packing list.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8cd8b4b-b114-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676893861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893861, "uuid": "97157f76-222b-4f55-9723-381582591717", "comment": "Malware payload (GuLoader)", "value": "720e817e905726d225a0c5d175a5d4eb", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893861, "uuid": "b4242c3d-9058-4acf-8e9c-fd3056d13a15", "comment": "Malware payload (GuLoader)", "value": "82596cc53fce11978c3808cdc29262b32009a9c36653b67546818afa6c255e41", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893861, "uuid": "b5f27a30-e2e1-49b4-93d8-ffffd43dc853", "comment": "Malware payload (GuLoader)", "value": "7ffa3e8fb98a6262cabce5722d2312817e4bcf28", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893861, "uuid": "59d64287-33c6-480a-b689-69e939afdcf3", "comment": "Malware payload (GuLoader)", "value": "6dabce0c5f8cd7d128b65be88becbcc2e4153a48102fb1feeadffc6888839e435d45de74bee1d43cd395c86b14feab7a", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893861, "uuid": "6d0875c3-b50e-40ef-a5f9-e14e43c8a251", "value": "T12C1423997FBA2CAF7063EC79D30F041A7561BE10532C64119E798AD351295F2E7B83B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893861, "uuid": "fe8917ee-8928-4ccd-a1b3-50eeac3e4922", "value": "3072:OYlvRfGEU4YPRPPskDbwXzTfSvy+elTE3u0hiBa284Tg6iv6NT6bywgjf5pdEQHU:OYb+EU40EDTfQN3WBKXVv6NUyDdvEQHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676893861, "uuid": "1d93abdf-1a1f-4427-8d2c-55eef7f0ef3e", "value": 204423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676893861, "uuid": "e980dd1f-9a2c-400f-a6c6-40bbbea33a1b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893861, "uuid": "68756e37-67ff-43f3-ad0f-ff086de00463", "value": "DGMT_Specification 0992658_pdf(83KB).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d927eb9a-b108-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676888707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888707, "uuid": "3dde0e78-9d8d-43c7-b03a-99ea18261e72", "comment": "Malware payload (Loki)", "value": "92c58afe23acd76e5f0ab0c8f0f0394e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888707, "uuid": "29782f66-74d5-4dae-9b0a-1295f413bb9a", "comment": "Malware payload (Loki)", "value": "82f786b26b47b6e60bed7d7aacf0dc221c6ad426554fec30fab21d59549e949c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888707, "uuid": "e12570b9-68ed-444d-bdc9-5ead3a8ea6c6", "comment": "Malware payload (Loki)", "value": "319c1720352e2924c6630428b691ef8706731530", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888707, "uuid": "1e501ba1-c4a0-4bea-a7f2-86604658644f", "comment": "Malware payload (Loki)", "value": "f5ce3ab2f128b2f1db7c3f76fe4b54aff1a5da45d32e85c1b5ea66b6ee1af77ec8519296d675fdb27ad6b00c301ab8ef", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888707, "uuid": "08a762b8-0183-47e5-951f-30c07f7c894d", "value": "T143328D39D54EE420D9728578709912F1FB498606B662C13FB817F8D9C864577033EB8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888707, "uuid": "3f5088a1-3e57-4975-8742-00bc69180976", "value": "192:CtNCWUyn0i13pNXqkOcPiYFLwzvdX6Ptpwjnw+umHBC0nVj:aNxUyn0i13LROEiOLkX6Ujnw+35Vj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676888707, "uuid": "0fe51d80-65aa-4083-886f-f78deb1a2008", "value": 11803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676888707, "uuid": "9a648086-14e7-4472-9ddb-76742411c705", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888707, "uuid": "5b147c0f-af2a-4392-8680-a2ac35358bdb", "value": "SOA #00776122.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba08f22-b119-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676895933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895933, "uuid": "f9989563-5613-45bc-b1ab-0eb427bf11b8", "comment": "Malware payload (RedLineStealer)", "value": "18d63236236b5726db36aa4e35bc4c65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895933, "uuid": "2c25baa2-2fab-40d8-861b-e62fd8820eb3", "comment": "Malware payload (RedLineStealer)", "value": "8304b7d20a0311b9ed3d6a38d2ae556244f3bacc1c46e90e457addd810afe6af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895933, "uuid": "db66c82a-a0a8-475f-8a3f-9c6114714c37", "comment": "Malware payload (RedLineStealer)", "value": "0b49331fb37277f448cc4f5deac748c929b85bf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895933, "uuid": "7e7efec4-cfde-4dfa-a874-1726144aee44", "comment": "Malware payload (RedLineStealer)", "value": "b4cdbe5fbe20a7746b8a402c0b719c18cec674b85509f06d12598d91249106952b7c760435b2f2fef9b9ff0664aaaa68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895933, "uuid": "540af238-974f-43d2-84f4-0f214a093382", "value": "T11704D61037FCDD11E1BA1A3F6921A05186BF98026852F75B76C367CE0E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895933, "uuid": "f877f238-9a79-48e1-872b-48c08b7d3489", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895933, "uuid": "a49dbac0-f9e3-447f-ae54-b7926070ed27", "value": "3072:oxqZWXQae0E58iYmTUeAaFMh0/xNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw7:WqZ8iYaxMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676895933, "uuid": "856b5b98-0f82-4968-b6c2-8c75ff222fe8", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676895933, "uuid": "2360e9ee-30af-4a16-99b6-6e26abf9b25a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895933, "uuid": "87620d7b-c642-4771-8cee-29b8ef1dc4ad", "value": "18d63236236b5726db36aa4e35bc4c65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc3780c9-b119-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1676895960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895960, "uuid": "78511c03-e18b-436a-aa4a-8daec08e3f58", "comment": "Malware payload (Gafgyt)", "value": "8b2fa2b6d99d5aeb75f8245559265cfa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895960, "uuid": "7634ab24-fce6-4ce8-bbd8-bfce33f201e2", "comment": "Malware payload (Gafgyt)", "value": "83734a32709d9667cc136b9cedf71d7360ec574d527f4a87744f436676b2e7fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895960, "uuid": "5ac94e42-0676-4771-be63-e985c7d02409", "comment": "Malware payload (Gafgyt)", "value": "e50270363f90b85af9aa7025a37b8db3decb1a53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895960, "uuid": "0fe73b30-ec7a-4ef3-be98-0055d0c8e480", "comment": "Malware payload (Gafgyt)", "value": "9c550a6f9c79ab130646f4c9876124749559cc6183953e942eb461dd918ce05cf53315f481d721d3d8e91cd54097cbe1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895960, "uuid": "cabf0fb1-72e8-46a5-87cd-405dc601fff6", "value": "T10003A7466A218FEDF168823547B34F22AB6863C517E29784E2BCD5001F7274D586FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895960, "uuid": "6f2961a9-e3ce-4ae3-86fa-7db3b8279147", "value": "384:nng8Si3mkFEI7Z9kDlfp706O3s6DJcHZcXu7DQPRtyqTNgh2MMebEP0l+B9bGtKy:2imR89NXu/ctymQ+e9CoIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676895960, "uuid": "0832d71f-2832-47cf-9cc4-3be30e24b7ae", "value": 39056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676895960, "uuid": "10a5cc70-adb1-4451-9e1b-820eafa50d56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895960, "uuid": "8efe55e1-66c9-48c9-b450-b11460724b4f", "value": "8b2fa2b6d99d5aeb75f8245559265cfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20925e5-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676882709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882709, "uuid": "a4423ab8-089f-4bf4-8c65-8fc20263f4d4", "comment": "Malware payload (AgentTesla)", "value": "afe8004f5569bc25539788a75b01616d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882709, "uuid": "15e10995-3164-48aa-b9c4-3d58899ca255", "comment": "Malware payload (AgentTesla)", "value": "8385d01029d2b97e1e63e11f93e23160470ba309c528ff0e0a0c091d41b7988f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882709, "uuid": "10887065-4ccd-4b81-9b9c-bdc7d420d85e", "comment": "Malware payload (AgentTesla)", "value": "25933cc3e49e8f27e94def6d6a8397e171b6afb2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882709, "uuid": "3492b56c-0443-4bcb-80a5-67e63de5b041", "comment": "Malware payload (AgentTesla)", "value": "7406e85def241e201f389a9cc75121c5217e55e691342f99bcc1827a0c69a0a858c7ab0de66aa07ef8b5e9a684f11572", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882709, "uuid": "6acbbef1-32e4-4187-9a9c-eb721b41b3e5", "value": "T1A4E49C8CC0F1EA3ECB498EBA371035081FE056437920D9E6E3A5FAD26F36563199D935", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882709, "uuid": "f7639e4a-c675-44dd-8712-7f05a0a2592e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882709, "uuid": "0d3787a4-653d-4ca0-9b38-5893e65ac5f3", "value": "12288:O7wvqDSuaT2fv8X1vCoTXsblRWr0IsriAtWqRUM5WUk5/r5Dsv9t+Dsv9t:OEvqDSuNUX1vyxYr8NfR/WX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882709, "uuid": "28774ebf-12b2-4013-beda-8b0bce830187", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882709, "uuid": "89d0e71a-ea6c-41c1-b5a9-a24683c00a5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882709, "uuid": "51fcbaa1-ef20-46ac-ac70-1204fc78da44", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7358853a-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676908723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908723, "uuid": "fdb0a6b4-b6d6-4726-8420-efa4759f6865", "comment": "Malware payload (SnakeKeylogger)", "value": "18019c025f011fc152801e57f4bd927d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908723, "uuid": "a3371c26-aa5b-43b6-a936-50473b4f026f", "comment": "Malware payload (SnakeKeylogger)", "value": "838a4da26241b33500509d8991d15af533ffbb57f61d18be76bdfbbe3a4abf7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908723, "uuid": "b1a879eb-bab2-4475-964d-b4331fc7c2d7", "comment": "Malware payload (SnakeKeylogger)", "value": "37529b9aa25e096d324bb2245435d691a5ae6fbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908723, "uuid": "d78e5649-77bc-46b2-8f43-18236679d135", "comment": "Malware payload (SnakeKeylogger)", "value": "7ccc4fff715f086a224e3b5386b7c5b12c75195b067cbb504a68ff800afaaa36296dda97b1f022a8ff62e78c2bf547ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908723, "uuid": "1e43577c-472d-48b7-8662-0f02318eb585", "value": "T13FE4BE3733844B2BCBBE42BAB650E191F761ACABB700DE0F26C761D2556B30055D6D2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908723, "uuid": "6dcfb578-77f0-4ab5-a30e-7fd51240974a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908723, "uuid": "e6814f80-9829-42e3-8ec9-132b3b57f181", "value": "6144:omHG/8tC4Fqevr/uUV9w1LHnUvaS/EfvDdYooZ9oXUAF2Nksr9T/9li70PDlbPMN:5HQUCGqei/nUH/sdYxGanTjUQDlbPbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908723, "uuid": "32491c3b-b9bb-4bc9-a82e-acc72c886740", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908723, "uuid": "db0e6cb3-aa57-4418-92f3-d00144252c80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908723, "uuid": "6cbd5b8e-7166-47ec-9a76-dff9ab601e7a", "value": "18019c025f011fc152801e57f4bd927d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8088ca-b0f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676880336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676880336, "uuid": "78bc7613-543c-4024-ada7-9a92160de051", "comment": "Malware payload (Smoke Loader)", "value": "c1388eab6f344a7c680168b05b12323a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676880336, "uuid": "29d7f6d6-0673-4eed-a354-6335b1ba93cf", "comment": "Malware payload (Smoke Loader)", "value": "84e51ffdf5d7d5804fa4777ecbe8e92ef95b7137298237c5b28b83061a5d4dd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676880336, "uuid": "cd50a36b-53f8-42d6-a9e6-a6bd201a9f4f", "comment": "Malware payload (Smoke Loader)", "value": "d4ebfc56d428d04619e84eef0d94e54319c6cd98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676880336, "uuid": "9f7a5123-fef3-4d95-89e8-7649e1e3d251", "comment": "Malware payload (Smoke Loader)", "value": "ea9623f6e629e93e702d114db3906839de446f37a2e9d8c30a498b14b039a14a892d37e6cd8250c26d99fba92e4c72af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676880336, "uuid": "c98a7eea-3577-4cf4-a767-f8d8b104f578", "value": "T1E114E012B9E0C1B2D5775574A4A0D7A02E7FB9F317618A8B3768162E0E703D227B731B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676880336, "uuid": "ca337b66-dccb-4f1e-a19a-6ff6451677cf", "value": "c33891a90cc721ae1c38ffdfc19c51ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676880336, "uuid": "c5950944-a86e-4514-8747-9e442340a7bf", "value": "3072:FMMZFqiVuwfLFM1fBoP4UMs+kBWMTZ3V23/MxrtWBk9nFZZDn84H1cqTEtBS:WNiIwfLFSoPzZ+3k6BEn5ZewEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676880336, "uuid": "44e227d2-0774-409b-ae88-0a17e757c2e2", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676880336, "uuid": "5bb17600-7255-4d4d-9608-a790799c2c90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676880336, "uuid": "1eaad83d-31b5-4712-a810-84e336ececd9", "value": "c1388eab6f344a7c680168b05b12323a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e40a41-b0dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676869989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869989, "uuid": "9f279dcc-b8bc-4d31-9a8f-0c37afe1941e", "comment": "Malware payload (Mirai)", "value": "cf5a924ea6958cb3afa52176e7efd670", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869989, "uuid": "99520c24-4176-4804-ba6d-0a93ee75922e", "comment": "Malware payload (Mirai)", "value": "8560214e496ca62f4abf2bd8f89ecbef8323c78676dd3193263696d487735302", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869989, "uuid": "550d0985-b66f-493f-afac-df6763aecfc5", "comment": "Malware payload (Mirai)", "value": "09947df8ae0c29546133618d90162cb594275ca9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869989, "uuid": "60dee0e7-b52a-44fb-98aa-1f3973fd9ffc", "comment": "Malware payload (Mirai)", "value": "a68ca11d2797b8ba578bd63379f5631e4b3d1014e8c4eb49e269d74d6f9e30c3d76bf930e517525e877d111be012eaf0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676869989, "uuid": "9481adaa-34c1-4340-a8a7-7265aeb573b4", "value": "T1AAD2D138F4407F16FE8666F54EC6C7C677B10B6EAAD184C6664CAE45320342AB568ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676869989, "uuid": "45bfc370-2b5e-4ea8-ba7a-eb312805993d", "value": "768:Lna3pTDhmaVBLhYjTdFRWUf0MxW7OWlkn4uVcqgw09y:zST9maVBF07RN0uW7JlS4u+qgw09y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676869989, "uuid": "73f20ba2-5426-4473-8fd6-d6286f11351a", "value": 28536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676869989, "uuid": "65c73d46-d0f2-426c-9ac2-0bd17b9fb47e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676869989, "uuid": "963af685-7f3b-4abe-9a1b-dce1bf5d1e18", "value": "cf5a924ea6958cb3afa52176e7efd670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc68cfa4-b129-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676902859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902859, "uuid": "2033b052-9d58-45dd-addc-1f2ca433042c", "comment": "Malware payload (AgentTesla)", "value": "f29088aaa88a52c5a6e80a9a43f34f72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902859, "uuid": "4c60dc2b-353d-4fc4-bd2d-48a1928ca3e6", "comment": "Malware payload (AgentTesla)", "value": "87851c8f0da48b52a24f0696eba016cbf2f2f533eba6edeccd81490e72ef8593", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902859, "uuid": "fdf0eda7-b37b-4ca2-9f50-43027f47297b", "comment": "Malware payload (AgentTesla)", "value": "0a85ae4e1cb2ebda776c7c8ddf3973ffbc5f969d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902859, "uuid": "e0e590fd-3943-45e1-9ed8-aea11d252673", "comment": "Malware payload (AgentTesla)", "value": "640a09d0ad7ee2aac2cec3da890bb3e9d26fd263114601bcea5971e9e6489d87359eda3586d88e51c972e4709d5dfec4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902859, "uuid": "d84ae77b-cfb3-46af-8f14-d3cd5928ad07", "value": "T14B25AE09A7B0E677C58B01EF18385B0C39A475437619E26C8FB77FD292709BB75A9203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902859, "uuid": "2876bc8e-121a-44ee-b32f-f978008eb0e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902859, "uuid": "3f4c2476-5f04-4a33-99e0-6ffd562101dc", "value": "24576:OrM4yZ1OUkSVp4jdddvkVlni59JhhurRmrYE:YgAUkcqkjAbaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676902859, "uuid": "b40992bb-591f-48d5-8454-cd1a0adb952c", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676902859, "uuid": "03e2a856-1f25-4e15-8413-97c3aa382f87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902859, "uuid": "d2b94302-704c-4280-a3f0-434a9add2f9b", "value": "damianozx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76938ba-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676908918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908918, "uuid": "b2dd3ba5-4f93-4fea-9296-3386e7228466", "comment": "Malware payload (AgentTesla)", "value": "c022a5e252c97d1abc93ef8174c3cde0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908918, "uuid": "8a16f6b7-d857-42d8-b024-531c6738bb52", "comment": "Malware payload (AgentTesla)", "value": "88c09ac3142228991a995ae6424a3edacba48637402a2adc014a2c43c8c21bbd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908918, "uuid": "fa83c281-e3b1-4d9f-8988-12cb8cfb7508", "comment": "Malware payload (AgentTesla)", "value": "499bd4198fe3b966a591a4552580771275566b6f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908918, "uuid": "4ef3efe1-9856-4bf8-b734-6343dd779457", "comment": "Malware payload (AgentTesla)", "value": "b198ca3a3f6ae2d05e60e6e2ed22d180891ac4caaa9dfc2c679ae7f008db9d9b42b3584adf605c80ac9ce33e38197561", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908918, "uuid": "ddee9150-6587-4932-b271-d0fba9c2921f", "value": "T175F31071E7A4BC2BF5540738AAB281971993BD33A915D91622C7735F4B73FA06C32E02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908918, "uuid": "b575a83a-fcd4-4d25-860f-61597f9d237b", "value": "3072:pkZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAaN2AS:OZ+RwPONXoRjDhIcp0fDlavx+W26nAar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908918, "uuid": "87bd0fcc-b2dd-41b2-a6d0-de84ae2bcb62", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908918, "uuid": "91839396-a232-4f99-9b57-f34e17cc93c4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908918, "uuid": "dce3903e-a4d9-4c01-bd33-6f84efdbb78b", "value": "REQUEST FOR QUOTATION RFQ.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1b3185-b161-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676926884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676926884, "uuid": "f5f7121b-0ed0-44ce-80d8-088ffa534bc9", "comment": "Malware payload", "value": "2f810b534e5a77ea4ea6ab968999cba3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676926884, "uuid": "9efb9924-620b-4a75-8150-0260686ffbfa", "comment": "Malware payload", "value": "896225fcd030c354b9b4924bf4b395dc358e2adca98ea71a1d604e24083e34be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676926884, "uuid": "06f18f31-c693-4b70-a848-d063f01c4f06", "comment": "Malware payload", "value": "d687def5053ec436819ea5a083f5c1d457b092c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676926884, "uuid": "c48b39ae-5c4e-4a73-9432-45b2c4442354", "comment": "Malware payload", "value": "a3d8797789d91a554ae104a0460055542fb166d14463eb39c2f6bc8ef3115a18f42d00e13121b629aa56a0de141d465f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676926884, "uuid": "8b7c64cd-1b95-4bb7-9b58-6fda84012a8f", "value": "T1C5940201B5D2C4B2D5B226320650A7B5AE3DFD300A8A4D7F17E51EBE1F74381EA25DB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676926884, "uuid": "4b5bc906-b824-45de-8828-cd331faa11da", "value": "0d2fd8b3a8d6bab31902f9718abf44e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676926884, "uuid": "41d536eb-cdec-41d5-8bbf-eb57f13a3e9d", "value": "6144:/lsRsDu1yYIAOAF6iUup04s5suxIv1d3cF4MGj6hTaeFjR3vb33e09yMu1OP:/lsRquIW0PupqKY2PjiTaCfT3e0FP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676926884, "uuid": "303669ac-c5ae-4c1f-b51d-0ae7577d052d", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676926884, "uuid": "152f7bfa-0796-4d84-a555-eae8888df81e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676926884, "uuid": "f1938c40-4733-4faa-a321-11093aaccc65", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa39b6f1-b124-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676900789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676900789, "uuid": "89005650-9e7c-4365-926a-264e6ed4c5cd", "comment": "Malware payload (Formbook)", "value": "b42414baa2acc9bd03b26d8bdbba9673", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676900789, "uuid": "b52789e6-ead5-449e-8ef5-c1e8be944e3d", "comment": "Malware payload (Formbook)", "value": "8a0fdd0d3d6f7f520ac8b0da039ac2e906732f7b38cf98742e4ba971c9e4513b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676900789, "uuid": "5d6b1d93-b876-4611-8e6a-abf4b63d5611", "comment": "Malware payload (Formbook)", "value": "2545f81d1dd846f38fd64c361421d6e26e3361d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676900789, "uuid": "50a05f62-eb41-4286-8b93-d9b56a4386bb", "comment": "Malware payload (Formbook)", "value": "947e9b70c471eca3e050c6aa1dc780d3ade6bb365a026c8db4d4ce2c08869eb15e47d7f756eef2fa317ccf8abc8248fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676900789, "uuid": "a6cd1f9b-4d18-4cef-8436-64492d103302", "value": "T18205167D39B796D2C239FA3386E3E520B5BD88923317C959D8D62AC04F421827DCE65C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676900789, "uuid": "67253203-991b-4bb1-8ff0-33d0219f98bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676900789, "uuid": "5d3425b6-16bd-4535-a686-93ffd1c8f146", "value": "24576:os8dOTsIBMNjnNNOhAe/S0+49ZJ/pPS1SMHnp0YbiKqig:Ea/JhPS1SAp0yiK3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676900789, "uuid": "af5f4533-61e3-4569-8713-f4cec7f751f6", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676900789, "uuid": "2f8b43c3-5629-4a31-ba6c-cda55b15382c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676900789, "uuid": "c500cbeb-82d4-4ead-a6c8-a6b33161b408", "value": "PNOO0988901234567YTRE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358a44af-b0dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676869965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869965, "uuid": "329572da-968c-4c87-ae39-4d76d6642695", "comment": "Malware payload (Mirai)", "value": "75de8577bf18a617bf487034dff2b135", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869965, "uuid": "bc1bcbc7-4e2c-460a-817c-0d9a10813092", "comment": "Malware payload (Mirai)", "value": "8a525715b9cccac5717a1cb2f05806292344a47e933c94839af7ed09bd440ebf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869965, "uuid": "976f8d40-4985-4dcb-a951-b4ba753d1cc9", "comment": "Malware payload (Mirai)", "value": "8970864576705707b26923c6cf105a30f383b848", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869965, "uuid": "5e04cb42-dd69-4ca6-81d4-158843acce0f", "comment": "Malware payload (Mirai)", "value": "6c880515f1dc15f0fec91ea1951effc9257b0f45aaeff76b96d38d110717a8f48a6ae2d1c5ef842c68705e8a0c623b20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676869965, "uuid": "d04838d4-2309-40d9-98c1-4a7b48b41039", "value": "T12D33023085A41CF1D1317DBAB27FC1525B2B1F7862FF903A6088810A35E655AF1FD9DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676869965, "uuid": "2151805c-dfe5-436a-9f6d-3c91fff2a71b", "value": "768:jAAXFHMN0ZRskSr0LynBe8D9vNqqqkvWfNKorH9q3UELen9p2iMQ/uOIm09W3vlE:jAA1HMVxlEkR0xKsWLArlFW8vlTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676869965, "uuid": "8309cc02-bee5-4283-8dae-421479216867", "value": 53960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676869965, "uuid": "d14cc1a6-c6fe-47f7-8e6e-0d0ca9e5dafa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676869965, "uuid": "db139c88-d4e7-43a4-ac0a-6b5a6e2d2494", "value": "75de8577bf18a617bf487034dff2b135", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd44a3d8-b107-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676888339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888339, "uuid": "66da04de-c6a3-4121-9690-04ee4021468b", "comment": "Malware payload (GuLoader)", "value": "2577c4541a9562fcfb037d834c70a6d5", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888339, "uuid": "99f56852-0c27-41c8-8ecc-f22144d89312", "comment": "Malware payload (GuLoader)", "value": "8b06d0898d20cca63c608749a96bd73e4aa063f85ec8074fda602192cfa95884", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888339, "uuid": "ed92a234-636d-4dc2-8bb6-89daae79eb2a", "comment": "Malware payload (GuLoader)", "value": "a4e600614945ac8787bac2d067deeb7fb9f18c67", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888339, "uuid": "3ac35191-c328-4dcf-9bab-57f5ec9f04ff", "comment": "Malware payload (GuLoader)", "value": "7d920c203decc62a7ecbb56f7c01a224b65e9df33b0175c537973ae128b99729f820c6fec1bad8f06502760cb5c47469", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888339, "uuid": "8f42cfd4-fc4c-46de-a821-0f6746c63e17", "value": "T16B8423E1BAC590259A06C7D305E7497B6527ED40D229E30C094EA7E3CFD6E4E33ED216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888339, "uuid": "8a691335-5851-4bc2-bd02-2d2af85bc683", "value": "6144:wllEFZlJ4k1hL6f8M8t14kVIGsY+ALVCGKn28bi0m3+6+Fhz76njKrkmdq:fFDJ4k1p8xAvvsf0anPbUr+5G9Yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676888339, "uuid": "c761b568-b07a-41ca-a4de-5ada5c1e34c7", "value": 376729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676888339, "uuid": "2e97e3f9-f210-4c1b-81c4-0ef26eaf6de3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888339, "uuid": "be4c756c-e56e-4501-92e2-a77cb199354f", "value": "ekstre.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c630c632-b10b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676889964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676889964, "uuid": "acbd1f50-e034-4bb5-916d-e0428dfcfaeb", "comment": "Malware payload (Smoke Loader)", "value": "b5e78a36a368a0fb608a44283dde5ff2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676889964, "uuid": "fe03219a-cc47-481d-8648-3967b66bc258", "comment": "Malware payload (Smoke Loader)", "value": "8b3b4feb7e618ca90501b51baf15bc9e7b210c8a7cdc12dff5a1a3af1b27215d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676889964, "uuid": "34b0548b-3b93-485d-952b-96bb81f29be0", "comment": "Malware payload (Smoke Loader)", "value": "9c6966b006b81b9e3755bc54e3e5bb5464d00deb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676889964, "uuid": "ed7e634b-d4c9-40be-9d70-a9f6220633e8", "comment": "Malware payload (Smoke Loader)", "value": "66fb965579b4f12763c82b4f499b444035f2a86233034376bf452c2543a1ea67971d3d479d21ca2aac5b3c434063fe8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676889964, "uuid": "740e8d69-beed-45e1-b101-c0914906d69e", "value": "T19414D09175A0C8B3C07744B45830DFB45A7FBA236765858B3BAA326F2F307D11AB5316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676889964, "uuid": "2de9fa49-15ea-4d54-98ef-91c89cd4c0cf", "value": "1dc9c32af2b0d0927717a78648d34c5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676889964, "uuid": "0177782d-f762-405e-a552-f28133a034e2", "value": "3072:Kiuvq/JzxRLPN/oJPQfHU7+xlvARURsTOSJE+5TddeYk3oWOK+6Y7p9Ar:kEJzxRLOJn7UuR6sTOK5AYk3olK+5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676889964, "uuid": "c3191f71-158f-4716-9c7f-462b05708841", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676889964, "uuid": "06b97e21-83cf-4ae8-a591-0a2ca7a8236d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676889964, "uuid": "8f2805e4-49df-4119-969a-899d484e770c", "value": "b5e78a36a368a0fb608a44283dde5ff2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d7a176-b145-11ed-88f6-42010a9c006e", "comment": "Malware payload (a310Logger)", "timestamp": 1676914957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914957, "uuid": "77922981-e578-4c9a-b0ab-dbef34368caf", "comment": "Malware payload (a310Logger)", "value": "1a496bebdf47aaee63127ad8e0f2c038", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914957, "uuid": "948a7cb0-cf5c-43e7-be97-927f9e8a6e7a", "comment": "Malware payload (a310Logger)", "value": "8b43fb960fbec0fcdc81a4e12892204c6dc80156258e92995f2a7ece5da3c5b3", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914957, "uuid": "53bd9e41-f2e6-4b65-9fd1-ec213e3a4215", "comment": "Malware payload (a310Logger)", "value": "0b4c18d15e7e03fdc58f942236591d01db2a0e15", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914957, "uuid": "d075a912-10dd-420a-badf-dba108faa995", "comment": "Malware payload (a310Logger)", "value": "7252da052aa47a0f84bca64571f0013a52b27d44bae1c754336dfcc81c3b4fa7ec128fa8925112f367544bfba87c34bc", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914957, "uuid": "a4abd690-d821-4f4c-92c5-14abda4eb1f4", "value": "T10ED423A9B974921ADCF04C301B36055A7699E73A3AEDA20703401DAF7977273CE1FB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914957, "uuid": "7c4cd33d-7061-45de-9a0b-dc2c321d1dca", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914957, "uuid": "41217b22-2977-472b-b674-9ba04800bd33", "value": "12288:/Ytho+cYQo+uRRAkbIWsRQ219z0EnDWg9/YG6B5ZdZOkiM:/Yt4YQoRqkV2Eg9h6JdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676914957, "uuid": "189b819c-977c-449d-8342-fa8572be1ea3", "value": 611560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676914957, "uuid": "151ca972-4892-463f-94ff-cc5cd1507b61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914957, "uuid": "917464dc-2a4f-42a1-91c3-ebd8f584da1f", "value": "PO7313 2023-02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523a1d06-b0ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676877314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877314, "uuid": "cba00d90-da32-490c-8216-24b13f2fb554", "comment": "Malware payload (AgentTesla)", "value": "04406ecfc8bd28c1f0c1a09e57dc78ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877314, "uuid": "989d1332-6520-4997-b979-8dc2970f5720", "comment": "Malware payload (AgentTesla)", "value": "8bd1d98d2cb843b9e03d04149dba86105b939781233eb1007fa33b79a76b4184", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877314, "uuid": "7568cb0b-a23a-4c56-a523-82a7edb2ec1b", "comment": "Malware payload (AgentTesla)", "value": "b69b78d85bbc44f25a0bb2f68afdf63440d76bcb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877314, "uuid": "5c4e993d-22f6-4cb4-9012-8a020c58569d", "comment": "Malware payload (AgentTesla)", "value": "fcf7af270239a9d0b0b2c525cd1a7f4285b5ba3f69d0c97a44459e0fc6d760fdd2fdfdbd7a19b56cbbeca068ca11e60e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877314, "uuid": "68d0ba65-9511-409a-98ad-533671cde893", "value": "T10435AE883774A07FF48B45FE58382F8C2D2035577609E21FA777BB9192298FBB684152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877314, "uuid": "2ada7ce5-468a-4379-8586-1fdbbb764f39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877314, "uuid": "a80994e7-f67e-41dd-9626-706533336c61", "value": "24576:5zIkSSSnTuYE70VVSig1T3C32mT+DMnmWy7ILz:56Ch70VVSig1T3A2miI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676877314, "uuid": "b6658c43-750a-49b2-a090-d0388b1e6c2c", "value": 1109504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676877314, "uuid": "0597ded3-8fff-43a2-b8e8-3b608613d3e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877314, "uuid": "75ee675c-cebd-4799-84e0-582698e0b7bc", "value": "AWB #3827747403.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd6728d-b130-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676905630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676905630, "uuid": "d542dadb-8f5c-47b1-849a-d70964300067", "comment": "Malware payload (Loki)", "value": "1bf9b73c459e8a0703e006716dd8222d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676905630, "uuid": "cc911615-a45b-4205-abef-82e458a4b6cd", "comment": "Malware payload (Loki)", "value": "8c76ca8a535aed705742cbf7619e7c5acff6e21c427d50bb4733d604536f909b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676905630, "uuid": "31b576e7-b245-4313-be69-31b336c5aa37", "comment": "Malware payload (Loki)", "value": "33a7fee50dd8fb25b7fc21e5a4c49a3df201f7da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676905630, "uuid": "51d42cb2-80a0-4e30-987f-6cd0b913d0d3", "comment": "Malware payload (Loki)", "value": "25650d03d4a625bf3a010c72de7be2154f9d63e56719fe676a902127ec241e693f1be90539f5dd4eb79ecf2f132e3c2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676905630, "uuid": "e1130153-29d7-4fbc-98a2-dddf267db612", "value": "T1A025AD19A7B4D6B7C59B01EF18385B0D39A435477619E22C8FB73FD292709BB35A8203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676905630, "uuid": "fd3c544c-c83e-4e5e-bf93-c2eeeedc3ae1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676905630, "uuid": "2c097b55-4bf1-454f-9cd7-5dbe131c03e4", "value": "12288:pm0re4y7raeyUUH9wvZj2iN3rEXNlmbji9i/rGXWjFnsrQVynFK0MOoQrqU6cVtF:p3y4yZ1VrYEnrGk+RnVt4tq8NS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676905630, "uuid": "60a903bc-8e5e-4557-89ad-aee3fdb6fe9e", "value": 974336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676905630, "uuid": "cd93722c-71f4-4f6a-8cae-29d975d0eee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676905630, "uuid": "1f016354-8844-488c-afdb-6532ca31a5fd", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ddaf77f-b0fc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676883347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883347, "uuid": "f885fa28-cdaf-43f1-8e5e-d46448d18780", "comment": "Malware payload", "value": "f71147ac3c9fc6d0144243fdf14ec138", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883347, "uuid": "44a0ba7c-c7e7-4497-bbe4-4abc8bb464f0", "comment": "Malware payload", "value": "8c7a3033baff75f3390b7625036e9f365f69c3084e8c4d4e8f9d5b724bb61fb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883347, "uuid": "e0a01b53-c598-4100-ae5f-fa12852a723a", "comment": "Malware payload", "value": "528621073122b7f78777d4f1cc7ebf435b5d37a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883347, "uuid": "c6d2b9b3-3e3c-401c-b85b-d5f3284bde8f", "comment": "Malware payload", "value": "c85c544b2fb49b91cf3b9bcc41a56adc151d1575b89ed8c5dd6583f37b2ff14386aa5cb89733bacc93fca07a9367749b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883347, "uuid": "b19cfffe-c527-483e-9afc-544157116c48", "value": "T1EF22F92177D9C531DABB4A7689A266410A76F3565822DF5F2DC8218E8E237400FE2F74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883347, "uuid": "656e1b4b-3482-4360-acc4-3f1213f7df85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883347, "uuid": "81b2443e-b9cf-42f3-9d1f-650d8c64a72e", "value": "192:T1+uwv6odC9EYHd1FEAbO62qwCuazXciDobflRhP9ULhN:T1+uWVQ5d1FEAbB2tCuabTezVULh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676883347, "uuid": "1776047a-c815-4278-a731-c6bbc35e4a7a", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676883347, "uuid": "c580d612-2fdc-4fc9-8294-901e10fafd78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883347, "uuid": "f862c6b9-f4d6-4336-abd5-c7c17af28c63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feef145d-b10a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676889630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676889630, "uuid": "c4266680-caf5-4dae-95d0-b70d934e24ac", "comment": "Malware payload (GuLoader)", "value": "e1d068fda32e6dd44b147604aaf86ff9", "object_relation": "md5", "Tag": [ { "name": "BoredFluff", "colour": "#F93A09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676889630, "uuid": "195ce5c7-35c2-4de8-8eae-c127247a945f", "comment": "Malware payload (GuLoader)", "value": "8de51f065764c5adb842556ae9950789ccf9c12b0c7f573d74316a9af856f284", "object_relation": "sha256", "Tag": [ { "name": "BoredFluff", "colour": "#F93A09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676889630, "uuid": "a5dd25fc-ddb0-49a9-8fda-726111ceb955", "comment": "Malware payload (GuLoader)", "value": "36119ae94db040396493b9fb04f2c17e7a188b54", "object_relation": "sha1", "Tag": [ { "name": "BoredFluff", "colour": "#F93A09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676889630, "uuid": "13967055-6f5f-4f4b-af3e-f3cf46b7399f", "comment": "Malware payload (GuLoader)", "value": "1d56c07084d5a0da677fa2ee9a87714cf21d444229cbf2ad49f52fd444c4d02f8c4643e5057fd664e40b89a4bb3dc350", "object_relation": "sha3-384", "Tag": [ { "name": "BoredFluff", "colour": "#F93A09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676889630, "uuid": "31c98d0c-0863-40fc-88c5-cc78bf9424b9", "value": "T151B41203CA75A442F6A61D302BB78676FDBED914303C425B5BA2BE683F15AC0E15EF41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676889630, "uuid": "72e58890-5d9f-4afa-b9db-aa5e02026433", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676889630, "uuid": "4f42b300-69aa-4ec8-a971-5f7dfc49af9c", "value": "12288:l5Z+iZhKb2jKq3OPSHRJ116e6DijBtpl2i6F+0cfjoozG:LUr2jJx1PY7ipzoo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676889630, "uuid": "838f89cc-655f-4120-b658-e06d3510c842", "value": 526888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676889630, "uuid": "1409b770-7fa3-4852-b41d-5e39ecae950c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676889630, "uuid": "f0ed381f-dc89-4da8-8279-fffcb8b38eb5", "value": "Ourbookingconfirmation#569%6.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a2ccdf-b141-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676913029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913029, "uuid": "5f1ce4e1-6231-4050-b882-d8984785c9bb", "comment": "Malware payload (AgentTesla)", "value": "f043922d283fb0d35b62d54ec69e4b64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913029, "uuid": "3afcab1e-a569-4b1c-8b7e-e547de264ed6", "comment": "Malware payload (AgentTesla)", "value": "8deb3514b80360ee819cf61e2140c3027a6fb865a18bb3cb5154f90384b0b372", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913029, "uuid": "40ab1d05-4c22-4ab0-96d5-162e6f2159be", "comment": "Malware payload (AgentTesla)", "value": "428067e316fec11cded708e24b12e8882fa3b4b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913029, "uuid": "96200e55-c69e-4e40-974e-7d3426aeab29", "comment": "Malware payload (AgentTesla)", "value": "da7d7e9d90711e2190ff9418c427bd6a63f6459e1e24559627db4117e9edb2dcfeed294eae91f33229c7fab9a7a4e0c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676913029, "uuid": "b817cd72-e62e-4e5b-b357-bb1c701101d9", "value": "T1CF25AD5977B4A473F48B01FE583827CC2D3065577619E22FA777BB92A2709FB7288201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676913029, "uuid": "26e64f43-6270-43f8-8488-a909bb5fbd30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676913029, "uuid": "439c2f75-2eec-42e3-a952-111e30002957", "value": "12288:XsfU6RFlmHCxDF3TzFMA7r/gOWROo1FkK6/fipelTL0YMnl7PwtK1gWybr2ay4ek:8M0GijPFMA/cQGn69P9Ml7PzmWy7ILq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676913029, "uuid": "215023c2-6c37-42ec-8476-a58f422d32d7", "value": 1001984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676913029, "uuid": "de662b34-c6e1-4dc4-a6db-49cd5555a4b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676913029, "uuid": "2533ffe4-4e22-44fa-8bb6-88cf29b69bf6", "value": "f043922d283fb0d35b62d54ec69e4b64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1db5530-b0ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676863811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676863811, "uuid": "a707fb6b-15e7-4727-a8d7-6b9f91aba1a9", "comment": "Malware payload (AsyncRAT)", "value": "a8f9431b201b5cfac044780abfd6469e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676863811, "uuid": "d43946af-b2c4-4ad8-9541-c7b3f7e4560c", "comment": "Malware payload (AsyncRAT)", "value": "8df350fdcf13e172a68873fa54ee51a8e141c2c3c467c1bf88fc6b7543c1bd38", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676863811, "uuid": "db03ffa5-be85-44aa-8995-977be66bdb8d", "comment": "Malware payload (AsyncRAT)", "value": "5822d2a7f5cad699095196a19b81b0b607a132b2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676863811, "uuid": "5ccd6735-d04d-49f6-80ce-c6ecb6880f97", "comment": "Malware payload (AsyncRAT)", "value": "f99cc2261132fa539ee8faee21fb21caabd77b09f1c2808ace5448b77dc3d5fbafe0a7a16ee68d071db4ead0221039d2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676863811, "uuid": "d4670bc9-cc68-4947-87bc-b7e94ddc6e22", "value": "T1C5458DECA0AA84D1F80B6DC564687FD2073137F38AD80524233E79448FE7DA95E4999F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676863811, "uuid": "6e88d76c-1358-4a9a-9866-ab8b77318237", "value": "12288:UGSo6+YyUfb/sso8UvI+avCrjVJ++saZu8LzfCMFtn4+pxetBy92aw3j:Uc6+YyUf76F/P1Zu83CMw+BUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676863811, "uuid": "8c862f2a-4786-4576-a343-4becdf125f68", "value": 1191199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676863811, "uuid": "0c7f08dc-af44-4ae2-b1fa-550e24fe7a46", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676863811, "uuid": "f478f552-bdc3-4502-a0d5-b8e57da83bd3", "value": "img.