{ "Event": { "published": true, "date": "2021-10-13", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-10-13", "timestamp": 1634169782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "889140b2-e0e0-4669-8399-dfe4e1672bf7", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acbc04dd-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1634108611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108611, "uuid": "c2ef1b00-ed7d-410c-b49b-802db1bf1f29", "comment": "Malware payload (STRRAT)", "value": "58033c34f29d72ad5baebf2193d17d73", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108611, "uuid": "6b3aabe5-68dc-4180-809c-144ef25d0baf", "comment": "Malware payload (STRRAT)", "value": "00d5640fdd3c1dd3baca7b092ec5aba640394a254477f79a9a58e2c9732babeb", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108611, "uuid": "672ea875-7ad2-4ec0-881b-6d00218c0f9b", "comment": "Malware payload (STRRAT)", "value": "780ef4d0957c081f17928c16a21cda1240c0a2a0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108611, "uuid": "bbca0d13-a5bc-4974-9c9d-b9bfb248b447", "comment": "Malware payload (STRRAT)", "value": "8481dfb7d983bbb0b5c6986a005b52afeb1c4aa28b496b6a5f7f658303fc2a388045f6f5cc210f778ffca898cb1a7a20", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108611, "uuid": "79f9feef-6aa9-441f-8709-75fcb761a4b6", "value": "T1E204F12AFEAA88D4E60BE47745488173AA1E01D8E825926F35FD48D81D32C5C4717BEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108611, "uuid": "687c5e1d-ec15-482a-829a-e538a01c62d2", "value": "3072:xzoOjHvZrRuCuCg37SKJ3rCFF24ht9LLznwaJuSchmi+Kjyk9A6ppq/DdmHjN/j3:xzrbZrMWNv5TJK99jERcDhmpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108611, "uuid": "f24045f0-c78a-44bf-9744-5c468c0c3af0", "value": 188969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108611, "uuid": "553d6db1-c4d7-4a19-b4f1-de5d59daa7a1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108611, "uuid": "fcc00446-17bf-4d3f-bf2e-0b2677f303b7", "value": "Quotation.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b9dab7-2c31-11ec-843c-42010a9c0014", "comment": "Malware payload (Cerberus)", "timestamp": 1634135331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634135331, "uuid": "38510349-ed58-432e-9560-236b8cba0c20", "comment": "Malware payload (Cerberus)", "value": "ebc1e608080227a13f173612ae3136e1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634135331, "uuid": "5ba2936b-339f-4994-b64f-562d14238946", "comment": "Malware payload (Cerberus)", "value": "00ec32ae4b2f32c99a8053fb0b7a5dacdfdad2fa1981f058919cc484b4a5924c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634135331, "uuid": "3651a552-13d2-4841-b1d2-726a1e913fdf", "comment": "Malware payload (Cerberus)", "value": "18770445ea731c509beb7322a98c0477f7b8d87c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634135331, "uuid": "6100fd44-cd63-4e92-b733-a131beb00da4", "comment": "Malware payload (Cerberus)", "value": "ac59e3c5353fb19f29053d8df284273eb2607d60b57411bc6d85cf0135c44ab4e23475da754246f441825871c1cc620e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634135331, "uuid": "9484f3ef-f33f-4048-aafe-b13737516e23", "value": "T184D523D84AA25CBAD2749C31A39371A1B9301710B7B1F53B267279717FB3A2045CAEF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634135331, "uuid": "2dfeaa8e-2f91-43e5-bc62-5dfbf2c98634", "value": "49152:YxHjSl9QRd4g6nRw8ysPcwf0THzCUIfuI5MX/OUeav6oOMor7uU:YxHWURd4gARwPwWzC7fdi2UWrMu7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634135331, "uuid": "375750e1-d504-4988-979e-e9ae098d40d3", "value": 2787937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634135331, "uuid": "07b3f96a-14b1-41d9-afb8-9eba4ff3ce80", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634135331, "uuid": "a46e857a-8e55-4223-b4b7-9047382d2be3", "value": "Aleyna_Tilki_Ifsa.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c35061-2c30-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634134636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134636, "uuid": "07502145-8a69-410a-a794-e551b4641d74", "comment": "Malware payload (Formbook)", "value": "98ffc3c812e6cec919ebd286973e2002", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134636, "uuid": "eef12184-3042-4d63-b16f-38e16314665c", "comment": "Malware payload (Formbook)", "value": "014d0ece0d472eaea73698d634308303ddb9f227f39d339a66416c3cb744d2c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134636, "uuid": "d453fe93-beee-4ffc-b294-26e2f9acbbc2", "comment": "Malware payload (Formbook)", "value": "b0d1a65445a7923870ad23ec4d80f592e808c987", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134636, "uuid": "93765ec9-091b-4417-8644-cd0dc105329a", "comment": "Malware payload (Formbook)", "value": "99162a154e753cbf23a5be72156f9dd1b58f4f994807a734d3ebd20a02136cc100e350f768c7ea2b012e8047750576f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134636, "uuid": "5c947b33-8e0f-4c6c-b657-181182bdebcd", "value": "T1B6A4CF776B54DA5BF391203481E5FB6D8BB0126C7EAB8B12FD71788CB7683904C5E212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134636, "uuid": "1921530d-50be-4a51-98e4-18cbcdcede4e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134636, "uuid": "87a24639-6f3d-4a82-83d5-8adb58d8a98e", "value": "6144:hBlL/NDevWMKIPT48zhmgL58KCjuLkTMm6GBX3KTDDC3cz/3aKkm3HC:n6B8KC4kTrV3KlziKkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634134636, "uuid": "c18fb402-cd94-476b-a403-68736b80bd32", "value": 455901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634134636, "uuid": "cac561b3-9331-498c-96da-a3f3b9e8edf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134636, "uuid": "8cb7a214-b334-4c0d-a867-d1c3681128b0", "value": "Payment Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808f0e8c-2c2b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634132589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132589, "uuid": "c3bac752-9870-4208-a4bc-9232a9ef803a", "comment": "Malware payload (Dridex)", "value": "5b0f21ba7548263a4a7fe550a9126a2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132589, "uuid": "4e0be15e-fa51-4cfa-9025-25d47807e8fd", "comment": "Malware payload (Dridex)", "value": "022300768af4879806a62b295825264657708576228f92efda2ba023ef0d955c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132589, "uuid": "54314bae-fcce-4088-a57f-e05435b06119", "comment": "Malware payload (Dridex)", "value": "d8ecfb993d473ebb0d2fe9633094debf777a3dd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132589, "uuid": "02407fb0-1060-48d8-a96f-457c88b162a1", "comment": "Malware payload (Dridex)", "value": "23cadf6318c5f622b96be8864b91ce22709053162ac8ad9d059c776f9d497300ce0b866f31cefc3ec7b90678ac2cbcd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132589, "uuid": "596f43df-b52e-41c1-bc03-168881813fca", "value": "T17AD4F8013A54E821E7E955B6CF2AC6E85B183D48EFB1A4C778E17F0F2AA94F3D215305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132589, "uuid": "904f8977-62c6-47de-954e-97a7d9a7429e", "value": "0bdeed4a70b8b1fd5924130bfe75d8bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132589, "uuid": "665a4e38-aa96-4ff2-92e2-3668bf131a77", "value": "12288:3uIBXPwMtjp4CqwqyaXPLAfx38TW9DiWUT2tq017JGoLb+W/:eyb4wqyaDA5sTWiXT2tq07G2b/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634132589, "uuid": "ce2783ff-1292-440c-be97-74791083ec78", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634132589, "uuid": "86e5709f-cc1c-4d95-a92a-58fcd37ccb7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132589, "uuid": "3ef703cf-cf16-4634-a685-535b865cb890", "value": "5b0f21ba7548263a4a7fe550a9126a2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5a259e-2c36-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634137519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137519, "uuid": "8598b758-383d-4f6f-a7aa-8d8cb7351e90", "comment": "Malware