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204557e2-b0dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676869929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869929, "uuid": "fcf82ff4-22e5-4196-892d-4499cb94b37c", "comment": "Malware payload (Mirai)", "value": "00b8657adcbd5815eb9496469482f466", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869929, "uuid": "b5ee906b-eb0d-4dfa-b3a7-a024260d44ac", "comment": "Malware payload (Mirai)", "value": "8dff83b3dbd448e5e448ef8c03d8512d94c8b224d2b7a80b5388883d79cb156f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869929, "uuid": "d65b92cb-9e1a-4f2c-ae47-27518bd1001e", "comment": "Malware payload (Mirai)", "value": "50006937d502acf8cdaa2b4c5278c273358fb017", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869929, "uuid": "69f4f498-9a05-4bee-b59c-3de00be25fdc", "comment": "Malware payload (Mirai)", "value": "cf088ba0849193a1abcb08f8ad95085e77cf0973f57ada289eb99d9ad6ade03836b085a9a569c5fcbfccf737e2bd870b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676869929, "uuid": "7729375d-3f21-4542-9921-6b2eda87f14a", "value": "T130D2E0693F8CD6A2E9B3243DC334EB8B648B5AF8D0E4561D11AC463A31DAC5301B7667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676869929, "uuid": "7cc2fdda-dfc1-43fe-bf19-69ae12ccebb2", "value": "768:VrJqrMa3AyNOXlMbrYNSPIOY1+BHEXgas3Uoz9:9Jwp3UXlMLIWHacz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676869929, "uuid": "899c3f4e-769e-4983-a83c-91cfb4396717", "value": 30152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676869929, "uuid": "c1af6438-b07c-4811-adeb-07e34eac480c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676869929, "uuid": "63bdd66c-fac4-416c-bdd7-99a255319925", "value": "00b8657adcbd5815eb9496469482f466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973945af-b156-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676922098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922098, "uuid": "d561fc76-a927-46b7-bc34-30e876f311ac", "comment": "Malware payload", "value": "899388332b4ed10c190de30d42abdd69", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922098, "uuid": "7b1e3c6e-a4dc-4db0-ba4c-99dcb476de95", "comment": "Malware payload", "value": "8e08794d0fa5095f94496edb9cabdc53779625eab10f8f7cd8d74e95cd7c3f90", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922098, "uuid": "029b2225-ba3d-43e1-9e8c-ab49094e86d1", "comment": "Malware payload", "value": "fef4eddeeaf3e0ed69b2b25d7c225f5db992076b", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922098, "uuid": "c28163a2-7dd5-4003-b94b-bf11edb4b54a", "comment": "Malware payload", "value": "9870763f6e3b384c9eecc2941b9298f6e72f07f608457a6e11b3dea92dba9087a292ed9c1acdc4d0f3ff3521f1f9025f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922098, "uuid": "0663b1a6-101d-4c78-85dc-fe97f8a3c105", "value": "T1313523178A00DC97C16E0739F5250E60A3AD0C21555BAAAF24923EDF5E36B735E9F08F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922098, "uuid": "a186f799-cf4f-4801-831a-c30c4b22f37c", "value": "24576:x8VM5k9uDnUeNbEkjYWajZYxvLEUgrXVFcIWuEvU4tcgKVexDwd3b1POOh:xkKk9UnNajYJLdIXVFjDEV2gvtEsOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676922098, "uuid": "003a10e6-0811-4222-9f77-baf64771f3b4", "value": 1145945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676922098, "uuid": "6c056639-0863-4d05-911f-3dfdaf705839", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922098, "uuid": "8f6f19c1-0d46-4323-9580-be6db48b6d97", "value": "8e08794d0fa5095f94496edb9cabdc53779625eab10f8f7cd8d74e95cd7c3f90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea94b1c0-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676882724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882724, "uuid": "d65e935f-b65b-4a05-bd8c-d736c556c204", "comment": "Malware payload (AgentTesla)", "value": "aacf584ceedca1321c91b370b685b878", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882724, "uuid": "5a7417be-2567-4587-bd3e-a4baa314c7fb", "comment": "Malware payload (AgentTesla)", "value": "8e483fea8031a97ef2bfaa7c7e94968db94e64aacc17aa3909cedbbb6750ac5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882724, "uuid": "4c4f4158-fb4b-458a-8b90-fd816302d302", "comment": "Malware payload (AgentTesla)", "value": "354bfcc6496b4cf5717222db978c62e0bc48fd52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882724, "uuid": "8ecfb43b-3879-4ee6-a1ac-7a80d020ddc9", "comment": "Malware payload (AgentTesla)", "value": "300ec0181d4d629b3f111ed23914f08b7303e1685532da7177e57682e4340b2fb9e8c44ccb568f020d039e8bbd7d8837", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882724, "uuid": "dd730d27-d66d-42f5-9fa1-5e1eec22deb9", "value": "T1768423415EA5C007EEB89B311E3416262FFFAA18647DA76B4B00BF547EF7790681A313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882724, "uuid": "63e7d358-12b6-4ca5-a959-ebd96278c51f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882724, "uuid": "c27c1600-62eb-4758-b556-a1637999d186", "value": "12288:PYhZiZAqLlxQ3wDNNk+oN0Dj7/wWwmoQFstH:PYhZiZAq8w/oNe0xmoQqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882724, "uuid": "9e71e21c-21c0-4ed7-9beb-3179588445e6", "value": 394583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882724, "uuid": "704303b4-901a-479b-a7af-d75533b93b8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882724, "uuid": "e6cbc560-fcf1-47e7-9039-ba400e6ac296", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbccc5d2-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676882672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882672, "uuid": "81314ecc-d8ce-4878-ac7c-a64a08ac5026", "comment": "Malware payload (AgentTesla)", "value": "02835bb802bdeb274c19dca4d1908aa0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882672, "uuid": "be00e385-a537-4e04-a37d-1c2bfa63e946", "comment": "Malware payload (AgentTesla)", "value": "8ef2718c254555dcf4f3717e512b73e066d99ae1df7663bb38ab13a17b0a594d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882672, "uuid": "58bc754d-bc41-4860-987a-d6b025e45aec", "comment": "Malware payload (AgentTesla)", "value": "17463d8703bcc5e98b642805a851703ee275e4c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882672, "uuid": "71e6df4f-e087-4b2c-9634-072dcba485f4", "comment": "Malware payload (AgentTesla)", "value": "6beda043f0fef1ac7b1f6e372874cc0f62bd08bd998950ebfa00dc5efe3dc9b5f5ea6563626274629d04abd7c229a6a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882672, "uuid": "5a93fa26-f45d-4844-b8f7-f2ac6b743118", "value": "T151C4024062B88729ECBE47FA3478246247B5B59BF832E35C5DE470C90B63F124691FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882672, "uuid": "4fd64002-2904-4091-9b4f-d2ef3384c3ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882672, "uuid": "7981dc8d-8a03-4177-9d43-b192c429ba1c", "value": "12288:IXBeB2gVHgLggwTXybYy46f0KAwPwcnPTx75XPy0pO:IXBY2ogL1w+bc6cK5Pxny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882672, "uuid": "b991e81a-92af-4887-af2d-c0ee7f91a973", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882672, "uuid": "ab7c0d89-66ea-4099-9f51-5fd0e9214ef6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882672, "uuid": "d2885ac8-8c25-438b-9e5b-9a8531c91bc2", "value": "AWB Number 907853880911 Original Shipment Document__PDF__.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe68b300-b104-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676887052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676887052, "uuid": "aa32ab85-7168-49e2-bc9c-c05923ebf1d8", "comment": "Malware payload (AgentTesla)", "value": "2772ad98ea4b884cfe063422a8013bff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676887052, "uuid": "9022b1fc-7752-4333-a12d-de9f96e323e4", "comment": "Malware payload (AgentTesla)", "value": "8ef995b3622a048d166b114cd1bb1cd5876e8817662a3d8f4fd1d305030e0d4d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676887052, "uuid": "cc2ec057-948e-4329-93f3-7ec64bb09d99", "comment": "Malware payload (AgentTesla)", "value": "947822fbbc7ec57a2d0ffb1fbf16ded2def255e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676887052, "uuid": "4b08baeb-e068-4037-836b-386dc266abc9", "comment": "Malware payload (AgentTesla)", "value": "516ce18259ff0525a39313362076ac62a911326dd1ab6991158c4933b6a22eda0575e4338e4857ff7b93b13b87624210", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676887052, "uuid": "06675086-25cb-4238-a38b-672df3e8c485", "value": "T10E62F6010B8EA9B2D359E43382369525487DF16F735359F8B88DE19133AC20DAAFD1F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676887052, "uuid": "8b210bb0-1ee3-4c0d-93b1-e806564d36f6", "value": "384:t6/LPAfJFQhFi187hvwsA9u0xyPAeQ+BbZFu:t6DPwEhFi1estqA1+Bb/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676887052, "uuid": "6f6b9e5c-a227-4ac3-9816-fdd6719b1c83", "value": 15441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676887052, "uuid": "a5f50e9c-e476-4c0d-9032-0b9018ff937b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676887052, "uuid": "65b3dfa7-a241-4ea1-9632-a55e3030b199", "value": "2772ad98ea4b884cfe063422a8013bff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d553f702-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676882688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882688, "uuid": "afac2d95-af63-43f2-9268-3421eb4b6b82", "comment": "Malware payload (AgentTesla)", "value": "c3313eaed340233391898c9755d06252", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882688, "uuid": "14a332c5-a754-49f5-97ab-a1a6b236de7f", "comment": "Malware payload (AgentTesla)", "value": "8ef9c77dcb06ee732d0cfbe66d7612679a642e54f08d5cb2a915810664d67914", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882688, "uuid": "1a69470c-232a-4ba5-b871-766fd020f599", "comment": "Malware payload (AgentTesla)", "value": "64cf54832d325d1779249b3c0c6861e5f4b2db12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882688, "uuid": "cba686a0-0218-4b58-87c9-f042fdf2b735", "comment": "Malware payload (AgentTesla)", "value": "ed60f510009e000d2c5aec46ed02d4d006578aba098d5a74833c93a2a1872ecd8dcdc36963eae786a1357bf7b05e8690", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882688, "uuid": "55678500-08d8-4f50-9826-cbdb44afa39b", "value": "T1F1F4020372A88300D6686576C0DF593997E16CC35672E3EA7F8CB7890A063E3AFC5759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882688, "uuid": "1c33abee-fca1-4349-9524-8b1b8a19e462", "value": "12288:JqL5AhuaDLW7h2wrX2XelaSm3MMtVSeziDcHSY/JWvIx:+50K2eGXRM8VSeznHSEJWvIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882688, "uuid": "fdbf9ce4-6a43-4128-b697-0f7368b1e48f", "value": 765512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882688, "uuid": "f2fe06fe-0284-4b00-ab32-e9229a102e9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882688, "uuid": "22311bbe-3c5c-4e34-9605-ba9e438b5efd", "value": "doc20230213-01976520230110105630-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81415364-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676908746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908746, "uuid": "29b15455-2451-48aa-82f4-de17aa3df4f7", "comment": "Malware payload (SnakeKeylogger)", "value": "d199164cc0ff895631253e65d40e19a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908746, "uuid": "ed7e7045-08ae-4c82-9ddd-421b478564b9", "comment": "Malware payload (SnakeKeylogger)", "value": "8f67a46019bd5d38fd165fbf8e0f92dc5883cbce4ca86e69f71639054cc3480a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908746, "uuid": "6efbe41b-3e3a-4440-aea7-e7156567c433", "comment": "Malware payload (SnakeKeylogger)", "value": "64097e64bf2c44050bf84eef68715b176812c3a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908746, "uuid": "c6cb7aed-4f2d-4beb-bf08-d0dcfd440e22", "comment": "Malware payload (SnakeKeylogger)", "value": "2ce973c646bf23154770fc501f24a3ba9a36d9fa56982fa28caf18dacfef3b1c2dad6a197be251cec106cf49fe801410", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908746, "uuid": "3bf9de1a-b514-4e9b-a1ff-bcc964fb5023", "value": "T1ABB46BE1216CC3D7D0B28D711FDA8A7176F139ACE4D0520CA0F9DB2D93D23A5159CAEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908746, "uuid": "3108dc08-46cf-47f7-927b-052f8b985f24", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908746, "uuid": "6cf80c3b-238e-433f-bf57-332a2c086137", "value": "12288:OYw7EjUPCHAKBes4PovL+6Y9zehJXGAuBgG:OYIEjESADPoD+6kehJXvuBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908746, "uuid": "080dd485-9ac9-40e8-aa6f-1ccd6aaf8b77", "value": 525506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908746, "uuid": "0c4dda55-9099-4db8-92ce-c12ddd6bf25f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908746, "uuid": "11c3956f-0cd3-4b29-aa04-f78b7c0a4b8d", "value": "Statement of Account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61f5a73-b0f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676878824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676878824, "uuid": "8a6ef004-016c-4dcd-9af4-5f9b54db0724", "comment": "Malware payload (RedLineStealer)", "value": "24e5e0ecd7dbe3178fdcea7b9574e858", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676878824, "uuid": "060d12d0-ee71-421d-ad7d-e5dab438a191", "comment": "Malware payload (RedLineStealer)", "value": "9039ce697fecb22f7da765efa220bd834db991d3c724cb960902b13f600c3793", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676878824, "uuid": "1354fb51-0538-429e-ad01-09bc16cb826a", "comment": "Malware payload (RedLineStealer)", "value": "7ccffc136a7948646185e519ae6fca622a80c08f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676878824, "uuid": "11bcb615-67aa-4f88-aa84-e010343a9b0d", "comment": "Malware payload (RedLineStealer)", "value": "8a95dd978a11b4c14326f49b49c766c46b1cea3a5e0e4f72eb1403869120f97439d6ea60e8449df9c19a2abc32ff6fac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676878824, "uuid": "6d5a62d2-e2a7-46b0-9b0b-e2002cbc3bf9", "value": "T1E234AE03B2E17C61D9174AB1BE1E86E4676EF6204F597B7B27185A6F09702F1C2B3321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676878824, "uuid": "11e87d9c-8d0e-4158-9b54-4498bb4f4605", "value": "ed191fd45aaa30104c7d529493e68118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676878824, "uuid": "4f5c3d7d-638a-421f-b217-ed667ef0c175", "value": "3072:8+taAcWILr1PH1za0k0BxL1ZbRzCMEQaXXPSnqdeOQl9e5Ii7k+zdbvBl2s:LLcWILJ1zllZEQqXP22/Ql9g1pjD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676878824, "uuid": "919d36e5-5753-4e84-83a9-23f4237ccf1d", "value": 231936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676878824, "uuid": "00b54108-750f-4155-8075-c6839a3932d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676878824, "uuid": "57ef7675-03b6-4016-a101-58bc077dba84", "value": "24e5e0ecd7dbe3178fdcea7b9574e858.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9803f6a2-b156-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676922099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922099, "uuid": "8d9aebd4-55a4-45d1-bccc-57bef8e843de", "comment": "Malware payload", "value": "293ed05fc343bf56fabf8204b2c3b0d3", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922099, "uuid": "6397c1a5-7f39-47b8-a21c-6a25249a4930", "comment": "Malware payload", "value": "90546040a0ef975265aa36c325681f9ae262de2a2726cb6919916cd8423000de", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922099, "uuid": "c7efe0f1-bc23-4a6d-9b1c-469585fb6fec", "comment": "Malware payload", "value": "545e534ddf089fa7fd6bb1f7c02da6ae835018e9", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922099, "uuid": "d6b85e94-a7be-4635-966f-222762a5eb2c", "comment": "Malware payload", "value": "a494207f585afd69a17cba52705451f8f655521fe4aadc047fa5bf38fd1d86ddf8633b69181b85ab96a63e79b207318e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922099, "uuid": "632574bf-bfe1-4755-9ea7-17fb4a8d810a", "value": "T1D6133096B3ABC846F5A507354AF2D2AA3732FC565F73870B3285730E1EB59809E02717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922099, "uuid": "9b30a0db-a1a8-4d66-9211-0bdbdb95bd07", "value": "768:yLFGrxEtjPOtioVjZUGGnwfDlaGGx+cL+LIfnAWJ7I5C6RBcbiUkG/Fjza86:gF+xEtjPOtioVjZUGGnwfDlaGGx+cL+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676922099, "uuid": "7eafb742-8168-428f-8732-a1eae357781e", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676922099, "uuid": "f74fffea-442b-4a33-81a4-34cae5341bb8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922099, "uuid": "278cda78-80a8-4dd0-aa83-a62192ed9b50", "value": "90546040a0ef975265aa36c325681f9ae262de2a2726cb6919916cd8423000de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61c1af6-b0e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676872811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676872811, "uuid": "6dc3d864-62ed-4b12-91b8-e62111ce3abf", "comment": "Malware payload (RedLineStealer)", "value": "b3503746bb7f1d30755c9f4a26ce0a2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676872811, "uuid": "ccd53efa-26b3-49e2-867e-d487f880d24d", "comment": "Malware payload (RedLineStealer)", "value": "90706da9b2d8dca13b4823cb9b6c95bde3df92ac336826722b33cfe495d2e300", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676872811, "uuid": "c61f1817-6cd1-45d8-b709-044c07e6ae18", "comment": "Malware payload (RedLineStealer)", "value": "2490c2a6b3fad0711993c8bb16aab2d21cefac6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676872811, "uuid": "054a29bc-1013-4fd4-b5dd-9942dc3608c1", "comment": "Malware payload (RedLineStealer)", "value": "7dfe8c0940d6aec4deef07775fb13e6da6c974f655a05a5bb428d5da5423954d32f40f7f266c0943678acd9a181f4afa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676872811, "uuid": "072ea21e-4ed1-4465-a8e9-e7e52d687cee", "value": "T1E22482742E894200DA7C233055BC057F32775DA97DA09A36ACB838BE267F3506E75B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676872811, "uuid": "167f5af2-df9b-4d2a-9533-2a955c2bf8e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676872811, "uuid": "0ce9bf7b-c883-4743-b8f6-d276f431c4c8", "value": "1536:pqsEFqJklbG6jejoigIg43Ywzi0Zb78ivombfexv0ujXyyed2AtmulgS6pG3OkzB:HYScYg+zi0ZbYe1g0ujyzdspkzLQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676872811, "uuid": "03c8d838-03ff-4978-a979-6baefa047554", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676872811, "uuid": "a5a720c7-6644-4e9e-b81f-934cf9ae09ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676872811, "uuid": "90711447-7c93-4dbc-82cd-44fdb8f91ec1", "value": "x1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e574900c-b12c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676904190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904190, "uuid": "660e03be-451b-4f07-8371-fa56bcb6a1ea", "comment": "Malware payload (AgentTesla)", "value": "ccde4cd1d7e0d4d8bc5a6437d9210bdd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904190, "uuid": "3b545b24-35fa-4447-a231-787a71b9524e", "comment": "Malware payload (AgentTesla)", "value": "937202d8cf7814f0de9a91b7f6f6a818ef7cf14f042ae2a9c4cd713dc30be45e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904190, "uuid": "02f2de9e-b1c2-4762-a1fb-b4249aea61db", "comment": "Malware payload (AgentTesla)", "value": "cae2d4bfbdee8ad8b411114bff9b10011da37753", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904190, "uuid": "0e61bd32-f1f8-44ec-a484-4509e534ce30", "comment": "Malware payload (AgentTesla)", "value": "07d74698ad9f052387e374b66cdba663ed31ee13db247d5088ec07df742b490b3bc2eed5c4c95d09d0ce778424bcf60d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904190, "uuid": "558c9af8-2a38-4261-8cda-efc26ea915a3", "value": "T1FE5423229FA9DC390546600ACD0F34724C8D2B11B5DD5BAB3253D298B5DBC18ABDC7EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904190, "uuid": "9b0e0336-130b-4980-addf-043133596e45", "value": "6144:j2CBOu94JIqCYyZolD346WwdSg4dFW6R9ARbSPoU:iCB3yQsDRWuSgCFt9AdUoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676904190, "uuid": "5167a486-19b0-4e09-9d6f-24143a7f4a89", "value": 304531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676904190, "uuid": "76210c39-8c36-4e31-8fda-63470fb03fa6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904190, "uuid": "2490395f-b66a-4cad-b37d-15b15cb81279", "value": "M-098-97228935.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f1e68d-b156-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1676922100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922100, "uuid": "02f5d4fb-aced-4e92-9a1f-017f1385374d", "comment": "Malware payload (Heodo)", "value": "344623480a742224558b38f5619a4614", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922100, "uuid": "9b14f6a0-de7c-40c4-9d98-fc26884a6e0e", "comment": "Malware payload (Heodo)", "value": "95d144a3f878347c96562af564fa54bba59e451845aec4ec328b342564917e4c", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922100, "uuid": "2177b2e9-95fe-4df1-87fe-9a66f534c14f", "comment": "Malware payload (Heodo)", "value": "9e94806d910922eb0e6eb833a6591116dadd825d", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922100, "uuid": "e7469d39-391b-4156-b502-086026f63ac9", "comment": "Malware payload (Heodo)", "value": "43681038755d403d3473f4fbe0d6ecc00991050694f4d1546925baa6209cac3c413e7ded6cab8b50067b57e829cd3865", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922100, "uuid": "8754e8d0-deeb-40c3-bd72-a0c2c3e7c0b6", "value": "T1AB1405963C84BC67E92543F21EBACEE97315AF0C7A0DA19B2D0477ADFB3B52046B1104", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922100, "uuid": "9ba6ba81-e145-42bb-9017-4dde404afe05", "value": "3072:X0ySV/H+UaqFh5Jr/SzFaSadGBrjC48+WZ/POhh+/k2PUcPj9oJx:X0ySV/HNaqDSzGdD48+aPOnt2PUuor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676922100, "uuid": "c9332cad-0758-4245-bf4e-b1b061745776", "value": 202024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676922100, "uuid": "c637997c-e363-437f-bc54-8e50c35cdb57", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922100, "uuid": "75ad70dd-38c3-49db-87d7-5df46ba9ac1d", "value": "95d144a3f878347c96562af564fa54bba59e451845aec4ec328b342564917e4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e459b1a1-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676882713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882713, "uuid": "dfae2341-5b7a-42b5-a519-ebfc793b9515", "comment": "Malware payload (AgentTesla)", "value": "b33a22e5d1fae161141baf401076ab3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882713, "uuid": "d5ebfee7-6f50-43db-a5ea-f9e203e1fbc9", "comment": "Malware payload (AgentTesla)", "value": "966cfb695adaa54a40c5306273de74f5de0924a7e874ee498591818c5a963b35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882713, "uuid": "721abf16-aae9-4559-83cb-5cd2fe713b63", "comment": "Malware payload (AgentTesla)", "value": "6afadf66f577455f18d0d28915731591d2f5df11", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882713, "uuid": "d3626244-4cf7-480f-a4ce-8e5a574aef98", "comment": "Malware payload (AgentTesla)", "value": "500f0fe9f66638b8a3c5ba01fcde9cd6f5f5f9e136eecd189376650ef7d369fb8b06a74d628cb998483577f0e3f17979", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882713, "uuid": "7a0555e3-8133-41bb-bc31-84c1dc9f7296", "value": "T18AD4F1D2D2C803E5E9265B755CF27851132B3E29AC70E91D2C89B4B90FB33425176EAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882713, "uuid": "0f864dbd-1e48-473a-b917-0117a0cac937", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882713, "uuid": "90a26b70-730e-4cd3-8e27-562a2c851612", "value": "12288:yFFZ6mj8UoNxleSb7RLPGjwkicRcxFiuydZ44LtG:E6bZCSbNL+skfdW4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882713, "uuid": "69d317ce-067b-431a-9b86-bc364fb9d849", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882713, "uuid": "557f668a-b9ab-47e7-a933-2981129e86a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882713, "uuid": "61702150-6999-4bb4-9fda-66169d3423aa", "value": "PROFORMA INVOICE -CEM BUS CONFORT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d9d40ff-b118-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676895265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895265, "uuid": "ccd055cc-9d85-4b59-9ad2-60a8f2efc3ad", "comment": "Malware payload (AgentTesla)", "value": "92c9428d979e175e6b1ceb5c0dc77642", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895265, "uuid": "8c896fad-9e0b-44cd-b079-e31c17a68fa7", "comment": "Malware payload (AgentTesla)", "value": "9720494b93d3f70f63839143313fa12ce52b42098dde7a41fd2c89562d9325f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895265, "uuid": "8ab375c9-2d6b-4bfa-8bb1-439d7bd0572b", "comment": "Malware payload (AgentTesla)", "value": "0b32ec47784370abe9c2a2f3283f3534bfd0a42c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895265, "uuid": "154fcd91-3ec6-43b6-a61d-438aa9ca0715", "comment": "Malware payload (AgentTesla)", "value": "838b3dbfa6d0e8bfe2115d263dd46337fd726d7caed6de8861a7e83d38966390fe04c62e127275f6a727cd7187f306fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895265, "uuid": "42624589-1e80-41ff-8490-f3cddac31aa8", "value": "T15335AD09AAB0DA77C5AB01FE18381B0D3DA4B5437505E6688FB37FD291709FB35A9213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895265, "uuid": "a9b2d739-71b7-4159-b68b-0a91bdfd1483", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895265, "uuid": "f85d68d6-07e0-4125-ab5c-1a7ad1c74a63", "value": "24576:IVs4yZ1arYEJhxun9PckB8Rb4xixCWY7jsoUf2:0A/EJ8kkBJhPSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676895265, "uuid": "a40d32cc-e981-4e49-8415-47aeaec11c66", "value": 1077248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676895265, "uuid": "8adeafd1-550a-40fe-b157-1f821c328a89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895265, "uuid": "32f0f18a-95cf-4abc-b5e5-bdcc01b8d38e", "value": "92c9428d979e175e6b1ceb5c0dc77642", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35618c28-b0da-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676868676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676868676, "uuid": "d5a0b189-8b95-48e2-a351-02107d505c2e", "comment": "Malware payload (AsyncRAT)", "value": "34f2cc0d56c690a7c6233cdfa69149e7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676868676, "uuid": "549702a3-5e8f-4541-a822-3287cf91bd91", "comment": "Malware payload (AsyncRAT)", "value": "97e5259e8173f046098f4c5744ca4ed05e3490a19721a5ef26dfd4612dec191f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676868676, "uuid": "2cf0b302-09de-4862-bb1f-5cd0404b063e", "comment": "Malware payload (AsyncRAT)", "value": "f064d77c1f0d8006f3a3ab30c6e3b65d84d52a97", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676868676, "uuid": "9f1730dc-f43e-4967-8322-b0652bd4821f", "comment": "Malware payload (AsyncRAT)", "value": "7beb82b235ef183c01c778046bdb3d587ded5585bdb178af369ca9a97cf638b688041a324b0b0c14d0cea781d9b43a56", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676868676, "uuid": "511ab288-dabe-469f-bb73-fa6de0b6562a", "value": "T18C432B003FE9D429F1BD9EB4ADF275550AB8A1576A02D54E1CE411CB0A22BC6DD027FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676868676, "uuid": "8a2622bc-6365-4e44-b191-7f3c8e6ec315", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676868676, "uuid": "1bd31450-ec91-45cd-8757-5701cf644b95", "value": "1536:hvKDtKNvPmE5OMIE7yckNKb/vtDYgOnSq7gx:hvK4NvOE5OMx7UNKb/ZY1SqEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676868676, "uuid": "fdcaf6e6-258e-4f73-a430-b59244855311", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676868676, "uuid": "74a2b1e7-7322-4c48-880d-d05ce4e03079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676868676, "uuid": "44202dfc-69f3-49e3-b889-6b7310a94e69", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63dc5b0a-b142-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676913421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913421, "uuid": "045bea07-091e-4875-99bd-dbc5f234b68f", "comment": "Malware payload (SnakeKeylogger)", "value": "14ff6995339d2bf6e28b40bdf6b1eef9", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913421, "uuid": "ab3f3484-fe7a-4f7d-a688-95a02f71f744", "comment": "Malware payload (SnakeKeylogger)", "value": "97f84fef172f961b170b07ee1dd146216af61e92365d300d000a3971b23e959f", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913421, "uuid": "36233f68-c6e5-481c-a796-e11c4f73c138", "comment": "Malware payload (SnakeKeylogger)", "value": "50945edc8a940c985cd7d20e510ba37662804837", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676913421, "uuid": "0ef2703f-ae0c-4e26-86e8-055c9d38fe6e", "comment": "Malware payload (SnakeKeylogger)", "value": "002ffb0bebbd6cdf230e2d7999769d4b2852004b956613bdb12a6f2569e23f46402ea0e627d30262e74d6a28a44beb1f", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676913421, "uuid": "9e6901a2-3475-4b86-ae65-ea620f480f3d", "value": "T1E5742322CB77675DED0D07867923D38EEA9E4C04DF6A85F48E45428F2BC09C13BB1966", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676913421, "uuid": "1c63e97f-1bd5-4907-be31-50869fc852be", "value": "6144:hugynTe+aVDlMZVWHukZQs4FDCx3M2jAXWASpLRR8L22zzK:ryy+4DaZBwN4JCxkWJpLOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676913421, "uuid": "23888651-af3e-446a-95d6-7666868679b3", "value": 338066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676913421, "uuid": "c42bb7b2-3fe7-42b7-8b8d-ee6d0fff620f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676913421, "uuid": "2bcef4e9-7ce7-4ca4-8c2f-ee61ccd2fbb1", "value": "XBSC150918 PL-0005.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ad6cde-b138-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676909056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676909056, "uuid": "1365b379-fc2c-4597-901e-f4f478f8419e", "comment": "Malware payload (AgentTesla)", "value": "bb324750f068db86e6bd339984db33b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676909056, "uuid": "6c3b8d4c-4c45-45ec-b025-6329a2186e91", "comment": "Malware payload (AgentTesla)", "value": "98ba8f834f155808a2a10f08b2289b14a90a56004fdc427b6a33e00a3f336468", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676909056, "uuid": "d3184ee3-b810-42d8-a6b6-a037b80d4329", "comment": "Malware payload (AgentTesla)", "value": "57fc59777c7a40babc7f7e4641a908b35fc064bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676909056, "uuid": "00de13a8-cc0e-4fd2-bcba-895f04e9845f", "comment": "Malware payload (AgentTesla)", "value": "da148c1a86e2eccb3fb9a144701557dc2f74209366ff69a2844eb6d6b35fe3b14e0223dfe58546b1d44709afcdbe6874", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676909056, "uuid": "1fb89186-0f32-4c63-a9ec-787451a008a6", "value": "T185F2F55AE38E0268CF411277271A0E89A6FDB73DB35154B134AC933433EDC2E42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676909056, "uuid": "69b3935e-c7b0-4890-b3a7-f6ac6d2ef6b9", "value": "768:FFx0XaIsnPRIa4fwJMPAVxTx/ftVUk9YZb:Ff0Xvx3EMoVxVD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676909056, "uuid": "fe874403-70e8-4406-b737-9d484178f395", "value": 36161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676909056, "uuid": "59542e48-61ed-4c41-ad2d-53e35bdf9b76", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676909056, "uuid": "b982c179-7e02-4580-b7a7-3453befeee60", "value": "ETA cargoch.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a1de67-b128-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676902150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902150, "uuid": "bd6f8be7-b570-427a-a1a6-eae82540d3f2", "comment": "Malware payload (AgentTesla)", "value": "9610344c8795c1061705606243b98e7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902150, "uuid": "8f159055-d3e7-456f-ba51-4942cf144fdc", "comment": "Malware payload (AgentTesla)", "value": "98c35d79a3169e6d0b9b5df94c984da71bf37b481d89de50380933c88d51d340", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902150, "uuid": "670dfb5f-abb1-4ae0-8e93-e3f2e6b98f15", "comment": "Malware payload (AgentTesla)", "value": "4233569acfed4840182792763a618a9e1df72443", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902150, "uuid": "612ed431-8b86-4c71-832e-9d1dc8f031c7", "comment": "Malware payload (AgentTesla)", "value": "13cdd112ebb81123467101614ace4131f217844fda3c88c2d70ea70e6c030573b5a413fe5984c038556a4b94179d3936", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902150, "uuid": "3e4041d4-7063-4403-802e-e147d7c0132c", "value": "T14184221477C2C9A7D533037217B915B6AABBB7066DA5410BA3203B8D7A32711DE1E3B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902150, "uuid": "453a8ab9-575b-4e85-ae44-d02a0131de19", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902150, "uuid": "d3041e68-fa13-4a7f-a97e-af8c22494992", "value": "6144:/Ya6+Xzc7lVZjjMxVuiRWERxf0b5ff9OrakBmu23R1mwzaBTE:/YAX0VZkz7CNOWkP2hswupE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676902150, "uuid": "7fff931d-f144-4277-8f53-9a95d1b749e5", "value": 394269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676902150, "uuid": "f37ce456-04f8-4218-9514-df906807cf98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902150, "uuid": "4ccf7536-e1a2-4396-af62-4742e7abd40f", "value": "Order HJH56934.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6185c27-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676882689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882689, "uuid": "bbe314a6-85a9-42a3-b441-ecb45e24de31", "comment": "Malware payload (AgentTesla)", "value": "d95871601cd5aad060d3b5dfd97b9620", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882689, "uuid": "87a63e8a-13c6-4f6e-bdd0-fc4e40aff3dc", "comment": "Malware payload (AgentTesla)", "value": "9a71b5c9ac514d5102af4956b5b26a081751c74393f4cd6d7aadcd0da82ffba2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882689, "uuid": "d70d09b8-30b4-4476-a4f0-589df3bd383c", "comment": "Malware payload (AgentTesla)", "value": "81b50bf8b2707cf7e5cb4c78beb1ce58706051e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882689, "uuid": "ebf0c89e-174a-4df6-beca-07f20543c329", "comment": "Malware payload (AgentTesla)", "value": "67530c09ca6150b25c61d430089b74c03a814ad23a564ae70bd29d7795858de167aec6d52ce904bb7deb247e09ceb4e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882689, "uuid": "853f9061-4788-4c25-bc14-3d31cf7cc7d2", "value": "T13BF4239AB76F4691E5D95E71D4C381120778FEAEE0B3D10E3ECA27881E21782CD553E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882689, "uuid": "ff681eee-3c12-4b15-b3ba-79280963c0ec", "value": "12288:PLCR2AboZDj+Ko/OutO5oWrUX1t3mjWDCZv8gASP1mzlO2QPG1uho1kG8kq:DCkAbI+K0cQX1zgvscmJO2QP3GTlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882689, "uuid": "42139459-b051-4d49-a2a6-f6352d2f5878", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882689, "uuid": "55955f99-e59c-413e-82c3-14b165aaf50d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882689, "uuid": "567e6530-9b8a-49b4-8ec1-d81a388ece06", "value": "doc20230216-0197652023011010563-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4076a2d5-b0b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676851515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676851515, "uuid": "7498da3a-8d5a-42ac-97a2-6e4bd6f6966a", "comment": "Malware payload (njrat)", "value": "1a1b981364817cdec0ee6f994e80b4cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676851515, "uuid": "99e4ac10-33fa-472a-9692-7d6539f0f4cd", "comment": "Malware payload (njrat)", "value": "9af828869ed0e27267a973fa2da11701aab8fe90e9ec42b46c2186c5e9e3c5f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676851515, "uuid": "ffb48fa1-475a-4ff8-a6ff-ee1ec01bb450", "comment": "Malware payload (njrat)", "value": "9974f436d2a64c9ed81699ee55deedbcdfa70cd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676851515, "uuid": "ff24e622-dbbf-4449-960b-9a966484ba4b", "comment": "Malware payload (njrat)", "value": "9d8522bab763da9a984a43137fbd46aa0232aa5ba1809e0d584d799bf55b22517a2a57a4658a9b7d5c4c537d9dfe60e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676851515, "uuid": "dd522f2e-4a03-4b55-948a-ea65b7236161", "value": "T18593E74977E52524E4BF56F79472F2004E34B44B1602E39E49F259EA0A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676851515, "uuid": "d1b1b372-ac1c-43d7-b779-239b2eaf92f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676851515, "uuid": "8ea1b275-493b-432f-9465-85af00064b17", "value": "1536:LUwC+xhUa9urgOBPRNvM4jEwzGi1dDNDkgS:LUmUa9urgObdGi1dxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676851515, "uuid": "32a368ad-f994-412e-a12f-9ebe91453f63", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676851515, "uuid": "6aad1e78-b1ab-419a-84e8-0df4d14c32e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676851515, "uuid": "8aca3040-b246-41fa-a3c0-f8cab91a09aa", "value": "1a1b981364817cdec0ee6f994e80b4cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c797a6eb-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676882665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882665, "uuid": "98669026-0e5a-4784-b7bd-2578924d781a", "comment": "Malware payload (Formbook)", "value": "10e609bf2bc7206abf99d71a97beffb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882665, "uuid": "83740606-0ce4-4725-a1a8-d1a1913057dd", "comment": "Malware payload (Formbook)", "value": "9b527164a5fead2d01d08270831bb0a22f0665322f2691bbc7e1171d873a5314", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882665, "uuid": "e2cb0096-2f2c-4815-9a55-82bdde644617", "comment": "Malware payload (Formbook)", "value": "6a4e94a976cc791bb3526dd97142572037bd2762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882665, "uuid": "ad30447e-d59f-4c3f-889f-3d0713d1d456", "comment": "Malware payload (Formbook)", "value": "7377e486d638a1880f343a8a2908a2e79b874815b19bb7a7d004637e90ccbfd63f6fb5abcda4f2bda804848f0782cb90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882665, "uuid": "52697951-646a-447c-97c1-a1697c3a4cdd", "value": "T1BF049E32D642C031F2B201B5F6BD1B7B4C3E0E343255A0E6A3E216A55EE49A9F17931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882665, "uuid": "685c0e0b-a40f-48d3-883a-cb602e3c34f7", "value": "3072:gqXONkOlwpno75f3esylwb6y1KNHstv6Z/mZjiLBGm:Ajfe7G6y1KN5Z/KGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882665, "uuid": "e0b6468f-2814-4d93-ae1a-e9c2abbb2de6", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882665, "uuid": "251b373e-f947-4df4-9b15-ab04242134de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882665, "uuid": "99e579fb-318d-4ca8-869a-0197ebd7e8bb", "value": "9b527164a5fead2d01d08270831bb0a22f0665322f2691bbc7e1171d873a5314", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ef9121-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676882721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882721, "uuid": "17d055f6-9541-49cd-a485-f451b3481d3d", "comment": "Malware payload (Formbook)", "value": "085542f3373f3f419c6ca1696eb11ab6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882721, "uuid": "11d9b6ae-603b-406f-ad7f-bb80a9b4c2dc", "comment": "Malware payload (Formbook)", "value": "9b8da7ed293e5293ce73a4fbd1425987fa548194c416263eb46ffaec57c5f741", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882721, "uuid": "85b4956f-f099-4ee0-ad51-9c0b8de4e1a0", "comment": "Malware payload (Formbook)", "value": "24ace54ccb9e31ba7158c7a7cdfbb246d2cdd213", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882721, "uuid": "6d11144a-86b0-4e43-a5f5-769960678dbc", "comment": "Malware payload (Formbook)", "value": "2dce844077c76c198255a263e7085ad1cc816d84c4284156aa7bfefe2b7681263f3634345452a33569feddb08bf42f23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882721, "uuid": "c4356a1f-8302-426f-80af-8af464ba0c42", "value": "T1478423855224C253E8610F73DE79D7061FE52A2610BDC10BA3D09EEDFE117A29A5E352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882721, "uuid": "e527d4ae-5809-404e-86f7-6325ec0804fa", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882721, "uuid": "23b126d0-ad3e-4a99-b80b-81a88c6de248", "value": "6144:vYa6L1b/tIfJjCf+RfWjAe02OgPqbnscdmtcFGD7O6Z76nrxnulJDbcEIzfvWmsk:vY51TsjtRfWj02OgCbsptgGD7zcnrx0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882721, "uuid": "396a6389-66c7-4f8b-84a5-65b450895fb9", "value": 376994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882721, "uuid": "59182fe0-f9a7-42ea-acbb-a345090e76f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882721, "uuid": "d2a5b611-a2d1-48be-9a9e-d33cf2f9dea9", "value": "rocrocc466732.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d37c1d7-b107-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676888177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888177, "uuid": "b758eb90-57a3-4973-956d-00dd9ff203ec", "comment": "Malware payload (AgentTesla)", "value": "fb8d6540f6db338ade48c46b8160ba39", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888177, "uuid": "7c6b005e-0124-481b-b42e-8b97f45688a9", "comment": "Malware payload (AgentTesla)", "value": "9bbcfd68fab68ee4769eb8f459d5c86bc67502f73599554b13f32490f98ee170", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888177, "uuid": "5830e894-8176-450f-8ced-a38c84ee4c1c", "comment": "Malware payload (AgentTesla)", "value": "d6cd22b3e8014f315c02db1ea9a3fc1e1094b9f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888177, "uuid": "8d9a728c-e1fb-44f9-9b3c-ea3828be2fc4", "comment": "Malware payload (AgentTesla)", "value": "4a77c152e97fc49da37ea6b02eb4c08201a1baff62150413e34b3c2d080bae1e3a85eb87544484cd01b04685ffbb835a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888177, "uuid": "8dda7eb8-93d1-4f79-a3d5-ca4025819bff", "value": "T19925393A39B756D2D279F53382E3E120B6FD88923303E94A9DD606C44F42642BDCE65D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888177, "uuid": "3bb0ce8f-b53f-4c7f-b760-122730a9db41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888177, "uuid": "e93de972-b3f1-468b-9031-f91e97fc6c8b", "value": "24576:4g4HyTsIBMNjnNNOhAe/S0Jj1FSQNTK1je9Qk/4XFnB:4gl9+jeeZFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676888177, "uuid": "a6634b6f-9f4c-4964-b133-fa6270d6768d", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676888177, "uuid": "6cff91a9-a71d-42da-beac-422044be85d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888177, "uuid": "82386913-6e1f-4e09-84eb-f067352b8285", "value": "z1DHLORIGINALDOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c7edcd-b0cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676863878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676863878, "uuid": "25882753-9e59-4d7c-83fe-583cb71a822b", "comment": "Malware payload (AsyncRAT)", "value": "cd5d2086abc62dba4304a852e7bd963d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676863878, "uuid": "edfb4e39-e320-4253-a91d-88fabf72edd9", "comment": "Malware payload (AsyncRAT)", "value": "9cdc8bc82290006a5e2a0c06a42bb3004cc41822876c861339ad5acc9c70403f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676863878, "uuid": "42e6fc62-54ac-4aeb-a986-8b0f794391bc", "comment": "Malware payload (AsyncRAT)", "value": "cfc14948c05c2efe08ebeba11316889396cbf31f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676863878, "uuid": "b7ef807d-6a14-4ffd-a88b-b47ba0624a09", "comment": "Malware payload (AsyncRAT)", "value": "5a43e672221332990a8c414cf8a5c90421e9eb2ca26f503f11b4c7d36a5130dbc6887f53116deadfee9f537cbeb010c3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676863878, "uuid": "3315ff49-3c8c-4775-8faf-0b7e41207e03", "value": "T1FC431A003FE99125F1BD8EB499F2654446B9E5676A02D94E2CD441CB0A32BC6DE03BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676863878, "uuid": "835e0fa5-e477-4a5a-a1e3-d1b278f7c71c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676863878, "uuid": "9f2b2fdb-88ff-4431-8043-c90e29679456", "value": "768:iLrBlOGhV1Xj+IfxXRs4yPbE5HeEBdnhZISt5LUbtg1UIE9KYJ3qSYztGHN78x:iPrVFns05+EBdh2eKb61ty3Etq78x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676863878, "uuid": "80fbe85e-08f6-463b-8dec-7bd2daf2c2f1", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676863878, "uuid": "4add427a-8e67-4b18-9c66-82516c1122b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676863878, "uuid": "5b12b3e1-fb6a-483d-aa30-126405a32ad1", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85758ff-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676882666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882666, "uuid": "af7943b2-fa25-4958-a8ed-5a29ffc5adf5", "comment": "Malware payload (AgentTesla)", "value": "a605d302235802f19c5fcd8dac09d2a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882666, "uuid": "b1f4acc3-e762-4708-88da-54ec1f2404d0", "comment": "Malware payload (AgentTesla)", "value": "9cdd4c38414c8f963d2a5536db4891fa1b0b5979babc5d604ea77b704e4cca3f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882666, "uuid": "b6ae9f47-164c-4999-9501-85b28f84aeaf", "comment": "Malware payload (AgentTesla)", "value": "8e64a9b4d8adba9f8d4b91f02c22a9b66fa0d92d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882666, "uuid": "238cd0e6-72fe-4b20-b3b2-77722032aff5", "comment": "Malware payload (AgentTesla)", "value": "38a6e0c97dd7b5b78714336cc9b2b078fd20b68647b52785a6983976a2be4574b7145d9c35b2c6baa1d3bdd4003da1c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882666, "uuid": "ef9a4adc-4338-47f7-b4ca-302da4eb87c9", "value": "T109F328685E899B11C32D41B8C5A008480E72A2475617E65D4EE0DCFA3F767F3F62BC6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882666, "uuid": "fc085116-db2e-45aa-9bac-19ab84bda4c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882666, "uuid": "690efa13-f0cd-4144-ad86-36295350def8", "value": "3072:epNRV9Chy9hp25dXrGkRmofJwZ5FrAtUZJNmEyDoQTjD:+9I95dXJgoDGvoV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882666, "uuid": "31f57932-5679-48c4-b2b9-a55e725ae137", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882666, "uuid": "ff9cca0f-ae75-4ca4-86c4-9bc9d9b2c254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882666, "uuid": "f7de44c5-16f3-4fb2-a318-e355525bbb67", "value": "9cdd4c38414c8f963d2a5536db4891fa1b0b5979babc5d604ea77b704e4cca3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e258c2-b0e6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676874153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676874153, "uuid": "15a86a5f-5283-48e2-b656-38ec2f1aeaf7", "comment": "Malware payload", "value": "0e9b94fe7b9fe17b811eadce4a01445c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676874153, "uuid": "5591efdd-ee06-45c3-8828-f5a7b56f1044", "comment": "Malware payload", "value": "9d2aaf3c548bcf8f6f9c46d5cf7c4671a0786d224b4d251398b414e87ba89f5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676874153, "uuid": "72a72091-851f-413c-8bfd-e57f42cacec4", "comment": "Malware payload", "value": "e7d755cd67d35b9ac1541cd248d976c710a4a2e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676874153, "uuid": "e6152265-a0de-4d4e-a85a-4650ed0a2b9c", "comment": "Malware payload", "value": "a7752808a78c13b91e6f8c9a803cbe4e025bd44508ce43c977ebaa017d9d59e92d467001759da2bca49f74193eb7d09c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676874153, "uuid": "1e8dc913-95b9-42ef-afac-d618e516ccb8", "value": "T13B465A90EDEF50F9EE075E3148AB923F633061099735DAD7C6104EE6E8277D20A3365A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676874153, "uuid": "3d560df3-91ac-40d5-9dc6-e5ea0f00845e", "value": "91802a615b3a5c4bcc05bc5f66a5b219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676874153, "uuid": "42820c0f-da99-43b6-8cde-cc0d4403a4ce", "value": "49152:kHFVU9xp1qxkCxnXrfYOFdwkiqOVx1WkVqmwVPID+agOd9OvHujB+:kHXU9xK14kAZImD+93Huj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676874153, "uuid": "e71da24f-7f14-40ab-b9c6-e57a4df9f416", "value": 5793280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676874153, "uuid": "b645a248-08ff-4ac3-9b37-595c0c1b62e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676874153, "uuid": "6592baae-fc81-46f0-9d31-b9af42caf9d7", "value": "hh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8986ef-b148-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676916201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916201, "uuid": "08fba5a3-cda4-4aea-a1e7-04ad8a4f36b7", "comment": "Malware payload (AgentTesla)", "value": "262d84fc2a2d4e80132dab3b72133261", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916201, "uuid": "8151adbd-b201-42e4-9b00-84f0245a9fc7", "comment": "Malware payload (AgentTesla)", "value": "9d4487a556d6fdda9e422d0bd108ec6f47ddb3521c613a976d4602b6f28b9149", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916201, "uuid": "6b62e2c3-63b5-4859-8860-e397e091f412", "comment": "Malware payload (AgentTesla)", "value": "0b953bcd859b6056899f4135a39c1217d34d57a2", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916201, "uuid": "8d4e305e-04cd-4445-9532-4f776b59b578", "comment": "Malware payload (AgentTesla)", "value": "fc8274bdda244e5aeb0eb63815ce236032274b7840ea755ad4f07e3e97d0661ad5c6064b1badf3d1def817e53aaeb14e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916201, "uuid": "db127691-45eb-40fd-82a8-b6054f57f068", "value": "T108C423B9AAD8CC55E2F719B4278944104F92E28063379E8DEAC0DEBC4DDE09F04C6765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916201, "uuid": "40844388-7f18-4392-b2ac-5119d91627cf", "value": "12288:qDf4JOZ1NP0+wEbKiaNKC/cJFKiluz0XjBEzCtQAzoEwRy:qDf+W1NP0+lbKVBEJFKic4jBXCAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676916201, "uuid": "7da26927-6ea2-4dc8-a314-a1f44475a720", "value": 561925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676916201, "uuid": "e1484597-487e-4ddc-ab90-7c055db3f725", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916201, "uuid": "f4cf1e4f-b08a-4e2b-a14f-8ce8c5b385b7", "value": "Request for Quote.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5bb7a5-b0ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676877387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877387, "uuid": "eb243e65-a7c4-44af-9eb7-3bed7504f316", "comment": "Malware payload (SnakeKeylogger)", "value": "66d49d7d360062dcd1e6061896d58609", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877387, "uuid": "997703c0-a312-42e7-aee7-f39c27d2264c", "comment": "Malware payload (SnakeKeylogger)", "value": "9dd7852b0af223e044c70870dc6691bf2fa26a35b738952c7f2c6a8049070d1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877387, "uuid": "d150e531-e59f-4bf8-b08d-cb98b143367a", "comment": "Malware payload (SnakeKeylogger)", "value": "54bc5c84948964d072c06f577b0f82b0b08ad013", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877387, "uuid": "df420d23-3dc6-4f23-94c4-ae4c189fd87d", "comment": "Malware payload (SnakeKeylogger)", "value": "64147fd6e9d5175c288c35d65839b02c8f793617c72555740ae2d58f86e32c20e2b28fb1eaa93e8e493f03fb9992ecb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877387, "uuid": "ab4304ee-77d5-48dc-88a3-9d408f13d195", "value": "T1CD255EC5B27084B7F89B05F66C3E666428627E4E7454910D577BBB1262B33B330DEE0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877387, "uuid": "3081b091-8353-4d9a-919c-37aa42408987", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877387, "uuid": "0fcda3e3-30d9-47f8-b5fb-fdd7ccbf4f3c", "value": "12288:PVSTu2nns0yT0KcLWlemFgbjFCvzDDvnfUn1gWybr2ay4eaIXSPJcH:PAznns0yT+SlerP0vzDDnMnmWy7IL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676877387, "uuid": "9867551d-4f80-44c8-988f-9eea16aa04ba", "value": 1043456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676877387, "uuid": "e4950d6b-36c8-4b10-a8cf-6faa708c94c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877387, "uuid": "901599bd-14e1-479a-9d1b-395350a89b98", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6ce7d7-b0eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676876122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876122, "uuid": "44324454-8bce-4c49-aac9-4df28f2bb3a5", "comment": "Malware payload (NanoCore)", "value": "421bc78a34c27f98af3453f0a3a46c2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876122, "uuid": "e0c6eeca-d62a-46f5-afcb-31cc699473e6", "comment": "Malware payload (NanoCore)", "value": "a0b10907c269ae8babadca95c4f546fb564b4eb71c2725a7b3a51ac02396e9c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876122, "uuid": "1aa4a181-2435-4ae0-b3d5-40362db0c8ff", "comment": "Malware payload (NanoCore)", "value": "fa7a3a57420c8b996be963b825b6ebe967349ad1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876122, "uuid": "118396d0-6fda-4b72-9c75-63c0e804ae89", "comment": "Malware payload (NanoCore)", "value": "8be4c648a4e70913d0beb5eec3d3236b71df927dcace036af4150620f44d526ad5413c82b140905ab86aee9c4573feb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876122, "uuid": "7572061b-666e-49bf-8f15-c7f2b445a74e", "value": "T1C0758C710242FEC6F6670CF5E6402622CC656DC3925EA0ACFD8A1EB9E1F9214FD15B78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876122, "uuid": "24b93314-3cd2-4e21-bc31-2d73f42e4233", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876122, "uuid": "c34d6e42-e829-43c9-9f3d-4315b5460483", "value": "24576:zHvmTIj8KSEhjrp/vKTDg4EP/Huj97XPAJ1ZyFeKkQ1qFFUdAmacqseoS5/:XNpv2Oi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676876122, "uuid": "0a8429cd-e769-4d4f-9fbd-c118653e7d0e", "value": 1570816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676876122, "uuid": "bb377565-3d4a-44c2-803e-87f2d53eff5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876122, "uuid": "c7e234fc-3fa1-4853-b065-03278e0aa79c", "value": "attached sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968e138f-b146-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676915225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915225, "uuid": "a3e32a70-a088-474e-a4df-e096ac6e04d3", "comment": "Malware payload (Mirai)", "value": "93be04798ee0891d57b18839d5f1e7b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915225, "uuid": "5a7f1756-0297-4a8f-bfbd-b401c8a64b64", "comment": "Malware payload (Mirai)", "value": "a0c627e5b3f24afaa3298a25090efeaba1903e8a2282504be76e975de1c6e1b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915225, "uuid": "0516b539-d419-4bba-8e29-26efd77d940c", "comment": "Malware payload (Mirai)", "value": "5ebebfb71a818132435fdc54b66d2821db102fab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915225, "uuid": "06a6e99b-e07b-4271-a711-592dcc934582", "comment": "Malware payload (Mirai)", "value": "4b3f6a9c1305a769d211eacc35d85b00d90095cab864f6308ff3181e469477c91c4ca817bef59639d3c905d47815640f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676915225, "uuid": "6fa0af6c-1868-4ffc-98f2-12926f1afb2b", "value": "T167E2D04EA37D1D67C8FDB836E0C932B06E74A28074A9CF7E0762DCC696D36267C45168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676915225, "uuid": "5e14b86f-176f-4bbd-a965-51734b557d40", "value": "768:yuRaW0oLcr3wZ2QJGbiHd3BAmP021dL4tZ7Uw2AhRWWy:yuRaWpLeADTHd3VP08UtZn2AhR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676915225, "uuid": "bde901df-d770-47de-9552-492bd8c97d0e", "value": 32232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676915225, "uuid": "8595facc-c141-4b0f-8397-0348ecc567c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676915225, "uuid": "e7303f72-cc5b-4cbb-9f81-8d92f8a1b937", "value": "93be04798ee0891d57b18839d5f1e7b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d26d72d-b110-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676891855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676891855, "uuid": "4325cbec-c81b-4cbc-9d83-999d0cd83094", "comment": "Malware payload (Formbook)", "value": "5d1d918f31ebebf67c656cf77d59ea9c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676891855, "uuid": "1613a2b5-23ba-489d-8408-9b91108fd620", "comment": "Malware payload (Formbook)", "value": "a166637c86700282070a6cc86ba0b4fbe7b8956f1ae4ef4d5404ee0818ca4db8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676891855, "uuid": "7a6faefa-43bc-424a-a480-929c69b545d0", "comment": "Malware payload (Formbook)", "value": "6f9afb74311e2dd8dbcfcd3299f3567692af97eb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676891855, "uuid": "9ae36a7f-a940-43d7-81ef-e59f7bb77591", "comment": "Malware payload (Formbook)", "value": "a1e5b822a956c38a971321bf48e1cd9024b984849985ee4b7bc0c4aedf8846a50c67a2b8456907e081d979dcbb74d14a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676891855, "uuid": "f72d0bbc-5f6b-46ee-8851-2a542a4a1491", "value": "T12AD4231D3A32658727B1D0180FE5528F59FED7942DAA5600FF3B63AE4A85D8BA0C503B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676891855, "uuid": "18ae16c2-6094-49e0-b5f8-01ce14716a8d", "value": "12288:vt6e9lyhJcOVq82GJ7TBx/RqjhXBYhaexpkXj55bYeOsM8mavaSU6HoF853:EyyA8BJ7D/a9BML651YeOgxlq853", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676891855, "uuid": "998de91d-0ab1-489b-81ad-8ca77030f630", "value": 626152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676891855, "uuid": "21f17dcc-b879-4d22-b94f-216c52cbd174", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676891855, "uuid": "39ea7589-ce78-4f3d-8e4f-c30117e76b89", "value": "INVOICES.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3179725d-b0dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676869958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869958, "uuid": "1997d5ba-e9ce-4ee9-8e35-b7bd292d292a", "comment": "Malware payload (Mirai)", "value": "580c9d2935256d8dbd42107ead60cd57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869958, "uuid": "1166c162-2445-4d15-9597-c2ddc221f702", "comment": "Malware payload (Mirai)", "value": "a194916c602736260cfc0cf3ed0ca8314f9a723cac161494e27aced00403d8ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869958, "uuid": "35875e7d-ac6b-45aa-b731-6607b41ae04b", "comment": "Malware payload (Mirai)", "value": "798a90edbbd024e1d156eff3097c4c4ca7f0400e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869958, "uuid": "4ecec533-10fc-43fe-97f4-e30db2fd1c1d", "comment": "Malware payload (Mirai)", "value": "aa9f8604b1f18b37ab479d48efc803a435b3797d5ad1f348a96cb348d759217a786f93497146ea5f31ca4ff839152dad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676869958, "uuid": "5cae1b91-ec65-443a-b12c-13763be73453", "value": "T1F2535CDAB8119E7CF9CBEABE80624E0DF820621150930B37BA6BFDD37D321949C56D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676869958, "uuid": "13765673-b3d3-4b42-ab8f-574e6fd456b2", "value": "1536:f0AhfwJ/meHN9s+8777X81g1p1tF7LB6dbld6lh8V:fA9VM8kp1XXudsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676869958, "uuid": "92dd17b7-9b73-4bbb-8ea2-a553400f4f3d", "value": 66380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676869958, "uuid": "06da2c80-5b6a-4366-876b-00c5b44fa8f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676869958, "uuid": "1ce442e8-14e7-4373-9ec5-de4e603b606c", "value": "580c9d2935256d8dbd42107ead60cd57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b560113-b119-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676895905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895905, "uuid": "2a4d05cf-16a7-49b1-b0fc-cfc85630880e", "comment": "Malware payload", "value": "3a7ec3ac2c55e096920136c07dfa07a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895905, "uuid": "6117a566-5c68-4475-a39f-aa4ab9618a92", "comment": "Malware payload", "value": "a406433f75411c2bc36c4dcd7d7602e61b066226ba29f2663b818ba31584299e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895905, "uuid": "410f8f63-a7ba-4051-a107-3a8e73e5d77d", "comment": "Malware payload", "value": "da3d3d9c1acfadcdff19340da5a526dd06a6c6d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895905, "uuid": "83ba8c1b-0b50-4735-9a00-b854dce23252", "comment": "Malware payload", "value": "ac9eaec4dbae7475ecf1862e984e62743ef5777413ba9dab7d9e949701c35503a6cd0f2a3e227ddfad389011c00ae88e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895905, "uuid": "0882b824-8982-4cf7-a6db-7a128582aa62", "value": "T1C1E22A95B9419A17C6C24137FB0E4F4B7F1707D8E2DB3303AA3A6B103287E560E6AD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895905, "uuid": "1d83d28b-3f48-4e68-bf1e-13effba9238e", "value": "384:9qxdfh96y+ijAk/OGST1q7UM1gg1c/XIBdp1vl5MPBEVwFx4e3HEIRzTFOTytiXx:9qVPjtfO1qoM1dddp1t5MSVBb0nwvkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676895905, "uuid": "dae7033c-1f5f-4659-b9a5-9aee79486f91", "value": 32576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676895905, "uuid": "cca0ca3d-6ed3-410c-aea4-34ead2abdd10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895905, "uuid": "36216a3b-e573-41ef-8dd1-b7ba3d987659", "value": "3a7ec3ac2c55e096920136c07dfa07a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a316976-b156-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676922103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922103, "uuid": "075b7ae9-134e-4b5c-a674-285c602e3903", "comment": "Malware payload", "value": "a9631063734ae0d14fc389d1d86ac468", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922103, "uuid": "f09f6118-44bb-42a8-b53a-c4082aea51b8", "comment": "Malware payload", "value": "a815d79fa968200f669b62232b92827f5ed1f57d56576e596f2f572fa5ce7670", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922103, "uuid": "5e4f369d-b294-4dae-b049-b07547e86f31", "comment": "Malware payload", "value": "efe3b8fbc3af7e6d94f47b53b0c89910d6a55bf9", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922103, "uuid": "fef81337-0ab5-4427-995d-b12e36e08ac2", "comment": "Malware payload", "value": "9ed857fd2eeea0f6cfbe1a8885371a51c2157f452ffe87628ddf031838007db2b66f10fa88fbf0f7bb1a6f38c5e73892", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922103, "uuid": "b55ef9f2-ebd7-4ea2-a7cb-97527cab876f", "value": "T1EC45B351FB13CD8AED25CB7D30978BA03331D80D66A1971B138DB26E7DE1900AE93799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922103, "uuid": "d164b4e6-0f72-4329-b390-8a3cd71511d1", "value": "6144:KTSWkCs5CrKvnSCDSgUes2Tp57K8lO56k7pu/0F6LTmm/rF5XHxFJbz/Gskdo4zB:RW9HTPNK7zUho2kRe0R/dLne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676922103, "uuid": "cb4e53e6-aecc-467f-b581-6f3cd166b03a", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676922103, "uuid": "99d42512-e3c8-4ce4-b945-ab609718f923", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922103, "uuid": "0978d53b-b34f-4762-bf8f-44eb3f5472e2", "value": "a815d79fa968200f669b62232b92827f5ed1f57d56576e596f2f572fa5ce7670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b300d3f-b112-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676892898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892898, "uuid": "2f7c9246-0293-4eac-b76e-384b9b9e87c3", "comment": "Malware payload", "value": "1c0cd7c46199da37d5f4910a6322da90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892898, "uuid": "b344d66d-93b2-48a9-ad62-ac1719301117", "comment": "Malware payload", "value": "a902469714ec172e7d2fde514e058670f21d8a5dba89241fd4f3ccc23baf4288", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892898, "uuid": "3a5f43e2-346b-4843-9278-7b1aeefaf26e", "comment": "Malware payload", "value": "f9f7cb5ce46461a2ee9b7353ff768a04738a55a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892898, "uuid": "6ca4c2e8-4104-4a87-9a92-77743947e83e", "comment": "Malware payload", "value": "d61d236fdf40fff11f112f5353f30a8f3fdfc8b14756d1aade0011ea08a2f6ce648971ee3b2247bfbc1b1c857dca6312", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892898, "uuid": "6664772c-ee10-47a8-baa8-f2208d4adc9f", "value": "T11F65D0CB00161DF2C101CAFDF7E6B0A09CDB6A60ED1189F51286E4AFDDD6ADCA87544E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892898, "uuid": "73bb8b09-649d-4312-9506-0c2a70a26dfe", "value": "4a43ef13050d45ae61812b2997033821", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892898, "uuid": "5521e0e7-ed73-4f75-9b13-6170f586643c", "value": "24576:dFdHMCfUktBOKQm2h1L27l20PjhqmhCvgu167qqyG2aQQ6C/jvOGMQHc2cPNtQlL:9sktcS0KKBGAQZ7mG3lROqKD27Lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676892898, "uuid": "a11f5e5e-74b7-4dec-95a4-b0d893da4865", "value": 1547296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676892898, "uuid": "8606ed8c-d33a-4eb1-85d1-c1a79bd567c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892898, "uuid": "871c79be-23d0-4672-bc49-02de5672521f", "value": "1c0cd7c46199da37d5f4910a6322da90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32bc134-b102-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676886067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676886067, "uuid": "f9db53cd-11b1-4b5e-adf4-f12df48f666a", "comment": "Malware payload (NanoCore)", "value": "cb95cdb67715d081640ef8c42d1c433f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676886067, "uuid": "e786de8b-0498-4fe8-ad09-aec4c5f80e75", "comment": "Malware payload (NanoCore)", "value": "a915b887c80b1c76553201c719dea5353601779740b9207fd293cf83a3a2d239", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676886067, "uuid": "83358465-efad-452a-a9a7-aa82aa41933e", "comment": "Malware payload (NanoCore)", "value": "27db4fd038db5b2a3775aaba79e53ab29753579b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676886067, "uuid": "0e41c8be-f20a-4c61-8210-e6ae88482b10", "comment": "Malware payload (NanoCore)", "value": "4ef6f126ebebf972139685349e0644920b7793135ce1007cc74e234489704b2f8b86b3768d27cd2f3ec77160e6813142", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676886067, "uuid": "eec51375-2b4c-414f-9ab4-3fa933f108d0", "value": "T14474122164A4A4C7EE2683B02776CE70E3F5FB049111D29F1B193F76EE52AC18D0E6B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676886067, "uuid": "23c7187a-a6ab-4dfe-9058-c0af6d57f487", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676886067, "uuid": "8668fbe2-49bf-464f-a80a-f8143f0d85b0", "value": "6144:6wK52TNrCRQ6ROxv8qg8FuwkQ83lAsQ5XumSztpF/hcxDj:C2Rr0Q6AUqg8QQ36puf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676886067, "uuid": "8c1bc60c-e3e1-41a3-984b-36009c9d3943", "value": 352616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676886067, "uuid": "8bf2231d-1c50-43f6-a887-445167ee8150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676886067, "uuid": "c915aec3-513c-42c7-b16a-dd449c978c68", "value": "IT01879020517_uGIim-xml-p7m\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92fb543d-b119-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1676895891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895891, "uuid": "7945fbb3-58e5-43a9-bf28-69e3e073ff65", "comment": "Malware payload (LaplasClipper)", "value": "723da0a004e4ac7783ddcbb2ed40a739", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895891, "uuid": "b08d7111-e302-44d1-a436-ad4932f9a8ec", "comment": "Malware payload (LaplasClipper)", "value": "aa0efd425ea2c4c1d8ab3e78d6b52c8be35173672df7811842f946a3283ad128", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895891, "uuid": "3631a4fd-74c7-475f-9d96-497894c7319e", "comment": "Malware payload (LaplasClipper)", "value": "e45d01b2278321420d001d5f464b5affe49e2272", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895891, "uuid": "60d34c1f-cba9-449c-b25b-f8706a4c76cd", "comment": "Malware payload (LaplasClipper)", "value": "8458515b5ae6fb4bf5c947f7c5c3b44fff77c95e95861f11dc09e8b3d59338f72c84da6619d0e9aa9f739471f6192bad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895891, "uuid": "4385a8b9-e8c4-4930-b49d-02b04248e221", "value": "T116073371BCCB48FAD14B6C3C890F83D736FE12A56E49881016E4558DA97EE72D0AED13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895891, "uuid": "f67583a9-9e9e-4a70-9eeb-0ebbc1d4ad19", "value": "3b9cbd6df4e5b395344be05e4c3f9c49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895891, "uuid": "391acf3e-401e-4cbc-aa3d-9ed1b79e9b5b", "value": "393216:esIA6MnTcFlAbytG/bAhbL/BYagT9uEs7Ivb6CDGDZX:ejAVnTcFsIhbLp8TIJi6Cg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676895891, "uuid": "991bec6a-ea77-4392-b4a1-f87092f43bdb", "value": 17993224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676895891, "uuid": "3a7c0402-2574-44e6-8ed3-4a5dadb81896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895891, "uuid": "440e6531-4310-4e09-a755-1c008a1953dd", "value": "723da0a004e4ac7783ddcbb2ed40a739", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed9a1a0-b124-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676900555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676900555, "uuid": "51390c2b-ce58-4821-be88-8a14418f7212", "comment": "Malware payload", "value": "b86bdbc1367f2270c5773f1e6301ad72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676900555, "uuid": "0a87f246-52df-44a3-952f-4a6cef808f86", "comment": "Malware payload", "value": "ab88c905fe662e1e8d0ec384185b74cb7e4c2614d5d11025e0d973912f1d3add", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676900555, "uuid": "3dba2d4b-76a5-410b-b264-182131c88237", "comment": "Malware payload", "value": "645c7b5685b9d79f7add7170bbe9f3c675fea0d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676900555, "uuid": "6f5eb11a-1e85-4a6f-81c2-bb30bee8086f", "comment": "Malware payload", "value": "ea61041d628ec9be50e164c0ee3d4cc216b870473d3fab580939a86880bba1d0046e723d9fc921e8df57e2b105a4163f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676900555, "uuid": "42330766-aec3-4a29-9fe3-8cf3d63e03e1", "value": "T101A2406579EE412DF2B78FB13FE034C6D96AF27A7519A85F2441030B4E41B84DE42A3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676900555, "uuid": "b4032914-dd06-4e5f-8bfe-52cf82de584d", "value": "384:ag0fcu0b7NtdKCVp7RiNZqeqq8LK2H4U6tZACcw9aHfd:90ku0b7ZYNubxr6tZ0OaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676900555, "uuid": "38a52519-234d-423c-85f0-7b1226a41627", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676900555, "uuid": "eb0de99d-1192-4c45-9da0-cdcf44c25814", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676900555, "uuid": "57190137-55c2-47cc-924c-45058afdb15d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8031f1f-b114-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676893859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893859, "uuid": "f00e16aa-2c2c-4fd2-a334-ca030dd10465", "comment": "Malware payload (GuLoader)", "value": "db23906b185b4ad3cdc8fcf496c2b22a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893859, "uuid": "2cf30057-47b6-4c7e-abff-5d333df45856", "comment": "Malware payload (GuLoader)", "value": "ac69bdd1a2cd6eb58887e6eaa36ea04db6825bba59473548e9a177f5e3dd7cb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893859, "uuid": "b568f62a-484d-41c5-8bf7-9ab910455fc8", "comment": "Malware payload (GuLoader)", "value": "03c844e149293d67da0e42cf6fa8c3ebf527cfe0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893859, "uuid": "0747f3d9-aef7-4ea7-b7c5-2702514a25d9", "comment": "Malware payload (GuLoader)", "value": "fa3bf73afb62948f2e43ead015fab3f8a3a56a68f4bbf12ce02fb945e9659c08016dc4abdb80f175e2f8082c3864dec3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893859, "uuid": "7db50d27-5e6a-47f1-8118-d004a23fedc9", "value": "T1333402552664DF67E52F4A3086BE4917EAE3AF005D1807C33BA0BE593D322C1E61E363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893859, "uuid": "3d49789b-66de-46cf-852d-ef0c1ecf71c7", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893859, "uuid": "71e75dac-7c2b-4a47-8a6b-e98904cf5eec", "value": "3072:8l2R732Hvv3OcDXjbwaPPskDNwXz5fSvy+el1E3u0haBa2C4Tq6iv61T6bywQjOg:8M23prSD5fQh3WBs3Vv61Uy91ms4oh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676893859, "uuid": "5d8d1fe9-351d-4b17-ab09-05c34edf46d7", "value": 230776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676893859, "uuid": "107c7fde-43b2-4000-8ee0-4f7293798c0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893859, "uuid": "1fb56b60-378e-4072-a104-0a9d4e3a0f6a", "value": "DGMT_Specification 0992658_pdf(83KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecfbb561-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676882728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882728, "uuid": "e15d8d55-2e36-4640-bbcb-5ff65913f0c4", "comment": "Malware payload (AgentTesla)", "value": "31b25df5635262590ec2c949e46c1235", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882728, "uuid": "109cac85-b521-4272-8095-548fe9f84309", "comment": "Malware payload (AgentTesla)", "value": "acd693ca7479058e055d4532372f5df4fb77d1f0a78358662cbc9a726764352e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882728, "uuid": "b1abf02c-75e3-4d52-9215-6c03d8ce9be0", "comment": "Malware payload (AgentTesla)", "value": "9efadceb7acf394271d4100a8ece209d07046683", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882728, "uuid": "4c6a4f6f-8cd4-4fca-a17f-2945a74e686c", "comment": "Malware payload (AgentTesla)", "value": "efc0eb26371712b51d5e0b9cba2ae4552a08c9c6f75a2e579480add70f404e105f24efd19f1ac3bda0eed802b438af28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882728, "uuid": "c56c7c30-051f-447a-853c-d5f6ce929998", "value": "T1D184231273F5C467D2D1863B8F7EA7E653D86A1389F8610F7BD0AA68FE110815B8C742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882728, "uuid": "b61f94b2-6aa6-406f-940a-d7d81e45de95", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882728, "uuid": "83a5fe4e-1baf-45bd-915a-94f754f6f1d9", "value": "12288:DYgAmhgxD/CIvIKov9/jcS2RyUYK5nqDM8:DYgAmID/CIv6/jXhUfV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882728, "uuid": "7c42f620-0aaf-4dd0-844e-d0c852f27267", "value": 406386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882728, "uuid": "e4c6750d-03ee-4955-bb2a-ba7358d77799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882728, "uuid": "aabdcf84-3dcf-4a82-9a3a-4ff839722cd0", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95dd970-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676882668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882668, "uuid": "3e9211c5-a8b4-45fe-a8be-7d092af6db0d", "comment": "Malware payload", "value": "9ac24f98944e117e10cf3f755f82be79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882668, "uuid": "dc9fb51c-1e31-494f-8e0d-4613d5dbe194", "comment": "Malware payload", "value": "acf1e180568bd352139689ae13a2a3774c454cc1efd5c219cc49680cea4e2b10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882668, "uuid": "b0d18825-6ae5-46a7-9e28-ab7ba34be866", "comment": "Malware payload", "value": "2fb2aaa88e7442f69f2d8619e4f3211f70ba96c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882668, "uuid": "a0116dd4-adf7-4161-8da1-6db459a95007", "comment": "Malware payload", "value": "2e06a6c61ce88ec4d7eb1fb9746f4b6777002859df9c95d008af9a28d1cdb78620476dd8b768d00cc6020d0f63bf6f81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882668, "uuid": "3ae1fe93-b5ca-4c57-aed0-10548acea293", "value": "T165720934E0962B33E2F101B242A6352191AC3F31FF6C98DBF90A35633969BA35D36543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882668, "uuid": "13713b3c-9eed-4cdb-8b62-c150944f80a6", "value": "192:KWgnLjvEMBvGpVHCAHD/sKniEMEVWsQC4D0+d2Jf3VMN7kNuWSFeGWDFWfs:KWgLLEMBvGLvYsQbgf1V5NuWSFeRhWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882668, "uuid": "e0bee455-cdd9-43f7-91eb-3f015b033698", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882668, "uuid": "f8f9e4f6-2350-48ed-9e4f-64ab2644b31e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882668, "uuid": "b3ab95d7-d802-4d37-b3f9-3884f3b86174", "value": "acf1e180568bd352139689ae13a2a3774c454cc1efd5c219cc49680cea4e2b10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75729dfb-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676908727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908727, "uuid": "9654c75c-8e13-41d9-8db2-19b12fb3df2e", "comment": "Malware payload (SnakeKeylogger)", "value": "e05427b2d5926de0d5183c7fbf32ca99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908727, "uuid": "7e20c44c-6532-4138-99ef-e32905fe70d1", "comment": "Malware payload (SnakeKeylogger)", "value": "ad408414cfc70cdc2f0a28d95130cde8931e694f39699aa4dce91a8cc30a0897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908727, "uuid": "d6a19e80-83c9-432e-83bb-83fef0b787d6", "comment": "Malware payload (SnakeKeylogger)", "value": "b3530d54a0a78d814f279b133329ce6005fd6e32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908727, "uuid": "00fe73fc-10d4-4bc4-a9e2-6a7d53ed3a81", "comment": "Malware payload (SnakeKeylogger)", "value": "241526219127d012287d86ecaddf07bec1cdfe8b8bf730a58cf703392cb254e94efea1469c6417f79579024ce50272dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908727, "uuid": "863710ae-fc5b-4d33-8d5c-8bd14f38c57a", "value": "T124557E95F2B0C8B7D89B01F66C3A562434A27D4E6454D11C4FAB7F5662B23B3309EE0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908727, "uuid": "498b1584-f74c-48f5-aed1-4cbed88fef20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908727, "uuid": "698db76f-be74-4133-afa9-4b11798e815e", "value": "24576:5n/4yZ1qeokQIncACeUfwkN9RAzOG5rYE:VXkkQInNCwqAwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908727, "uuid": "fed3c25b-fb82-4e58-b6b4-7844e4862be9", "value": 1299456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908727, "uuid": "9e9b2ab0-3de3-47ef-a991-b27421746de3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908727, "uuid": "2f0756a5-4ea4-4ccd-b4e0-a495d0a7ef47", "value": "PO3420056.