payload (Loki)", "value": "0c977c3928bae817297e6e4f79469290", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137519, "uuid": "99dd527c-87c2-4e3b-9f00-1d5aa811b2db", "comment": "Malware payload (Loki)", "value": "0300502f1a1664d90992dd340006df7c7852a2c33121e7ee95192ee0b0209fab", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137519, "uuid": "51713906-4e49-4e08-85c2-79c95e4d5148", "comment": "Malware payload (Loki)", "value": "cf614fa2f56d288b80a02692ef766e9a0fbcf357", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137519, "uuid": "ef7d08f2-4d4b-4548-bde8-9907e3fa6aa3", "comment": "Malware payload (Loki)", "value": "82fdf3c5ea63338078be1ed034cae8fc4dfed5dce18c15cea0a98c1057db894cddf96ed54d25f5ad2d3188868a79a207", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137519, "uuid": "85a034d0-88a8-4069-938c-c73afe6caefe", "value": "T18DB4CF2233598262E67B0FB46023A76843B4FD256971CB7D29D276DF2F73B805211AD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137519, "uuid": "1544bbdb-c71e-40f2-90ea-0051612e8ce5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137519, "uuid": "58a249d0-0a73-4550-bcbd-6fcec8374a8d", "value": "6144:y3gYJjvSyKcQXadhHbLVOTPUwc5onLDATcmBq7bbIMkhBaQpCIOOBx0F4gNV1cW:JCWlcOWdL9oLDq/UHjSBaQpFBm4gN8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137519, "uuid": "22d9ebdd-d75e-4c3b-a3f9-1c176601e571", "value": 511488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137519, "uuid": "14714319-9a24-4e0b-acf2-d913eb8c784e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137519, "uuid": "a5270d17-9902-4f7f-a05b-34ade22f61db", "value": "DHL DOC 74653898.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c1df07-2c47-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1634144654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144654, "uuid": "7909f46a-34ec-4822-9939-f431bf0b08e7", "comment": "Malware payload (TrickBot)", "value": "584aa8473d873ecccb7601672550f4dc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144654, "uuid": "e4e2d45d-3290-44ce-ab25-0a3355a3acde", "comment": "Malware payload (TrickBot)", "value": "0304fe2f5cbac1cc2e79bdbc8daa3824d6a8eb139f4d5bec7b57358cd4de8252", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144654, "uuid": "76bf12b3-dd18-4cb2-91b8-cff3d7f3bdb3", "comment": "Malware payload (TrickBot)", "value": "e65c7052e235e776cb9fbb8accef8d27e42f3b2c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144654, "uuid": "fae43a37-00b6-4605-b3d8-b0df8073de85", "comment": "Malware payload (TrickBot)", "value": "66ef203787aa685b17cb7057cc3c5658b6bb2a60600ee43a82d589ff7c56d52f48045a6364348e5437fb640b216085f1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144654, "uuid": "ac1d0e60-96cc-4954-b0c4-24455eafc05e", "value": "T1C994DF1232D0C032D26F26794862D3B16B6A7C709FB5978F3F94BE3E5E706904E28356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144654, "uuid": "edb96656-ec0c-47c7-b1b8-fdca2df60ffc", "value": "dc56e072f32d1e6dbbad8cbe6ec04fdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144654, "uuid": "bde7341e-13ad-4d00-9b84-a60313637432", "value": "12288:izMrEY/8q9j0uOEcLmWtQqqCSoHhMVr9fC6n:Z/8e0vEcLmWKIwr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634144654, "uuid": "ac89d6f6-fb33-405e-b686-7db55ae0601c", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634144654, "uuid": "76948d1e-c014-4cc4-b8f6-eb12054a5e13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144654, "uuid": "fb3f2d2c-b01b-4c08-9198-99af71f55c46", "value": "584aa8473d873ecccb7601672550f4dc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54512dab-2bc6-11ec-843c-42010a9c0014", "comment": "Malware payload (Cerberus)", "timestamp": 1634089135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089135, "uuid": "38578738-76d1-4719-8ec0-9955693e04b2", "comment": "Malware payload (Cerberus)", "value": "79406a37aa56c8c3b0a6f6eeb48cf5a5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089135, "uuid": "ebd53224-2ffd-4f97-b083-101f919709ec", "comment": "Malware payload (Cerberus)", "value": "0314ea6ad3cf224a9417ccfd1f8a784a836472094c04a6bc2ffb688313131ecb", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089135, "uuid": "e8991ba3-7c1b-44e9-8bd6-72d3cf21bf9b", "comment": "Malware payload (Cerberus)", "value": "118fa2cf82b7ca85cc59eb8986b1537ca5fcd38e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089135, "uuid": "fe98ddd5-f820-4e82-8b42-d4ff0d2ca07c", "comment": "Malware payload (Cerberus)", "value": "3dfb1083ac58946619e0322e6d3b162f83f747ea14bf2c371aa3083f7527f19f813ffef65caa6581226908da46c963d4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634089135, "uuid": "e84217fb-8220-4236-9995-dafa347b24e6", "value": "T1B5C512D50A815EFEF5399C71A34360A9B9313B50A6F5E67F1472B6207FA3A208109FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634089135, "uuid": "89effd0b-4934-41ae-9e86-715a44b51366", "value": "49152:RqlBejgkVwtbraC9Ww/NZ9GLud4ijdbSDaOi1K:clAd2brD8w/X9GLW4va0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634089135, "uuid": "add9ab01-4d12-4d66-ab62-70116d2dd09a", "value": 2667969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634089135, "uuid": "99978cac-a207-4af0-afe7-2b08ecd84402", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634089135, "uuid": "917c8da7-a644-4ad1-84a1-5856cb1ff00c", "value": "Bildirm.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a69a870-2c52-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634149275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149275, "uuid": "17295d55-a976-4128-a043-2ceae6ed1d89", "comment": "Malware payload", "value": "8a7100cb39127200222f22557586d4fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149275, "uuid": "7d79140e-5ec6-4410-b1f2-bfd22f531df1", "comment": "Malware payload", "value": "03555d8ea739df664c3eb88e62a30e7c590233eff39c2dfe7f72bd717eb3d716", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149275, "uuid": "64ddc470-e705-4969-9a69-0baf948fd6ca", "comment": "Malware payload", "value": "c098b152cc9badd410edea9afca7cdcc1e006602", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149275, "uuid": "2c9985bd-bb94-4980-a848-fe34b5da7112", "comment": "Malware payload", "value": "805b18160b446dbc950798cd7b35744d76756669dfa48cdd7877ad3b2c21b30872458f0acd758cfb027ca83b33d5acc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149275, "uuid": "652ba30e-e255-4050-a833-8418c1d5aceb", "value": "T195B533B55ED0480FDE8FA9385E60F562E8606BF7CA4AF5C246371CF3A5B17922E06071", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149275, "uuid": "7260574e-b1e8-4efb-9288-79f328d8ad4c", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149275, "uuid": "4297557c-6ef9-4472-9df7-38d5a5cbc8e6", "value": "49152:MhQK5g2VOStDOPAHrryjy5zZJtzbTnwrZBQfw/vhYNdMHXSPtjE5c9:ip54ayYHv+i3VfwrL0M6dMHiPe5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634149275, "uuid": "84ca7cea-7119-47a4-9a2c-cff7b99ad30a", "value": 2377972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634149275, "uuid": "38715d1b-a206-4f31-b99a-322bcc4b1bcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149275, "uuid": "d3caaeee-5df4-4b4d-997f-7e5f4fc1e817", "value": "FAR6CRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66dc6657-2c29-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634131687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131687, "uuid": "7c5849ae-4495-4416-817e-214fa584d292", "comment": "Malware