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cca95e8-b11c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676897035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676897035, "uuid": "c905350c-2fa4-42fa-b382-108596042781", "comment": "Malware payload", "value": "da81c68e2f88a3eaea836826f44fcba7", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676897035, "uuid": "ccca5adb-09c6-424d-987d-502587930ca7", "comment": "Malware payload", "value": "ae54c18727715192eb0e5160f7ef9f7ff2382a517679a6c84e1136280ed11aee", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676897035, "uuid": "626269ae-90f6-481a-a1f9-59e65d5e91e0", "comment": "Malware payload", "value": "db739206524eea16885e81bfd058c6eeac013e5d", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676897035, "uuid": "59f9c2ea-d223-451b-ba03-b9263c462862", "comment": "Malware payload", "value": "78860a54c60b7328bd595ec979f7ee1efe0e92b17605ae9611c2bc941776cd954e31a126c37de84415d59677521ee45b", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676897035, "uuid": "3da68953-90ae-4636-847f-b47ebb40bb9c", "value": "T198A533558BED4833C63827B61DE216875F3E7D909DB0C36F17446A086DB2281BBB2376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676897035, "uuid": "2c6a6563-230c-4c0b-91b0-73ede284f9aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676897035, "uuid": "0ab207c0-7346-46f7-bb4c-758feedf9294", "value": "49152:4fh9ck+SaWDhfaTz016bPGUsaZ99zDOYcX+ryk9D0BL4JLvtGx0:GEg1ibuYcX+V0ILvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676897035, "uuid": "fd0ad7e8-966c-43ad-aaab-8b04edef4860", "value": 2187264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676897035, "uuid": "9e31739c-9bc3-45d8-849e-c35ec7cf8900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676897035, "uuid": "4077a43a-9c50-470e-96b7-861a7b6f449e", "value": "da81c68e2f88a3eaea836826f44fcba7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d5197b-b13b-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1676910626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676910626, "uuid": "7a1b471a-2ca5-48a2-a042-24d1ac4f3e13", "comment": "Malware payload (CoinMiner.XMRig)", "value": "5807efef92e20ffe074bbdc141cfbdad", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676910626, "uuid": "3eecb973-3bfc-4ce3-967a-160e7953a672", "comment": "Malware payload (CoinMiner.XMRig)", "value": "af421881786af65cf89b28d2a88d37658625f21f9644cf298c438267c7c92572", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676910626, "uuid": "73acc0e4-d8d2-4ef0-aa63-ddd5db3fe619", "comment": "Malware payload (CoinMiner.XMRig)", "value": "b6c4a743c2fa8ed7fca8257d26134806b64ef9e0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676910626, "uuid": "acfc896f-b3d9-4d52-ac8f-9602583eda66", "comment": "Malware payload (CoinMiner.XMRig)", "value": "783bd8d4c7db369f5e40d2badd78f5403a7a1585491087ad36a5f567e611f32067381bfbd23af15b11a10c6be440b8af", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676910626, "uuid": "3ca29572-00f9-46cf-9de9-86d0b390ac17", "value": "T10DA623BE6688335CD419CC794037BD09B3B6561F0AF856AAF5DBFE807B9E810E506B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676910626, "uuid": "75ec3cf8-c4cb-42e7-952b-c58341990f4b", "value": "1b2324c097913513bef0f7e95aeec8b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676910626, "uuid": "620b73be-8314-4986-a710-5a3eef56234a", "value": "196608:EpU9d+xVQbxm+Y6pdA5yCAXHQ93klXFIfO+I3JSIJV1Fav1:Eq9d8sxm+Yad5ZQ90lFIfO++DJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676910626, "uuid": "aa09edff-2765-49c3-b107-36ffc01544b1", "value": 9899008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676910626, "uuid": "600ef1d3-8b00-4975-a82f-dfbf3711d108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676910626, "uuid": "8082d8b0-30c2-4970-8d7d-987707e24051", "value": "SecuriteInfo.com.Variant.Lazy.274098.29671.18026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b33e961-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676908763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908763, "uuid": "6503ffc5-d4b9-4e32-b0e5-a3cd4b325e56", "comment": "Malware payload (Smoke Loader)", "value": "26ebf4b16a7b59e42a4bb77818d6fd31", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908763, "uuid": "fb8eb75c-e644-4589-afba-4734fd32ed71", "comment": "Malware payload (Smoke Loader)", "value": "b06b1b4d5a9dddb0d067a38fdf2b3b872d974ce1379c4101ab13aa1a6f143b13", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908763, "uuid": "c536a1de-8412-4a64-a6e7-2abbe349a06b", "comment": "Malware payload (Smoke Loader)", "value": "3b76faa23a88fa0937eab421e4c8f2c4a8d070f0", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908763, "uuid": "3b077127-5728-412a-bf17-8fe5378d406e", "comment": "Malware payload (Smoke Loader)", "value": "471d7b1f54e546c9cf0c6bb477f666c55af39e1a7a53058168e56228eaa22a129b358a254883e4b3b75044aeed1fffc4", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908763, "uuid": "a7a78dab-e2bc-4a63-8737-cdd2cd556df3", "value": "T10114E11178A0C0BFC45205B26864EBE09EBE7911A72185CB3B88167E2EF17D147B5FDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908763, "uuid": "3d49ebb2-a8f7-4978-82bb-1a711c0b4b77", "value": "ba19c5d833d8f89c60a2bc026207e7c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908763, "uuid": "83cb60eb-eae3-483f-9b10-f21dd518460d", "value": "3072:dpnVxDLhdvd+kfHkJbWU5TszWKsQ0U99qpz0kDB1sh02qR9wBA:3nVxDLl+Dpf5TYWKsQzbqKkzshALu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908763, "uuid": "a35f1f98-0ecd-4f5a-bb9d-ce8b6aa51776", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908763, "uuid": "365860b7-1836-4921-a446-1c3ae41c382c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908763, "uuid": "6fc41680-c204-4308-b954-c13ab90a4cd2", "value": "26ebf4b16a7b59e42a4bb77818d6fd31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3ee50e-b145-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676914672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914672, "uuid": "9a6c6863-efd4-4cc5-85a6-72bf4cb582f8", "comment": "Malware payload", "value": "fd1ec13bebe2648351ed8c746d2737d7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914672, "uuid": "b69decff-fdbd-4b97-b40e-af78f128a7a4", "comment": "Malware payload", "value": "b0f53efe358097e176572ed51bcbc204edcf3849c64a6e5610caedf7bfb6fde5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914672, "uuid": "24bafa6c-5cc8-4041-961c-70a2f734113f", "comment": "Malware payload", "value": "742efa81f30d84e4ecc69d35c97d58bb280dc012", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914672, "uuid": "cfb3c881-db8d-4e21-ade5-883e49a54ad0", "comment": "Malware payload", "value": "ba4793e5834d2f08d2283a5225af5e00505a5b0cf1eb6e27f1135ee2f508ec08c5f8b02fd23590c920b4d798c27ea0b3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914672, "uuid": "f6845bcc-fd99-4352-9ef9-319e77fab478", "value": "T1C645AFB875047DE6666F176BDE96ACDD03B627639ACBA4CC80A4B7C30563335FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914672, "uuid": "32db9d4f-4840-4403-b9ab-b0a723b46693", "value": "24576:iodW8Al7kunzhZQf/AIASoYWSiyDCTncFXEW5NOVkEClqfqGBbSgmRviOL2:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676914672, "uuid": "a082a307-3d20-4bf6-9570-38b8d97fd7f7", "value": 1197593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676914672, "uuid": "aa62bd8b-39cc-4f99-b73a-1ca3c795743b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914672, "uuid": "5c185235-5534-4563-bb47-51b1fc63b31d", "value": "MBL OBD-COAU7243048140.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc72ade-b0cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676862729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862729, "uuid": "fe44983d-5d52-4d8a-b953-040c5891751c", "comment": "Malware payload (AsyncRAT)", "value": "47d80da7c6cf2210e09db507f1d9d7f8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862729, "uuid": "f5f2cc74-53aa-4960-8fb8-6a6186d249d9", "comment": "Malware payload (AsyncRAT)", "value": "b1b9795bd6a8f47224b156a25c9011d7c8b4f8fb2c3a9042fa97db6eabef8ac7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862729, "uuid": "eaab6abb-1a72-4485-b338-406107e70db9", "comment": "Malware payload (AsyncRAT)", "value": "548c186421763f4bb9a8de844dbfcbae6d50e03b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862729, "uuid": "ef2746ac-6c80-4a81-9b32-cdab5141f47f", "comment": "Malware payload (AsyncRAT)", "value": "2a4e8ec59d5bc995be3b1598a561eaa637a43d2264ba07380e9b97cc53e24cc9a6c16e1af7941203ed4c28dad75f4a05", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862729, "uuid": "1e16f699-147f-42e5-9540-85f0f69bc614", "value": "T12654DDB564AAC999FA4BCB41767CFFA411B270F399C91A20133C6604CFE9F952F4814E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862729, "uuid": "589eae44-3637-4f0e-aecc-da7237dd4c92", "value": "6144:zeU/QIyNoKlwIFhqK9re8gtowmGcAh3ApF:zeBoKlwWhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676862729, "uuid": "ad45f5af-10d3-497f-afa9-4c75658e5c2a", "value": 293263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676862729, "uuid": "74422850-8dd3-4ace-8125-0ffbd23f8ee9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862729, "uuid": "b543b5a9-81a4-4fa7-a0ca-36b471c253b7", "value": "img.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cceae487-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676882674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882674, "uuid": "054893f6-db5e-4a50-8a54-d0b61e88d081", "comment": "Malware payload (SnakeKeylogger)", "value": "23da4bae336b4d65847143e638019c60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882674, "uuid": "9e94ee40-1773-4995-a766-8ae945d3b2f2", "comment": "Malware payload (SnakeKeylogger)", "value": "b35b083250fb0f118661c25466c6cff4b7de3990775425d8357657566f656f53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882674, "uuid": "6e7be376-4181-4bd5-8af7-2d531dd5eb65", "comment": "Malware payload (SnakeKeylogger)", "value": "21f144c5b8c1c9fbcd59518357e1805b4a1a1273", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882674, "uuid": "9c73ac11-be9c-4ce8-9c43-5c1d0c4487f9", "comment": "Malware payload (SnakeKeylogger)", "value": "12e0029fc484dde8832a9dd894ff1e9b23c3fa088b7b1a32fed79b3d3a2cf43419d483c213cf720b13c31e460091f305", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882674, "uuid": "f2ecae03-aaa0-4695-8ef6-f8bb9d73e613", "value": "T1FFD3281D2BF89840E5FF597305B15112C776FC52092ACE0D4AD2F9192A7DA90CE1BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882674, "uuid": "d676fe1f-f64f-4b75-89b7-b2819e5240c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882674, "uuid": "29f2159a-431c-4958-9748-fb3b97bcbae8", "value": "1536:eqUzG4bIST+nCZvyDF7i+E+vBUFrlYYufkuYcyIirswSGMFzBARs0b/U0EVzsg5D:eqUzG11hR7auf4b8DzZ1wB/2yFbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882674, "uuid": "59732170-7817-4a99-8648-3f87f628c078", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882674, "uuid": "25502870-54f1-43ba-b848-120d1268010c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882674, "uuid": "ebc518ab-68fe-40ba-b584-638024a0cba9", "value": "b35b083250fb0f118661c25466c6cff4b7de3990775425d8357657566f656f53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d505dea6-b0f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676878822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676878822, "uuid": "7080545f-928d-4a07-827d-e3f285b9c139", "comment": "Malware payload (RedLineStealer)", "value": "08bc61aa9c5c9dfb546c9322f33e84c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676878822, "uuid": "439bbcc7-f449-4ad1-8a72-8e16910b9219", "comment": "Malware payload (RedLineStealer)", "value": "b35dbca8527c0df61ac5415f5ef7263fde30a8e313300ba63352899b8e2906cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676878822, "uuid": "affeac93-0533-4cf8-8651-1dd716667b24", "comment": "Malware payload (RedLineStealer)", "value": "6506281576c616050d96161c11dd6c71487466ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676878822, "uuid": "04456678-565d-4c79-8f65-ab47f07a81cd", "comment": "Malware payload (RedLineStealer)", "value": "e160e6a9be3224cc5d59b14960a66c2c12be92dab06737de06d4cbc300680b515566c9a7dcd70ec9ab68a516da213d29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676878822, "uuid": "b023d951-1e54-4922-97d5-33809f502b77", "value": "T1CB14E02179E0C1F2D85B9530B821ABA05EBFF97226648D8B3B68167E0E747D157B3307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676878822, "uuid": "c082978b-5356-4493-866e-7743bf3efe36", "value": "c33891a90cc721ae1c38ffdfc19c51ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676878822, "uuid": "c089769b-b3bb-43cc-905b-85f8c0c6646f", "value": "3072:dC4yCeESuLx1fqhuP4UMswPn/FTUaYEmrHgVtCYtflVbflKs2dz+ttS:dteESuLChuPzwVTgGzCYtbAz+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676878822, "uuid": "46c87652-bbc7-4c74-8ba0-a71a3b713812", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676878822, "uuid": "9c483368-3fbe-4d93-99f7-6e4e88461e03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676878822, "uuid": "f54af9d0-8802-48e1-81c6-806667660b43", "value": "08bc61aa9c5c9dfb546c9322f33e84c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a7878c-b0f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676879732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879732, "uuid": "c15d9d11-4203-4720-9f0c-e5c2086b6f50", "comment": "Malware payload (RedLineStealer)", "value": "8e9b5572a7470a015a4bd2b91fd78ab0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879732, "uuid": "e1938795-7022-4487-84f1-a989f343a089", "comment": "Malware payload (RedLineStealer)", "value": "b45d683efd7ec95afd23317e2c0e9ca178b16c0d9f4f3c2363035dd10e24698a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879732, "uuid": "38639455-7b51-47f6-8c99-a11933701880", "comment": "Malware payload (RedLineStealer)", "value": "4e4d5406696a6d00bcf54633aba6f2f68c80ad72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879732, "uuid": "e42038d8-8eef-41b6-83f0-902e0c1110fe", "comment": "Malware payload (RedLineStealer)", "value": "838e3736092c694de644ed3d91fd3d23691b49c85a1c0a1ac307b11e6a6be20a8067ac665306f1be869712b5f64d8a2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879732, "uuid": "447d51a4-4fe0-4bfd-8273-ac7bd79b4f17", "value": "T1F334AF83B6E1BCB1D9164A719D2E86E47A2DF660CF197B6B22385A6F0C701F1C273711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879732, "uuid": "857f78bd-a715-485a-8c9d-0dc8bcfce3f3", "value": "ed191fd45aaa30104c7d529493e68118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879732, "uuid": "00bee551-5ba8-450d-a582-73c554bd0b91", "value": "3072:sB/aYaPSLD1P/m0a0k0IiqCRfsB5xJ7zg6qeL+VqYsPAl/Mvcf1iBh2s:6LaPSLFm0lJqCRfgdgRjwnPpENiH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676879732, "uuid": "4a64d5ca-fa5e-4f76-9f99-eaaa0b1863de", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676879732, "uuid": "12829b6e-53a3-4a95-bbbb-061337274776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879732, "uuid": "b1371dfe-99ae-40e5-86ce-3f876794cfab", "value": "8e9b5572a7470a015a4bd2b91fd78ab0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b37a58-b10d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676890663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676890663, "uuid": "e99888d6-99b4-41fb-b82c-3c348b384f1b", "comment": "Malware payload (Formbook)", "value": "0dcb73a3f228f3c33d9cda4eae1d74d8", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676890663, "uuid": "7ef024b1-10dc-4321-aa9e-9140d9c5bb94", "comment": "Malware payload (Formbook)", "value": "b4ab080aa3446f175f60215b44112f555e5c42e7e6e2c7575bdf84f61d4b81bb", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676890663, "uuid": "51c6043b-62a0-40e3-bc16-3b8292189531", "comment": "Malware payload (Formbook)", "value": "31b9d31a6c55a794c70adf1681416786b7593741", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676890663, "uuid": "385c2f56-af98-4485-b6e7-94530b75221e", "comment": "Malware payload (Formbook)", "value": "7062febea3698e75e137cc7f7c107e107e5965dc4a54dd66d8c76575fbbb0082d0df0810c5b85af7f20e3d9924f98a2b", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676890663, "uuid": "2d0a3280-dede-4c93-ac59-d6c15edbc9f4", "value": "T144B4DFFD9E1C3BA006CEA62794591D1CCC220E9F6FC1EF5BCD945656250B20CBABB346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676890663, "uuid": "e91cab43-0119-4017-9609-e91fc7c771ac", "value": "12288:mnJIxFZY1rzXZVt6bznQRaDu4uAWe6fAUlVxo:mJMWnuzGaDPuAWz4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676890663, "uuid": "69216ba3-93f2-4898-9af9-6cc6ad6ecd37", "value": 498499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676890663, "uuid": "93c13ef9-d373-4859-abaa-adbb76e3fb76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676890663, "uuid": "7789737e-6456-4a42-b838-f94aa9bd47c5", "value": "FEDEX_TNT-21993681135_FT_AK-4090502_CT-9311.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5898be-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676908842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908842, "uuid": "cf471a84-08d8-4b42-809b-888c4c0b50de", "comment": "Malware payload (RedLineStealer)", "value": "c7c1b4c003e01f7a2007a2b6d6ce20d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908842, "uuid": "0dddcbcd-3e51-4838-8725-6e1b7a43ebf7", "comment": "Malware payload (RedLineStealer)", "value": "b599efd2e66c673820cfd676d9d8095066961d6feb61c6d435144a0d9b226a71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908842, "uuid": "38fed036-fd91-442f-b1ff-6ee3ecca5f75", "comment": "Malware payload (RedLineStealer)", "value": "92b0f0a7ede4e6c20f622b632cbf928bf4924458", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908842, "uuid": "e760f9fc-9329-4634-a66d-753fe5725ff9", "comment": "Malware payload (RedLineStealer)", "value": "b2b8ab3234493f26d28e66bd7d20c6a906c96d091634d45ad9f79bd83f13b49ff466e751e93b0e79990eae1a824c627d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908842, "uuid": "71562f2b-ad8f-4e85-a7d4-6e55ba60288e", "value": "T1A2D4120B6AE88032E5B447702CF717C30B367D605B78939B274F6D6A1973668B63172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908842, "uuid": "471509eb-e9c5-4d8e-b422-726226c507fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908842, "uuid": "62ddfb89-fc37-4433-ac1b-162bd637441f", "value": "12288:AMrby90E8sqQ5ONMXGVamcqttKKc+P7muA223gb:Lyr1qBqGtnttpauA5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908842, "uuid": "099d8d95-5748-4e5c-80e4-172aff692429", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908842, "uuid": "489c8cd9-1a37-4e7f-a83c-2308355cdc04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908842, "uuid": "c7080994-ff67-4229-b9d1-25b87a628f4d", "value": "c7c1b4c003e01f7a2007a2b6d6ce20d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a08759-b114-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676893862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893862, "uuid": "7d02a2b3-24a8-493c-9d22-be8d083a0e98", "comment": "Malware payload (SnakeKeylogger)", "value": "43bc668c1dcf962941d09f6bd22325e8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893862, "uuid": "a90cc621-8272-4a45-af32-d94ef977b36c", "comment": "Malware payload (SnakeKeylogger)", "value": "b5f7bc8ce9f09f5c2a23c9d0379cc065ff1b800abb45955de8ef086aeb88bf8c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893862, "uuid": "569c83ce-6459-4911-962d-ac3d7fb7a4fa", "comment": "Malware payload (SnakeKeylogger)", "value": "83695c6050d20698b470736cf8e62fa83a9707cb", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893862, "uuid": "3a6fd4d7-798c-4983-bba8-e4acbc8496d4", "comment": "Malware payload (SnakeKeylogger)", "value": "05864dbc4442e4c31f381d4217db2208b836856cad9f0b0e9276421d334e53c9b4212c523104d17f144343e264d9ebd1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893862, "uuid": "55bb073a-a7a6-4343-9499-efbcb1a6df47", "value": "T1B7045351E7A07C3BF6580738AAB295871953BD33A911D91A2287735F4B73FB06C32E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893862, "uuid": "cf4b5e67-608a-4f1d-8ce7-d826e40e0e85", "value": "3072:zkZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAT9R4OtNSwFW:wZ+RwPONXoRjDhIcp0fDlavx+W26nATW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676893862, "uuid": "bcb32b1f-0ca0-4ea3-a328-fe8aeac0389f", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676893862, "uuid": "e7dd59e3-f8d0-4861-9934-8347ab690711", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893862, "uuid": "a356f7fc-701a-4ecf-a9b5-80063c375fb7", "value": "NEW PO#102972.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda4ee58-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676882675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882675, "uuid": "b8d661a4-1531-4fd7-aeeb-b10e658f9717", "comment": "Malware payload (Formbook)", "value": "06efee70a18a162205ebff5cdf1883b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882675, "uuid": "3d250882-7304-4aa2-99ea-07e678fdaa6a", "comment": "Malware payload (Formbook)", "value": "b71909f3cd1d9b763d573a9c76b36fcb98e57c9eba7b54a35fbe5ad154efc52e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882675, "uuid": "a6f1e391-3d3f-402d-8376-79f45fe3bbc8", "comment": "Malware payload (Formbook)", "value": "f493f3fec07a21d38d5041828d08df5e1ce371cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882675, "uuid": "61e17f12-8371-4258-bf0c-b75cb0c8e824", "comment": "Malware payload (Formbook)", "value": "5600ff9ed2afb107c3888ce2341d8bae76bc1f7aae07993c7eecdf6668163d484c53f60c7a192395ba58d285aec4febb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882675, "uuid": "f6f6335f-ffea-4cfe-ab9e-8bfa888733d6", "value": "T19704AE36D642C031E2B211B5F67D0B7B483E4E347395A4E6E3E116A16EE08E5B17A31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882675, "uuid": "fc311013-afc6-444f-b976-35c68615fbbb", "value": "3072:AKMEfcKBB2vIN34+UZuEquJ838xMxgl+9CGi5WW/fLAO:vcoB4jZ5quJ839xcefWbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882675, "uuid": "aaf0361d-54a6-4f1f-a85d-8f4e0f1e6522", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882675, "uuid": "c1838fd5-bc04-4afb-9ef6-7f4ae452be33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882675, "uuid": "67ed92aa-89e6-45c5-9097-c0a806d36856", "value": "b71909f3cd1d9b763d573a9c76b36fcb98e57c9eba7b54a35fbe5ad154efc52e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee5c727-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676882704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882704, "uuid": "bba92f2b-3df6-4a2e-b0fd-1d76c34acc9f", "comment": "Malware payload (AgentTesla)", "value": "69a175556a09a3597897c18e8683782c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882704, "uuid": "1ee20e00-06b0-422a-837f-b6e2559d3ed1", "comment": "Malware payload (AgentTesla)", "value": "b79bb7f8fefe938362cad121c7753409422afd3904a0753da8e9de8b06af9813", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882704, "uuid": "0cb841bd-6510-4513-a23e-5ddf2ae925e0", "comment": "Malware payload (AgentTesla)", "value": "4ba7608ce9271346924b730704fe8e9fc14400ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882704, "uuid": "116a84f0-3bdc-41d5-910e-6b369579daed", "comment": "Malware payload (AgentTesla)", "value": "cfaa7fa2b188dd7a4c70a95a6645d04da5c7512b97e93839a92bf62c52932fa3663a9d8eeb62c2ce8249113074bc0c7d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882704, "uuid": "9875c3bb-9a8a-4e33-aad7-4a888d82fa29", "value": "T1C925AD9977B46473F4CB01FE5839278D2E3166137609E22FA777BB81A2319FB7285201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882704, "uuid": "308ab300-8977-47e3-b13b-f3a1a4b266cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882704, "uuid": "47265ab7-2bc4-450c-97e9-af92bf45ac2a", "value": "24576:oL/s3NpK0c7OT4fa3yI9UcZ4TiuwMnmWy7IL:c/sdYyTn3y0UcZ4Tiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882704, "uuid": "2111fc61-bd3c-47cb-83c6-85fe4c7be27d", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882704, "uuid": "8233feca-d2f4-4ecd-9f49-32b7d2932f02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882704, "uuid": "226cd965-ad24-4ecd-bdc2-560f10e463e2", "value": "ISF FORM --- RT5301 x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff4dd45a-b0ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676877175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877175, "uuid": "c0cb4ec7-21d6-4c51-8987-dffb409fccea", "comment": "Malware payload (AgentTesla)", "value": "6e581e887c7227bf3635d03f33f6d305", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877175, "uuid": "190b61ab-c610-40d5-85df-053890b4431a", "comment": "Malware payload (AgentTesla)", "value": "b7edcf412d229e488db5a92975a1b2398f4bc4e7dc0317f9e226b706140994f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877175, "uuid": "d3a317df-3bc4-49af-b3e5-73c4433384dc", "comment": "Malware payload (AgentTesla)", "value": "92f44eed10b34b67108c56c71dd7100cf09e7206", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877175, "uuid": "dfe3d965-7f93-42b8-8c3d-64a5310417bd", "comment": "Malware payload (AgentTesla)", "value": "4268352784f123de6969cce33484891b2ee0510ee89a95ce6df5d7b15c4d80e3fd6ff0e9972ac50ff9152921e6f20239", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877175, "uuid": "11361afc-9ce3-41e7-87e9-364973bac9f9", "value": "T1FB8423C437F4D857E86342F15FBB8EAE3ED5751225B08A0917700B59BD33681A60EBA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877175, "uuid": "0fa3d45b-a517-47d2-b84d-b06d919ded74", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877175, "uuid": "b0160bff-c67c-401b-8a56-04a83965478a", "value": "12288:/Y6D3is8BdVe+PEpm0G2YnF/X41DbuSOWBDRR:/Y6W7BdVeg0GJPSnuSOWJRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676877175, "uuid": "59cfad8d-4b86-422f-bfd8-026622d59975", "value": 397150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676877175, "uuid": "7471c0d9-1e7f-4ddc-b758-5b90720361ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877175, "uuid": "5cd4ceeb-1c52-4ff6-ad9b-4cb126b6c342", "value": "Inquiry specifications.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1567c8-b114-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1676893871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893871, "uuid": "25b88699-5b59-4a8f-9d23-ba650387f24a", "comment": "Malware payload (Quakbot)", "value": "4b80f9e2ad1f7ef034f9ccedf45de33d", "object_relation": "md5", "Tag": [ { "name": "1676886180", "colour": "#AC9814", "exportable": true, "hide_tag": false }, { "name": "BB16", "colour": "#52982A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893871, "uuid": "e7e26f8a-7b06-4914-959f-dad17d64419f", "comment": "Malware payload (Quakbot)", "value": "b91340d156582060095227e8d26f29f5ffc8b0e8fbf35a392b649adc60a5d4ab", "object_relation": "sha256", "Tag": [ { "name": "1676886180", "colour": "#AC9814", "exportable": true, "hide_tag": false }, { "name": "BB16", "colour": "#52982A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893871, "uuid": "335a459a-f28f-4f10-9458-90eec38ae969", "comment": "Malware payload (Quakbot)", "value": "6af6ec8f3c3434442c9ded389568e6a5ceffc491", "object_relation": "sha1", "Tag": [ { "name": "1676886180", "colour": "#AC9814", "exportable": true, "hide_tag": false }, { "name": "BB16", "colour": "#52982A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893871, "uuid": "e1e3c824-b571-4b3f-b130-f8b3b05b70ff", "comment": "Malware payload (Quakbot)", "value": "5ffd6638ffd7876da43d959aa5b864a4c2ce4e5982384c8da9655921cabee6b516730feac40b468b9c976b86f0fc448f", "object_relation": "sha3-384", "Tag": [ { "name": "1676886180", "colour": "#AC9814", "exportable": true, "hide_tag": false }, { "name": "BB16", "colour": "#52982A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893871, "uuid": "887e9c02-2d92-4e52-8f17-5be103874d81", "value": "T14D943B54FF4713F0EE0354F8814BFB7F6B381E1185658EBADBB14F68E5A1A69840E608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893871, "uuid": "ff6877df-17b7-436c-89a6-b24cca462079", "value": "6144:wNdLVrwwya0SU50lCtsDKxNNuNtrdO8xXB4LDhW7q4jr61bm:wNdLVrwpaJUKwSWxNs68YLDcq4jr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676893871, "uuid": "4ed73e7f-36d6-4056-adce-fccb9664e2bd", "value": 425700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676893871, "uuid": "b458184f-24d7-42c1-9cfa-fd7ab97a501b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893871, "uuid": "e274e626-db59-44de-93a8-6ea100372f13", "value": "adeP1F.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63fcbc19-b129-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676902684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902684, "uuid": "d11d7e65-6c92-44d5-812d-8a73372a752e", "comment": "Malware payload (AgentTesla)", "value": "246a33702e7ef1bea8ac9fb1671f51e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902684, "uuid": "58b597e0-08b6-4c02-9a16-505db8da840b", "comment": "Malware payload (AgentTesla)", "value": "ba807d8c847bf0f8098ba330bcc0f7e488bc967179e5a9062c3eaf76f2b8fd77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902684, "uuid": "f559c74c-bbae-44bf-92e9-f41c5c1b790d", "comment": "Malware payload (AgentTesla)", "value": "b92e1692bb37b24adcb4c798f658a8509a6e743a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902684, "uuid": "01fd5fd2-35f2-4566-8754-7e5b3bcf653c", "comment": "Malware payload (AgentTesla)", "value": "e0cd9f911ffb70fd1f248dc3020430e2d3fb2327bcf1b58927c5e4e57432faa1bff0b3fb4b0aa1816b9a2c18645cfb7d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902684, "uuid": "7ce75871-96f6-4eb2-9ab7-efa55754361b", "value": "T141F49E9C91F0FB3EC9498EF9331036441BF492032D35D6E9DBA9F6C50B36362589DA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902684, "uuid": "f31b2a32-d0c6-4e19-b119-801b5ce95a92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902684, "uuid": "78e86e36-43c3-445f-a05d-daafa236a82a", "value": "12288:STStRyqDSucLyF5ekbmW+GtATgduT74aNg0SC+OJ/HlhPuk1c:GStRyqDSu4fkhukdK0ug0r/HPuk1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676902684, "uuid": "4676a5ba-f1c0-4619-a2de-512cc0367625", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676902684, "uuid": "d51d8a6c-517a-457a-ab1d-b35ec0fc4550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902684, "uuid": "73c5b4be-9fef-4db8-acce-1b61f4c96080", "value": "16- febrero-2023 pago de 3 facturas p 74359.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce696f03-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676882676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882676, "uuid": "f5cf873f-0e86-487b-9a1a-9fee5e8d8c65", "comment": "Malware payload", "value": "268c590fc2aab8e491405e79a288f869", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882676, "uuid": "66ce304f-5136-41d2-87f0-00122c713296", "comment": "Malware payload", "value": "bacfb0b5ebef580a175935d446e576e57e67a53f07019eafe2590e3df096292c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882676, "uuid": "f6302562-0794-4cf1-b9ff-f2f1a7424116", "comment": "Malware payload", "value": "4366d59f1adb41c10157613c85a8792584d587a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882676, "uuid": "ec2eaab3-38a9-4a2e-b358-63a143f9c737", "comment": "Malware payload", "value": "21c98cc4c4874484f0c48ccfc5a240431f148f4e4ebf17b867cbb319c82de16dd32673820ff698dc8fa355067f495c3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882676, "uuid": "69680783-363d-4193-9ec5-40c05a2fd78e", "value": "T1F184129273C74B00CD2524BD44EF823A07E16FC369378AD9BF0C36A95E16A139F96946", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882676, "uuid": "9591c2be-b0e3-44b2-b2de-4d3cdb87eca6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882676, "uuid": "2f184262-31a2-4ddc-8155-6c9e6dd48a80", "value": "6144:0iyrlK2EmkseqwA1Lxl6dONR8NQLkNNL66hUMK/W3dDUyhU2rV:hyrlK0np1l/g+LkNJDhUp/WtIVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882676, "uuid": "9491953c-9a90-4fb5-a65b-e8541c81659d", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882676, "uuid": "0e6c3771-e664-4bf7-ade9-782d89a9bee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882676, "uuid": "698bb6f3-91e6-4281-9614-dd9fa3912ab1", "value": "bacfb0b5ebef580a175935d446e576e57e67a53f07019eafe2590e3df096292c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf209b4a-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676882678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882678, "uuid": "40de044d-2277-4cbf-bfce-a3b7a089a6b1", "comment": "Malware payload (Loki)", "value": "65f9838d8cda08833ad74e90c28dc2f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882678, "uuid": "f1a5d38e-eaf8-4ee0-ab8b-15a7d7cb039b", "comment": "Malware payload (Loki)", "value": "bb23d40131bc7781fdc8ebd46bf9b1c922d04c41f34286bf76e7e0e44c5e5920", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882678, "uuid": "9eac5b11-c808-49cb-81f0-9c331491895d", "comment": "Malware payload (Loki)", "value": "fa98a1f0027c35f980f4261c28089a60dbc824c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882678, "uuid": "e134e38f-323a-45a3-8acd-e18daab8d60b", "comment": "Malware payload (Loki)", "value": "cafd2929c15c25e4559ffda4865f815999d6b4c54f292835c0922af9e271abd766fb3ca8a3bf614e2d59b869b63d9ca9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882678, "uuid": "6ac80120-c171-4ff0-a19c-ac498df06b68", "value": "T1AAA32A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C44E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882678, "uuid": "3a2745ee-1891-4c88-9317-4e48d40637f1", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882678, "uuid": "eeea25bd-6313-4edc-bcdd-5b496f53655d", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882678, "uuid": "8f53973a-4c91-4643-99a8-9fde31218f22", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882678, "uuid": "3bbba470-eaaa-43be-8e6e-ff822f0bd97e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882678, "uuid": "a3962194-5668-4e43-9527-0312dab6bcaa", "value": "bb23d40131bc7781fdc8ebd46bf9b1c922d04c41f34286bf76e7e0e44c5e5920", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6714cf-b114-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676893895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893895, "uuid": "d506be27-27a0-40d7-88c1-ee3132e2c61c", "comment": "Malware payload (GuLoader)", "value": "b3f61cda941407783da334213b01a888", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893895, "uuid": "012b0ed1-d0f4-4858-8ad0-41aed5f06c33", "comment": "Malware payload (GuLoader)", "value": "bbd9b52faf53964e369f24ebc165f3440f5b4299c8aacd4c41d96b2e40f3e360", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893895, "uuid": "9ae2a60c-46d7-4c1a-8ac7-04da61996988", "comment": "Malware payload (GuLoader)", "value": "f828635ae6797436f78e2d176659d7a73b0381f9", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893895, "uuid": "7d97a56f-a253-4113-9228-0598ff375c05", "comment": "Malware payload (GuLoader)", "value": "b85199c1adf936a5ec711d7ab5eb710f6c8b28a2aed57656fe6af6fcbfc9679e3b07374cc06018c819d04852addeade1", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893895, "uuid": "cccd7613-cbcb-4ae9-a677-146403b80d62", "value": "T1818423EF7E598A5439570E7622741DBFAF23AFC6831D678B04826741CEBC518EA3D101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893895, "uuid": "fa70340e-8004-4cf3-a91e-bcd1184e949c", "value": "6144:X7llEFZlJ4k1hL6f8M8t14kVIGsY+ALVRmfRf5UzoyoKz5m/GxZiVXaXfEn3MNF8:IFDJ4k1p8xAvvsf0yf5uuP6ZOaXfEn3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676893895, "uuid": "5162c0e9-b1f3-4e79-8ba6-edeb65c6e18f", "value": 385830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676893895, "uuid": "555bfaf4-3457-4d2e-af44-3f9ff0032cac", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893895, "uuid": "a6d1b2d6-14af-437f-adda-e50b41303997", "value": "RFQ-F-LJI-0622D003006.r14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db9787f2-b0ee-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676877545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877545, "uuid": "107534f2-acc2-4316-b213-13d4894ee901", "comment": "Malware payload", "value": "ea04a5c95d792fee479b955ca91da000", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877545, "uuid": "af863eae-5a93-435f-ba3f-35a444806298", "comment": "Malware payload", "value": "bc2f9fb51d4da2cf6a3009c0540ad2031a544dad8d37a3c262728e2012d60f2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877545, "uuid": "4b5e13ed-e57f-4eb9-a365-2c91a8416391", "comment": "Malware payload", "value": "ca93a14569b2f0edee478707017cdf453d704668", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676877545, "uuid": "06a303b4-0815-45df-acbc-84fb47035d9f", "comment": "Malware payload", "value": "59cceae7fe53d559226550b699ed9a0624be10a851a90171f5a9cb4c8926fa03932e55e9e4cfd8db2fc1dc56d41e12d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877545, "uuid": "a8786281-98f7-40ac-aa72-141bcdf8debf", "value": "T19C75DFB21143FE8D5B771C99F64037338CACFE97A7A58048BEC80EF85555618DE688B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877545, "uuid": "eac005dd-cabd-45aa-8e0d-2c8caf091930", "value": "24576:kN8UY1uDGARK8QbKriwOU181dWY7579Gwl28NybdCrUevEtGoqc+A6Yl7KbnuGZf:f7cegI6zDTOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676877545, "uuid": "505810d7-bdcc-4881-b279-f08d0f54de00", "value": 1696256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676877545, "uuid": "2bfd807f-8a7c-4801-b808-5294126946c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676877545, "uuid": "2f04a524-96bc-4b73-a521-14dfc48a07c5", "value": "33MT SORBITOL GLOBAL INTERNATIONAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03cc3ee0-b0fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676883625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883625, "uuid": "d42a8535-6136-493d-907d-d679dfdd9756", "comment": "Malware payload (AgentTesla)", "value": "2b7d05d0b2df07721c29694f4029c947", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883625, "uuid": "b7b667c4-0af8-4a1f-b41a-adfab0e63a4e", "comment": "Malware payload (AgentTesla)", "value": "bc74bc0afbb217e8ba0761e8b0e49b7a3c9945e5a83fa043d58679a2a8ea4231", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883625, "uuid": "016c2e88-0398-49b3-8250-34812f1f4dbd", "comment": "Malware payload (AgentTesla)", "value": "16252448559f7c3d639b98b5ead83b7ba70b7124", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676883625, "uuid": "6bdc5a80-2f8e-4ca5-9b32-5f6c84471b2c", "comment": "Malware payload (AgentTesla)", "value": "dd7784f6bbd3daa9ca7c63040075867d58e4aa72dddeb209789e56f92752106ff67a211d3ee7aeb9c9aec99696c7d216", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883625, "uuid": "9f2475e8-0248-4433-994f-759b93bd779b", "value": "T17603B15AE39F0264CF810277271A1E899ABDB23DB35091B1746C933433EDC7D06A66BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883625, "uuid": "ef50d390-318f-44cb-b931-b9c0beda8656", "value": "768:vFx0XaIsnPRIa4fwJMbYxRk4V2mn4qe9dT5rjC:vf0Xvx3EMbSoqepHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676883625, "uuid": "85b630cf-f9fc-4cd3-9849-d4d4fd979db0", "value": 38346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676883625, "uuid": "03fb65fe-7b33-496d-96f6-1d07c0f77e08", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676883625, "uuid": "30bed848-7dc8-4e04-812e-1dd03123c381", "value": "Liste.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35a5bba-b14a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676917098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676917098, "uuid": "52a4e1bc-783d-4f80-9b62-94e84ce98041", "comment": "Malware payload (AgentTesla)", "value": "8bf6721f5acbb9222f9f874dd2d8dc91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676917098, "uuid": "7e2f18d2-fcd1-47ed-b8d8-af593b726915", "comment": "Malware payload (AgentTesla)", "value": "bd5e36b0acb0537f788d102db2fe5659c429ac150f78d0c51c23a262d573e052", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676917098, "uuid": "53f27157-9ff4-48aa-a23a-f2f67df1d775", "comment": "Malware payload (AgentTesla)", "value": "8f0e7a3eeb9179e88eb62a25c43298d167a61303", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676917098, "uuid": "96915e00-6f8c-4a31-98fe-9d6f9d71e794", "comment": "Malware payload (AgentTesla)", "value": "f7e11b84915489ab32f928fe46ed9175e401d3df9bbd1b381d82d018d4792240333b77489117c483a6aa3545b5c96873", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676917098, "uuid": "430e8531-4a45-4b13-877d-2107bff8440f", "value": "T1C48423A4C8AA13053133DEBC567206869CD66F5807EBC655D2F352B88351C23FACF95E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676917098, "uuid": "04c85abd-6eef-479a-a35c-eb600374dfc2", "value": "6144:6St7pJMU19NSCoTBsWpUtgG79aDB5DnXsJRWU3lMsV6CpgAMuIV1GkqOq9c4Jo:btgU1nwzpGV79aLDn8HVMK6c7MuK1Gkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676917098, "uuid": "5a943cb7-6226-432d-901a-bac7f27f164f", "value": 380653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676917098, "uuid": "3e4564f7-59a0-4b0b-87e4-4f53bb83abef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676917098, "uuid": "24cc45fd-470d-4ed1-b0fb-7f5a7617ae9a", "value": "PRE ALERT NOTICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351e60fd-b148-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676915920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915920, "uuid": "49d0aa85-6525-40f1-be14-373f8f9ef1b3", "comment": "Malware payload (AgentTesla)", "value": "30e8193e2a0b52571c638d103a0af7eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915920, "uuid": "67afe3b9-303a-4ad2-a985-8de7642d58f4", "comment": "Malware payload (AgentTesla)", "value": "bd73a3691cc9bc9a8221fa1892e8df4387c59e58ae191261ce3534e03a9e16f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915920, "uuid": "3c91fce7-e9e9-4c3b-94e0-85b5a9c8882d", "comment": "Malware payload (AgentTesla)", "value": "56ab89f9c3f747e68b3cabdd5ec7ef47ac7fb9a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915920, "uuid": "6e8f7419-4002-4762-8be2-94a6dbb0666c", "comment": "Malware payload (AgentTesla)", "value": "1f47334998894aacc82e49464800697e1fe1c5a089932c0f364b6a0adaceb85711aafe6ded24a6ae383a35c381adbbce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676915920, "uuid": "b9bc31d7-8b78-42ee-b966-34af767bb4bd", "value": "T102842345A81A233CFCD2EB12A2DD5D3E4E92CC0AB850969FF34835FE3A645636707694", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676915920, "uuid": "2cc95788-bc67-48e4-8ba0-8f7c4d8a6ee3", "value": "6144:LKsHyYiaevZ3nFRQcp8EN+YEqtu5zlgdr/WEduLyf3vGc8pbJh0fegj2iEQazgHP:LKsSYihZ3n4cp8EN+j5z2jDD3X8pbJh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676915920, "uuid": "8cb6ecf6-fafc-40c9-883a-5e54f47628b3", "value": 382962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676915920, "uuid": "7fb18040-16d1-4f6e-b2d4-39ba684109f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676915920, "uuid": "61104eee-f7d3-4306-a1e5-c7f188e92481", "value": "receipt-23270100293.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b708c24-b156-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676922105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922105, "uuid": "d90cde80-628a-4802-b02a-085355da2d4d", "comment": "Malware payload", "value": "0a4e53589e4f4eb03ae79c2646135fef", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922105, "uuid": "41345d6a-8578-452c-8cad-519b0d4cd00a", "comment": "Malware payload", "value": "be0c0c406b0be4d8a70e00d3e12fd7e9f80a4a06a6cdde9e0786f444fc8b6f4b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922105, "uuid": "7f3bed9b-9508-4581-95be-3ca4377f8f04", "comment": "Malware payload", "value": "99a8e9c1cd89d8aa044b0475ce101a255a87c5fa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922105, "uuid": "d1f6f240-408a-4e89-89a2-390aa667892d", "comment": "Malware payload", "value": "7a8c0bb7b9d980befdbaae859d602869f51666de8f589e8dc83a9883b3104b513711125690e2a217d5f5427b801bec78", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922105, "uuid": "4a76d23a-ae0d-40e9-be91-a46d21427495", "value": "T17D62A0761E912C3CDA8B737DFA148205E7904586B54BB69B1C5AF2CD8DB0C788A239CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922105, "uuid": "0d4be476-ec81-4cc4-a482-5f3753098d5b", "value": "384:RNhlwEpueBVZqgexz6fvxLtrTqli2yJPoMi3s1:fhiKZqQLtiFyyMi30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676922105, "uuid": "ce382fb9-53da-4229-b08f-46abf00bc0a2", "value": 15926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676922105, "uuid": "870d6925-1224-4431-912d-36ae1aae8a62", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922105, "uuid": "ece74a62-396e-4756-a960-12ba468478f7", "value": "be0c0c406b0be4d8a70e00d3e12fd7e9f80a4a06a6cdde9e0786f444fc8b6f4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75380eb7-b0de-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676870501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676870501, "uuid": "1a7db4ca-8b4f-471d-bed5-511a06fd0353", "comment": "Malware payload (Mirai)", "value": "7a06ed80c78e481b973cd027143736c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676870501, "uuid": "f2f88118-165c-437a-8c04-bfa961193184", "comment": "Malware payload (Mirai)", "value": "be3184d27073dd711ef16c674e96718e09fd59096415baf42c48f90f4b5addfe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676870501, "uuid": "98e83993-97a4-4b52-9598-5b3cccb79e80", "comment": "Malware payload (Mirai)", "value": "78756a4949ac711cabde9689d905dcc2356dc2ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676870501, "uuid": "dcec02c1-2bcc-42ba-95ae-06be5b147624", "comment": "Malware payload (Mirai)", "value": "0ca3e755b25661654df98a5be45f31710cf73dbab8fc8483c7f48011d0ea0a658e5fab45c3b46557c8db025536319857", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676870501, "uuid": "509b4824-b48a-4f53-be7e-0493fd63d88a", "value": "T1E4D2F2B55A02CB84D6969E30CF64CAC4002FA7E4F5B0F8381FB350B4E2A912B75E5E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676870501, "uuid": "9ec5f162-47ec-4c64-948b-e1b535a1a424", "value": "768:qGNAY1bHfRb4Et8FiYgDDJ2jVfAcx12W2Hs3Uozw:qMAY1lRxYg/J2ZZxdzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676870501, "uuid": "c24df523-4a7e-46c0-9cde-0df5f80d01e7", "value": 30216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676870501, "uuid": "574ef1ca-4350-4a49-9b65-2112f61e9c7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676870501, "uuid": "299a59d9-1768-4b88-8cff-8a0ae1e84696", "value": "7a06ed80c78e481b973cd027143736c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf27724-b114-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676893891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893891, "uuid": "7fd0bc71-51d5-4a3a-a684-718c9dd21f32", "comment": "Malware payload (Formbook)", "value": "03099197d4fc8d2b63f3eaef8bdb7922", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893891, "uuid": "e1e77766-48c9-4820-bfd2-d8891cf122ee", "comment": "Malware payload (Formbook)", "value": "be82fad6a7978bb60d6b647db8e830578af39a2cb60155beb19a86806da13caf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893891, "uuid": "1366b5b4-7edc-4d0b-bff2-571cdc1e3770", "comment": "Malware payload (Formbook)", "value": "13adb1f78c815ebdeffe59953b6e1a3b80982c65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893891, "uuid": "4ecde8fb-acfd-413c-bf98-8f475f3f7328", "comment": "Malware payload (Formbook)", "value": "4045e44bd2933cec78b9c5bd1c15a55600bb251557e5b0e175f1b2e596b13264a78a11ec4f84ae9f7a306e147eec31f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893891, "uuid": "f5007c2e-d2f3-42ac-aed1-37dd10a67203", "value": "T125257C5977B4A073F89B01FA583827DD2E203D43B619E21FA777BB91A2719FB7284101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893891, "uuid": "1f53dfee-6d29-48b8-906d-e60b904f2c22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893891, "uuid": "38bfdb69-b84b-41e9-bdb9-8c083b5b5e48", "value": "24576:PxMGVaN2i6GNdDYz+EIN+DvHR/rSIbsvjRmWy7IL:/VaN3F3DYCEIg5tsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676893891, "uuid": "4909384b-b563-4273-8dd7-412ade8d73b7", "value": 1005056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676893891, "uuid": "722e7f7e-726b-484d-a54f-b1b33225932e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893891, "uuid": "e0142ef7-7d81-41b9-b7f9-2b43f373145c", "value": "PO20230128.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c26789-b13f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676912317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676912317, "uuid": "76aa01f5-2f1d-4008-8125-0e19105b0a8f", "comment": "Malware payload (AgentTesla)", "value": "ad57f8d327f2d70074c66ecdcd404ade", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676912317, "uuid": "94b2102e-2f14-49d4-8c1a-d2f7b9bf5903", "comment": "Malware payload (AgentTesla)", "value": "c02e5a48cfd7da4ff45176b3cdaf2a998dca371698add2447fc2c6fe5a484208", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676912317, "uuid": "609a5af3-140e-45e7-978e-db99e84b3e2e", "comment": "Malware payload (AgentTesla)", "value": "1f432b7fbeaa6b57e7c256d20e9a4f8ae136f589", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676912317, "uuid": "775857cc-af9e-4fed-97e6-965203bf76c5", "comment": "Malware payload (AgentTesla)", "value": "64bfd197cb1490ba9e62971aa9b904c6319171b3b0a79bf9a83a368c31261415a6cfbc6b138d8de2cfa49ab3e7cbe154", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676912317, "uuid": "3bb3c3ce-5a07-4a3d-a51b-65202adba4ce", "value": "T13A259D9977B4A073F48B01FE58382BCC2D3026577619E21FA777BB81A2719FB7294211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676912317, "uuid": "c0c1a2bf-46fc-4460-a947-95cb5a3b3445", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676912317, "uuid": "3c4f5e98-5067-4d11-bcc8-80e32eccb9f4", "value": "24576:82M8OoDeJ1+pKBANzRJk0HQrr3qoVmWy7IL:O31IKoz00HQv6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676912317, "uuid": "cc8a154d-b518-4805-a9ca-e8fea268cbc1", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676912317, "uuid": "63e7bbb6-0475-4cda-84a3-b867152eec1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676912317, "uuid": "81f93fa9-9f22-4ffb-b24d-c5195bf69444", "value": "ad57f8d327f2d70074c66ecdcd404ade", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdd9006-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676882679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882679, "uuid": "36830366-e88e-4227-b983-946759c06eb5", "comment": "Malware payload (Formbook)", "value": "bb317cc4ba129483716e11cd975bab82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882679, "uuid": "c936d04c-e758-49b1-a1e9-fcb08ff0b5c7", "comment": "Malware payload (Formbook)", "value": "c05150aeb82312c064d530c0570a19436d44bb0955142074a4787aa998677d6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882679, "uuid": "4d3ec129-4845-4c14-9803-ce3faadd9100", "comment": "Malware payload (Formbook)", "value": "630700d6641071c39cf25fcfc0c9acb19d274685", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882679, "uuid": "fd36ef3c-1ad7-4604-beff-ebbe3cd73850", "comment": "Malware payload (Formbook)", "value": "689cb9a2cb7b1937e3b6b21d5220de00d13ddd4b557516d1888f7e6f14643fb5a74af229a05e3b89aa2084e8f45557ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882679, "uuid": "dcd85afd-2f14-4401-8fef-b2f7f21794d2", "value": "T184049E32D642C031F2B201B5F6BD1B7B4C3E0E343255A0E6A3E216A55EE49A9F17931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882679, "uuid": "bc7202ba-4ed7-4a18-82d0-319624a864fa", "value": "3072:yqXONkOlwpno75f3esylwb6y1KNHsbv6Z/mZjiLBGm:Kjfe7G6y1KNfZ/KGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882679, "uuid": "1ac56873-2ade-4a4b-ae50-4b16e27f3288", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882679, "uuid": "bdfd8be0-d282-438d-b16d-3acaee2741d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882679, "uuid": "cff76200-6b18-4fc1-af02-bb58e020e1b8", "value": "c05150aeb82312c064d530c0570a19436d44bb0955142074a4787aa998677d6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2fad72-b100-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676885141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676885141, "uuid": "4eddbea5-3a69-499b-9077-0c0090d7e09f", "comment": "Malware payload (Formbook)", "value": "94f684ee271db8857019f25061aea30a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676885141, "uuid": "9966e9ed-1567-4a7b-8037-bdff5542583b", "comment": "Malware payload (Formbook)", "value": "c1cff34906a473251ce42fd92e5bb6ba3b3043292f3b6c7f6730746b9119ea29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676885141, "uuid": "237f6502-ec90-4291-b628-22328359845b", "comment": "Malware payload (Formbook)", "value": "5d527b3e0095f9309f8521e59698afb7b90d20c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676885141, "uuid": "a04dff5c-e48d-4c9c-adb2-116c27c2fe35", "comment": "Malware payload (Formbook)", "value": "c54b702e62862f2141998afc7573b46cd6960b57e0d74e72636c706315140ba6555c547eea4c1ec5c3bed2f770826f9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676885141, "uuid": "60eb2d92-d547-4645-a07d-aa32043db87c", "value": "T122D4F11B6C7D219FDEBC483D68482898E3F16B0215E0EA537CC852DC8AF67C61FE1665", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676885141, "uuid": "2e813822-ee07-4462-a419-4dd45abcb7d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676885141, "uuid": "b620b4e0-856c-4fc6-a4a6-3dc974eeab81", "value": "12288:YXkiA388/T9JmfA+J5iEshz22LZyIQ8599qDairg4:YXA3BWVQTp/9qD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676885141, "uuid": "3043f86b-1824-4e0f-ad84-8f62cfa81424", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676885141, "uuid": "885083a7-d68c-48a3-abf2-4fc852b24583", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676885141, "uuid": "4bf39980-ca05-4130-b58e-caef5af798a2", "value": "ohafaman.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8898b2ca-b0f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676879123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879123, "uuid": "3fc5a6a8-5df0-43f5-8d15-a7fb15844d34", "comment": "Malware payload (RedLineStealer)", "value": "5b9824b2d7d6c4333af4c55b1d50f695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879123, "uuid": "1f14069b-2460-4485-a418-7cdc9520bd54", "comment": "Malware payload (RedLineStealer)", "value": "c1f74a63a2a09105ea6edc097da6bda018a24eb223d9007d65d4ee6963dd6c14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879123, "uuid": "e7ff713b-58a8-422d-a2fd-b564b83bce8d", "comment": "Malware payload (RedLineStealer)", "value": "e6dd9b36aca1082d2d09980dd0fdd0ac110d586b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879123, "uuid": "13544b2e-b248-49e7-8c28-362db902a6ea", "comment": "Malware payload (RedLineStealer)", "value": "726e598c09668c24206f197b6a7dda32f9bafbc834ff8683ce07565f6e7e8ebf086a4e60158ef38190510ed2725da31c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879123, "uuid": "b690e946-a93d-4eea-ab80-4e6370837326", "value": "T16B14E053B5E0C072C66A4530E4719BA41E7DB832673D808F2B182BAE6E337D157B671B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879123, "uuid": "1e1fd757-0847-4288-9c50-ec8ac1669cd2", "value": "c33891a90cc721ae1c38ffdfc19c51ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879123, "uuid": "e7d83850-ca0e-4ac0-b17c-1e4509d11047", "value": "6144:5oiow/LclPzZ7SQkMxIR/8zcTfjakMclb:5oe/IlPE46R/8Ibj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676879123, "uuid": "213a929e-2f52-4720-808a-cd9ff19baed2", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676879123, "uuid": "c4c433db-e284-4d4b-888e-3577e0475e42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879123, "uuid": "7a8db896-4d81-4f3a-b8ef-2bef713f0fca", "value": "5b9824b2d7d6c4333af4c55b1d50f695.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a1a4df-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676882680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882680, "uuid": "f870d0f9-5ef9-4aee-9c84-ad36d2088f8a", "comment": "Malware payload (Loki)", "value": "750b020033dbd1e02dbb50fece70de1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882680, "uuid": "bdc2abaf-8252-4fa5-af0a-4c8e16497071", "comment": "Malware payload (Loki)", "value": "c2e87e031cf06cfbc066444c30dc76d1377857012a034143c7b039b292da73b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882680, "uuid": "337deade-f224-4102-94ab-6f7b0c1a237a", "comment": "Malware payload (Loki)", "value": "9492f9a7a887bfc415da9d48cef130c054c5c2eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882680, "uuid": "a0d5a1cd-995a-45f1-ac1c-68fb0ecaf280", "comment": "Malware payload (Loki)", "value": "06129d73fc9b1c2c9f04e7caae956320440556f9b9d99d1f62dfa68b5d1a147c3472eba31d26c4c921294cd0c8dcf460", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882680, "uuid": "3829a050-0ece-421b-84db-1f532caf2a73", "value": "T1B014E021B6E0E0B2C057A53DB871AFB52B7EB931D265C58B23982A2E1F343D15772317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882680, "uuid": "42d8bcb4-ee2f-4745-8e27-6d2088661629", "value": "c33891a90cc721ae1c38ffdfc19c51ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882680, "uuid": "738bd183-adfa-4d12-8da4-2e38a575cb0d", "value": "3072:VZUUzadnELL1fetP4UMsR+zBLrRWVzyRsXikZaMZ14pd02s0JtBS:V9adnELstPzSBXRQyR8ikZaMZ1OH/Jb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882680, "uuid": "3cd19691-fcfc-4b16-b228-3ab48a4872a4", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882680, "uuid": "76a3328d-68e7-42f1-b7eb-961df91ff17e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882680, "uuid": "a9ea2fc4-3135-41a0-9704-d55adbcd2aa6", "value": "c2e87e031cf06cfbc066444c30dc76d1377857012a034143c7b039b292da73b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f195c0f3-b129-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676902922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902922, "uuid": "5d4bd662-1af5-4500-8de9-0ac806e91366", "comment": "Malware payload (AgentTesla)", "value": "f8297318a6c9e8435b6dcfc9eccef61e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902922, "uuid": "225c91da-8feb-44e3-bd83-6167726d4c7e", "comment": "Malware payload (AgentTesla)", "value": "c2f4d0d80f4f4c2a292b542b5d1fb54fbae9d55fdfe65a59f9b321ab47cd186c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902922, "uuid": "867a27f2-49fe-47d8-ab25-4cc6a35061ca", "comment": "Malware payload (AgentTesla)", "value": "d7d21bfba71972c59fc06ccab229df490050892b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902922, "uuid": "12251159-f7b7-4724-b25d-1a9182d63f29", "comment": "Malware payload (AgentTesla)", "value": "9b19e97f0e12537fcc77c3033027dc37af93d684248068aca7a9f43b7f316245df7d72454b183432a455089a73f834a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902922, "uuid": "2117b539-a1ab-4ea6-834e-770da3ff090f", "value": "T105842297339CD53BE05643734B3EA1F2A9E9CB2011B8072717159F6DFD72A10C92AB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902922, "uuid": "873c94c4-9a87-4dcc-bd56-c9205a0bb123", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902922, "uuid": "08728eae-5930-446a-8a8b-f0120c81d85c", "value": "12288:/YdEQkP2bt6fbsW3Hnx5vyjBcSBAAS7J8P:/Yd9kObgoUnx0VBAAS72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676902922, "uuid": "7214f59b-497d-43a8-b5b0-f2f129a7992e", "value": 396297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676902922, "uuid": "b9a3d0b0-d2cc-46ee-b86d-e85332ae36a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902922, "uuid": "6b5f70aa-3db3-4507-83b0-50b3821a7222", "value": "Purchase Order #9983989102023 XLS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e42f2cb-b134-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676907345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676907345, "uuid": "3770f526-967f-4e87-833b-b93c36f582d5", "comment": "Malware payload (AgentTesla)", "value": "359bf2a347010c2d50b72c589f7fa131", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676907345, "uuid": "63ad8201-f599-4d60-9ac1-91318f1f8fa3", "comment": "Malware payload (AgentTesla)", "value": "c4861b525f6f5dec8ad1971b4e3d19c16aa626e95ef28ec66c6fe33ef3e1889b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676907345, "uuid": "bd2d32e1-29e7-479d-81a2-2e405e41d809", "comment": "Malware payload (AgentTesla)", "value": "21d6df92aaa9390d9f46940adc4d3bf4474aba88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676907345, "uuid": "204fc31f-86ae-42fc-984f-306d39b3b997", "comment": "Malware payload (AgentTesla)", "value": "1ecca7fcc3a7c20dd5c8b799df5e4849cce454e4776d85f78d25c4691165010f193f278874f7722497b69eec4fa1bb5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676907345, "uuid": "5cf3b01b-ed36-440e-b879-7adcbaf37726", "value": "T1BD15010B7D6D269FDE6C46781C066D94A3F0AE1119A0E9557CCEB2ED00F9B81CEF2660", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676907345, "uuid": "c39214a7-c320-46a1-87e4-2b84564fc818", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676907345, "uuid": "f31a2989-3e59-47a0-9fdf-f922e749aab2", "value": "12288:MkiA388/T9JmfA+J5iEshz2gGArwClB5RfGHJs6WtAihYFBW1uJK480gWlG2VGxr:MA3BWVQ3GALl31G6ztvhsgePJPVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676907345, "uuid": "6ca58dab-a32d-42cb-a877-9de09d38c6fa", "value": 922624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676907345, "uuid": "8df5583b-fd88-4a20-8ed0-b53e1b30dcac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676907345, "uuid": "10735577-a3b5-4dbb-a70b-d644e4669728", "value": "Orden de Compra 20_05_2023_OC-2726_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38ee518-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676882712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882712, "uuid": "c3ff10d7-2bbb-4175-b9c3-76cacce2e366", "comment": "Malware payload (AgentTesla)", "value": "718347e5fcc79710172b0e646680ec79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882712, "uuid": "00974125-3933-4c31-9165-fd3bec27fecc", "comment": "Malware payload (AgentTesla)", "value": "c53e1c640e8af61e02f119192a63bfebdbeccd5124be3f2a92bd9692ec413fbf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882712, "uuid": "4dbd61f7-43f2-45a1-8b9c-cb558ce47138", "comment": "Malware payload (AgentTesla)", "value": "7a81b45e6b287641db17103e656b1ef2314f4e96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882712, "uuid": "6bdbb41c-b76e-4d7d-8e8d-efe8c7fdf97e", "comment": "Malware payload (AgentTesla)", "value": "9e254b304424e2816a7e32168d95c00b9809c6a66d25d1c6456372d41a2759b6e48aaf9c69ce3efc8980971509acb3c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882712, "uuid": "06f4b939-7aca-402a-b3ed-ddb1d4bc7f1d", "value": "T116842337EB81FB11D2BA473585D3A2397ADD7ED9FFB631EE0989801328506CD0494B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882712, "uuid": "bb129a8e-c376-4cef-9653-204698a05309", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882712, "uuid": "3c478798-83be-49a1-b85c-49fa7c08fb87", "value": "6144:1NYTKbjQXSHHGHzVXtWQBHUXEhJGcumeYtPOlUK85NLN7ZtxbgXLZ6x9:kaQsH2Xt10XELRuPYtPSaRvvgX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882712, "uuid": "5092caa7-401f-4322-b36f-8b5369da4eb1", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882712, "uuid": "3f3ebd27-4426-4a20-af86-bf6d6cda0abe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882712, "uuid": "72c2137e-447e-4992-8f8d-c1fe640b6b0e", "value": "Product specifiction.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832d5936-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676908750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908750, "uuid": "98a06aef-d52f-48d6-bcac-998e082c3589", "comment": "Malware payload (SnakeKeylogger)", "value": "547399e2aa49c31aa4916d6ceea18e45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908750, "uuid": "f0534f3a-7d29-4609-9cd0-88705c3ad6e8", "comment": "Malware payload (SnakeKeylogger)", "value": "c5eda04141af34b126af81d6f13caea86feed0ceb4338c2d76a3411f3482127a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908750, "uuid": "7e52ef3f-01de-4e0d-964c-fe28723c51d9", "comment": "Malware payload (SnakeKeylogger)", "value": "b09c781e1266774e68894c302ae40a44652a6af6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908750, "uuid": "e83ce779-99c6-4ecd-b3a6-4b20d66414c1", "comment": "Malware payload (SnakeKeylogger)", "value": "423523e6f65f43cc1ad4719f316a9f7fb56ab23bcc2916e15bc4d813d780c9128e39913f2967446e686df54fa43e9124", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908750, "uuid": "fea74d8f-0f19-46ca-bb22-c15532681edf", "value": "T13944228473A4E4BFDCA323B14AB0952799E594163974AF0F57E08F0CB133242AE4F3A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908750, "uuid": "b824c731-5969-4a17-9db2-0db78078999e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908750, "uuid": "a963c175-1cb5-4e53-a8c1-f87924faadca", "value": "6144:PYa6k3PpRA2NNZuFa8fxBdpWaj6w5RiJQ+Z7V5HL5J3THYbUR:PYK/pi29z8tpQw5RiJQ0VV55TzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908750, "uuid": "8a7e9909-1fc8-49e3-92dd-98aad93b615a", "value": 277782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908750, "uuid": "08b74e1c-c5a6-4414-ba89-b96edb643273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908750, "uuid": "7c6e4429-b1ef-48a0-97c2-ac7b3146a60f", "value": "COPY PO.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72eb0c29-b123-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1676900132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676900132, "uuid": "72e9f53d-0f10-49a1-ab2b-09dd1ad1b58a", "comment": "Malware payload (Rhadamanthys)", "value": "e2d43c2752ac2abb5899b44b5d371f9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676900132, "uuid": "f0e2afc7-c7a8-4d7e-993f-6c0815c1ceeb", "comment": "Malware payload (Rhadamanthys)", "value": "c666a65709b040157a175afb6caa5bd8e726849944562aa95ee941550167eaca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676900132, "uuid": "b5987824-6608-4fe9-b5cc-7d82618b4643", "comment": "Malware payload (Rhadamanthys)", "value": "242e8ed1673ad493fb21cc98d6411d4d6be2a30b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676900132, "uuid": "b4a0d58a-c29f-4627-869c-080be22517b0", "comment": "Malware payload (Rhadamanthys)", "value": "6cc11940c2fbe2d70eca6851be0cb04e7ea8bc444eec6088b99e0e3ba0b2c966e07ed8a55a368a48382ccfa691b4a6e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676900132, "uuid": "cbbdddf3-730e-41a6-9758-0ab5c7c6a3ca", "value": "T17314D021B9E0C0B2C11A45745862DBE0DEBFFD21277189AB27941B6F1E30FD14BB935A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676900132, "uuid": "6b3423eb-aa4e-451d-a272-a49f1b3019e5", "value": "1dc9c32af2b0d0927717a78648d34c5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676900132, "uuid": "43572ee3-5d6b-4b9b-b7e3-4aae26e0bbfc", "value": "3072:76gq8v6nPcL8N/1mPQfHUppnQWFQ0QdiwRTmj+H1bKieSc5ZVveDSbA0pvdN+9Ar:Ki6nPcLamnpdxu0s3iCZY5PVbxNDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676900132, "uuid": "e6ac0432-68f0-42c6-8c65-7bfb46bc7df3", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676900132, "uuid": "584ad9b5-bb65-4b70-9212-687f7bc61da4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676900132, "uuid": "a2029051-d1e9-4b97-9c47-8a44b89fd90f", "value": "e2d43c2752ac2abb5899b44b5d371f9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47411573-b128-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676902207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902207, "uuid": "1091013b-838b-4a73-8a09-a8a2f6cdd5b5", "comment": "Malware payload (AgentTesla)", "value": "3de0cc84f5b156c9530fd072f6befe49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902207, "uuid": "ed69bfaf-b636-4126-aa65-68163ec8e2dd", "comment": "Malware payload (AgentTesla)", "value": "c6a88fa7c96472e543ffb6fe52a0a56ebea150a8e60f1779d1241cd7a26f02e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902207, "uuid": "edef7e57-c0e4-4f8a-a85e-fada0d0eb1b9", "comment": "Malware payload (AgentTesla)", "value": "a0481defcf37800183805ba34621426c2f6354db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676902207, "uuid": "afffb3b4-4ad4-496b-b1dd-17f48c603b22", "comment": "Malware payload (AgentTesla)", "value": "48929ed138c8fc46d8c9260ec4132be2344779905a980b9dbbad0cf3d76d5700208ecbb08dbd0c0cc747cd25b81d8951", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902207, "uuid": "e447002a-afb7-4a11-97c7-92048fd185a7", "value": "T1C484236496E48217F433CFB40A320642DEE6AE1503F9C64B03B16BD97B62D13EA4F706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902207, "uuid": "4a21d22c-efe7-4448-9cff-857c6642aae7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902207, "uuid": "c81d73c8-8515-4e34-9404-246b2857fe91", "value": "12288:/Y1sokG1hwdpGVP9aZDRKNnmKUc7EuOzGMtH5:/Y1sLGB1aVRwmjzntZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676902207, "uuid": "cedfd360-e7fa-4d5e-9504-7a96598271e5", "value": 395392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676902207, "uuid": "c124fb92-dae3-49a7-916b-f5251ec41de2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676902207, "uuid": "5f23d8a0-c977-48bc-be6f-069f6885410f", "value": "SOA#NEW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde8c8e5-b0cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1676862892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862892, "uuid": "8fbb8fd6-d747-47aa-8d52-3bd484233a33", "comment": "Malware payload (CoinMiner)", "value": "75688cd0fc79df64e111de9c3fac97b3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862892, "uuid": "72f9ce9a-a7f2-44dd-bd32-5ec9a9087836", "comment": "Malware payload (CoinMiner)", "value": "c6aff8ff25c3c38e86a4857f306e19a6b7ad1810fd378acdbe4946acebba5de2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862892, "uuid": "d76eaf56-b191-435c-a9ef-3f561bc470be", "comment": "Malware payload (CoinMiner)", "value": "448930127870cb6256103035d9685a6cf16b0da6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862892, "uuid": "b8caa17f-2c00-49ab-8432-01a66716dd12", "comment": "Malware payload (CoinMiner)", "value": "a1ca1e0fc60cb9570a943350ae681bc70c66a86f39e0afdeeabfb72c386b74b18e3616b2c7f871897c02413e255f4fef", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862892, "uuid": "b951b4aa-850d-4ac1-8938-1a780639cd05", "value": "T1D5D304DF288163C0C596AE5672374BAC0B7E6671E08070BDA32DD9F6BC8339187C57A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862892, "uuid": "3afc8bc4-ba70-4603-8352-706cfacee3f8", "value": "1536:x0MBDXd79WoKoklMzekkYpq2nEkxL/gbHkrMZtLb3UYuP2h0o3IaCQrz4datP8Wr:97U7ZPCmlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676862892, "uuid": "7d8d4206-34d6-405a-bb4f-f54067103192", "value": 139594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676862892, "uuid": "4b84101e-30b2-4887-9eaa-45dd16db6fac", "value": "text/x-asm", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862892, "uuid": "d2674da8-9987-4f82-be9a-c0706a43524d", "value": "curriculum_vitae-copie.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15c36e7-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676882681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882681, "uuid": "9bc209da-cf02-4a70-878b-1de13cdbec73", "comment": "Malware payload (Formbook)", "value": "35dd8c929b34a48cdab34c3522120425", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882681, "uuid": "3a5415db-67da-4777-9cdd-1c72fb7aea02", "comment": "Malware payload (Formbook)", "value": "c6b45b5143c6a8aefe0c044db55553615eae339eeb70280146235369ebd4f49b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882681, "uuid": "cb5e8017-a94f-4406-a94d-9ceec0701d58", "comment": "Malware payload (Formbook)", "value": "6b4ff5f44a068d83a1faf89351d068eb0d76ae99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882681, "uuid": "7cc5bb2d-af5e-42c0-9ad3-3fca040078f1", "comment": "Malware payload (Formbook)", "value": "4785c5ceab4f7790d43ba9b381cb71416a3a833c2e55672ee92ef8aadfc7bda14ff71306b0739ffedb42a89cfb76e3a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882681, "uuid": "2a06b397-5973-4f48-93be-e6dfd3f21afd", "value": "T10C04AE36DA02C071E2B251B4F6B90B7B4C3E0E343295A0E5E3E615E06EA49E5F53931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882681, "uuid": "e4f78cb8-bcc1-45cf-827b-8b336fafb01d", "value": "3072:u2TYPU26FOQJ9sjqFeTiqGaXI9BOaaqfm7hxkga++wimuBtzV:SH63siUlGaXI9jaquh3a+Ymw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882681, "uuid": "7da3358b-0185-4f2c-a187-e28fbbe1e3b9", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882681, "uuid": "19ec7bf3-3264-4873-823a-f75bfa736820", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882681, "uuid": "686bb095-c37b-4efd-b6e4-77126209687a", "value": "c6b45b5143c6a8aefe0c044db55553615eae339eeb70280146235369ebd4f49b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55c207e-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676908914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908914, "uuid": "71f759ae-a212-4dde-a889-2ac23a591260", "comment": "Malware payload (SnakeKeylogger)", "value": "237ca100a1e2d96c21a1933d4d994a0b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908914, "uuid": "839999da-5f69-46f4-a857-437c32b6902d", "comment": "Malware payload (SnakeKeylogger)", "value": "c75afefe9049792dfa51101e6e1a13179a6d38434835f3554b1e1dd63e88ebf1", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908914, "uuid": "01e8b9da-ebbd-4b7a-9453-91370d8311a6", "comment": "Malware payload (SnakeKeylogger)", "value": "0c6d8bf568eb39b759382bfa8e12987d188fbb18", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908914, "uuid": "80bdf033-d008-4f48-ab39-38d56f928bba", "comment": "Malware payload (SnakeKeylogger)", "value": "4b8011577d6c51357c1f7cc4ec1b628c2a13611cd85bf4311e195ac2037b51e22251ff7fd20c67eff2b64f19efde3f42", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908914, "uuid": "52f91dfc-3559-45ea-8eee-037d12461701", "value": "T16713065AE79F02688F410277671B0E85AABDB73EB35144B1385C933433ED83E46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908914, "uuid": "647f487b-3317-4cbe-907b-9674fe00c04a", "value": "768:sTFx0XaIsnPRIa4fwJMiLKMNOa+YQN4Sc9jsVMkZ4kkW3h3OlZnTlR8:sTf0Xvx3EMfMNOa+F4N4VMkGax3OrpR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908914, "uuid": "a145d52e-2bc7-49fc-af35-ef9c5f1365fd", "value": 41532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908914, "uuid": "d84ea3e6-b61c-46d4-b12d-7fb8601e97e3", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908914, "uuid": "a41451e0-b965-422f-8258-b5599dea579f", "value": "2023DHL.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc66cb03-b13f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676912308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676912308, "uuid": "3a5b9894-1e77-458f-9295-36f0e1116a0c", "comment": "Malware payload (AgentTesla)", "value": "c948dab97df226045e7c8671f4425b59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676912308, "uuid": "03769d56-b5bf-41c7-85a7-cb466bd8dc22", "comment": "Malware payload (AgentTesla)", "value": "c76040096507663998ffccafca9a00a19258e24d56513e7fe5817f786592ae51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676912308, "uuid": "b7efe6ea-9ee5-4f49-8c31-0885bb13fe2c", "comment": "Malware payload (AgentTesla)", "value": "631b101d8ca17948865e85bac322abbd59006433", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676912308, "uuid": "f39875ee-e812-4087-a2a0-233058b00616", "comment": "Malware payload (AgentTesla)", "value": "faab4106f183a8a9c1346f591f3e86189a6e922c20a04af1e91a915703adf57c24268afd067879a766954ff908cbf323", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676912308, "uuid": "d4d4f951-75c0-42f6-a990-e9d89a492d1b", "value": "T113F1D600F7DC4A76DDE20B36EDF742908F74E76048668B7FA8C46217AC0529927637B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676912308, "uuid": "7592acb0-1a01-4908-bf2c-7536cf1afc1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676912308, "uuid": "248a50bc-e34a-41da-bfda-eead9e9e576e", "value": "96:DLOC6lh+7L44+w2JdA4DUg5EXZ0ysHT2ncLGkWb28cAKcO9LzNt:DLOnlhk4/DDUgy5sxLrWb28cAs9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676912308, "uuid": "172dd8d3-ae92-47cf-b39a-adcedf9486e3", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676912308, "uuid": "18f4996f-148a-4379-a071-9b376cd2f3ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676912308, "uuid": "6256232e-4138-4fb7-9abf-a1ed81af556d", "value": "c948dab97df226045e7c8671f4425b59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a20d5df-b0eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676876119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876119, "uuid": "a1d6027b-ba0e-4da9-836c-2e7c168d8d24", "comment": "Malware payload (NanoCore)", "value": "31d1eb730526ee39a0beb9505c21c9f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876119, "uuid": "b9c6d7a6-6786-4595-88ba-a60efecc7d98", "comment": "Malware payload (NanoCore)", "value": "c8ac049426f13a35a327a2a0de7d95c3bc0eb2bf4b2f522f308003b5a670b0f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876119, "uuid": "5b4caee6-f84b-42ec-8edb-0913e7a6e22d", "comment": "Malware payload (NanoCore)", "value": "1dc521936d9897475eff6e4c96f39d4263fb7945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876119, "uuid": "6740de4a-fc07-4cc2-a1e6-bb88cdb68a52", "comment": "Malware payload (NanoCore)", "value": "cb5a4d8a58fb15a379320fa1f03eb5223942e9ab1f8811bc191b791b5935c3c1155e7846de465a46a07a1eb6cd38c63f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876119, "uuid": "ca2afe27-f766-4b66-ab11-c7ca6d8c7fb6", "value": "T13A757AB20253FE4DF26F0DBAE6482271CCA56DD71701C158BEA82AFAE2F5124BD05774", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876119, "uuid": "be57f6a5-9090-424c-bded-f270106c5d4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876119, "uuid": "84d7509c-c391-44d5-8685-545278070d53", "value": "24576:nBLlRQi+XBmc1ADOktGMcTwD6lfkFClbGUXf3poI0iV8Bt+g9STCpvotfwMZNL3s:KZL3Y4Ybc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676876119, "uuid": "3945aebf-a435-4bff-9baa-9eb5375cb859", "value": 1582080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676876119, "uuid": "1ba162de-7169-4496-b46f-bb603b665a99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876119, "uuid": "50013323-f01c-4a9e-98ec-63f2dd9d7e21", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc16be0-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676908932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908932, "uuid": "15350fbc-e213-45b6-bd1c-e0b865e2c148", "comment": "Malware payload (AgentTesla)", "value": "f7f648ed2c87ef9bfcd3eacc6cb34965", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908932, "uuid": "eed53826-73a6-4308-a452-37256446f622", "comment": "Malware payload (AgentTesla)", "value": "c996e20b5362793c89378f9bd70917b83efb359810885e33b3e3c42092364c11", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908932, "uuid": "267840d3-4039-493d-9a0d-68e1221c4fd1", "comment": "Malware payload (AgentTesla)", "value": "56edbad9a0d6f309577344844934899f454b2988", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908932, "uuid": "82746e21-1643-493e-b118-f3c78c1e05df", "comment": "Malware payload (AgentTesla)", "value": "c12400cee77e81a209ef5fb10968dfdd219da97ebc88cd2848da72382b624f99aa12e37c867a78d244f93d5fee6826db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908932, "uuid": "d9acfd2c-52dd-46b7-8b1e-408f44976723", "value": "T140F3EE55E7B0BC2BF5540778AAB282931993BD33A915D95626C3730F4B73FA06C32E02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908932, "uuid": "4319a3e2-7b35-4592-9a2d-5520617fec1b", "value": "3072:hkZ+RwPONXoRjDhIcp0fDlaGGx+cL26nA8N2w:WZ+RwPONXoRjDhIcp0fDlavx+W26nA80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908932, "uuid": "882c8029-fef5-4261-9caa-b99ee365702a", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908932, "uuid": "d791bc25-40fc-4d07-a357-e34b316b0272", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908932, "uuid": "3a9f17af-264c-434b-9cf3-085c9b905c6d", "value": "bal_INV_2360510_50AE23500166.