payload (Mirai)", "value": "056c5018aeea5b07f149b812a87c1a4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131687, "uuid": "31e69855-7ca2-42aa-90df-a28a21a777f9", "comment": "Malware payload (Mirai)", "value": "03da2f0596685267b2a906f7eb80f0b93556d675a29553b17ba961d06c78c342", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131687, "uuid": "c6d7e6f8-0ada-4910-a77b-642519dd48f8", "comment": "Malware payload (Mirai)", "value": "0de4d6e83b8674a6ebc215b4b1837ce06792dd31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131687, "uuid": "e96f2d2f-ac6e-4754-be71-26490895c2e7", "comment": "Malware payload (Mirai)", "value": "bda9914ef062ec80f1125d46fa2352300684b3365478a180a190d54ed6ab445f01e783944d8365a4eeeeabb125d502dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131687, "uuid": "bd056370-0552-424f-8d41-85e697324375", "value": "T1A1E32931D4604B17C2C213FAE65E815E3F331FAB93DB33115A287AB45FE278A1E65528", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131687, "uuid": "5dd5c9bd-e9cf-49b9-8387-25f7168b5563", "value": "3072:fbL7wIJWa2pp3aHXhOl/vofqqQWQb+kmhxQwoVSUNu:fMTa2ppJ/vofqX+kmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634131687, "uuid": "524aafcd-ad50-4e06-a83e-441f7d00e341", "value": 147115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634131687, "uuid": "4f6ec51b-f180-46aa-9faa-a833d9b565a2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131687, "uuid": "b92e13df-feb5-4a3f-b818-b583eeb95bb0", "value": "056c5018aeea5b07f149b812a87c1a4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0eb201-2c32-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634135452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634135452, "uuid": "59f31f1e-6559-4e90-b0ec-b6584c9e27f7", "comment": "Malware payload (Dridex)", "value": "24ceaa006c0dce2aedb1e4af1d0ae187", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634135452, "uuid": "85b199d8-9291-4b1c-a0f9-9318d870b36a", "comment": "Malware payload (Dridex)", "value": "04383e92078b7bba5951c99dc00908e38ec8c544aedf9c30743ae2a8516621f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634135452, "uuid": "4c7b7555-9046-4054-802b-2d2853f1ddb4", "comment": "Malware payload (Dridex)", "value": "830ba0230638912b11b87eb988d6fa36c11bd270", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634135452, "uuid": "91c376c0-fd4d-4c58-b393-84373b1ad113", "comment": "Malware payload (Dridex)", "value": "d78422a25ae465ebd59b37ec9e42b550e0b4332c2158679cd7055128a82455673f1c749cdf864433d55afdc088f79622", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634135452, "uuid": "380a10b1-02be-451c-bf12-8a43e89f4ef2", "value": "T125D4F8013A54E821E7E955B6CF2AC6E85B183D49EFB0A4C778E17F0F2AA94F3D215305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634135452, "uuid": "994e765f-af9b-4529-8a96-31f6798e67c8", "value": "a5fbb54a2d8e086b0b1f07a086b817fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634135452, "uuid": "d85c67b2-160b-48d3-9364-9676a6d3bbb0", "value": "12288:ZuIB8rwMtjp4CqwqyaXPLAfx38TW9DiWUT2tq017JGoLbuW/:0Nb4wqyaDA5sTWiXT2tq07G2T/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634135452, "uuid": "da6d6278-59c0-4ab7-91c2-58e18435f2ba", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634135452, "uuid": "2dd28e8f-2a0a-41bd-bd5c-d9de5b3d99e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634135452, "uuid": "edb3992f-099f-4a74-bb95-14eca85848a4", "value": "24ceaa006c0dce2aedb1e4af1d0ae187", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df3c9dc-2c2c-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634132853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132853, "uuid": "97d9da4d-53dd-4172-baff-6f381bfdd230", "comment": "Malware payload (Dridex)", "value": "782f3a3edfc69c661caf22286858f19e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132853, "uuid": "048d9626-3098-4890-a53d-14d4c8a85999", "comment": "Malware payload (Dridex)", "value": "04622665ec1dccb6fabcd0d62b24747bb650aa6964a84a966a633066c840d379", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132853, "uuid": "627d9e0b-4671-4ba1-b101-fd99915f0fac", "comment": "Malware payload (Dridex)", "value": "5e48729ded71998c5320dbe73aea54cbf6bd257d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132853, "uuid": "bb506308-8ada-4ae2-9586-3ba4aab7da1b", "comment": "Malware payload (Dridex)", "value": "7052f5f5bcd309eaf4d1e7389124d9e45249ccea92c5d9fb353cf6f5fa9e28ae4df2d4d5d5727523220ecc5ea20b0420", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132853, "uuid": "20819d36-3763-4088-ab2a-37b3828af7e5", "value": "T140D4F7013A54E821E7E955B6CF2AC6E85B183D49EFB0A4C778E17F0F2AA94F3D215305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132853, "uuid": "4809205b-1be7-4826-8305-ca88a3c6d499", "value": "5eb95f99453a8a6fe3d6300e286747db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132853, "uuid": "a800da2d-62c5-4154-bc53-a41e1269b53a", "value": "12288:KuIBaTwMtjp4CqwqyaXPLAfx38TW9DiWUT2tq017JGoLbSW/:FXb4wqyaDA5sTWiXT2tq07G2//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634132853, "uuid": "9b0dfc80-33c5-4341-9263-906194f86e43", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634132853, "uuid": "5e6ccf08-25a0-4fbe-85cd-4cf620453902", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132853, "uuid": "69e3f07c-cd66-4bfd-a66a-1f9726ca3133", "value": "782f3a3edfc69c661caf22286858f19e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c97320-2c29-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634131794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131794, "uuid": "d72755cd-042c-4f92-b9a0-9dad311eb9b0", "comment": "Malware payload (AgentTesla)", "value": "8f389bf0706d448a4b24f5599873a03e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131794, "uuid": "692f9484-cffb-45f6-a5f6-8bece8d61c5e", "comment": "Malware payload (AgentTesla)", "value": "0494b60c73d40f4552f6f9f8cb203a4c29f5bbd01e8e2528174fd424b83932c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131794, "uuid": "a0b3baf6-4e1d-4c15-a5c5-b4d632b36a44", "comment": "Malware payload (AgentTesla)", "value": "a48369aba2bedd972790e67768ad60cc970c6caf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131794, "uuid": "25951d4e-874c-4db1-b8ac-753ebabc8ede", "comment": "Malware payload (AgentTesla)", "value": "7caca18001acb68f941f13a89c7f976fd65f5b907f00f769cb293d66401570a87850ab34a132cd3fe86f7a6e2d2a02ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131794, "uuid": "c2328f5a-00e5-4394-9706-5b25b45af651", "value": "T1D945E0647F99DD0EF3A698B85131DF44963DA64A3713C625EDBF503B93AC79028C2283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131794, "uuid": "83df32bc-6d63-4969-b1ad-6943a5e1811f", "value": "12288:1LAKnZTPmdDmnSSrDJWXC+M0G7CvWoNSBFg:1k6TumnpHYXC+sCOoABF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634131794, "uuid": "a994f99c-89f3-4498-8550-d4a66d733800", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634131794, "uuid": "b29671d1-3044-442f-b828-dceca235b3a4", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131794, "uuid": "c999ca23-7785-42f5-86ea-e8232859bb85", "value": "SCAN001.