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d10e61d-b100-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676885144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676885144, "uuid": "4b8061c8-6458-46ac-b15e-40f597c09ddd", "comment": "Malware payload (RedLineStealer)", "value": "442c5c3905b23d0fdef86a3b023601d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676885144, "uuid": "494b685b-d97a-4970-b1c3-b5496647ff5c", "comment": "Malware payload (RedLineStealer)", "value": "c99d9cafabea6c31f4f0c33f52d27620b3e0026ee2833c87d4e6858b78fad8c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676885144, "uuid": "d7e011ce-21ea-4a34-a487-4167e13e5bbd", "comment": "Malware payload (RedLineStealer)", "value": "b6dd2c18a41163cd62ef127056413a37bf217788", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676885144, "uuid": "5c77a8f7-fab6-4ac1-82c8-1a36aa6d18c0", "comment": "Malware payload (RedLineStealer)", "value": "6106641cecfdd34a1e991e7f41078e5e66ce130c4e94d2bb3930cf5dff15f1a8dfd88e0fe6f30b714b3b3a7f694a63e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676885144, "uuid": "96e0ffee-dc19-46c3-b676-fc44a8ecb5ce", "value": "T12705014673E00326E86D67FC1BF5F1371261BDF35A37460B2A743AC4B952E80A9B1A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676885144, "uuid": "2b04f283-3763-461b-ba13-474b37cc6ca2", "value": "bc70c4fa605f17c85050b7c7b6d42e44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676885144, "uuid": "3bb628b0-471c-432b-ad72-83e6ae3660b2", "value": "12288:eQQe6M+0L108cqNNUXSQVADpzE/nf8csiMGw/CBUOQSGbIJ0eTGFQE4Iv7:eQj6mpNcm0ADpo/nf8m2K6V3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676885144, "uuid": "9771477f-d41a-45db-9206-3702bf7018d7", "value": 856576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676885144, "uuid": "195ab505-1780-4060-a6a0-6db075df377e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676885144, "uuid": "2e0f3803-b2b6-4321-9645-7eae8b73dfff", "value": "c99d9cafabea6c31f4f0c33f52d27620b3e0026ee2833.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e139461-b147-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676915506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915506, "uuid": "fdbd6803-8de0-436e-a5f3-3914c47cbe64", "comment": "Malware payload", "value": "ef156ef5c49b5271d1cfe398e0bbd91c", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915506, "uuid": "dc6e5f2a-797c-4963-942a-134c7f39c06c", "comment": "Malware payload", "value": "cab7e3e82694d8fd329e72da304a14ff6defcbc4d1eeb0b36a83592979d6d27d", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915506, "uuid": "135b978f-ca03-43c0-b19e-d7757f9069c9", "comment": "Malware payload", "value": "6386524f079ccd529051184ec0354c1185a50eb6", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915506, "uuid": "3f5e99b8-79cf-4948-b2ea-e7235d3fe73a", "comment": "Malware payload", "value": "004d73b2796a50d17b6887cac15bb364d1c18a020fd8fd9b02ffe071e8b7732978db04074ef440c1553cdcf558ad62fa", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676915506, "uuid": "7d00d7ae-558d-4cff-8e48-ea57d259d791", "value": "T186D423BD08437C7A5CE643CC144DCA6350B77A1B7BAB09924B174BD12C395ECAE6EC62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676915506, "uuid": "271c6321-77d6-4e78-89fd-cf1257b1310d", "value": "12288:mrowdUWujYO09StfA2lth1lDcW98HTXae7FfmKh2Pxk0zGAvFxH1dLs1R5:m0BWujh0UN7flD3mzZmKhmL7H1dLst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676915506, "uuid": "1114cee8-ec89-40af-80da-6604b551b1c3", "value": 637584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676915506, "uuid": "5e248f86-4769-4e58-8995-2ab4eb80f776", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676915506, "uuid": "2a283d13-0f84-42fe-9386-c1ebec0cb6ba", "value": "Hsbc Advice_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ad0f3e-b131-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676906148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676906148, "uuid": "75365d8d-9995-43d0-861a-fcacf8e2e331", "comment": "Malware payload (NanoCore)", "value": "42ee1ad3b4600a955888780e8899c1ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676906148, "uuid": "8dd9a28c-5ffc-41aa-ac49-57309b408123", "comment": "Malware payload (NanoCore)", "value": "caf073b1d85bc136488382be2c83c264ac64d2df279752341b1c4601c6201a41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676906148, "uuid": "ea5930de-6725-4f53-8015-0b2ced450fc9", "comment": "Malware payload (NanoCore)", "value": "4ba8b368c32fa57703613e0c98d90381b872d5ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676906148, "uuid": "d3434516-2ac6-4da8-948f-0b203b862fd9", "comment": "Malware payload (NanoCore)", "value": "ed320b7b26d8c773678f10b058cfad426ea458a9eb044866a6c9349c263b2ac3482debc67b139ff4fb58709b84691b57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676906148, "uuid": "659970be-94be-423e-835e-6e9315c14928", "value": "T12ED422074AB14887F1A61A341FFB8676F8FA5C11742C239B9BB27F093900AC1E59EF55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676906148, "uuid": "39657495-7a87-4916-8e54-343fc7d47eb9", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676906148, "uuid": "7bdb732d-f024-4656-a06b-83e6a0c45aec", "value": "12288:L5Z+mqofs6TaXML3crUlbIInrHR2Fwn6DijBtpl2i6F+0cfjoop:tUJN9MwrfInrHvnY7ipzoop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676906148, "uuid": "bb7be0f9-922b-498b-9f71-58790ba93a2f", "value": 597440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676906148, "uuid": "c2212eab-575d-456e-9c8a-6f3227dade68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676906148, "uuid": "518b9b4e-dd07-4d22-b694-f29ff93215bd", "value": "chrome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ba658b-b160-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1676926544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676926544, "uuid": "8d71bfdc-d747-4331-921e-598c4a4bc2ca", "comment": "Malware payload (RecordBreaker)", "value": "50c9d1123fbcbec919b6e5c703c350cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676926544, "uuid": "baee6454-9a61-482f-864d-6f86ace9cd8f", "comment": "Malware payload (RecordBreaker)", "value": "cd7f075fc5ca8ef703f71de1d9f195e01e9a3433668f0a54898b4d88ea85587b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676926544, "uuid": "0bde0bf8-4d06-4600-89b5-4c4e11d41cc3", "comment": "Malware payload (RecordBreaker)", "value": "6f985ae67ac49691e9d710c3d6857d8fb8d5e846", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676926544, "uuid": "70c8f6ea-e9b1-419c-b5a5-2a2e7ae062d3", "comment": "Malware payload (RecordBreaker)", "value": "99122032596ee1734092b1da60a1a747a264de940de9971edf965a2b889f54d7cf6cfb8d6dc6711c1af655009ff9ad0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676926544, "uuid": "f8e8368f-fb13-4571-85cd-386c2d140c5c", "value": "T1886623A396B42919E0D6CC3A4963FDF732B9033B6E80EC7A66CD25E13C554907F27582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676926544, "uuid": "2a89f20b-c358-4470-9a7f-06924428b27e", "value": "161839a78ef6f07a30d3f07895f6fe23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676926544, "uuid": "1974adf0-9351-4b7b-b55d-81ae2570da48", "value": "98304:QuOCe2GxkNJAULgF2qFZaR+UkojUNRhTV8w/9hZ+cqJ17Zo4DeibfGDu:QuJf7VYNnV4cqZmib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676926544, "uuid": "9f095239-0df3-403b-8eba-1894588fb79f", "value": 6626304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676926544, "uuid": "9bae9d97-307f-444c-913d-5806736ba079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676926544, "uuid": "6adce49b-f38f-4964-9866-4011e6330c24", "value": "50c9d1123fbcbec919b6e5c703c350cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6548f40-b114-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676893857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893857, "uuid": "74dcd077-13f2-4edf-82a1-6dde74173c7f", "comment": "Malware payload (GuLoader)", "value": "c443fbd9364a7bdbaee51292611292b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893857, "uuid": "d3c8dad3-1ead-41c4-8740-7d5ba8e50d0b", "comment": "Malware payload (GuLoader)", "value": "ce658c5606f7dbd1d4f7b45ffb7ced6524c78ec564597781e8b80d6f3e28d3b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893857, "uuid": "becfc9b6-657c-482e-b743-c51de08774c6", "comment": "Malware payload (GuLoader)", "value": "83cee953a53f8b1f3cb01fe00d64a6d4a3adcdfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893857, "uuid": "7d5f10fe-83b8-4b52-9526-ba314f42f398", "comment": "Malware payload (GuLoader)", "value": "8b073d82c7d367ea0b7d5904e5dfbb1c6b4c1074bc219152db29a9aab1055469311b770db07bb6dcd2105e8986b1d03a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893857, "uuid": "ce1ef403-6042-4706-8dd2-e3e2d68ec775", "value": "T1E2C401D53790C93FCAC399719662F61F0BBD6E342A204613A7A53A0D3E3E9C18D4B725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893857, "uuid": "b86168d1-9e69-4925-8f14-ff445e0bbc37", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893857, "uuid": "a7010eb4-01c5-4df1-b654-4fe27a98bd27", "value": "12288:K7YaMPI+XCGQUoVuXdPp7r9hMOcLyksq3V+4iKxHI:1myrNxVOyk1Y41NI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676893857, "uuid": "7bbd1856-975d-4962-80ec-9073fa53990d", "value": 566266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676893857, "uuid": "d4b7cf86-0c3a-41fc-8a7a-72d2405b67f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893857, "uuid": "c2ce96d9-0669-40f5-bec7-341b3d057e21", "value": "09854567887654334567898765434.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29e7535-b145-11ed-88f6-42010a9c006e", "comment": "Malware payload (a310Logger)", "timestamp": 1676914949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914949, "uuid": "07810804-cd69-48c4-9b00-42283b9b9565", "comment": "Malware payload (a310Logger)", "value": "1b1cae0b7e396659ccbd2cb956047258", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914949, "uuid": "17cc1f36-4b02-4be5-a213-f8e95ea642a5", "comment": "Malware payload (a310Logger)", "value": "ce77e7f5813c623caecb1ee1c013c54c986af73af7d1cff041f666860ff18163", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914949, "uuid": "0070cbeb-39ba-4b32-82dd-dc674c6b30c5", "comment": "Malware payload (a310Logger)", "value": "baebf73afaa50d8d710ebe14651b09f244fb74aa", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914949, "uuid": "1a97864e-09c8-4127-8c2a-4087dbd2e144", "comment": "Malware payload (a310Logger)", "value": "9311c8e488979656ba33d8ae65f0bb5fa225d9747bcf3661532241425432acd78a834a40398045d5ce31c1beeea9144d", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914949, "uuid": "337be0fe-186b-4fc4-ab81-07d9d436d9bc", "value": "T1F1C4237212BDE40432F8A54DA4072FF6C7A9AE7E7F8348D5755BF836A61E08B0340667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914949, "uuid": "5e0d3386-b47e-42d5-bcf7-53f699cc9960", "value": "12288:ff811lAM+bgosEjdgaRoU9XuzxlesW4fKvOP/2XJi29Lqv:8flD+1J5oLOeimH+J79LQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676914949, "uuid": "b0463875-cf84-4ab8-98c1-64e0b34ca550", "value": 596343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676914949, "uuid": "52006cdd-1efa-49ee-adf4-0c35a3bb1b13", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914949, "uuid": "b0c35fa2-a585-4823-a10d-655b6dfc1913", "value": "PO7313 2023-02.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41a935c-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676908912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908912, "uuid": "46b77cb7-8700-4ed8-8863-d969a93178a4", "comment": "Malware payload", "value": "c501e480794ac64dbc3324ea5ef2c6f4", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908912, "uuid": "12062cb0-77d3-4a48-904a-f350a84f8b1a", "comment": "Malware payload", "value": "d009d1247fc57b0da2da76fb93bb359b2d8e764218c96d47356c2329327eaa3e", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908912, "uuid": "3b7259bc-0d28-453f-86ae-5b701055e0f4", "comment": "Malware payload", "value": "4686c91c70f0a3dd7c7b2218ce45069a1c95a7d2", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908912, "uuid": "89e3d063-dd2b-4d0d-aa0e-695887a41eee", "comment": "Malware payload", "value": "5d554384ea3887e6e97ec2f4432cd8438e32ba4ac606503c64e8cb56278053673a462c5b1c040943d566c751103b45ca", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908912, "uuid": "042c54ca-69c2-419d-a6a4-65f68e539b01", "value": "T13CD35818E7518477F2064135BA82869722247C7BB942CD0B26D73B1F6B37FB29E32E15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908912, "uuid": "cf96bc0b-f294-46d9-b9ee-683aeab9f452", "value": "1536:aCkNWZ3c3agHWltOc0tF9a4+w5sTDzP+U99+jE37NiSLO390xc1klt1uvbCim:sN2eAr03T5qn99ZLvK1st1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908912, "uuid": "374682d4-7f99-43e5-8179-d68e04ba38d1", "value": 138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908912, "uuid": "abb6b729-2578-4a2d-b20a-d2ee31373c1c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908912, "uuid": "11899844-be86-490b-9c35-3cbbf403d27e", "value": "PO 2110035615 2110035616 - EXP DOCs.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ee4596-b12c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676904083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904083, "uuid": "42a23389-fcdd-44cf-9355-5a9744ce88c9", "comment": "Malware payload (AgentTesla)", "value": "b715badbf2a1145f1019289fbc2a67a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904083, "uuid": "2a6a2be1-aa96-4c82-ae48-dc254bbe0518", "comment": "Malware payload (AgentTesla)", "value": "d0d4a98b292813a7ee9154f2063a1a0592373ef777f9db5dc05575f5b6a0a609", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904083, "uuid": "d874903e-50e4-4afe-8365-a6681597eb05", "comment": "Malware payload (AgentTesla)", "value": "a05e07901b21729cc14d34aa58581a9ffdf3f2ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904083, "uuid": "1c3c5536-7ad5-4119-9bc7-e0697a2042fc", "comment": "Malware payload (AgentTesla)", "value": "05a0a8161076ccdd81aca51fe31bd4e8fc0c7908a0bb2020ff338a0db91f93a38e2687f4a4bca840636708b4552a490c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904083, "uuid": "0837f279-b691-4abe-8b6d-239082f257b0", "value": "T1845423229FA9DC394546600ACD0F34724C8C2B11B5DC5BAB3253D298B5DBC18ABDC7EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904083, "uuid": "d39ee486-06f8-4e6c-a50e-adaa91afaf02", "value": "6144:12CBOu94JIqCYyZolD346WwdSg4dFW6R9ARbSPoS:UCB3yQsDRWuSgCFt9AdUoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676904083, "uuid": "41940638-c2d0-42a9-a210-6979399b404a", "value": 304525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676904083, "uuid": "c9c1b164-8628-4446-9130-081e0f168c3e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904083, "uuid": "c7e32f54-941a-416c-9620-4d3c89eaaf4b", "value": "H-GB3001051.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6303ce-b114-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676893899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893899, "uuid": "4339edf9-d927-4c97-8311-3842d09cb381", "comment": "Malware payload (GuLoader)", "value": "8eaf2f386c1131c72124e51f3864d866", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893899, "uuid": "3191005e-c6f1-4d01-80b8-68456aaaa327", "comment": "Malware payload (GuLoader)", "value": "d1cad30e727d5381e7c6eb5a62b8113885535ecd3d9e83dab148fca436c1361c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893899, "uuid": "f10b19d8-6c3c-4f43-8ff2-37e88b7e6b42", "comment": "Malware payload (GuLoader)", "value": "6953d36d76ef38dd0eb8797015d17654d83613e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893899, "uuid": "fcef5f43-fdbf-402e-9a9c-07d3f6414a38", "comment": "Malware payload (GuLoader)", "value": "2c58a16c8ee152c30f699cf0be1ecd7c179ad7227f7bd60540d9ee07ebdba3c5333fdaa7cf53d4f928f99c516dc623e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893899, "uuid": "5a260063-d787-49b0-ae8f-f928ed93fedd", "value": "T10CC412917794C93FCAC25A31A6A2F61B8E7D2E743420AA13679C3F0E7E3D4C1994D711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893899, "uuid": "5211e734-089f-4fd6-b51b-5e08e5370c48", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893899, "uuid": "73d8f2fd-4e3b-4028-b7ed-56801eefdae5", "value": "6144:qQ606x4fu7YaMkcZX4lBZ6ogLXCGhx1D7KqSKtgokQ1RxLvMknxpZxoExJ8Xk2qV:K7YaMPI+XCGx/j5gokA1NyExJ3xHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676893899, "uuid": "8505288c-9c05-4a2c-95fb-469ad4345f35", "value": 553853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676893899, "uuid": "7de540c2-a045-4020-98f9-fafecd19839b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893899, "uuid": "b58af570-33a8-424f-9cdd-0af8e7a64427", "value": "SUPERA\u2019T SANT ROC RACE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af66e8f9-b112-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676892932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892932, "uuid": "e2e3e980-7c23-4fdc-91f7-ff6b351060dd", "comment": "Malware payload (Mirai)", "value": "c540e3db873a69e65094ddf35591303d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892932, "uuid": "1ced5d5d-a428-471b-b866-7d61281957cd", "comment": "Malware payload (Mirai)", "value": "d1d8e226a0f48725899632cba78fc115b6aece1abfe554c4975a23d81ebc7be9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892932, "uuid": "dd810326-b431-4db3-ba28-db797ed57ee2", "comment": "Malware payload (Mirai)", "value": "26cf97b9a27ba7cfd3c19e006abae3b5306e7e0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892932, "uuid": "10dbaa11-841a-4e5c-ae17-6e23082debf5", "comment": "Malware payload (Mirai)", "value": "8728b8540783f18cadb64cad92c84d70fb42e1e3d25edc377136a4970e7048bfc238e9f082a50bddbc2617a4b8f8d5a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892932, "uuid": "d8b7e228-818f-4fe6-b960-1883b997c5e7", "value": "T10E837BA7E13A4C94C5041AFA747194F04F87D177E27B0EB2BE418519644BE8C7B32BEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892932, "uuid": "d9f0b279-fef7-4b03-92bb-7480b88d8fbd", "value": "1536:wagwtQuswdhZbEmZTzQtObuiDClEz5ClYkb5B:wrMswb1zO8xDCSz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676892932, "uuid": "04498e81-069b-4a10-9447-7c5cb7ef46c2", "value": 81164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676892932, "uuid": "18f699c2-1aff-4d39-a928-14e5852f6064", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892932, "uuid": "3f0f04bd-3466-4474-9e98-f5cad946c334", "value": "c540e3db873a69e65094ddf35591303d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b99ca6-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676908720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908720, "uuid": "3b64e15e-2d8c-451c-8fe0-ec7ef367f670", "comment": "Malware payload (SnakeKeylogger)", "value": "23462982434a9fa669ec934d3097e207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908720, "uuid": "31f65f8a-b653-4385-9147-d919ff15ff21", "comment": "Malware payload (SnakeKeylogger)", "value": "d479a5c8a3280908a501d32eb0332b18a93dc2faf34ea0a6b64800f2ae05d1b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908720, "uuid": "ef5d79dd-570d-463f-8a8e-ae607671bfd2", "comment": "Malware payload (SnakeKeylogger)", "value": "92f6e4d32a271aa023a6079953a23f708a9beec8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908720, "uuid": "75950ad6-195c-498b-9e89-0fef889c49a9", "comment": "Malware payload (SnakeKeylogger)", "value": "d27d393ade344e6434e74f0fc802461396de33ff5fd377af0aa4af5bf613fd664635c21554a86b9f2ce7101ae24d1e4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908720, "uuid": "926e8cd6-4053-4400-b6d8-e9729efc39e4", "value": "T1ED157C7221037E8D5B6F1D95E9402732CCEDFDA3BB598084BEC80EE82A6D514DD649F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908720, "uuid": "19bba0d9-5a51-4d1c-a9ce-9f4243cc2c55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908720, "uuid": "1d1f6172-4c38-4118-9733-6650cc905423", "value": "24576:IyvENQDJRV0zIAXnVez5zInHzDjHmxUyxA9OFzHKmGGWLbuRybXXKRL:/z6bLCea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908720, "uuid": "109e05fc-7783-469c-a6b1-ba87eea65414", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908720, "uuid": "2a46a2a3-5239-44a5-9e3d-1ed39fe7a5fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908720, "uuid": "25d2b307-4ac2-4f60-9288-0d6aab758068", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9caf74dd-b156-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676922107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922107, "uuid": "c67e675c-bafa-4d7f-9240-0c4c8156c8ca", "comment": "Malware payload", "value": "8928d53735102e8e91d8181607ba26da", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922107, "uuid": "d31bef77-4275-4b8d-b273-bae40079f685", "comment": "Malware payload", "value": "d4cb1ac74b40b8d6de535b009efc51606f432ede2ade75145eed4fdd921f79b7", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922107, "uuid": "4f8683d2-ae10-4b56-b99a-3e0b7f09b840", "comment": "Malware payload", "value": "93976e2963445cd42272b7b044bc581cecdaa9d7", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922107, "uuid": "c26ee519-0970-4258-82c1-6d4d4b96653d", "comment": "Malware payload", "value": "276a760962f4d09a6624c3f8d32a003c88413c332a175a557230147b9a0fdedf6e8061382cd00d4e0f0eff386d26e0de", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922107, "uuid": "b7e5d68f-70ff-4021-b991-c95424e7b8c5", "value": "T13405D403CE7B9EF5CF57B23688F60ADB237BC5018E795A8B02D961293CC2D543E91664", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922107, "uuid": "29800bcb-a2b6-4fec-bff5-d769bc824457", "value": "12288:t3wXyuDwsryfLlYUFZWyehWg6rj4P8pJNjavyb:tAxr2YUWyXvzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676922107, "uuid": "dff7da21-2154-4eea-b829-63a5eb538de0", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676922107, "uuid": "40879b6f-d3c1-4cc8-946a-6f563e14f02a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922107, "uuid": "28525af4-567e-4a39-80bd-11e852f150bb", "value": "d4cb1ac74b40b8d6de535b009efc51606f432ede2ade75145eed4fdd921f79b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da0a422-b12a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676903103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676903103, "uuid": "e37a3218-6210-412d-83ea-e6483a0c5845", "comment": "Malware payload (Formbook)", "value": "8654f45ca86d45b40eda29324478b986", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676903103, "uuid": "d7050a22-83d4-4769-b7e7-385fe3ae5d82", "comment": "Malware payload (Formbook)", "value": "d53bfebaa5727190790fb0ee11028d82703c9ec84e50735248179a756ed0fd04", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676903103, "uuid": "95808546-6b87-4d0b-b27e-912f803362e6", "comment": "Malware payload (Formbook)", "value": "5b48b95f25c0f2f091ecba6cefbce7dd93301e6e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676903103, "uuid": "1575cc06-bd1c-4bc1-9bf3-588e06e5fc66", "comment": "Malware payload (Formbook)", "value": "893110a5dd9bf427b8c5d7e4d238fc78ad491fab32849eb908a4116ad4d1ce96cdf9a838911eb8456bcb62061d53455d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676903103, "uuid": "8ba43e1d-b6cc-4eb8-83ff-6266df979ff3", "value": "T13054C7C27F50D116F4507F320CE247662322EEC66A52560B2299B31DED74AF46E2F6CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676903103, "uuid": "7b2d0725-b570-4d64-b255-3c5a0a3ad2ac", "value": "3072:PUkZ+RwPONXoRjDhIcp0fDlaGGx+cL26nA:JZ+RwPONXoRjDhIcp0fDlavx+W26nA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676903103, "uuid": "b7e4385c-58de-4ba5-bbdc-e0598e3b8416", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676903103, "uuid": "84d1a324-1093-4bbc-805a-d71f22660960", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676903103, "uuid": "40c8e6bc-0048-459a-bb0a-355d444ff502", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5388db4-b122-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676899841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676899841, "uuid": "7b3407ac-28ef-4ba7-a5fe-8e9907cda2e8", "comment": "Malware payload (njrat)", "value": "2e16a455044861cd67c6da1474a4e4cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676899841, "uuid": "618cac86-49d0-49b0-9dc8-0bdd6b1cfdee", "comment": "Malware payload (njrat)", "value": "d5775aecd2e8d149e2b9ba576ddc2db3624a974cafc8fc1df318226fc2c6d4b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676899841, "uuid": "d61d7b40-4234-47d1-83f0-b980893c6494", "comment": "Malware payload (njrat)", "value": "d76c008dbeb3cc82bfd6b87d503256e15259cbdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676899841, "uuid": "f600f9e0-0525-478f-8046-b75616625c7f", "comment": "Malware payload (njrat)", "value": "c9e1576d87b073e50ce8bf0cc08fe1aca544dd04cc76ed620b10164a8005440d64911d998395ab09b41eada4ed9681dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676899841, "uuid": "0de0e219-1d06-437d-8bee-950f9b7aa9e6", "value": "T1FAB633A9EB01C4FFEF419C30189DE362E7195355F72A21396B134EEED4C94438BB0A96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676899841, "uuid": "d64df1e2-7cd8-4027-946e-3946d3452b26", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676899841, "uuid": "e02580c1-0337-4f78-824f-6e2556901f75", "value": "196608:71Z/d18R53eg+XcW3jLCavAfCfnFGGiTVsFxQTvPaCfiROLO+f+cOL4QMJdrxSsN:71Z/PgkvAfC/IGy3TeRmO+POcfxbs8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676899841, "uuid": "af051113-1801-487e-b0fb-593888a97fe9", "value": 10908672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676899841, "uuid": "13020145-10a9-4444-8ce9-d7f6fd5aae53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676899841, "uuid": "8cc809b7-3b97-45a1-89de-e99a69cccbfe", "value": "2e16a455044861cd67c6da1474a4e4cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a616c408-b149-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676916539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916539, "uuid": "e8473aef-768a-49bf-8d83-35082d6291d4", "comment": "Malware payload (Formbook)", "value": "8d0505c74ffabbdc3b31bd29618ed478", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916539, "uuid": "61df5f74-8a13-4991-a6e4-83aef339bfe2", "comment": "Malware payload (Formbook)", "value": "db0ce498e89e73428a0d1325a91da911e0b369615e4c1d22d5c8d17a8e5475f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916539, "uuid": "39ed0307-1a1f-426a-851e-c41770514f0a", "comment": "Malware payload (Formbook)", "value": "35d1363a113e0b4061e1731a9e1d392f38ee5eae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676916539, "uuid": "5d5640eb-b48f-415a-9a33-5a49368b07ec", "comment": "Malware payload (Formbook)", "value": "58a5ff517880b0d22db5f77de069077ea944c00fa18cf661a16e22ac2c0c06c57635c9f3687265a5d0f9158714bacb28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916539, "uuid": "376d1df4-efb5-452a-94b6-b752cb974b58", "value": "T177253A3D39B796D2D279F63382E3E520B6FC88923313D94A9DD506C54F02642BD8E69C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916539, "uuid": "1a5e94ff-8ac9-45f0-9110-865d4a11e1db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916539, "uuid": "fbbe3c39-a689-4387-87bf-86ca68a02d0d", "value": "24576:Fnm7M0TsIBMNjnNNOhAe/S0fj1FSQNzThA/wpPh9/bsOy6v5:wpThAO9/w4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676916539, "uuid": "94167a9c-585a-4b89-ae44-f949d2a0c2db", "value": 1035264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676916539, "uuid": "b242218e-d5ca-4183-a2d0-7fbae8043571", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676916539, "uuid": "a14becb3-e84e-48c1-af4b-e5804b46d496", "value": "sales contract-876 & New-Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92024c4f-b0d9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676868402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676868402, "uuid": "bff27ed0-a389-4753-8c71-d0ca6c718fd3", "comment": "Malware payload (AsyncRAT)", "value": "d31283700a76d59dbba2e835b5e792cf", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676868402, "uuid": "4831e6cc-efc4-4a59-852f-2a64204fbd20", "comment": "Malware payload (AsyncRAT)", "value": "dd1345087ccfd8768f687102b3b1d217998bde985c67204fbf2f40be37cf1e8e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676868402, "uuid": "35d77865-0edc-462d-97e1-646696fc91c5", "comment": "Malware payload (AsyncRAT)", "value": "ba881f1656b38fe2fcb41e728b3c7e4c5587e40f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676868402, "uuid": "5bf1a7ed-0ac1-4cc9-81dd-9f4d1cdbb8b3", "comment": "Malware payload (AsyncRAT)", "value": "9ffe988c0f13df33cc6d085b7662ed2baa7b5dfe37f627851b43ca8c7d20cb525783ef6422c91553d3899ff315bf149b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676868402, "uuid": "9f4f89d7-cb71-4802-b892-16997ea44447", "value": "T1AE14DCB5649AC99AFE1BCB40B2BCFFA151F171F399C91A20133C5504CBE9FA52E4814E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676868402, "uuid": "74f37b1b-b879-4dfd-86c0-918a8e386d95", "value": "3072:XO2MjmUvQ1qadCv9owmGcAK3Ap0Yt/QIB:XpMjb41kv9owmGcAK3ApRt/QIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676868402, "uuid": "6b935e81-7eea-4406-864f-10461a48dba0", "value": 206773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676868402, "uuid": "c4c50660-5818-42b7-9aa6-b8c5abbb4d14", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676868402, "uuid": "30290ac9-8736-41c9-b5e9-3edc36848f63", "value": "img.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95484eb9-b10d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1676890741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676890741, "uuid": "cabceec4-9320-4b4f-83e1-17f38698c28e", "comment": "Malware payload (Vidar)", "value": "77a16e8827320ea4d24011e7ab635ee7", "object_relation": "md5", "Tag": [ { "name": "195-201-44-125", "colour": "#1BC4DB", "exportable": true, "hide_tag": false }, { "name": "907", "colour": "#B284F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676890741, "uuid": "35a95466-35aa-4239-aa52-00af66a98504", "comment": "Malware payload (Vidar)", "value": "dd15f493fc13d00bb1abc0ac20bb0f7dc44632e71b4fcde1c2889fc34dff6c14", "object_relation": "sha256", "Tag": [ { "name": "195-201-44-125", "colour": "#1BC4DB", "exportable": true, "hide_tag": false }, { "name": "907", "colour": "#B284F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676890741, "uuid": "f196bb86-8dd2-43f3-86c9-503fa5351c63", "comment": "Malware payload (Vidar)", "value": "48725f0756319c01ff9a389dfeeec5236fb78edb", "object_relation": "sha1", "Tag": [ { "name": "195-201-44-125", "colour": "#1BC4DB", "exportable": true, "hide_tag": false }, { "name": "907", "colour": "#B284F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676890741, "uuid": "2dd8e19b-1003-4ffa-9c77-3c6b643b31fb", "comment": "Malware payload (Vidar)", "value": "99b289ca5a82cd8af5f34569694804ef402798e5fbeb34853cc27f4f10225b534f09ea99674f735a461c607c6512f7f0", "object_relation": "sha3-384", "Tag": [ { "name": "195-201-44-125", "colour": "#1BC4DB", "exportable": true, "hide_tag": false }, { "name": "907", "colour": "#B284F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676890741, "uuid": "4cebd7f8-9132-47ea-8e10-08f3a88feae9", "value": "T107847D25F204D831F4720275AB6E9BB2987CA9B01752A5C3F3D44DBD6DB01E22A7631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676890741, "uuid": "ca372c93-3bbb-4485-ba7b-8891c516fe57", "value": "d63b483d8e71fc96eb3e066a63e3102d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676890741, "uuid": "c88a0426-15e2-4ae3-a781-8e2da5bbc25f", "value": "6144:CHd2snAZDkCZbuuq3D3Fr6PMXDuOYijvafhtfhDV9KUBi1M2am:CHd2snsDkCFqDFeMXKujvafhBhDV9ve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676890741, "uuid": "42076f77-9887-4a5a-a718-fdb9dd764584", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676890741, "uuid": "0a1c4186-f311-483b-9d49-16ca4226aa23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676890741, "uuid": "a00544c2-d2fe-4508-80dc-a19c887662ea", "value": "vidar.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0e849c-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676908926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908926, "uuid": "8c045bf0-ecfc-4513-8af2-2294974bb87b", "comment": "Malware payload (SnakeKeylogger)", "value": "5ece2ed75c1177f72012da65c060c59e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908926, "uuid": "84acfbb6-9d83-4be8-a1fe-c0f4cf6561b4", "comment": "Malware payload (SnakeKeylogger)", "value": "dd7a2fe3e0216485e12aa4063c47787c1e9ba075f8f76f7fe9ac800d6eaeec97", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908926, "uuid": "e96c1847-b730-46d7-84c5-624075bb3f3e", "comment": "Malware payload (SnakeKeylogger)", "value": "a17de6e4c87e7c40ef5391968a68c2872d7005fa", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908926, "uuid": "9a3456b3-94f7-4707-8ee9-c619734fbb61", "comment": "Malware payload (SnakeKeylogger)", "value": "0b91aa3dd1ee58317f2a6c26edfe79398e4cddd09a8c070e239543f4b5a18f55ec83025a7532d6d6d5a4e41d59c3447b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908926, "uuid": "a439013a-d9bc-43c7-a01b-38cf0e46d2f5", "value": "T15803185AE78F02688F5102B7171B0A89AAFDB33EB3515561746C933433EDC3D4266ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908926, "uuid": "b80251a7-6ba6-4d75-a17c-61297d9d69c1", "value": "768:cFx0XaIsnPRIa4fwJMJjIXuC1cCag9PiIQGk4Y+P4pW+F5H6+NkkW:cf0Xvx3EMJjyVCgwIQ/+oW+Fd6++kW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908926, "uuid": "f6b0de4a-f8ce-4525-8fb7-c4fb89a2a45e", "value": 40381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908926, "uuid": "303668bf-aa5d-462d-8151-16fd832a3381", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908926, "uuid": "9c2e9d3a-5db1-48a8-b780-1a303504cda2", "value": "Contract ID 79754529001.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7a9960-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676908713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908713, "uuid": "fb2a2bbb-8989-42af-8fe6-eab56b1d7a51", "comment": "Malware payload (SnakeKeylogger)", "value": "f44a21ace1deb749148c604eb9a23fcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908713, "uuid": "21ce5db6-dea5-4d1d-8b1d-39c1d9a844bc", "comment": "Malware payload (SnakeKeylogger)", "value": "dd885f21fb7ce0c8a2cecc43add3472bc6f74b8a13ede1231b00a71262f4615c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908713, "uuid": "30020169-fd50-46b9-8b7b-1a3265e5dafc", "comment": "Malware payload (SnakeKeylogger)", "value": "f2f605fb4f8367859f1b53531c2096c43cc727e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908713, "uuid": "4af3714e-966c-479d-b20d-12dcfc934e9d", "comment": "Malware payload (SnakeKeylogger)", "value": "3db015320be2eec8aa6dbabea6c3268d87f1046575493b65422b53e47911ac7511c874906316aa78242ce2b842ff6940", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908713, "uuid": "07ef7070-42a4-4790-8371-3bedf13a016b", "value": "T13B25AD59A7B4E6B3C58B01EF14395B0D3DA435437608E22C8FB77ED292749BB35A9203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908713, "uuid": "dba2b108-a174-4dfd-810b-edb0b78ae831", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908713, "uuid": "5ab24593-6c34-426f-93bd-54f372c8de04", "value": "24576:q8k4yZ1SqHSxp2k9mE36tRcTABErjY6kN+JYrYE:PoAqyxwE4c3j9JnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908713, "uuid": "96bcc6ea-8c21-488b-a128-924bc6a5a20d", "value": 1001984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908713, "uuid": "0373c112-8f52-4472-95ae-4f585e35b9c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908713, "uuid": "17edb574-c29e-4ae6-bc4c-def0f584914c", "value": "sv21sl2a9TweykY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2095b1f-b0be-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676856913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676856913, "uuid": "3dcd6d95-907f-4e6b-8ed7-206d406daad5", "comment": "Malware payload (njrat)", "value": "213f1518437a78259f34aa515d97b504", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676856913, "uuid": "35faa514-d43c-40c3-82ba-fa34097a01e3", "comment": "Malware payload (njrat)", "value": "de78f61f2ea5df21de5bc6b32d5a899a7434ec5b60974be1c9e6bc149ce8af62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676856913, "uuid": "3e251dbc-876d-47cb-baf4-0777e8c98d08", "comment": "Malware payload (njrat)", "value": "f46f87bf07c0d704d9343adb6064f921170fee50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676856913, "uuid": "ae742d7b-ff4f-49b9-bb93-da0aea738a05", "comment": "Malware payload (njrat)", "value": "471706bbd2b170f467fe4ef86d33b85c0ca2d8a9bd79f33da7292a998477be6563531e3b874008a712f965bb453def58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676856913, "uuid": "31ffed23-cbd1-46c6-be2b-94ca78c0e577", "value": "T1BE93D84977E56524E1BF5AF75471F2004E34B48B1602E39D88F219AA1B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676856913, "uuid": "0bc344aa-e1c7-4f62-84e8-19ea63c74dc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676856913, "uuid": "a28822db-a60a-48fe-bc1c-9dd497cb7f74", "value": "768:wY3+CBnkpjTMpALPGMtsas88EtNXhe9S1mxCXxrjEtCdnl2pi1Rz4Rk3LsGdp2gM:mCRkVbPGHz88Ebv1pjEwzGi1dDXD2gS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676856913, "uuid": "a7dff83a-6a6c-4d48-9419-7e8c52063fe1", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676856913, "uuid": "dfe4ee4b-0027-4080-81ec-fb37eda6bc88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676856913, "uuid": "eb6d49f5-778a-4dd2-a1df-8b33fedbba7a", "value": "213f1518437a78259f34aa515d97b504.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b13dce-b0f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676879125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879125, "uuid": "20dac7a5-3507-46cf-940c-005f7f053bf1", "comment": "Malware payload (RedLineStealer)", "value": "63acdf17762e502071ae4bdff9b6eac5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879125, "uuid": "eb69f858-82ee-4eea-825e-18ee31ef5db3", "comment": "Malware payload (RedLineStealer)", "value": "df52d57d12052a2fba6955a91c5bdec7a4f1a96582a92d33d35f735bb51352ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879125, "uuid": "882a474d-cfd8-4c1c-9e63-1bda284c7c70", "comment": "Malware payload (RedLineStealer)", "value": "10b0b6df7595825030daed4324d75bf905a39ef5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879125, "uuid": "92074d61-c975-4827-b8a0-441d5a031c08", "comment": "Malware payload (RedLineStealer)", "value": "4f4dedf422dc667b7bf1ec9c4f8608faa359916b01d73cdb666545e974f14a78aca65ba35bd50f15af70ee00c01e5a81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879125, "uuid": "147492e0-3502-44a4-8384-7529aa366ed6", "value": "T1F434AE13B2E1BCA2D95A4B71DD2ED6E43A2DF6200E19776B17187A2F08701F1C273726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879125, "uuid": "b1b87406-a65a-47c2-97d5-1757728c4f5b", "value": "ed191fd45aaa30104c7d529493e68118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879125, "uuid": "5b45f310-aea5-485c-815f-4b52723d961b", "value": "3072:t+4aAcWILr1PH1za0k0kYaNP7xwZG2Y+FM1P7A3Xm1PjBl2s:vLcWILJ1zl3aNP7xw02Z8P7hVjD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676879125, "uuid": "2c85a0ec-b5cd-40d2-b795-36ec50bc3737", "value": 231936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676879125, "uuid": "70e91889-d806-498b-be9f-2b013059cd5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879125, "uuid": "d9813c63-732f-4aa4-9be4-19836d47afd1", "value": "63acdf17762e502071ae4bdff9b6eac5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72ec868-b114-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676893858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893858, "uuid": "d47e370d-3d5c-4526-af5f-d7f09f32592f", "comment": "Malware payload (GuLoader)", "value": "2c8ec70038808bae70dba39f8d1d96b1", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893858, "uuid": "3ace2f71-0e67-4166-8751-40f000659c77", "comment": "Malware payload (GuLoader)", "value": "df984c5575f3c74f2255af2a8e141144285003a3a72c9589aef89830f31f6ff0", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893858, "uuid": "0348e395-4d09-4f11-abbf-ada6ec17446b", "comment": "Malware payload (GuLoader)", "value": "399657c4c33ab016ec21963a1c3a089a00c266fb", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676893858, "uuid": "71731bb1-f3cd-4046-97a6-516694c0ca24", "comment": "Malware payload (GuLoader)", "value": "453574ac82f03987636a72318561a7b3915d5034828c1816e56bad57b9650c00fcb3536cbd1380f3fe92d55c92672ffc", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893858, "uuid": "a2a2c918-4823-4a8b-aa28-f8f375ca50d7", "value": "T15CA423FDC8D7BF8B09E9DA670CC96A58E92E847982633D2542CBC53F58A34184D1B7C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893858, "uuid": "ee762c23-a4dc-48fb-91c3-8acde1f76674", "value": "12288:x68DbmRWtUBWRmVDuRlXwo9RUJl5TiXUBF:x68nmUnmUB7iJl5TiXyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676893858, "uuid": "9e305a11-12b5-4baf-8456-ceef1c349dee", "value": 468578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676893858, "uuid": "8cf7c58e-638d-4970-abed-783ff010db27", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676893858, "uuid": "4bd9cf73-f25a-4e5c-a161-48d6cf6fb48b", "value": "09854567887654334567898765434.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e11d79-b119-11ed-88f6-42010a9c006e", "comment": "Malware payload (EternityStealer)", "timestamp": 1676895921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895921, "uuid": "71596cdc-83d6-48c5-8fce-f15985a7bd05", "comment": "Malware payload (EternityStealer)", "value": "e7e45fb3d4899b886214f926b4ac845d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895921, "uuid": "6736cc19-e380-4938-87b5-a40798ce94cd", "comment": "Malware payload (EternityStealer)", "value": "dfc14db8ebe89dab82aaf1476fd573acf91fab5c7a048320f9f7aa68193fceef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895921, "uuid": "84612a73-75be-4b75-9e47-541990378a68", "comment": "Malware payload (EternityStealer)", "value": "e6c7291d8e2e6bfa2e45cf1c846a64638b90b64e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676895921, "uuid": "1ede238b-1f61-48ec-906a-8da78dec40ad", "comment": "Malware payload (EternityStealer)", "value": "20983e2edfe54862d0cc310bcc4bfd318d76d514b8e08d6ae57270aecf614ff0a4a21b07bbde71dd0c726fe66d0d64b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895921, "uuid": "4e907a8f-1e16-4d13-bdff-4608ce05945c", "value": "T1CC35E09405294CB0C96CB5713A6FE2120BFC1D721E3367599210AFE19B3AFCB61FE192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895921, "uuid": "8168f214-be22-44b3-a523-93b2a9ef759b", "value": "4a43ef13050d45ae61812b2997033821", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895921, "uuid": "250168f6-16a5-4364-a876-551ec1ab63eb", "value": "24576:EdIz687AJq0zp+n5SJ4esrcqsV4D/140Wkog5pW1/9YCRj:1nn5S2esZsV840Wc5pEYCRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676895921, "uuid": "fb4aa58a-010c-42bb-8113-66f2bbafbf18", "value": 1154792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676895921, "uuid": "c3ac3aa0-2410-4956-bca1-2ee8aeed2736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676895921, "uuid": "2daec8f6-4ce1-48e8-bd1b-92a1e692ad2c", "value": "e7e45fb3d4899b886214f926b4ac845d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095b1db6-b0ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676876333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876333, "uuid": "a3e1617c-e13a-4485-affd-f6631a82bc69", "comment": "Malware payload (Loki)", "value": "3653f2a5db35870295ad408a2afea998", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876333, "uuid": "9c3a1ecc-6712-40f3-a6a3-28edc4d1a090", "comment": "Malware payload (Loki)", "value": "dff0e47bd498a9cae3b84239b9cdb1cd7507bb9049d769fa099d7bcde19f6e01", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876333, "uuid": "bf95c9e1-d71d-4924-9c19-c30ee4e2ee02", "comment": "Malware payload (Loki)", "value": "3323cbdc1f3b902a82807e27ae2262cfaa558c07", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876333, "uuid": "547abd5d-0d21-46f4-a3dd-bd54b820047d", "comment": "Malware payload (Loki)", "value": "58551e649d0c65dbbfc0537d5fca5b7a41089126895729b136a2836f120904bd15f9725ec98f937d43952ee344121e44", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876333, "uuid": "fc255359-b892-405e-9021-6334d9b9ef66", "value": "T1F263912DE70F0915DF91A77B435B4A8A49FCB629F28140A1796C873837DDC3E4A2297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876333, "uuid": "432c7b13-33e4-4085-8880-8d231ca63172", "value": "1536:tq863RGmQadqW4Mf9za+8FseJeCTj+utazhZZKNea0fMRgIMb:l6bQa/f1G+8FvJeCTiut+ZKqfMRgIMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676876333, "uuid": "329a6287-5f7d-4e96-971c-94531f55067c", "value": 67560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676876333, "uuid": "f5484b41-61c0-4c5b-9ec4-82b10fc23d0c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876333, "uuid": "e384c001-c21b-4d72-b989-e4bc1825c85c", "value": "INVOICE 1008.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb1772e-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676882705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882705, "uuid": "ac2bdbcf-513a-4974-b28c-6c318b861b28", "comment": "Malware payload (SnakeKeylogger)", "value": "d298b7f4ab377d022c0e979c26b02efe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882705, "uuid": "f8ff489e-c51d-4632-bf6f-dc58d1aec188", "comment": "Malware payload (SnakeKeylogger)", "value": "e059262525ff67d92d0b95de8398c6a3687f66b4da7b6733f4aa54c44dc42039", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882705, "uuid": "cf539576-74d8-4b69-b3fa-52a3d4631756", "comment": "Malware payload (SnakeKeylogger)", "value": "c94838b54a6aeaec17d1ab647c736d744e21df71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882705, "uuid": "6a4346b6-5d58-4341-998d-c2d4f4f81792", "comment": "Malware payload (SnakeKeylogger)", "value": "7094aee0a6c446541ab2d51285af5c31a451cbfe172186f2b6fa9b24ff8cc42bb0d707e4b5c239764dbd2bd6a76e6061", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882705, "uuid": "8c435cda-bcc8-46ff-8745-d8945f281089", "value": "T19AC45B8DC4BD4212EAFD0F7DB19F29480E90044A266E4D3B97E7F880E57326A707E65D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882705, "uuid": "47ccff1c-e863-49dd-a92e-ead8c0a7b252", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882705, "uuid": "8367d8a3-0364-4d9e-9bca-59d18fe9ea04", "value": "12288:2xecesW6VFAcap3Aho9AttJu2QGLYOSDamws5:9ceszhY3A6AttJu2QjwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882705, "uuid": "73165f8d-318c-4891-baa1-01b3636cede3", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882705, "uuid": "9cb5edfb-f1bd-426b-b9b4-4bbaaebe7a78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882705, "uuid": "167bff3d-3388-49a1-b3f3-1c38420b64a6", "value": "k3NGCtZE7nsmYFH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad25bd8-b0f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676879127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879127, "uuid": "5c72dcdc-6fbb-4d6f-9d90-a92bc9beb310", "comment": "Malware payload (RedLineStealer)", "value": "15f57888b114057a94ff7417faf1990f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879127, "uuid": "53d30c6e-f566-431b-8c51-ae1da67699bc", "comment": "Malware payload (RedLineStealer)", "value": "e280a38c44918dee6095ef997d4b415468c80f4ea42f3107614fdc0ddec93455", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879127, "uuid": "27808044-8f51-4806-b6be-416a47d83e90", "comment": "Malware payload (RedLineStealer)", "value": "a8d3fdb1db8abd7013421a4d2d4d05a58f261ca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879127, "uuid": "42bcf823-b26b-4b27-8e1d-d86912bd97c6", "comment": "Malware payload (RedLineStealer)", "value": "4dcd7ea6de85b1958ee00c7a23feb96684dcfba197015fa180415b2acf7d2c040c7ad96eff0044c92b1e115360661488", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879127, "uuid": "315212cf-cc49-4eee-92e6-5d80cabbeb12", "value": "T1EA34AF03B2F17DA2D5574A729D1EA6E4261DF6207E097B6B23184A6F0970EF1C3B3721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879127, "uuid": "2939a7e0-2198-4d3f-b0fb-dc4c7e4feaa9", "value": "ed191fd45aaa30104c7d529493e68118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879127, "uuid": "9a06a2ee-ade6-4592-a117-ecb012d2837c", "value": "3072:kqkaFW1QWL71PEK9a0k04gLj0lv+jSjJ2eubiKj1PP8NAPaLmyMdLuQXABl2s:OGW1QWL6K9lVfQ+jm2RGk1p2laAD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676879127, "uuid": "a98d6b6c-9f39-4fe0-87d9-69b8e4bbd927", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676879127, "uuid": "32365455-d98e-4992-b54f-72129a2ffc04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879127, "uuid": "6b197e52-fe94-4494-9917-43f6e0d83370", "value": "15f57888b114057a94ff7417faf1990f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f07e89-b12d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676904276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904276, "uuid": "56429c82-f585-49cc-b0ab-09f9b8fdbb0f", "comment": "Malware payload (Loki)", "value": "f040f163824ecc1f4851ed9a5845b394", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904276, "uuid": "25bd7bcb-7a80-4378-9a58-f5402b5e9c2a", "comment": "Malware payload (Loki)", "value": "e2dbdd45e11e2b7e32caef9e2f4365d05e63eaf13724bea2ed842a503adb802f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904276, "uuid": "7cf2efb5-1414-4ea8-8f60-958e71ca1966", "comment": "Malware payload (Loki)", "value": "9a9d0e15ca91904ad983c5a685b3e43e2b18e737", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676904276, "uuid": "d02fdf58-7ca0-41bd-b75f-4af9df6d5655", "comment": "Malware payload (Loki)", "value": "e22cafc5926adc068806e22bf1f48afb367757015519f52e8843947ffaafb3d3f928c544049549b79e45a6550fb82b6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904276, "uuid": "3602e3dc-e892-456c-885f-e0fd4df711d2", "value": "T10465AD5ED6B75F8FD1298A38880E0E423026C6C598BDDB4A579BED3C319498F9379331", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904276, "uuid": "bf16e497-0f50-4739-a0d8-de9405eeda89", "value": "24576:jn54Ogw6qJBXBWTAcCrnAS7HaCV6ZPh/wFWyXG6Cw5lKudy+:V4Ogw6uuZKnJ6CV6ZRwA015Tdy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676904276, "uuid": "1b1dab66-1255-43d6-80bd-21b2d2520f21", "value": 1504768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676904276, "uuid": "240e7a2c-5d08-46c4-b907-24cbf7bc91d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676904276, "uuid": "3e25ae85-2df4-4b05-a62f-c368f5f664e3", "value": "FACTURA DE PROFORMA_________________24432444224552.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a4c54a-b138-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676909047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676909047, "uuid": "517b5ac5-97b9-4182-b526-5ccbe66fa667", "comment": "Malware payload (NanoCore)", "value": "e032205bb3bd7666287f956ba7b12f7c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676909047, "uuid": "0d61348c-2d55-4ac9-80ae-f33e19981b2a", "comment": "Malware payload (NanoCore)", "value": "e364d207e5ed628566265ea2ed094709af93c2fb47e2fe4bb3ee130fe020882a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676909047, "uuid": "0328062d-2be9-42ed-9081-9a28f3b139d5", "comment": "Malware payload (NanoCore)", "value": "45f1140d7bfd914cc85eff64bdd247d7e727cf7b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676909047, "uuid": "68617b7e-fb0d-421a-8be2-6d91800c7f68", "comment": "Malware payload (NanoCore)", "value": "39bb2b237f9379257d4fa7187df1ba9b4f41edc22095202c8ee434ca00f2d2e3dad2d0d3e0ab7ca7610949491aca5365", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676909047, "uuid": "994a6629-55de-4015-8c6a-af7856f5bb48", "value": "T161037E5AE79F02A8CF511273161A1A89AAFDB33EF350456174AC837433EDC3D06666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676909047, "uuid": "32269b99-b73f-4f16-ba9c-fdd0aa9b544f", "value": "768:RFx0XaIsnPRIa4fwJM9azYIqeryCqhUKo2J9m:Rf0Xvx3EM9aziylJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676909047, "uuid": "af4a66fe-b79a-417c-a8cf-84eb66be73bd", "value": 39478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676909047, "uuid": "57318d18-3e35-4bf2-82a0-eb28cd6dd0cd", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676909047, "uuid": "0c35a139-dd77-409d-839c-6ad7c5ea51bf", "value": "New order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875275a4-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676908756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908756, "uuid": "a190932e-32c5-40b6-92e1-b851f9b6504b", "comment": "Malware payload (SnakeKeylogger)", "value": "7dd393107012a24d94753d5791245854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908756, "uuid": "bf23c4ce-2819-46f3-b502-859955315737", "comment": "Malware payload (SnakeKeylogger)", "value": "e490c6109db267bb71b26d38a216214372bc036050b667afa798b3792d65562e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908756, "uuid": "5c0120b9-3b0f-4281-9567-c80a726c1cbb", "comment": "Malware payload (SnakeKeylogger)", "value": "e5ba66b525af8b788d2d2ba415b6d0f1ccb6d21c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908756, "uuid": "839c4099-6ac3-4cae-8aa7-d86548a44b4f", "comment": "Malware payload (SnakeKeylogger)", "value": "0b807b4ca5867d2b0b1979f8e5187c06acf525c1e4272dcfb4f9c4cb95e5de4e99ac267de26650f9afb3744d9f61813d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908756, "uuid": "5c534370-c3ff-4b16-9545-5567d421baf0", "value": "T12B557E85F2B0C9B7D99B01F66C3A562434A27D4E6454C11C4BBB7F5662B23B3309EE0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908756, "uuid": "e7f11f4c-e818-4f4d-991b-8ad6fa1ae24c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908756, "uuid": "4679c97c-141a-443e-ab12-0f4b85141e68", "value": "24576:Uvu4yZ1CMhpC6/UMgRsGRuuCRpdez9pWp5xvqS6xtrYE:uOAMhw6hgJRRCRjeOpLSkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908756, "uuid": "d7a69730-3fa2-4f64-9d99-5de8f0247c69", "value": 1300480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908756, "uuid": "3fa57eb5-3d8f-4b1c-b0f9-3d4ce6333c51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908756, "uuid": "db7aea66-1895-4c1e-9c18-1699e2f62113", "value": "FATURA VE BELGELER..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ad0935-b112-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676892973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892973, "uuid": "9614a8b3-fba3-4798-be95-edc4edd81181", "comment": "Malware payload (RedLineStealer)", "value": "ee358d9e04b971cfdc3a4d3a12e78157", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892973, "uuid": "ebc28be6-3be2-46e9-ad2f-c6fb58a5d142", "comment": "Malware payload (RedLineStealer)", "value": "e4b1973d824a6dd7b72575152a9d99592cd6d9536a80a969822976d6fa2e270e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892973, "uuid": "3b8e4f08-e73b-4c8a-a041-fa14f63d98f7", "comment": "Malware payload (RedLineStealer)", "value": "dc59f07078d3a0a022564317377d29faee4c557c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892973, "uuid": "0915fa4a-4791-4925-9dfa-98ea58bb2b39", "comment": "Malware payload (RedLineStealer)", "value": "c91f1335ed20e56802a7c4d0ea9882f853436573de97cee9006914c2154f4326a5ec16da1ded8e0fe248ad471d7c5b80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892973, "uuid": "26fd9a5d-fcd0-4798-ad54-231ce0db3720", "value": "T19C25AD19A7B4D6B7C58B01EF18385B0D39A435437518E26C8FB77FD292709BB76A8203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892973, "uuid": "7e8770c9-d108-459e-a12e-8eee32cc3b02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892973, "uuid": "086ef56c-2aa1-4747-bd6a-cff4e1827040", "value": "24576:n0K4yZ1Hsycnxa8qdxyVGoeevKW5sjouxwrYE:0Ka3FqdxAcG9YE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676892973, "uuid": "6387d5e8-e423-494e-b657-0e612926caad", "value": 1001472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676892973, "uuid": "e4fa466c-5c9b-4454-b2e5-fbb33aaf5fca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892973, "uuid": "f90a96a5-b22f-4abf-887c-fe6d98979343", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1914cfc-b145-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676914840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914840, "uuid": "fe7dd9ee-3aa7-4340-be4a-68c5fffc995a", "comment": "Malware payload (AgentTesla)", "value": "44d290b26fc8ba032e2e7b67c13b98a5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914840, "uuid": "8cf643c8-0397-4852-9177-a561cf472f29", "comment": "Malware payload (AgentTesla)", "value": "e6b4388c473eea0bcb21615647f68d9ce4ba29bb6a40b6a602f6a38c08a8916c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914840, "uuid": "1560a0a0-e4e8-4976-b327-dd20eb60b11e", "comment": "Malware payload (AgentTesla)", "value": "af4d3a7856bf74a331797a5ca15dc0a9ae81a51e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676914840, "uuid": "2a60385f-7c42-4574-b843-2f7a1b38f30c", "comment": "Malware payload (AgentTesla)", "value": "9961f4e58404fecfa3fdebb0d962ec8c4b5b0d1622d4b4c9a16d535b06609b4c73042f9b7977a80c14162f957a30ec69", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914840, "uuid": "8ff82f62-1356-4df5-a7a2-18fdbe78916b", "value": "T126842335B08336586F882E1946F43FB4BC620C2A295F0F5E6841462CE63AD354A1FDFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914840, "uuid": "1659971d-ae73-4f5a-953f-2eeb69b86485", "value": "6144:tStCSFUWzZdH8WeC2j7f9Mi8T0G/68uUWbXhin3PJZuHYP4b0sGxKMBVQofN8Wpy:oteWldHReC4z/Bh6WH3brBeXN8WppJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676914840, "uuid": "8c8c637e-1871-4db8-97e8-20ea3fb57749", "value": 380572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676914840, "uuid": "e53c73f0-1c46-4fa2-b6b4-1b5024f92cce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676914840, "uuid": "5be88ae6-e4ad-48cf-8780-5d76b0c7d4a8", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78f3474-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676882692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882692, "uuid": "18d43415-6976-4062-a667-d43ad0eaf1c0", "comment": "Malware payload (Formbook)", "value": "a22fc31380accdcb7aaf6abf956cecfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882692, "uuid": "b276aca5-f4f8-4bb5-beac-6a33c2dbe70c", "comment": "Malware payload (Formbook)", "value": "e915ad87f311c890721d00bdb20a6e1afe0c4b12bc878b356f8875d808aa59a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882692, "uuid": "5052cdf2-0774-4295-b7f2-93fa637eb867", "comment": "Malware payload (Formbook)", "value": "f69666c6f10f65267dfc94a8f17ecf7fb722282e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882692, "uuid": "5be0e632-140b-410a-bfb0-bb35e44755e3", "comment": "Malware payload (Formbook)", "value": "c2d6389dfa6315395a9c137be5865b6d4c80b422da5bfc56d67960b772ba7fcdaa087d5a88ef33d388b7eb79870a5909", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882692, "uuid": "7990cf54-c864-4604-a92d-2724243b7be7", "value": "T13404AE36E601C075E2B242F5B26C177B843D2D342394A0A6F7E21AE56EF05F6B46931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882692, "uuid": "f648bdb7-3fe2-4046-98fa-b3618f742087", "value": "3072:D7oHnT5GM1Em/A06sWMvYWAf7g/Gg6yw40R9aGovpwhX06JJWW0Hh2qpsgAn9zfF:wHlT76iwzgOgp8R9aGovpwhX0AJD0HYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882692, "uuid": "d0685664-a221-4bb1-b77f-b3808fda16c3", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882692, "uuid": "857b70a0-86fd-4328-b5b6-9d3037a5ef13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882692, "uuid": "9d2c519e-9023-4f59-95c2-d6d6e588d5cf", "value": "e915ad87f311c890721d00bdb20a6e1afe0c4b12bc878b356f8875d808aa59a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0aea2d7-b14f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676919161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676919161, "uuid": "39cb1067-8dcd-4144-914c-1ca50f5397bc", "comment": "Malware payload", "value": "22dcc219bcca74041a9e7715f9530f5c", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676919161, "uuid": "0210c3ef-700d-4a93-8665-01d18d20a520", "comment": "Malware payload", "value": "e98d53d88e9f53782eacae380255dab3d2a32e0e2b4d54d5cac03a9fc81d4cc3", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676919161, "uuid": "afde0203-2e24-47bd-9a80-b76b4d2c4f0c", "comment": "Malware payload", "value": "bb2e45d7894d5bf46d381acee998ab7bb656900d", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676919161, "uuid": "3dce3715-ea86-4bb8-993e-ee0df0d9d40e", "comment": "Malware payload", "value": "35429b5398632bd1d0102f8ded4782cb28d8062ff2055faa2ff8959c52fb7490ff4808707b51ed3a1e1e90ce2328bd45", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676919161, "uuid": "02d33b14-a259-4585-a725-2028e560b659", "value": "T17C52C098BFC70062E1DDC6C1219043D5FEEB556669F2EBD30D4284851FAA63B54F4252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676919161, "uuid": "6bed049a-8548-47af-a778-dd93e40a799f", "value": "384:81k6fZlODmgHVII1ABbZ7G2Ox9dYvkS/plBZKGm:fKTINj1ud7GZxYvjBXUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676919161, "uuid": "6aae91f2-770e-41f3-bdbd-2d752a7b78fa", "value": 13898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676919161, "uuid": "b17800c6-606c-4eaa-be15-2ec934aaa074", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676919161, "uuid": "b62731cc-ad91-4c89-9864-218a68346cea", "value": "ca9efa84-c094-40c4-fbf4-08db1361680d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bcb38b9-b11f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676898429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676898429, "uuid": "03fcd066-c1dc-4103-832e-a69b66c5c822", "comment": "Malware payload (Loki)", "value": "8cbad11f5002ce2ac201072b5fba6051", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676898429, "uuid": "e14c37e9-13ed-404c-9d05-0eca1b6d125b", "comment": "Malware payload (Loki)", "value": "ea65c337f9cf8ed9f794342b9f1ec9be47cbe5c13731943d51118f13396c5d87", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676898429, "uuid": "0470a5b1-425e-439c-b6ec-3e3bceef9f98", "comment": "Malware payload (Loki)", "value": "7f5ee664020ebb97215cc220f6ce4f533f74c754", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676898429, "uuid": "b95b6535-41c2-4346-b544-a1b19f4fbb4f", "comment": "Malware payload (Loki)", "value": "7bec2d20533252a9fcd4e21dd70b6e4a21eaab60bf4d14311960ea1ce9f61725a9e7f4fb9d1f8404ef4681859385d1e2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676898429, "uuid": "a0cf02d6-9198-407a-9b7a-5a2863f8b883", "value": "T1B452D5416B8D69B2D365E5338119950A0CBEF6BE378306F4B49CD45237FC30E6AB81B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676898429, "uuid": "709de584-0457-4f7c-ac9d-6814d815c482", "value": "384:mAJ0Kjn0JBsctMSJMr3O7ELvH3Cm4JFj/0z5Q:mkjWsMJMr3OAryPJFqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676898429, "uuid": "5ef3b93c-546e-4dcf-a2f5-c60734b141a7", "value": 14360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676898429, "uuid": "4e098270-ac02-4666-ad46-31fa7257722e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676898429, "uuid": "68847ace-0566-4796-a6a8-b6f5ffbf034d", "value": "8cbad11f5002ce2ac201072b5fba6051", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb283dd8-b0eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676876282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876282, "uuid": "0a395c0e-6373-49b5-989c-d58e0b939464", "comment": "Malware payload (SnakeKeylogger)", "value": "7b9d51862172b64931934b9ce326143e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876282, "uuid": "719afcde-b724-4721-afac-d605ef64cb56", "comment": "Malware payload (SnakeKeylogger)", "value": "eb338ef149a68ad0526b37877584ff07e875524e775e0007798e18e6580cf907", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876282, "uuid": "f281a18a-32d2-4dd7-b24f-a194f5a57f81", "comment": "Malware payload (SnakeKeylogger)", "value": "24c750ad3aab36f3ab3c950a579da9bc12f03a42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876282, "uuid": "04c5f0f9-cda5-414c-9f13-657f468df534", "comment": "Malware payload (SnakeKeylogger)", "value": "3a78960419840bafa44ece27a868956878687517e3000e40aa2e94ef164e82242b1af5cac5972418d553afcbcf17437f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876282, "uuid": "43d5155f-9f11-43c2-a508-676dc003281b", "value": "T139E3191D2BF89800E6FF8A7315B15111C776FC52192ACE1D06D2F55A2A7CA90CE1BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876282, "uuid": "a4fa840d-d0ab-4c74-89de-7422a8d8058b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876282, "uuid": "5b5af330-9020-4c2d-a535-8d0c8cf96ef9", "value": "3072:jAgAEzoHj/LDd280fqMlb8S2wBj2WFbYCu:waWVMlb72SbBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676876282, "uuid": "d9b1d396-a665-44fd-bbf0-1610f52c958a", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676876282, "uuid": "e6b7d72d-d1ec-4cdf-a2a5-d75981db19c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876282, "uuid": "f2520bbf-8699-48c5-872d-92a4256d9344", "value": "7b9d51862172b64931934b9ce326143e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a922f324-b156-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676922128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922128, "uuid": "6993106b-61d1-4538-80a0-c4c6d212c01f", "comment": "Malware payload", "value": "6d31103463a232f034b28b189bf74ec3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922128, "uuid": "327a145a-68c2-4806-822e-d390459e96e9", "comment": "Malware payload", "value": "ebc5888524afd089fb1951d572a02315ce2afbab86c20a440320da8955ebcc6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922128, "uuid": "78f00780-f971-4bd0-bceb-f814b3a86b3f", "comment": "Malware payload", "value": "98d56e7e80b16f887221f93429c601ff0980abab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922128, "uuid": "511c27de-ea4e-47ec-b66d-4d7829031410", "comment": "Malware payload", "value": "72dc134235cf13727106eb0d304bd2c21e18f3fcfe7337b0cdeeeaba21575c3928e74e870e3ccef233e5db538a711166", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922128, "uuid": "3509c61d-b886-484c-9f6a-1c99332bb474", "value": "T1F2555B01F0B18873FC2E173D89E597E4F929B527442EC75F2F9D7A6E071029842ADA27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922128, "uuid": "3b5294d6-e6e1-48bc-810d-884aedc6e945", "value": "19f63d24f8949fc723d269de46ddfe98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922128, "uuid": "23dd37a2-abba-4aa6-8ec9-21dddc0db7bb", "value": "3072:b8JUdl+LjZ8FgEmThdUhqrAlyGF4sYMmzZ4uAg0FujDERw1KyHDKLAGcNC0mznIZ:r+Z4qPUhtpFR+AOebJ227wgYH4YgUtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676922128, "uuid": "b7d41ea1-6e3a-4fc2-acd3-b1ec77dce5ce", "value": 1315328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676922128, "uuid": "f97f18a0-2be1-4696-a059-13992a556cf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922128, "uuid": "5377fb69-2004-40ea-bbd5-e3411078a4bc", "value": "Set-up.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e226ffec-b116-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1676894735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676894735, "uuid": "b4260789-9d4e-44a3-9f77-9492e063b45d", "comment": "Malware payload (Vjw0rm)", "value": "2e893ed360a5b3586ae13862a492652f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676894735, "uuid": "ba05c9a7-c026-43d2-87e9-a30558b9b4da", "comment": "Malware payload (Vjw0rm)", "value": "ec20d0a098f22992a04e3b875996a6af49e023e929fea3e6192c7444fb80553f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676894735, "uuid": "34500ab5-8946-400d-8b4f-8f918315e940", "comment": "Malware payload (Vjw0rm)", "value": "053d796519b37d69bf6650f92c5404ef9830ec43", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676894735, "uuid": "2f2d3982-0aff-45f5-b00a-b63802f2ce65", "comment": "Malware payload (Vjw0rm)", "value": "ecb8b54ed90997e6dff65cd97815691a62b5e0b7b2b4feeb627213c4e917db1ff83b7bf5d0aca4ee2f749cc696f00487", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676894735, "uuid": "015558d2-2a17-44c0-95b4-9be0a6a51e29", "value": "T1ADE5E5C8AB81D8036B8D9D937F5ABFE550356263DADC7287D5A87FCC04A85C34462CE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676894735, "uuid": "572aceeb-fcb1-40f4-a29d-ced7902db47e", "value": "3072:gOMWWSK0P5mUSfibfWZN7T7VE+NFlC7575eGlGE32qXaj1slgD71dwMbb9rp6D9B:y1Ye4E/e/gElEiLnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676894735, "uuid": "ad8f910d-731a-4b7b-933b-af3dfbe0dffd", "value": 3133383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676894735, "uuid": "75cf5a03-c844-4a52-bdbb-6baa91ebd480", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676894735, "uuid": "ca1104cd-4063-4f81-a72c-fb7b08a215c2", "value": "Payment Details.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b371d3-b123-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676899956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676899956, "uuid": "e0beb44b-adf8-4358-b8fc-e1e089684cd9", "comment": "Malware payload", "value": "d4a5ad8022e21079bc6a62f97d688046", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676899956, "uuid": "633370e5-0386-4687-b25b-4153819830fc", "comment": "Malware payload", "value": "ec2c17b77742d5dc299fe52637584443fcb9cc77988581bf4a58bc1773ee9f69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676899956, "uuid": "d495eb45-de89-4815-85dc-6241d2b1e500", "comment": "Malware payload", "value": "60058fee8a544187b4e66c1b4df89a08150a7ad4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676899956, "uuid": "1dcecb46-3fd9-4032-9de5-289225d7fa0e", "comment": "Malware payload", "value": "65416525a591b3fd056f440ddb45f48bc3d5dbaee9d7dffd5bfae1a12482c1dcdb0b55064ba23fdfb76c00f1ab4f6a38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676899956, "uuid": "7bf3b46c-09e2-4af2-b41c-f936c66d6a5c", "value": "T1F39633AD87267CB2B2F142D9FCBCA5E86FF459031D7D025B92D161AAC83CC68581393D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676899956, "uuid": "36ce4f42-115b-4971-94b7-2b08a18b0c9d", "value": "196608:Rv7qXREWqCnFMIcLV3PxcPd8yZunWd+vlfaeVExNp6QMVUAlwcAq4SNVr:p2BEWqCnFAV3PxKe7Wd+tfaeiHWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676899956, "uuid": "c620c91b-58dd-414a-82db-59aa55c28969", "value": 8921088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676899956, "uuid": "b3eff651-4329-40cf-bf83-5b4e3b356ed9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676899956, "uuid": "b009f3d4-08be-4f12-9930-186e1dd85940", "value": "SecuriteInfo.com.Trojan.Siggen19.54329.27605.6028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3905339-b100-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676885208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676885208, "uuid": "bc3f13a2-7cb3-41db-bc05-bd1e1f105d59", "comment": "Malware payload (AgentTesla)", "value": "70832ea61e7a8ceb07afb9b6d00e76b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676885208, "uuid": "7f10f903-7af6-414d-8684-0a0390e117e3", "comment": "Malware payload (AgentTesla)", "value": "ec6d0458a71a3e07cc9511e54e0bf83c1a449da3ce6fb0c21dc15160d7522f77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676885208, "uuid": "78f26502-420b-4639-b1ed-79e23f6806cc", "comment": "Malware payload (AgentTesla)", "value": "eee7d575d0964c7810568454f47652eb20f73fae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676885208, "uuid": "c6af9e86-ceb8-459e-81af-ab3f7f9ff4f5", "comment": "Malware payload (AgentTesla)", "value": "86cfeeb5eadbbdcd0cca0efff1982e9ce0045a6f492fbd9bef8d41268576f564dae569f88d647156704f85c470cf4b33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676885208, "uuid": "42997940-cd2d-4336-aa45-5f23d4f67d2b", "value": "T1FC03A25AE78F0264CF5512B7171B0A88AAFDB33DB35151A138AC9334339DC7E42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676885208, "uuid": "227c4bab-4632-46f8-9ae4-881fe57bb54f", "value": "768:2Fx0XaIsnPRIa4fwJM277FGMXmG+ABcNUkGOb:2f0Xvx3EM277FZ2Gvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676885208, "uuid": "65efdde3-4a9c-4d1c-9887-48e570f789fc", "value": 39513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676885208, "uuid": "4442cc70-5e30-4f2b-bb22-2b69cf7be608", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676885208, "uuid": "b317d1f8-c549-4804-a9da-fcde9dc88125", "value": "ETA2023cargo.docX", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e46695-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676882696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882696, "uuid": "4fee82d2-bddd-4bff-96f4-818a219cafbe", "comment": "Malware payload", "value": "85e67c24617a3eaab0a7094acab85751", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882696, "uuid": "504722e3-575b-4f2e-ba53-720ecc4c370b", "comment": "Malware payload", "value": "f0bbd9618077c745466cf29439b0446e2ec19ce9ada97943a0288c683d191b1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882696, "uuid": "29ebeb90-d2c9-4c5e-84f0-9c5937873fd3", "comment": "Malware payload", "value": "6eb89ee7a67f58dda1ca8553c6d09d49b4a5a715", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882696, "uuid": "c9ca39eb-6ac6-4e3b-9aba-b83453a0b047", "comment": "Malware payload", "value": "b2136959598963b30f27717befb92cc09308136cc4042b1fe12e37122b6e4cbfb603070d6cf94673c6cb0925a4e1f0d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882696, "uuid": "f8bd9955-6d39-48dd-bcd2-da6aa1c8f10e", "value": "T1951307C0E902A271D0AB953044BA6F3555727D23D8B65E0EE5B1F8581EF3101E63B9BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882696, "uuid": "0a26872c-5c45-4df6-aeec-1be93b31ce89", "value": "768:09DKo91cbdWa3SRqbSEln5IyYpamDjobj8SpM:QL2bdBSRqln5IUmDjoXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882696, "uuid": "1851656e-c380-4c42-9942-f96cdccdd20f", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882696, "uuid": "27bc3f86-cf36-40b3-bc30-0e55371dc72e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882696, "uuid": "916f1b92-c091-4980-aae9-3129b0becda4", "value": "f0bbd9618077c745466cf29439b0446e2ec19ce9ada97943a0288c683d191b1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "266f1e4c-b0dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676869939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869939, "uuid": "726821f5-2c6c-47bd-afa8-8a106c304dba", "comment": "Malware payload (Mirai)", "value": "d66137f1592e7e5a0c63450d32d0ecb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869939, "uuid": "900e830f-0616-490c-977a-49f95135b590", "comment": "Malware payload (Mirai)", "value": "f14c4b4c8891578a8cc34e14d10b4c722c7050eef17836ab2448df500fd0e14c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869939, "uuid": "69975525-a895-42ad-a8aa-6da81f9c8d5f", "comment": "Malware payload (Mirai)", "value": "4c68b5048750c89548fd56f31f4c149487482cd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676869939, "uuid": "34009933-bca8-430f-971f-d82267c749cf", "comment": "Malware payload (Mirai)", "value": "49a7e64bdb2a77fb52a527004b752a8520d89440fbe899eada067f30b6101161f664b2cc09a5593327c0811f8244aaf2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676869939, "uuid": "b8bfa247-b6fc-4ff8-8a5c-5dbb370fa085", "value": "T10ED2F1B9B922C4BBD79E153B5062EA37784DB0A1C7A7D3E302C1701BB01BB130394E44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676869939, "uuid": "643c32ed-99b1-48b0-af2d-dff793353d8b", "value": "768:V7N8nO88agW9focDuBgrmSI1lPHIJbikQEGidd5/:VR0MmNoi++e1H0G6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676869939, "uuid": "a96020e6-b0b3-4111-9eed-fef719b4534b", "value": 29920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676869939, "uuid": "af2e0f40-4b1c-4e6a-ad71-8091e927e05c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676869939, "uuid": "b3d91c01-87d7-484d-9244-272eedfedf8b", "value": "d66137f1592e7e5a0c63450d32d0ecb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b631b2-b0f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676881883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676881883, "uuid": "1f21929e-2c6d-487d-bb31-10bd50beb74d", "comment": "Malware payload (Smoke Loader)", "value": "cfc568115bb0d4a53868911df3c52943", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676881883, "uuid": "98983ab7-0034-4f8b-93ba-6c29c02ef82b", "comment": "Malware payload (Smoke Loader)", "value": "f23bf048e15eb819af71c70acfb23c1cb4f2812d68eef9f53c326662e3b68225", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676881883, "uuid": "04319a33-57d4-4116-b1dd-73f86e472d14", "comment": "Malware payload (Smoke Loader)", "value": "b85dc340b793bf52d8c73ae63b777191ae588204", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676881883, "uuid": "b40065e3-32e4-4277-addf-0c593c2a8544", "comment": "Malware payload (Smoke Loader)", "value": "3ab7d733991cf47a9f0ae050835569b1f8cb42b38e86bd0d819d4b8912dac6d637a081fad5ae802e3838529f3b91e693", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676881883, "uuid": "907d3bd8-d8e9-4f68-954a-7e8314df46be", "value": "T19334AF03F2E17C61D4164A719D2E96E47A6FF5218E597BEB13284B2F19702F1C2B3722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676881883, "uuid": "995f04a3-cd73-4c3f-9baa-96f1f829281d", "value": "ed191fd45aaa30104c7d529493e68118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676881883, "uuid": "3d0eeaf8-478a-4f87-abdf-7eaa21bb699f", "value": "3072:Y+RahcBfL91P5VOa0k0DlyElWYhZWQ6QCKVL67QiTtHAMHl8FyFLf5ZBfBh2s:vycBfLNVOlD0GFVdVLMQixHXukLLdH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676881883, "uuid": "199d49eb-bc1c-45b9-8839-7e18fd6f3624", "value": 231936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676881883, "uuid": "9d46b8ad-951d-45f0-98e1-4af39573dbbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676881883, "uuid": "5fda4c0f-a7ed-4318-9ddd-9c4b88c7cb68", "value": "cfc568115bb0d4a53868911df3c52943.