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3c6a36-2c53-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634149866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149866, "uuid": "0f652425-55ae-4b2a-9d0e-c1d226dcd0be", "comment": "Malware payload (Dridex)", "value": "cd850bef2d969b09e5ff5124cd32d49c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149866, "uuid": "80b07468-bd7e-4428-9623-081d92400502", "comment": "Malware payload (Dridex)", "value": "060896c12e1e76d584225a256cb9659fe3f94ab5188040cc8a0df2e3ca59467c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149866, "uuid": "dfd52dd9-f36d-44af-aed2-682d35db61af", "comment": "Malware payload (Dridex)", "value": "fbe489a82ac617a2c63d146fca78505a2ae0de5a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149866, "uuid": "af7f016c-f430-4809-9d38-1ce5f40a22b8", "comment": "Malware payload (Dridex)", "value": "5d4d8b32e9840abffde434e09c3fa2f7fcd64864dae9109d93a7998fcf38df386c359fa2934b9c974559b645ce73194e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149866, "uuid": "8e37d6b3-e2c1-4dde-8488-8163aac57339", "value": "T199D4F7013A04E821E7E55575DE2AC6E85B183D49EFB1A4CB78E17F0F2ABA9F3D215301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149866, "uuid": "578c3c99-029f-45bb-9e84-82fa4ff3ff3b", "value": "77aefec4cdbad9a00d9143503be0ce97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149866, "uuid": "a6ce5a61-8532-4c14-af25-7b6ad585ee67", "value": "12288:oE6rSiw4lbs3j09TMmonCh5atbz9+eoQoUZpDd7Da1nX9y14O/zFZx:ue223j0dMZnCutz4zI5xDwXUym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634149866, "uuid": "8e97cae4-df5d-4341-b506-7aaec52fcbcb", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634149866, "uuid": "eb475847-370d-407d-b24e-30a492eaa57d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149866, "uuid": "51a63c30-1e9c-4253-a980-e1414ed85a79", "value": "bdxloc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a8f293-2c6f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634161726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161726, "uuid": "b84d478b-8f55-4bf8-a7b7-1bf7afd48fdf", "comment": "Malware payload (Mirai)", "value": "d492a3bc056b2e4a1f790a754b831ea2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161726, "uuid": "4a95500f-bff5-40b0-ac67-507d27e916ca", "comment": "Malware payload (Mirai)", "value": "06a029b43ffc7cfce135bf9697374645635467ac72362e05bae1c8a005f8e1bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161726, "uuid": "bc64c071-f822-4ee1-b663-3e1a93c1d604", "comment": "Malware payload (Mirai)", "value": "f6a171e75f17998147d56c2954db62adf5b0abe7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161726, "uuid": "a85b07d4-39cc-48f4-83ce-f8e8bdcb0a5d", "comment": "Malware payload (Mirai)", "value": "731a30577930f9a7d48bb18b74d905ab38e51735003f2543115efd288ab80acab124850db41be6889bb97d921bbc6fef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161726, "uuid": "a8d84080-21ed-41ec-9cf1-19d9d5b584e7", "value": "T1E5A2D01825CDEE72D1B0903BE23CC307EADB47B652FE327A2E180798A44491AD3BD945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161726, "uuid": "6e46c301-17f0-4b1e-95ae-bd8d1190f732", "value": "384:Yamog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbBhymdGUop5hXI:YToh/DxCvhdR4IjWVFbS1s3UozJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634161726, "uuid": "c1f99d2e-0891-4fa0-99fb-945df9beaba1", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634161726, "uuid": "aaff88f8-000e-4887-9b77-544e2a8194c7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161726, "uuid": "769b2c4e-2962-4397-bf0b-2066f9424b96", "value": "d492a3bc056b2e4a1f790a754b831ea2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4827c144-2c4d-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634147097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147097, "uuid": "1720cc7d-5b4c-4a8c-b2f8-cb3bb7571a7c", "comment": "Malware payload (Dridex)", "value": "676514125157e96345e544a2c72a4844", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147097, "uuid": "acd5d880-ab5b-4619-a056-4b48c127320b", "comment": "Malware payload (Dridex)", "value": "06e41c9e1128631c9e0c2174ed4b367d0f6ed7e3481fdcc95b24d66edd02a45f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147097, "uuid": "6ac1cf62-6e39-4ce6-abfb-d6afd3812c31", "comment": "Malware payload (Dridex)", "value": "7063a2dd1e3b2d27ae864198e3df8b5b6ba9c5ef", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147097, "uuid": "170b5f3e-a238-4bb6-b080-e268933e13c7", "comment": "Malware payload (Dridex)", "value": "ed06384d67490c041f666c646b9ba40937be3db34d3e087a72700c227f6d9a0a7c685ed0837208b996382054a3092da0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147097, "uuid": "cb2bc76d-5094-48e7-9028-a44d7ed2418a", "value": "T117D4F7013A04E821E7E55575DE2AC6E85B183D49EFB1A4CB78E17F0F2ABA9F3D215301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147097, "uuid": "82d2d4f6-e96e-4e05-ad1e-ec10f63542bc", "value": "77aefec4cdbad9a00d9143503be0ce97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147097, "uuid": "70787876-3a11-4b27-b336-0f85612be6c5", "value": "12288:CE6rSir4nbs3j09TMmonCh5atbz9+eoQoUZpDd7Da1nX9y1CO/zFZx:oe143j0dMZnCutz4zI5xDwXUom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634147097, "uuid": "c6ebcda0-e359-43a2-ba9d-60f0feb022bf", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634147097, "uuid": "e570c6cc-6b8c-45ea-b320-1909d502f5aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147097, "uuid": "6e2e7d6f-bd59-4ecd-ac64-f3658020c17a", "value": "676514125157e96345e544a2c72a4844.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e418ef-2c4c-11ec-843c-42010a9c0014", "comment": "Malware payload (ServHelper)", "timestamp": 1634146954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146954, "uuid": "1a869265-2111-4cb5-958b-c6aca2a28bf9", "comment": "Malware payload (ServHelper)", "value": "44d42138d67d0e52c3c26cb726bc8f39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146954, "uuid": "06c9a3d6-cfd0-4da3-af8f-561bd756cc5d", "comment": "Malware payload (ServHelper)", "value": "074d3a0bcfb3d4b0b179a2495004fb95947de60ce002fded7af1d1781add9d2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146954, "uuid": "616b19c9-e1e4-40b7-8b1d-60400380f9cd", "comment": "Malware payload (ServHelper)", "value": "2613e0e464b334ed66e34a8cffc174c5603dd1d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146954, "uuid": "d0e1aca6-c980-4e97-bf73-a13a57d67030", "comment": "Malware payload (ServHelper)", "value": "dbd59aa6707114e39e9178be07bd3ba0eea0cf212e3ba6c986abab29431c6c4d8f1c4e7cd5d3f792634816a584629af4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146954, "uuid": "52ef2ac3-960a-4504-8d86-60cf866eba46", "value": "T1A2163371B47AE1B6C18B11B5BE508BA1931F3853B131EBCF477D623887B036175722AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146954, "uuid": "442e7e90-a149-4459-8c15-daf0332ea9b1", "value": "a3d3c102ccd598a84c1f646602841228", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146954, "uuid": "a90848f3-f864-40a2-a98b-40243c199214", "value": "98304:5RDQNYpuboTrhHZw1LhIArXs7YL8WVM872qAR:5RePbo3tZw17s7YQWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634146954, "uuid": "cf03ea28-8ac5-47df-b2a7-3edbe4e27a77", "value": 4364800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634146954, "uuid": "9c2fc23c-1c10-4972-a785-4f0d0eb2276e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146954, "uuid": "e27a9aa5-4202-43f5-93c0-4beb4fab8a88", "value": "44d42138d67d0e52c3c26cb726bc8f39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2744cead-2c08-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1634117407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117407, "uuid": "c403cd6a-450a-45bb-93ac-a6143b2b5a42", "comment": "Malware payload (BazaLoader)", "value": "efad3e8098fdc4778d1744abb659fb04", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117407, "uuid": "769b6a29-c163-4088-989e-f1c62a50bef1", "comment": "Malware payload (BazaLoader)", "value": "081409dbf0464baad30442d3f8cea67c885e15e438b0f6dbf9c64da67620eaa1", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117407, "uuid": "5bf849ed-e12a-4c6d-96e3-f770a948f101", "comment": "Malware payload (BazaLoader)", "value": "90e28ff7cc0cc20ae2f10652f9ffda01107470ed", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117407, "uuid": "07283d57-90a1-4da9-9dae-35e915c0b745", "comment": "Malware payload (BazaLoader)", "value": "dfc978a58eb782e1316fbc561aee94677fae2c67558fb42a49e8967896e689889f6a9d8bb634f8c458baf9bffb3e09b5", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117407, "uuid": "ae644263-c6fd-40cb-916a-e06bb893add5", "value": "T103C49E56FBA449A5E127C1388D338545E6727C9A0B60CADF23A4532E1F33FD0897EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117407, "uuid": "d22d52ec-fcf2-4a0b-b0e0-fe4f4643c7b5", "value": "bb371708c55cf92a872421fa64c41b03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117407, "uuid": "074c118a-672b-4c70-8159-1db4a3fb1082", "value": "12288:DXI/lsYS/im/YnmCPksStIYotSPNwGG+Sft:DX67zmCPksUIYMO+GG+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117407, "uuid": "a309462b-c1c7-471d-a74f-c5df940bbcaa", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117407, "uuid": "48f1f7df-7f0a-41b1-872d-ca9bba972110", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117407, "uuid": "128cbdf3-8ef2-4e2e-ab6c-1da5b5bad565", "value": "1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf8dd72e-2c37-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634137849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137849, "uuid": "46a746fd-a403-4028-86f4-2b3a0d7b2e19", "comment": "Malware payload", "value": "25187f1a0c61dd484e43ccfbbea0d8dd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137849, "uuid": "5cbccf91-0228-43ec-a033-7d7aa5f6b48a", "comment": "Malware payload", "value": "08e3da6d2868bb292f81e3580b1686a34fc5c25051f2c9601671f35873688307", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137849, "uuid": "02b9ec33-a242-4450-8066-427fc097c9d5", "comment": "Malware payload", "value": "2f57d6fa7cdc407dd7e13f8d82ba385054bf09ea", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137849, "uuid": "635faf1c-60e3-4e9b-a786-692d9c609ae7", "comment": "Malware payload", "value": "e6d2f6e1ab85122c186e8bdad7d4c9209c4244ff22fd25a396653beedf6364bb38f42b7a54c59c34d88aa0e5e46eb466", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137849, "uuid": "27833bbe-a01f-4520-8f1f-62458ae7f7da", "value": "T1DF2308017292DE17F25695748DF3D6EA3639BC198E12830F32857B0FBC39AB14B12B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137849, "uuid": "75a6e4f2-0d2b-4d46-a4a1-534681d4f6f9", "value": "384:PqkJ3chjvoxKJ2LUa8c4yDMLiyGcS2rA6VsEEMc+iOQazItyfeX0juR4Db3fntb1:PcFAYU4yEnrhsEjcc2R8rzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137849, "uuid": "9759b0c4-0d5d-4b3f-ad19-c1c0ce3c6d05", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137849, "uuid": "631b0de2-8ab4-4871-afd2-2df721638ba7", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137849, "uuid": "1feea115-05ac-467c-af5d-b16902507608", "value": "SecureMessage.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501872b3-2c47-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634144533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144533, "uuid": "e8bf3359-2ed8-45d6-aa4d-167b0fc4df7b", "comment": "Malware payload (Formbook)", "value": "51dcc89ed1035a6c2fc57ada8dcb4dc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144533, "uuid": "f4955334-ed71-4525-8b74-54b0ae6e9055", "comment": "Malware payload (Formbook)", "value": "092be1f456b0c24d932d6c4e4c44cfd0c9abc6c0418bf1567e67826cb51aef14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144533, "uuid": "73fe9082-500f-47bf-9b63-ee367f673191", "comment": "Malware payload (Formbook)", "value": "0e59efbffdd8153c61f20a6039110474c50c20e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144533, "uuid": "e70b83c0-65af-46a7-b7f7-f1ae4cc68e96", "comment": "Malware payload (Formbook)", "value": "071b145c5cd3159b9011d1991b3c6299e3cd0ed64c60b2b9008d68ae384b1604f8781fc32128deaecbd9e53093645dbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144533, "uuid": "1c1c20b6-05ff-4ede-a365-2ca752c59da1", "value": "T15CC4E012334A8263E6BB0FB4A023A32543B4FD266A71D77D29D176DF2F727804215AD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144533, "uuid": "609a4cdc-e154-4ba5-aff6-0dde4cd3bc36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144533, "uuid": "5d4e532c-3f17-4c6a-947e-3f0c9dd5c686", "value": "12288:IQSB6F/pLLbTHFw1WufwltdYYXsOaCnuNQpFINwgNP1:IdBS/lbTHu1WuovdYoayuNrNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634144533, "uuid": "a47e91d1-8892-4813-af8b-1b3634925732", "value": 583168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634144533, "uuid": "8b2702a0-5371-460e-a1d5-2e27cb88b4a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144533, "uuid": "b3a77a32-eed8-4551-af48-e21d4b95af51", "value": "51dcc89ed1035a6c2fc57ada8dcb4dc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42736ec0-2bf4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634108862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108862, "uuid": "65668cdc-18ac-461c-b5fc-8930ac7d9bac", "comment": "Malware payload", "value": "20449cfecc3f7eee3da86d812515fa63", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108862, "uuid": "632c5764-bef6-44dc-9ed7-f8ce2e7c78a3", "comment": "Malware payload", "value": "0a8cf52ae9e64fac145ee7694c20b7b9805df1c7c6ec853f0c4f67e60d314e66", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108862, "uuid": "545b23bf-2218-422c-8343-652b4a75ed47", "comment": "Malware payload", "value": "7fdad32cac4ffbc2f29469abe1e67d3032c35b48", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108862, "uuid": "43676222-f834-427c-9a11-6ed81b175e90", "comment": "Malware payload", "value": "2c5486d75b455c3f4b93bbc443a63e1c497e67e4d32aa9f1771c3bc5fa445e4ccdd5d862d2ed8f587ca1581388d799b7", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108862, "uuid": "48635487-c8c1-4c24-b0bd-d5a2dc569baa", "value": "T12F737CA6F6C1DC06CEAA077A48F782D6662BFC551F53934F3248F75E0F70A90891261B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108862, "uuid": "b36a4eae-b923-418b-b70d-b838b329ef33", "value": "1536:dk3hOdsylKlgxopeiBNhZFGzE+cL2kdA34zI0ScDNzmVQyrnHRBoESK4nceC7r9O:dk3hOdsylKlgxopeiBNhZFGzE+cL2kdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108862, "uuid": "0421d2f0-3617-4e43-a3c8-6e1fa9980de4", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108862, "uuid": "f07c398e-596b-4108-81b7-df84cfc14348", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108862, "uuid": "2e89d12e-f604-44a7-b0aa-bc31d2cc641c", "value": "Remittance Advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8aedc4-2bf4-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634108990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108990, "uuid": "b39c651f-0f37-4195-901d-ba939f5764d6", "comment": "Malware payload (SnakeKeylogger)", "value": "5a47c83afe361294f04dc2d1135a147f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108990, "uuid": "77f0bfa8-07dc-4e7d-b6d9-4137d92e8bd0", "comment": "Malware payload (SnakeKeylogger)", "value": "0ab967cedf8b0dad891484aea1f1319fdf6360803f68cf11dcd4cedc79f015a4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108990, "uuid": "761af4df-b9b9-474e-8bd8-7607ccff0ae9", "comment": "Malware payload (SnakeKeylogger)", "value": "0f6a703da0847040237fe866d0edfb2179f84d70", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108990, "uuid": "0dfd15cd-aebc-47be-b97c-0d5aee6664ce", "comment": "Malware payload (SnakeKeylogger)", "value": "7d01fd298d7f1c58655c481fa33a5f9648e5022a97599995a7656577a8d276e376d0e64ac26d66413841061869916200", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108990, "uuid": "e802842d-7f17-41fc-bc8c-d47ef255d5fd", "value": "T10AD42393B1D4DFDBE41B66391CC3D09C7E08EC885E9DD20B3A55BB5B4EB97368102819", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108990, "uuid": "f4df0efc-9ab2-451a-9146-d58ee402b6a9", "value": "12288:mbqTtukI4DLk+N76BI7G+eDYYQgc6gID6ijVAm5vbZ82NHKLtO2:GmukI6Y+N7uDgl6gI9VAm5vzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108990, "uuid": "daca6c87-b612-45af-9b7e-baf4dbf01da9", "value": 644096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108990, "uuid": "231bae88-40d4-4feb-8576-edc2c956a208", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108990, "uuid": "27358377-9113-44ea-8726-bfb8f403728c", "value": "PO # 7800017872.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97f561d-2c70-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634162293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162293, "uuid": "eaaa3896-944b-4034-8135-05d3b5defcc4", "comment": "Malware payload (Mirai)", "value": "b9d2dd7b1d4b95738313c995b41f4b69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162293, "uuid": "f0367147-3b13-4044-b58a-0c90a7528217", "comment": "Malware payload (Mirai)", "value": "0af78db99bc224dda04056ee49cb91213731a5f89a4efe3916e30712732b5c49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162293, "uuid": "95e9d95a-11b3-4b0e-b77b-4a132750db74", "comment": "Malware payload (Mirai)", "value": "28800c8e162e8c77ce8bb1a689d3634b17630fa6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162293, "uuid": "aac24bb3-4745-4267-9827-634f82f3c7fc", "comment": "Malware payload (Mirai)", "value": "42a5e4e84f88228a95d7cdb71bddd8fe3324ddffca5d5605731096163ba5019dcdd695887254c5c2820bbca83a333e83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162293, "uuid": "f59d2fa5-5f3c-4e17-bfb6-7fc8d2a07b14", "value": "T1F58306A7FB53E2F2EC8912381C639F395775B4191433E78AF36CA9B6891B345885234C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162293, "uuid": "fa346c56-8e57-4516-a1f5-0e08f66e8ab0", "value": "1536:T8z2OS71dcKHckamfGZUvuyTyqqDxWSuud:Ts2jpdcK4ytv1TxqDxmud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634162293, "uuid": "bec34c9b-1353-4a36-80fa-3badb15ebd61", "value": 87472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634162293, "uuid": "c86d0f9f-6bf1-4086-a7d8-cf32a56ab7db", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162293, "uuid": "27f37394-e59c-4586-b86f-7331d79cc7f0", "value": "b9d2dd7b1d4b95738313c995b41f4b69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e18be7-2c2c-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634133057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133057, "uuid": "4b56700b-13dc-49c7-a5c1-cfa06b67dfde", "comment": "Malware payload (SnakeKeylogger)", "value": "66c7e791514c1ff8add82a6ff054f95e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133057, "uuid": "89f4bc15-b9d6-405a-ae94-28df377604f3", "comment": "Malware payload (SnakeKeylogger)", "value": "0b47f2153c7dc74c974cb865e32c121133a7c1740d0e09ee819a4823c0712241", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133057, "uuid": "b477b538-1aab-44a0-a036-a633aa8a7589", "comment": "Malware payload (SnakeKeylogger)", "value": "785d66d46de99a8c9089d51fd5411afd156570db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133057, "uuid": "94c190dc-0036-4de2-840c-65545a3c0263", "comment": "Malware payload (SnakeKeylogger)", "value": "5c3e8c053a144261be652f551a00a81959ae575a2ac104c9ee3d5f4a4c17ce7c8424ec68f98d8275bc6d6c0f57df17ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133057, "uuid": "3805cf29-ce3b-4e5a-9091-16d0a5503fe2", "value": "T1442523B0F6E78646EC94293258AFFE554D25EDED0670BB2B13AC3128CC353513AD229D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133057, "uuid": "09804624-00e8-4999-97f6-c7c0fdd11eb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133057, "uuid": "a4d151d0-eab7-4230-8e07-5334ff9e9fdc", "value": "24576:EItI9Yf+h/olvUuf25OmYQZSFYWMfG14TtySQ0cMWBb/h:EI6UQolvVu5H0WGSTtyF7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634133057, "uuid": "16cc4a96-f86e-4f7a-a81e-9bd45b0837e3", "value": 1052160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634133057, "uuid": "11fcc657-8882-499c-9f29-4323bb59467c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133057, "uuid": "12d8bb7e-8429-4e04-bdfe-329d6b3d838a", "value": "AWB # 2617429350,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad7d668-2c09-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634118191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118191, "uuid": "68bb0e2e-01a9-4904-bdc0-df4d70ebd338", "comment": "Malware payload (GuLoader)", "value": "0fb63e5eb6af1aff086e3c2a2321f716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118191, "uuid": "5418b707-2055-4400-9672-c7841aad1dea", "comment": "Malware payload (GuLoader)", "value": "0b65815d462586870177898072a1500ec014a390eb466ea0dd716567ada4109a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118191, "uuid": "2aa17bd7-ff28-4aca-ac1f-bcc64c46d1af", "comment": "Malware payload (GuLoader)", "value": "5e7e1db40c9104297c3b05b26c97a788eb92401b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118191, "uuid": "4b3b3ea0-1d68-482f-b36a-97d282eab232", "comment": "Malware payload (GuLoader)", "value": "89e95608304aabb96c47002f0b11e2b3c91bfa1bf5f66ca24f158f2605638a0d31b5afa3609049c162e3dbfb3b776471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118191, "uuid": "f90e25f9-24f7-4c39-ba01-e985ca6e006f", "value": "T1D8D3A4A162B08FD9E0A78ABF13E5471035717E340912AE47F69CBE1E4E761E0D59032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118191, "uuid": "3d306905-be1a-4b4c-919b-5cc32691539b", "value": "c727a98e677fb7bd25bb06d2a2d956f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118191, "uuid": "e2b13d2f-0017-45fc-bb4b-2362ab5aef25", "value": "1536:5sYs89TfPXmlAo30SC66Biy2bbMSekC7dY5KwchyuGWawkANvv0LLhQ4sZiDNmMN:5JXS0SC6aiyCYUKw7T3hBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634118191, "uuid": "951424c9-21ae-464e-bf33-38c399f2dc04", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634118191, "uuid": "1885597b-4c72-42e5-b457-c2af928bcbe3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118191, "uuid": "48860de2-30e3-401e-9cfc-c641cc89992d", "value": "Statement of Account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9162b282-2c1f-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634127463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127463, "uuid": "34140326-cb5f-4534-af32-e90e00cb8e76", "comment": "Malware payload (GuLoader)", "value": "16c79c6d661e6448bd71d554d4100c20", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127463, "uuid": "1d116f7c-938e-49bd-8c50-b49f7c6e0181", "comment": "Malware payload (GuLoader)", "value": "0bec54998deebdb6b8edf2d45b43cf102a1a2430c97074d0acc32f85fe4a8952", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127463, "uuid": "57228793-1008-48df-b50c-06497c1412d7", "comment": "Malware payload (GuLoader)", "value": "c81029717df70dee9551f5805ec3ec34ff8a318b", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127463, "uuid": "0f9c6585-2320-47a9-b9bd-44ea0737f433", "comment": "Malware payload (GuLoader)", "value": "7fcbe3b6c89937597231e7f90abfea6648f4e9664b501d6343fdb73104bf8579aea5b51a49af7deb8241503ce0114b13", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127463, "uuid": "c0f7e379-2207-418f-a6e7-8b59e7562d05", "value": "T16E4301D1143E548FDA8EB516D1E627D981CDC773FF189C9D3D06E9BDA08C8386C86A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127463, "uuid": "c740d9ec-e493-481e-8125-7f750eda664d", "value": "1536:tH2oKwg4v8NZfe02NFNTSyndHPOa3lMWwsb:YF4v8XzkFNlndHAWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634127463, "uuid": "a8dd799d-27ba-445c-b11d-342ad6e39f3c", "value": 55193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634127463, "uuid": "b096af65-15f6-4a4a-aed7-7644a04d3f1e", "value": "application/x-lzh-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127463, "uuid": "e1bd9e9b-1305-4f17-9697-7bcd788a2e62", "value": "0810202 import Inquiry ref- ( November order )2021.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4517ffe3-2c3b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634139361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139361, "uuid": "0f58ea14-db73-44bb-95c5-6a2dacfeb88e", "comment": "Malware payload (AgentTesla)", "value": "1fe1ee623a3e338943fcf366f735124c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139361, "uuid": "84a68d0a-04e6-4079-b7e3-bdabf3b9ed93", "comment": "Malware payload (AgentTesla)", "value": "0cb35117613485bee153e43df3fbdaad54d62b8e59a59af7b335e7e8875f7b88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139361, "uuid": "9ee32e07-c8a3-459e-9d93-f6467fd810f1", "comment": "Malware payload (AgentTesla)", "value": "4ad1cdb1cb8c648f435b9880d75e4987f8cfd9f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139361, "uuid": "198759ed-eac1-42ed-9dd9-3b1d40389a5a", "comment": "Malware payload (AgentTesla)", "value": "199d0f19802d0e89b843ea6871067ba70425426616b7ac31342923ee755ddd8c9687acd2039195daefed086a040cc3d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139361, "uuid": "0d101c6d-9d1f-445e-a0d3-44a4bb70ea33", "value": "T1CDB4C0A57F95DC0FF36A9C785131DF84CA6D614B3B13C626D9BE607A83987842CC2287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139361, "uuid": "50f808c3-6e57-4407-8078-c5f340e73041", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139361, "uuid": "2cd440a0-ba15-495e-a3d9-d364748f08ef", "value": "6144:PcOmuTX9ciqXz6+aGmkdVUzJwiRZ3RnTyeBk6FnMPfOHp/7V70aMkhBnMYB:Pcgb97GzOGmkd+yQ9TbpHp/7V4ZSBnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634139361, "uuid": "7bc5e27e-2a47-4198-8eb3-acb10d7348fd", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634139361, "uuid": "cd197c1e-e745-493f-95c7-b6d63a1ef175", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139361, "uuid": "3b995121-2656-423d-9426-9cdef764affc", "value": "New order6534231_Xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe4934c-2c09-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634118086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118086, "uuid": "3aa90b61-2937-41bd-925a-1a1c4a75642b", "comment": "Malware payload (Formbook)", "value": "7b57c26a8208756f37e8df8331f94610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118086, "uuid": "56601f75-788d-4c42-a336-ff1f2fe5dba4", "comment": "Malware payload (Formbook)", "value": "0cf11de8a0ce67a46203ae419f2aa7bb988ae3088dc4f33158dccc55b97e4a7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118086, "uuid": "63b3c3b8-0834-4135-bfe4-689df7a4c7fe", "comment": "Malware payload (Formbook)", "value": "bfb4a9e25f36ade44b084706da30c3f305d65609", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118086, "uuid": "034b65da-7ddf-4b52-8bdf-c62880ed42ce", "comment": "Malware payload (Formbook)", "value": "f5450dd1d9ac8a13062e38729fcad786baa70e9636db3ef2f67815bd18a9dd3b65bcd42d150c6df2cdcf644b21317f13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118086, "uuid": "185d1699-5549-43f2-9579-5bf5ac5a7eb2", "value": "T1E1D412028F76DC96D6AC0EB242A2E971D371DD81BC23F24A9DE97E6737333D00944296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118086, "uuid": "d9cf9eee-455e-4c07-9c2b-a4e4607828da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118086, "uuid": "c8630359-e23b-4678-94b0-c257b12b44d0", "value": "12288:ZZkPkXSBYiV0RhiIKp7RLAjBcCZEZ+k1+oChhgIa7cRWcsP8ZqLsfcZy:TkPZBTV03iI6NL8cz+AChNRWzem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634118086, "uuid": "e5736b31-abe5-4910-8bb8-c26453e674f6", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634118086, "uuid": "8aa6f64a-6bb7-48d0-9c9d-00e839db9df5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118086, "uuid": "db64efb2-8c13-4785-896b-77896f0b7b30", "value": "7b57c26a8208756f37e8df8331f94610.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7c41a2-2c54-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634150109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634150109, "uuid": "d3e45152-0442-4163-b6bd-d6ea9ad9baa9", "comment": "Malware payload", "value": "5c3caa890959997801766b64c38148a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634150109, "uuid": "2f3263a0-f7a9-4137-b52f-fed5f38d4116", "comment": "Malware payload", "value": "0d313c753af6da5db931cf7c68e5936109d760ea9188cda5353ebb7fc9f535fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634150109, "uuid": "672b93d6-3fa6-4c4b-8162-837a65577d93", "comment": "Malware payload", "value": "d6b87927db33a60c4facc9fb617d23d89a84d81f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634150109, "uuid": "13e07df2-91f5-47ed-a23c-02aeec1d1707", "comment": "Malware payload", "value": "c88bef7dbf7415af1ba42a9c0f3587d0584efb71d34b28b93a5a929275c8ed95774a46c6af35f8bb157b2eed535386d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634150109, "uuid": "8a4a6ce0-169e-4633-9a41-368f92407547", "value": "T1D3640A02F6D68F81F7F81771C4A2552093BCE18672B2EB0E2D8823D56D13762DDCAA5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634150109, "uuid": "28d9504f-8fa9-4885-a566-23736b715cb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634150109, "uuid": "20f3e796-3efa-4033-b6a9-c1f5b86c19ee", "value": "6144:XwW8ihNTJ9kcB8Kbl+TQkOXC3NhoevZqVyG/OJk/6zCPp:XNTkGHbg9nqCzCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634150109, "uuid": "8e123587-42ac-48dc-90a0-07ba0aeadb72", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634150109, "uuid": "4134c734-aaeb-453c-a923-f27689409482", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634150109, "uuid": "fdb5a1de-9d9d-4e87-bae7-1c8cfc7212ed", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003df041-2c52-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634149124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149124, "uuid": "19195ae2-f614-43b7-abe2-41c598697399", "comment": "Malware payload (Dridex)", "value": "172e33cda92623f3f9b3213954f52e9e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149124, "uuid": "133701b5-15c8-48c9-b0ba-7468a1f507a4", "comment": "Malware payload (Dridex)", "value": "0d9a0d05c7ba4ae81904e64f66235e032ded422aa95de11b8a9691123f911885", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149124, "uuid": "090b368a-fbc1-4251-8cef-9be8e5253427", "comment": "Malware payload (Dridex)", "value": "05f886e3a9d32eb725dc4f3128c62a0165bc0506", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149124, "uuid": "6d52511c-3d5d-4b19-9015-0fab3e910313", "comment": "Malware payload (Dridex)", "value": "8b3c2a81a7eefe4483295100527333c29d7431a5b13d3f17613e17adea75c2627126a1eef0d2ed941fdc3e74ec237bc9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149124, "uuid": "d0f2fb7e-5c58-42d4-980d-4e305b94ad82", "value": "T13404DF34D6BB27D1F8DB0878B047F07BF21A6E59712CC945D29AC05FA4EDA12B8B1913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149124, "uuid": "81877cde-71d5-4a64-9fa4-6e7fb930714f", "value": "4ae655604782e94c4041a6069971edd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149124, "uuid": "15774f82-8035-40b6-b983-ba448578b708", "value": "3072:vqzhtjVkooePHOHX9s/4R1ltAeSKt84r5AMUpbSeS:yuopPu3q/4FCur5AMC2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634149124, "uuid": "87715d7b-a0a1-4d2d-96af-d91bcf1858e8", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634149124, "uuid": "f43068d7-52e4-4b7d-8208-e21b7b3faa20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149124, "uuid": "52c37328-0f33-4b62-9072-f88a6cff0b3c", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.6583.26429", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d3d3f2b-2c4c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634146622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146622, "uuid": "e86f30b4-2e75-4837-9edf-7503b80ece45", "comment": "Malware payload", "value": "1c978ed3ed7b3f6c428792697d5fade4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146622, "uuid": "c199c82e-e5c0-479c-adb6-53a7a947a404", "comment": "Malware payload", "value": "0dba0627fcf1b3a0c754c2e0a71cd15a73705719729a53feaa676bae9fb3fc23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146622, "uuid": "7dd6660f-db42-415d-8067-cfbddc9c02ab", "comment": "Malware payload", "value": "e99eb2597c67ce115dd5a5e32c203b68c37caccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146622, "uuid": "b05e7595-b938-4995-b073-26bef98d5cc1", "comment": "Malware payload", "value": "549736227350c80df4d6f18af43c9d91797bbe1493fdd6edec0252441f58f4d6d10713c19e06ec21488e4e628261a624", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146622, "uuid": "8da4eeb3-60c9-4cac-ad3a-ca1539471b49", "value": "T135439DF18FF8B8A5E114603370A4A13C3BD35E0DDC65543AE69FF50A36A29C224E5E1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146622, "uuid": "8de86746-fc0b-42a3-90e3-d84ffabfb519", "value": "192:CtwlMr8MIhI1SLj4+kFrtRoCKoCW0hyY8PGCz9QwAOWgSr/GQyBbd2/0rfwOzqN7:SW6FIK1SL34BrVyOzhVWpAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634146622, "uuid": "9a917bdb-4b7d-4a98-9b8a-5d2e06a0641d", "value": 56832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634146622, "uuid": "4fc91675-e8b5-4bd0-a79e-47f421b9aeb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146622, "uuid": "8490f5d0-9c54-4c46-87a6-71467dd06eb1", "value": "1c978ed3ed7b3f6c428792697d5fade4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1257ef2e-2c45-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634143571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634143571, "uuid": "1b62fe41-a9ba-4e8e-b960-c4e32e1ad8c5", "comment": "Malware payload", "value": "ca027182d31698dcbb704e0d1a7c28d2", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634143571, "uuid": "4a809e6d-4604-49e7-93d4-fcc9bc7a5214", "comment": "Malware payload", "value": "0e201d6a6fbac62df83faedc6af867e1b17de08220698b5f06c204ad4d936b83", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634143571, "uuid": "0cd7a30b-6b8a-4d63-96b1-add137bc8051", "comment": "Malware payload", "value": "628a5f48cbad45672a239e683bfc4eeadb82fbc3", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634143571, "uuid": "b5f3d3bb-8f1c-4b5a-bb2d-2c363f1f3890", "comment": "Malware payload", "value": "1777113319beec71593c36ae9e0fd68bd08380f72210f703ec3ee4921842099a40bfbc07ad27d1a1059f6bd3bf3e2877", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634143571, "uuid": "22d470d5-10f2-40f3-8b04-69c34f3383b0", "value": "T11F737CA6F6C1DC06CEAA077A48F782D6662BFC551F53834F3248F75E0F70A91891261B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634143571, "uuid": "496b3ca6-4d38-41e7-a407-444bb5144ad5", "value": "1536:jk3hOdsylKlgxopeiBNhZFGzE+cL2kdA34zI0ScDNzmVQyrnHRBoESK4nceC7r9O:jk3hOdsylKlgxopeiBNhZFGzE+cL2kdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634143571, "uuid": "d9c5009d-2515-4692-9791-e0f73656c04a", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634143571, "uuid": "9d456ad5-2fa8-4da1-a003-3e350c647c4d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634143571, "uuid": "be0001d6-65fa-44c2-8576-cf70df7d9a71", "value": "Remittance Advice File.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281fce93-2c0a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634118267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118267, "uuid": "56607e74-cab9-4c46-8716-c88e61562e3c", "comment": "Malware payload (SnakeKeylogger)", "value": "45c772f399be8eb70956b0ae69224b08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118267, "uuid": "b843e7d7-abc6-42bc-98ad-7bf0b10d745b", "comment": "Malware payload (SnakeKeylogger)", "value": "0e658e76cd787fc1e7e65cbefd6a9e191b437ac23c749c90f30f3a3c307d2dd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118267, "uuid": "e2b61203-fece-4d21-9eec-f7aa47962879", "comment": "Malware payload (SnakeKeylogger)", "value": "cc5f32dd90c396ae857e4f75681f8e62cc4e0d75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118267, "uuid": "ed2ea53b-7535-40b6-824b-601b489f5f9b", "comment": "Malware payload (SnakeKeylogger)", "value": "c2e7f7aa2b58f8b7fc726e22c9b5b696a162dcf66fbafee94760dffbad1f167085349adc5648e06e1eeb7d430d174b63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118267, "uuid": "fa339ea4-a67e-4143-85b5-494a7f420754", "value": "T18745334B2076F260FC9986B7A2C746DC48ACCD8A2F2B125537CD0FA73E119858CB755E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118267, "uuid": "38112f28-3606-4513-98c5-0618a2c00909", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118267, "uuid": "6d416e31-9931-4b1d-8c30-ad95d68599ac", "value": "24576:hwhQbXOZ/2CcxqimT4GroidE4tAUHGRHnT8XDCbDRcjSEHDQLFZ/S:OQbiKqimT4iJWpNT8zCBcjSEHDQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634118267, "uuid": "bc1c636a-5936-4948-bb62-e56750e2022c", "value": 1184768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634118267, "uuid": "01293191-a2bd-4d4e-9554-428b915db197", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118267, "uuid": "a927c79f-318c-4038-8809-280ef44eecc6", "value": "45c772f399be8eb70956b0ae69224b08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8760ae75-2c5b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634153216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634153216, "uuid": "1f6d9f05-8eae-4f79-a4c1-38c1c4fb2096", "comment": "Malware payload", "value": "5c890f0670043a9ddbdf583ae26b38e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634153216, "uuid": "f13f6c9e-4c0f-4e1e-b9f1-14732166a85d", "comment": "Malware payload", "value": "0e7df40748bc25633fdbff4ae313acb3e5c3a9325e9a9de2afa6e832a2797004", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634153216, "uuid": "f5fffc97-6620-4413-a679-c0d36dbbb2a2", "comment": "Malware payload", "value": "0d6ab940dfe8beae1a9fb2582f0ad4ef908ac392", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634153216, "uuid": "385a26c3-4d43-4264-9251-7d74d5559d42", "comment": "Malware payload", "value": "db7993b2b9d638f2db4c552489f8559efa21a9ce33639a50dcb5f856dc1f4bbb57f3eaf059385af62a1562db19e80656", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634153216, "uuid": "c5bc01f1-8b0d-4904-aa73-4fd6bc0c9dfe", "value": "T1E694E102B1E88E76E1630A3D0EE497355EF6FF745B36D59367D17A1F2E320880D252A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634153216, "uuid": "96daf8f3-34f1-46a0-925d-53306c3af5f0", "value": "535fa6479108b5163f64223c5e835312", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634153216, "uuid": "06058a2f-680a-4ba7-9307-e6405fec2d58", "