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f379da-b0d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676865622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676865622, "uuid": "79c150fa-c8b6-44cd-87a8-bea026eb45e1", "comment": "Malware payload (RedLineStealer)", "value": "6a3f7d655a09266272aa57b6dd1d5025", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676865622, "uuid": "00402ae2-9db5-46f9-b70c-646c94ac90dc", "comment": "Malware payload (RedLineStealer)", "value": "f242ed6ebd26e1f8c0f3b5aada580731d9dec11cc552514d4529069a5163fbb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676865622, "uuid": "4fe1e652-8454-40cf-8a83-19be7d147935", "comment": "Malware payload (RedLineStealer)", "value": "9c279e22f86155e6f01d4602ffbb4b0564458dd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676865622, "uuid": "cde5a610-f4ad-41e5-950f-c1b9287a39e7", "comment": "Malware payload (RedLineStealer)", "value": "07bf15596516936a5a28721f21513a41aec726ac6a40d987f62396f3fb4a3683a3a3ba90f92d1ca98e664b441f693a1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676865622, "uuid": "b3349a7c-6595-4a1c-98e2-a91162ed1415", "value": "T14034CF2173A0C031D1AB25306875D7B25A7FBC32667688CBBB943A6F5F302C19AB5717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676865622, "uuid": "8ff3f98e-e37c-4643-b343-2b94c69a47e3", "value": "d3d7f90f1fed92ecb35a60d3b673be12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676865622, "uuid": "da09f670-58c6-4271-86e9-38da63259730", "value": "3072:W5G3S3XRf1MoKnkzHKcSbUnJzkkEdgcKr7E:iB3Bf1MPki0Jz0GcKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676865622, "uuid": "78c1af45-2605-4839-af80-965c09f4074f", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676865622, "uuid": "4577b517-4c50-4ff1-b7df-f3d98f596b47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676865622, "uuid": "e61c51d0-04d9-49f4-88c4-ec2ee963c539", "value": "6a3f7d655a09266272aa57b6dd1d5025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21193b92-b0ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676863488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676863488, "uuid": "c809befb-69f5-4152-8be5-45472af170c8", "comment": "Malware payload (AsyncRAT)", "value": "e2a958543a3900c20effc35ae2bf5456", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676863488, "uuid": "884a27f9-721c-4d1e-80d2-30e623dbb0f9", "comment": "Malware payload (AsyncRAT)", "value": "f2553908efbbb55b89f79b20e175023a427fb5ddc225cc22c578f82227e0175f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676863488, "uuid": "fc6fb104-a6f2-4757-8ff2-e789a7b056a3", "comment": "Malware payload (AsyncRAT)", "value": "87ff54ecc42b3a55c712564bbca75ef472f82bde", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676863488, "uuid": "224c1724-71c8-4ed0-8def-628d48ac02f8", "comment": "Malware payload (AsyncRAT)", "value": "762e8210299288ecc486609e80847ccf69405a982c1f35d6cb25d864dfa5972c486408167074e464511ccb6b301c40f0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676863488, "uuid": "8b03a197-3c92-4d29-9f2e-66973ab3fa09", "value": "T109533D043FEDD129F2BD9EB099F3754446B8A55B6A02D64E1CD412DA0A22BC2C9437EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676863488, "uuid": "8c9930bf-1703-455c-acb1-85d83ef25ede", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676863488, "uuid": "909644f7-7a6d-40ff-a2ee-e44890751654", "value": "1536:5nKDtaNvPmM5OQOI5WbWFttrB3GDseq7gx:5nKYNvOM5OQOIEbWF1GDvq0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676863488, "uuid": "ad1e49f6-f475-439e-9cbc-3ee830204393", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676863488, "uuid": "939a9996-5462-41b2-a654-374f78b26970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676863488, "uuid": "9915615c-4adb-4fde-9d24-cb42901044af", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc91634a-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676882700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882700, "uuid": "c36a8193-d582-4f2e-a410-8cd037f3ea60", "comment": "Malware payload (AgentTesla)", "value": "8f77e44710f96d7f16b11f7da70f2693", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882700, "uuid": "b2be9b7d-e9b6-4575-a24f-b9086b8d25d9", "comment": "Malware payload (AgentTesla)", "value": "f372f32242ba5521234305f8d8cb0f314b89be5417f875e9f2789348fab3d3c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882700, "uuid": "1afc32f0-2735-4629-8df4-1b37d007ea91", "comment": "Malware payload (AgentTesla)", "value": "17680e02fa65ba085aa23e48475cacf46005e5d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882700, "uuid": "f9d70f62-836f-488b-9eed-ec55cf804b5e", "comment": "Malware payload (AgentTesla)", "value": "ca2efbda30b221f6253b387660e9b37e9c55832ab86d0b52141fdb86f039b2064219ef6dea1f9961c0466eca68dbcf0f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882700, "uuid": "8fa1763e-425c-44d5-9242-1796945f2fbf", "value": "T1CD6412088751C4DFC4634FB11D3767BB5F95B211D0F819AB3B9142D9FEB6280981B7A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882700, "uuid": "45e84dbc-ab94-44ef-94cc-edbf5acc13e9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882700, "uuid": "f5bd0678-0a4c-4aa7-91a8-c09de88819d3", "value": "6144:vYa6Qm0s9LqGpZmWa8iWfnOt6Ntb94HmtKWp24eoINBn16NnFKWm6DwedNCKYt2i:vYGm0PgdIWfxNz4sk4eoYAxst6skBA2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882700, "uuid": "493f68e2-fa61-4047-975f-7ccd026e5721", "value": 332289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882700, "uuid": "71dc266e-5a23-40eb-807a-c6db2b83afa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882700, "uuid": "c4a0d6ff-b6fe-4f4b-a29b-1ab8ab46b3d7", "value": "Inquiry#09221_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd9edf9-b0f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676879426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879426, "uuid": "37e6d8d2-af98-4e66-a829-ba68110a4e09", "comment": "Malware payload (RedLineStealer)", "value": "9f04ab985cb0c529075c16f52e89d53e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879426, "uuid": "978e3978-f7f9-4c27-af17-d8bf9ef14ef1", "comment": "Malware payload (RedLineStealer)", "value": "f4470e707ade0ff091f079efb030b6a503951dc13196d29878ff6922ae659064", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879426, "uuid": "2b3438a5-cbe0-494b-b8b1-82d38842fc07", "comment": "Malware payload (RedLineStealer)", "value": "3322983160d439a0fcb3d6efdc13b6d41e88368b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676879426, "uuid": "c6bed209-5cd7-46ff-9178-c4e201f6bb22", "comment": "Malware payload (RedLineStealer)", "value": "644c8ca85396c7805810212ccda41ee417f21f37bf1a564a4c79575ca0ae36e013b4c4a17977b85b95deb8dc00f1676d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879426, "uuid": "433925e8-eb7f-4d0b-a099-e6b5330aefed", "value": "T10D14D0117BA0D272C0276D7094B59BA12E7EB9312364D56FB7A91B7E0E302F057BA307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879426, "uuid": "6b070fd8-6c09-4410-b727-d13074fa345a", "value": "c33891a90cc721ae1c38ffdfc19c51ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879426, "uuid": "08ea1a83-c554-4241-9518-508d0d73e076", "value": "3072:v5ZEqiVuwfLFM1fBoP4UMswrICFfZl+2gNa1CsAzeEEatoTKvt1S:vBiIwfLFSoPzwE2fZI2gNa8WEEa2iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676879426, "uuid": "1f866267-72a7-4d86-a31d-1409c2cb83a1", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676879426, "uuid": "16bc0843-f856-44e8-8272-78570b42a079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676879426, "uuid": "27a3993a-0863-4337-8b82-7ece39624132", "value": "9f04ab985cb0c529075c16f52e89d53e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e259dbb-b0ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676863456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676863456, "uuid": "a466d0cd-9e92-4c27-9696-7bab2e28c3ea", "comment": "Malware payload (AsyncRAT)", "value": "ef866685b2c8e9c7fb3ac18e54a6fa95", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676863456, "uuid": "e20e16cf-c60c-472a-9e75-6d99ddbdbea9", "comment": "Malware payload (AsyncRAT)", "value": "f48b72f04edd5ab7cb1f60bb7aa5a5dd3bd789833948cc61f16307b19e4ec741", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676863456, "uuid": "ac550e43-b5ef-4c84-9839-c5cebf44780b", "comment": "Malware payload (AsyncRAT)", "value": "63f545708962788785c44907859a8447d01cc25f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676863456, "uuid": "71f70e06-accc-452c-a4b4-91bea6d1a57a", "comment": "Malware payload (AsyncRAT)", "value": "982e7ebad4d38baad18b5da4acd324f385a34d741ac0367d79a8495b0a747a95ff91277db10cf3edfe4cef40e10d3afc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676863456, "uuid": "f5db77cb-c2e0-4227-b1a5-2a4dd57498b1", "value": "T15A54ECB564AAC899F94BCB41767CFFA411B270F399C91A60133C6604CFE9FA52F4814E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676863456, "uuid": "3f19f807-35c1-482a-818b-48014960ac00", "value": "3072:zeDnIv1vZP/QIYOcvjXni/mbTVxowmGcAl3Ap3:zeU/QIYTvjXimFxowmGcAl3Ap3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676863456, "uuid": "19200bc9-f3c0-420a-853f-45a76fac62b5", "value": 293263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676863456, "uuid": "92466e0b-a606-4d4e-9970-eb8e7a6b93ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676863456, "uuid": "3b660ea3-5d3a-4a7d-a2ea-1852b8b0fabf", "value": "img.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3c3f6c-b156-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676922109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922109, "uuid": "94804790-1613-45b5-bdf5-8391cfd3ff54", "comment": "Malware payload", "value": "f775a5b2c18eb0f36530a4a8c4941e02", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922109, "uuid": "5902c5a2-1496-4cfc-92c7-bb014b63b64a", "comment": "Malware payload", "value": "f496648ce36ea9395635faefd270540d400b95d6183364af1bd9e42a7630c337", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922109, "uuid": "31e381d2-f406-4c47-9930-e70a907fe899", "comment": "Malware payload", "value": "6820a79ceabb72d3753b4f1433a9af162973ae95", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676922109, "uuid": "1820c7ad-2a92-402b-b03a-7c6a7e53ff82", "comment": "Malware payload", "value": "8c395704458eb0aa818d760b2bef661d316097741d283281a2dadd027a5819e54cfd3f82523957fbfa9592869ab2afb3", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922109, "uuid": "14239f39-736d-4423-b2fd-21040ebab6b1", "value": "T1BC3523138A01DC97C12E0339F1250E60A3AD0D2159576EAB24A73DEE5E367736EDF18E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922109, "uuid": "b4bd876e-04b8-4cab-8438-e3d4d854426f", "value": "24576:Ei8VM5k9uDndRbEkjYWajZYxvLEUgrXVFcIWuEvUGbawgKVexDwd3V5cK:EikKk9UndejYJLdIXVFjDEppgvtEVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676922109, "uuid": "a7f4ec75-30d1-40b1-9366-37b767e4147c", "value": 1147583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676922109, "uuid": "8ec8d514-0d54-400a-93a9-f64eeacb87c7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676922109, "uuid": "1376bcef-faa6-46ed-9d85-5592611d657c", "value": "f496648ce36ea9395635faefd270540d400b95d6183364af1bd9e42a7630c337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93024c0-b146-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676915363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915363, "uuid": "bae175d5-3966-4116-9ead-2df75e93123b", "comment": "Malware payload", "value": "a006bb4ded77c77b4d984f498cb786f3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915363, "uuid": "ad7104e8-ca5f-42cc-bf77-8473a48f583d", "comment": "Malware payload", "value": "f549c6af01bbef3ade94013a01a7e9d688882f01d8095009d36bdb761600a30d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915363, "uuid": "bca328a8-e440-433d-baeb-2c038ff0d4e1", "comment": "Malware payload", "value": "b393cf556daca1c3359e358823a07040e6e8acb6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676915363, "uuid": "957b0626-8efc-4afd-9fcd-aac9ac5d5cb0", "comment": "Malware payload", "value": "df5062c626e0460335d15945e0991e68beb10e856686aa934cfc43e6da7f053ac459534f9571e83a4c70091d015216de", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676915363, "uuid": "19248a88-1194-4596-a6c2-7c47633d7249", "value": "T1768423AEE6C8ED81C0056BBA66B940FA336504724932B077B50A853D1DB2DE74397F4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676915363, "uuid": "cceb5764-73b9-421b-a6a8-1f892d6b0363", "value": "6144:qXFIQrRIXB3gyCMtO6u+GGcRA7umhOLwPZuUg9G0uuOPazw1LpUpaIqKCQx:ktIXB3n94dGc0lmRLI0P5zw1LpUphpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676915363, "uuid": "792e8385-fc5a-4a12-8ff0-4e738f45a85c", "value": 374096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676915363, "uuid": "77bc502d-40ba-4785-aadf-154f49af3908", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676915363, "uuid": "1bf25308-65fd-4eae-965d-6c52b2448d54", "value": "Reservas Details.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6155d2d2-b0ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676876910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876910, "uuid": "6d9ba153-b6e4-43fc-9dec-81ee2cd6f522", "comment": "Malware payload (AgentTesla)", "value": "504b9101a5a633de932a5a2c8f5b302f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876910, "uuid": "1a13440e-ca0b-4afd-a902-9b4108994f54", "comment": "Malware payload (AgentTesla)", "value": "f62618b888bd1d305f278cdb50711f85a53f2101ba44067408a647682fd3fee7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876910, "uuid": "151f1d8b-ffcc-4924-b4f6-018fe814fa9d", "comment": "Malware payload (AgentTesla)", "value": "1cc81c681824263032f88652b82ff73821ebbdb4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876910, "uuid": "b19600cb-5782-4f32-b6e0-79232817e2cd", "comment": "Malware payload (AgentTesla)", "value": "79b7198152ca12d9b15aeb0dcac2c055a32053a12ccdb426e2e9c3b735f68cb7d5b7e2e0fc29810d1d994af78a23e2bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876910, "uuid": "47fa1326-e5bc-4e5b-87f5-3eda70d82f2d", "value": "T17113905AE79E0264CF9112B7131B4A899AFDB33EB35054A138AC933433EDC3D46665BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876910, "uuid": "c7cd293b-a89a-4ec1-9a90-a3490c14d42b", "value": "768:lFx0XaIsnPRIa4fwJMb+3nUYWZx+UHaSEBnTvS4q2JzLeY0MK:lf0Xvx3EMsUYy/a7BO4q2tLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676876910, "uuid": "bd9b7784-e2be-4745-953e-9247cfad5a87", "value": 45455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676876910, "uuid": "31c10115-e2ea-4195-ac96-7757305879a2", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876910, "uuid": "7ba6ea83-67e5-4ccc-85b3-e3f02cdc06cd", "value": "Order20230220.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7f8678-b11b-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1676896766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896766, "uuid": "3a5aa84a-93b5-49f0-9b44-a90a9c8f28a7", "comment": "Malware payload (CoinMiner)", "value": "22a9265676ffebc71d888f0c57af9fd1", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896766, "uuid": "e142d412-17b5-42a4-812d-353135d670ae", "comment": "Malware payload (CoinMiner)", "value": "f63921129822475dd132a116b11312ebbb0cdc8b54f188aabeb7cf7a8c9065fd", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896766, "uuid": "e4a2ed90-3756-43e0-b01b-29553ab80bf8", "comment": "Malware payload (CoinMiner)", "value": "fe5c0686830f3e5f6b244cda15561a3b65e95b75", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676896766, "uuid": "c83676d5-a971-49d6-8206-8f6d0f646b88", "comment": "Malware payload (CoinMiner)", "value": "0cc8962c8132538a28b02375f29e31e23179dd3b8b8f96a9eaf25ce286b30b9ad04e1467d34fa93da06fdfbddb1316c0", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896766, "uuid": "91e1d0fc-414f-4cec-9a18-bece3cb1b75b", "value": "T1DA16027BF251DEFDC046CAB458D296B05931BD641A71138752CD330E2AB2E902EAD7CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896766, "uuid": "21a59951-83b2-4e5f-9d5e-12ce683f8c21", "value": "2a9a8afe0c4589826f3e83ff7470eb91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896766, "uuid": "3956dc27-5a20-4311-ae0f-9e07edcd94ee", "value": "98304:IgJL8qIwELol83T8QhbXLISpFPTVElvzPSp/2e:IikwjQJXLImVSPSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676896766, "uuid": "53f18e47-8491-406b-8937-abb745545f9a", "value": 4353552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676896766, "uuid": "3862d00e-ddd6-4221-bc4a-9c59a07623fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676896766, "uuid": "49b19c77-f573-4ad6-bdfd-8d0c8db94d35", "value": "22a9265676ffebc71d888f0c57af9fd1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da62a0f-b108-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676888527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888527, "uuid": "28781486-3ffd-4f47-9d5c-e60699c91973", "comment": "Malware payload (Loki)", "value": "c647ab911862f2b75ceb0d762334f055", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888527, "uuid": "a0553b70-51be-494a-9d17-c4eed763b3be", "comment": "Malware payload (Loki)", "value": "f6492ad0470b829459520b18427a41f67050e926656592ddb0effd892d57d0db", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888527, "uuid": "ca73c501-dbab-4597-9b89-59c139cda365", "comment": "Malware payload (Loki)", "value": "52fb85f679cd7fb96e742b3d47c719e0eca6eaed", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676888527, "uuid": "7c9d6d99-14b7-420b-9f36-83c9f1ee1971", "comment": "Malware payload (Loki)", "value": "ffc2aa5f34db2ac9988cdcfbd234b0c1830faece1e468dd39ae9da2134d1b9b5aba7474180a6bc1e8ac48192868634c9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888527, "uuid": "90ce7e72-f905-441d-b1aa-015958b7f465", "value": "T1E754C8C27F50E116F4507F310CE247662322EEC66A52560B2299B31DED74AF46E2F6CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888527, "uuid": "aff2c7e3-19c0-4a33-9a0d-94a733934c0e", "value": "3072:1kZ+RwPONXoRjDhIcp0fDlaGGx+cL26nA:KZ+RwPONXoRjDhIcp0fDlavx+W26nA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676888527, "uuid": "9482730b-3cab-4d0a-b202-938faf18f994", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676888527, "uuid": "0dcd2228-0120-4532-b956-1f87ca33ae8e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676888527, "uuid": "63ed134b-f7d2-46c6-bca9-baab67d59060", "value": "CI__26_PL.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa3311d-b0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676882697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882697, "uuid": "63012b20-50af-42db-810e-4d52b790d629", "comment": "Malware payload (Formbook)", "value": "52ba9890b2da1b2d8cb2b5a2bb0c65e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882697, "uuid": "16e5bd0c-e4d2-45fe-a905-9471728b3e5e", "comment": "Malware payload (Formbook)", "value": "f6530f654262274b3f1debb0bc6b3de7686fd551224a03a3d0814b45c7e431ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882697, "uuid": "f2031481-8f17-4382-9429-ba081e7a02e8", "comment": "Malware payload (Formbook)", "value": "b6c725e86ee7e6da6eb231d59105a9af9d8c000e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676882697, "uuid": "22d324ea-535e-4e3f-a79b-71f0562d969f", "comment": "Malware payload (Formbook)", "value": "34c79633f15c643a2822129b3d5f24e6b0571eba71bf38827de84878697889d211aed5d95fc31a5433915cad16bcf259", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882697, "uuid": "98772ec9-49aa-43e1-b60a-2cb107b9403d", "value": "T1F504AE32D601C031F2B251B5F6BD0B7B483E0D347295A0EAA3E116A06FE55A6F57A31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882697, "uuid": "0a4036d6-6514-454d-bcf6-1f6bacfdec3b", "value": "3072:vueNWkFE3SqMayvyF03+gj+JL9afNaTKZwVcMM73AKlNDfMMf0:TM5yca+GYafgTKMcjlbMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676882697, "uuid": "535dacf5-addb-4bc4-8bae-497e707ecd5e", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676882697, "uuid": "3a3663b1-bb68-4c16-baf1-46d8918cb382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676882697, "uuid": "66e0a554-f79e-4281-b4df-850172f2dbc9", "value": "f6530f654262274b3f1debb0bc6b3de7686fd551224a03a3d0814b45c7e431ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a80f7e-b11f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676898452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676898452, "uuid": "239a8726-3b1f-4475-b2a8-13abbcba324d", "comment": "Malware payload", "value": "894a9b91f0d1110009b2162628fb3d97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676898452, "uuid": "332ea2d8-ce37-4d6c-8f69-07ad1db58741", "comment": "Malware payload", "value": "f805b049f875b23c5b4a2c5e32846ee70dee5f70b76b20d4268f93d8ad36661c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676898452, "uuid": "70d4ad18-31e6-46c5-a0e1-c1e82e08abb4", "comment": "Malware payload", "value": "3910e19ecda6ac93f5a9f6d7181ae82c0201050f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676898452, "uuid": "39c1df41-b5be-435c-923e-fea1c8dc3808", "comment": "Malware payload", "value": "1d0d5e16cbcc2bf1000d7727c4164174a3aaf2a7f0309d02fb200cf9fe2e980c9dacc871e9a63f3f63301487c19da269", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676898452, "uuid": "f36d32f3-91ab-4edd-9384-29aa84a74c42", "value": "T1EE845251DBEA448CE8F078FACC35F0B063265D2A097509CF8A5879185535FDE18EBF2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676898452, "uuid": "ed7318a9-d09c-4163-943c-fc1f2ad85ebc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676898452, "uuid": "3ba5ac24-d26c-45e7-99c4-50386d368e72", "value": "3072:lr4snQt+OLsocBvEUodZRniBIHmSwOu6wbcqMRc:usQt+OLsocREnq4whCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676898452, "uuid": "f1ffde08-785d-4d73-a13a-01631e9d14f5", "value": 378368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676898452, "uuid": "84a30fd6-e842-4161-8741-0df64ae0e6a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676898452, "uuid": "c9a6f7c7-50e3-4cb9-86ac-82802321daa4", "value": "894a9b91f0d1110009b2162628fb3d97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a26fdb44-b14e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676918680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676918680, "uuid": "ac52ecae-5aa7-4761-8b1d-c335a4feaf87", "comment": "Malware payload", "value": "e06594d09e1147a0a66b78b881ba9b30", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676918680, "uuid": "40a365ce-c974-4d09-ae83-2862823d1597", "comment": "Malware payload", "value": "f8ace9f5d6fc73d24689b29bed0a6d1c2de00a23b32c96f4d091f1ebcb47fc23", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676918680, "uuid": "d5143b83-58ba-4f2b-b402-07fb850e8fd6", "comment": "Malware payload", "value": "44e25c5eee6024687a05b01f07b71699c47b0ab8", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676918680, "uuid": "f7925057-0ed4-4b47-ac32-4c3cba6aadc5", "comment": "Malware payload", "value": "e16fcaecd3cd763d5ab483a924ae0adefd160d2ba61f790f0cea4c0900bb7485caa332f17ec948c925d14b2d42073a36", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676918680, "uuid": "c848f95f-f72b-478d-a0f2-292ca6ade25b", "value": "T19992C0699E8464E77761C9C2FB831B3C9514D26D03FE9AECA836D8E7A857062172803D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676918680, "uuid": "3b5c6ff1-c328-40e6-9eda-f5bf83b3ca50", "value": "384:bEPxBaboGaU9RZ40qtua6uvE0psrMWPTa2GXx6It2WobNcY3moQRSAw3Cx/CGJ:bE7Ga4b6u8Rlnl6IlohFmoQRvw3eV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676918680, "uuid": "2c0e537a-9982-4647-b5f5-01316f0ac920", "value": 20677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676918680, "uuid": "8b28d905-057e-48dd-8743-14b4098b22c2", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676918680, "uuid": "c77940b9-9039-45cb-afe2-08916828556c", "value": "78fb1d38-d17b-44dc-03a8-08db1356f400", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf40822-b112-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1676892927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892927, "uuid": "45619bc8-48a4-4c16-8993-65bfabd7ce5c", "comment": "Malware payload (zgRAT)", "value": "d22cd7d032bb2d7bf5e55a811157bd34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892927, "uuid": "2ee6415a-ea94-4019-9067-ecf8dc919454", "comment": "Malware payload (zgRAT)", "value": "f96ce425352e621d1143cd2ca48eaf3423625fa4821e81c494da40666b59fb71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892927, "uuid": "f412ea08-ff56-44c0-a11a-c678ae314df5", "comment": "Malware payload (zgRAT)", "value": "4bf174c56d380f0b96745a2792e4d8de6b2d1a06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892927, "uuid": "8d800238-7467-40e2-a162-f53761b996d7", "comment": "Malware payload (zgRAT)", "value": "1b2300081f24369cd5b7e5c3fb22106c1f740c2369ca36b727748e6e9b23c4911e4002ad6dbece13ff10c2b78bf3edd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892927, "uuid": "51624996-bfc9-4dbd-8f21-4f67ebcaa6e8", "value": "T1BA0394923259C026D424A5FEC8E7E6E4937BBE599D22D60734B4FB1E3E37393C952408", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892927, "uuid": "624b24a1-ef60-4fe9-9b43-0d43228a6775", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892927, "uuid": "3fb0131f-553e-4ba0-9385-a90112a518a1", "value": "768:rCVe0QS//g9EQigUJwHVN93zwtI2hkYFxIuqF3hKk:qR//nnJCVNGtn0uq3hKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676892927, "uuid": "ffea3b63-f59d-4e36-bdcd-4766b7bdce2a", "value": 38120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676892927, "uuid": "701015fc-99d8-4513-9820-f19f4bac9710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892927, "uuid": "f4471d68-a969-41e3-bb23-5439be4bfe29", "value": "d22cd7d032bb2d7bf5e55a811157bd34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97f48db-b137-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676908921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908921, "uuid": "4dd9711e-f7c7-48c7-aa69-933edcd5d4e5", "comment": "Malware payload", "value": "e2624e0c9b0bc56f03aaede9623cec3c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908921, "uuid": "689c78cb-ab1b-4b07-8583-64ddd509bd2d", "comment": "Malware payload", "value": "fae9f6560aa01d38586018b75adf289735c7760cf7f19cb93deb73d9ff5461fd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908921, "uuid": "d6a7f076-735f-4fb3-8f1a-254fbd5e6dd6", "comment": "Malware payload", "value": "67f194350b92589e87537bf6ccf3006e4a370b0e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676908921, "uuid": "dc6d7d6e-e023-4545-a593-800b4eeef1de", "comment": "Malware payload", "value": "f30bf9434b6f43c7de5c70a48b1204a3ada83fdb82cde85a313b7a3cf3dce6711367defff16c4f5daa7c961ad47b912d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908921, "uuid": "7e6104a5-085c-4134-890d-3e74fb8de075", "value": "T1D391D5F5264C1C17C51A48F1C5E6BFA22665F63B8ADB2715932FFDF3496B05249220C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908921, "uuid": "73f364f1-3c92-40b0-9b74-ab6ba7f4c993", "value": "96:wh6phdXUXJq0tHYmhKvN28aErngpGNhY9jiu8D:wofUXY4h6NB1gpGXYNB8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676908921, "uuid": "4cec33d6-8650-4617-bfb2-148f47a024d4", "value": 4288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676908921, "uuid": "db7363fa-8e92-469e-9fbe-f04880fb7817", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676908921, "uuid": "ef60938e-1ea7-4dca-b712-ea7ef0124304", "value": "PROPOSAL.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31c49f1-b155-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676921769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676921769, "uuid": "4eede434-a2d2-4a64-8492-8d634c0e6a68", "comment": "Malware payload (AgentTesla)", "value": "c0ee8d87db57a49f913099e441709616", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676921769, "uuid": "77044f8f-3b3c-4964-9f2d-d36f85cd0596", "comment": "Malware payload (AgentTesla)", "value": "fb8233f06fbc028a8f6454fbc409a028f6e04b0f9e1b53a84ddf16c2ced8d39a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676921769, "uuid": "51b7a107-4dc8-4737-bd75-0dad9a611fcc", "comment": "Malware payload (AgentTesla)", "value": "80a755f938e11d81b2e32c90c659366f751e7d98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676921769, "uuid": "df6f8fa2-fa41-4bb9-a004-2430399d950f", "comment": "Malware payload (AgentTesla)", "value": "f500bd39a950b1b8eeb7be315a0ece736ec2abcfcb4429cb9c0cfaf9faa0202956807143967dff1f4d14f9f7692b6eca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676921769, "uuid": "86cccbf9-05c2-4c89-a4f0-f48d08e8ccba", "value": "T1FA45330FA75ECFCAD3D66E37F27508A221ED8029A1D2DC90645BF9530E009E9253E8F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676921769, "uuid": "f739f0bd-0020-4f26-a093-6f64fcfd099c", "value": "24576:FXUKIpVnmu16VmoQtmyS/KTlpah2MSARDEbEg//LHzrFxy:t8Vm46okyS/KTPah2MSA5EbvzH/fy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676921769, "uuid": "78635b24-952b-47e6-bb19-70c1f9afbbfa", "value": 1189725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676921769, "uuid": "8442ecc8-12f4-4690-9d4c-6c88336fc6b5", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676921769, "uuid": "2710d042-04fc-4407-ae00-6963deec4ff7", "value": "new_order_quotation_200220230000000000000001_PDF.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3c8da5-b0eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676876284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876284, "uuid": "be144145-8925-46e8-90d9-5ce300988503", "comment": "Malware payload (SnakeKeylogger)", "value": "39fd888c1497bde768c2aeada45a0c3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876284, "uuid": "89e4ce7d-03f3-4c50-aa06-3c6071e6e603", "comment": "Malware payload (SnakeKeylogger)", "value": "fc3669875257ee267e479e6c1646c3fbb7427070fbb973453a771aa60069caed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876284, "uuid": "f77809db-6a8f-41f3-9042-783f819f1d57", "comment": "Malware payload (SnakeKeylogger)", "value": "3e898e40e6ecd1bcbbcb847a18b95e07bd506344", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676876284, "uuid": "84c4a7ac-acbb-416a-b9da-5134bde85fbb", "comment": "Malware payload (SnakeKeylogger)", "value": "59ac44fdd3c2407f916674b861d05ddfaafe38efba1fd99664dddb4236716f1354cbcabb7720408d92fbf53b05704ef7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876284, "uuid": "db96bc6d-bb91-4731-8cb3-db14c6325796", "value": "T1E2F47B5977B49073F48B01FE583827CD2E3026137619E22FA777BB91A2719FB7299201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876284, "uuid": "073c74fa-0c95-44f3-a222-1104542e3592", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876284, "uuid": "cbd8addc-de99-459a-9026-4d70f1a64fde", "value": "12288:GJfUB2mjRnIu8apB2A5NLg2Lcr45imptkgyz+/1gWybr2ay4eaIXSPJcH:GJMB2quw+A5NZN5hmgyq/mWy7IL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676876284, "uuid": "317095ad-8293-4674-a916-a2c193928dbf", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676876284, "uuid": "61520e6b-a1f2-4b78-837d-377cb5a1a73c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676876284, "uuid": "9147f072-7fbf-41c0-8573-3eb523e03d43", "value": "HESAP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ddf908a-b112-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676892903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892903, "uuid": "7ded17bc-2f45-4ff3-bebb-19395cf3e8c2", "comment": "Malware payload (Smoke Loader)", "value": "496f79f65fe67127ad07b18f8e8560dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892903, "uuid": "007f1966-ffc9-4735-8d02-5abbc536913c", "comment": "Malware payload (Smoke Loader)", "value": "fda645481f01db3d67ee5b42d6a46a1b14b106eaa5e46e218056eca7249aba73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892903, "uuid": "45b3e7ce-11de-4ff3-919a-c77e9a70eb2d", "comment": "Malware payload (Smoke Loader)", "value": "47ea598111493706138f72cc448572698a515db9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676892903, "uuid": "919b4809-8ac7-467b-b24b-61ec7e645056", "comment": "Malware payload (Smoke Loader)", "value": "716eaf9a35eabfed22e5c638a1efa0e6bc4644ef1f13d20cdc267b035557a703c180e91f2fa380795a664604af4eec77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892903, "uuid": "f474a533-3f7a-42dc-8776-1dd9d22dd12b", "value": "T1EF14E012B5E1C4B5C46755B38421EBE40ABF7B2D4B21C98B37A817EF2EB07D106B9316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892903, "uuid": "17cd0c17-5da4-4000-ae76-eb0bd888f478", "value": "1dc9c32af2b0d0927717a78648d34c5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892903, "uuid": "f79cac5b-9fc8-41f9-9cc7-c6e968a2308c", "value": "3072:LCbve/pMmxLPN/eDPQfHUI75Do0dhn8ZBbQV0hud+Km8knI9Ar:+IpMmxL0DnI75dhnsMVx+KmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676892903, "uuid": "2e8240ef-90d2-48f0-b26a-cd983230fe76", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676892903, "uuid": "a7230186-0cb6-4952-b902-06959f1eedde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676892903, "uuid": "abdb7e47-e09b-49df-90d2-97917570b1f1", "value": "496f79f65fe67127ad07b18f8e8560dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436bcd35-b0cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676862686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862686, "uuid": "25d1ae74-dc6d-4a79-880b-f22a32f8df62", "comment": "Malware payload (AsyncRAT)", "value": "9877364c52f76487181d5da76adfd121", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862686, "uuid": "5ac58b01-e0b2-40eb-b482-a0ddac487c8f", "comment": "Malware payload (AsyncRAT)", "value": "fe9b163fd9645a16adea5f4655be3d072e5459e753f52c3d292637f5d41062c9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862686, "uuid": "6944cb7b-c5d2-4b1f-a24e-b66531afe5e1", "comment": "Malware payload (AsyncRAT)", "value": "4580eaf814a1a738132438abf62f9c186ec6ab03", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676862686, "uuid": "75119f77-ea9c-410d-bdb2-a673b32f2d23", "comment": "Malware payload (AsyncRAT)", "value": "ffc719c891eeaae47bcc75e03d322afb33417d54ec0fbeac7ba7f85aa3b5eda142b722f408789b91eeced98de9073eca", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862686, "uuid": "92574b17-a5d3-4400-839d-36ea29be3eed", "value": "T155533C043FE9C129F1BD8EB499F2B6844AB9E1576902DA4E1CD401C61A23BC2D9536FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862686, "uuid": "083edba8-4787-4c31-9f68-d001ad17b37c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862686, "uuid": "bf235e55-b7f3-4c96-a92c-5a153029248d", "value": "1536:NTnFkQMcYNVT5O8qVpieVLHAb9oLig7824Ykmvrq70x:NTnFkQMcYjT5ONVpieVLHAbyLiG3vrqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676862686, "uuid": "6b9c1c7c-3383-4378-ba56-7e062a8e2c57", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676862686, "uuid": "017b30ba-48f2-4403-842c-3875cbcbfb66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676862686, "uuid": "deca089c-c536-4564-8a3a-db4eba0efe01", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03dc5530-b13e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676911542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676911542, "uuid": "967405d6-4a39-4494-aa41-9102013d4ccb", "comment": "Malware payload (RedLineStealer)", "value": "495dac095856da26310bdaaa1c9e005b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676911542, "uuid": "ca52a4a8-de66-451e-a94a-977deaad1e8d", "comment": "Malware payload (RedLineStealer)", "value": "ff5c4c9e62fe57df136c08296ce2edbe9b34b8ddfa2546e3880e9196d3bb6662", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676911542, "uuid": "be3d1a5d-82e7-4a4d-95db-31ce0489ebcc", "comment": "Malware payload (RedLineStealer)", "value": "e13e14c3c7f6613219806aa244fc14e76d456b03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676911542, "uuid": "dd41a503-0ef5-4a8c-b48a-b6029598e58e", "comment": "Malware payload (RedLineStealer)", "value": "5fcd64c66f74b53410d5895b1c8175e5c903b31e7105fd557261ef4150a928e521a64ee790e923b1d790adf1c3908d6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676911542, "uuid": "6d2f6095-e6b7-4d90-bcbe-a3a7bf071ead", "value": "T103455A23B3F184B2CF62743159BAD664C9F9A72C7E5D446F17B80EAE2B20140D236977", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676911542, "uuid": "5c8cf70b-211d-4058-9f64-3af4d737cdf8", "value": "ad00f804a87cc91a4d9f5cbecda94aa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676911542, "uuid": "c61a2769-35dd-4c84-9b73-1bd5c90c3555", "value": "6144:IakuEaE+4f4/t2AOqozeImU0kD9/ajXIfmxsLcc:IakuE5+UPCItVajXIfDcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676911542, "uuid": "b3b96d5e-c93a-4e2e-82b0-c675c53190f4", "value": 1259520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676911542, "uuid": "a48f665a-5614-4eb8-90cc-c749aa0f4d50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676911542, "uuid": "7416896f-d449-4b2a-8b08-cdf9878b8a32", "value": "495dac095856da26310bdaaa1c9e005b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f20f0c9-b125-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676901039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676901039, "uuid": "127c5dfc-2e02-4510-b752-3d00149c25d7", "comment": "Malware payload (RedLineStealer)", "value": "36f323cc045c689007314dfb2e63080a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676901039, "uuid": "a7d6f8b0-12e8-4421-b3fb-73402d3372e8", "comment": "Malware payload (RedLineStealer)", "value": "ffb9aaeabb07b07ab4f7fb2e4d62dc7ade2e5fb55ed3b43fc38a81ec6fbd4dac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676901039, "uuid": "f48ae55c-738d-41a1-a795-c58b0f186768", "comment": "Malware payload (RedLineStealer)", "value": "af2157b1ab4ffc1e9ab6d3d025f209626da6341b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676901039, "uuid": "7be23ea6-dd75-4ff6-a7d1-5fcf7780e4ab", "comment": "Malware payload (RedLineStealer)", "value": "14fa61b252a745c7bca28e8a4290b7c281ae80224be36f7f6573b2bacb0259aa2ce8d45deae4b3abdcfd4cf4a1b098f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676901039, "uuid": "009b00ca-fd43-4a43-a5f2-41696fba76b7", "value": "T1CD352307B7ED4121E6B807B05AF643C30937BE911A398797738DA95918B37B0E23536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676901039, "uuid": "726f33e5-e5c1-4863-8fe8-88812e0dfe4e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676901039, "uuid": "4d920a7c-53a7-441c-a7d9-4b0244df446c", "value": "24576:qyKYt1Oq8kWJkkTrBQ//Wl+1yl1/0Kbll559XmUqRfjA:xXAjkMkmys1MYll559XmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676901039, "uuid": "fcca5058-e3f2-4c6e-a456-e0eeecd2bf32", "value": 1122816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676901039, "uuid": "03b0c8ac-d817-45de-90a9-6cfed396c28d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676901039, "uuid": "6bcd96ec-f3f6-4630-8c8b-cffe5be53e3f", "value": "36f323cc045c689007314dfb2e63080a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97211792-b0d9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676868410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676868410, "uuid": "426ccf96-1b01-4d57-86c6-154bbfd62b32", "comment": "Malware payload (AsyncRAT)", "value": "aa7fb6cd05270f5bb482093da8797838", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676868410, "uuid": "1d745fca-2e5d-4193-aa3c-eb69191944c0", "comment": "Malware payload (AsyncRAT)", "value": "ffdbbc04470d0abb40347fa73fbe6c0e16cb21689f8ff11c0947fde79baad402", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676868410, "uuid": "130c5191-4245-46a2-8a38-87eab3c69761", "comment": "Malware payload (AsyncRAT)", "value": "922575442c7c281c5a64ea36d1062fc709f4de23", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676868410, "uuid": "7b53dc28-19c0-4e55-b456-23f5fc5791a1", "comment": "Malware payload (AsyncRAT)", "value": "e4c4770ce66d1f9fe35888d0b91cd520dc66125f856b55cb7971c6517572d5fa19d1e91bb9ddfeb50102e582086202ab", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676868410, "uuid": "e1fb4bbc-93b4-480e-9a21-3d781e19ab3e", "value": "T1E2432C003FD9D126F1BD8EB4ADF2755546B9E1976902DA0E1CE411CA0623BC69E03BEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676868410, "uuid": "597abdfd-cf72-4b9f-9f41-be5bb62802aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676868410, "uuid": "0947e21b-ecb7-4a78-ac84-c2f17030e6a9", "value": "1536:tvKDtKNvPmE5OMT3wLH2Kby1tzyvq7Ex:tvK4NvOE5OMzwLWKbyfWqgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676868410, "uuid": "ba5a4de3-1e38-421d-b073-066c6d1b081e", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676868410, "uuid": "bf6a0ab0-2c5d-4d6c-a906-50b9d6d9e342", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676868410, "uuid": "dddeda67-d174-49d3-b01b-da16760ade95", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27623269-b151-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676919762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676919762, "uuid": "bd9865fd-5f99-4c08-99b4-f046682a079a", "comment": "Malware payload", "value": "688748310083488feb4b5d326471e515", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676919762, "uuid": "4667d949-be3e-44a5-b96f-9c197fb5db54", "comment": "Malware payload", "value": "ffe7216be5f3f1938e2b0f4f079a3a2cbc7d7cb9ce8281cea9374103febca17d", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676919762, "uuid": "257eab88-6181-487d-911e-6ead85b9f16c", "comment": "Malware payload", "value": "6a6f9ab15f99be77d13ac43168d721c5a3f88d99", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676919762, "uuid": "046d5101-53b7-45e4-b0f2-81c77ecbd423", "comment": "Malware payload", "value": "c88bb0cfbc3bc15fa0cb7bbfcf23583d0c2ca54845293045c75a67da7eb032db6f87ca76636decd65bad8a16517bcfae", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676919762, "uuid": "aa5bc7b4-ea29-4f0b-98b8-4d8751382e95", "value": "T18E15333E4D80169B3329ED3F6FBD19F9F27D1B0565B41053334FC6AA2F389869A92190", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676919762, "uuid": "5870a2cb-4628-4a3f-8758-48ddc267deef", "value": "24576:qPX1LktBm1F0O8JfxE+NybXW36TkNA1E5iXlfem:qPpkfmeqHG3MBy5cFem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676919762, "uuid": "c2388835-daef-4f12-9f45-07d5931f0c3a", "value": 943433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676919762, "uuid": "d5c663c3-6797-46df-8ab1-b363e1f34ec9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676919762, "uuid": "bfc8679a-4c48-4be0-b377-568d86fc1331", "value": "Shipping 0372023.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }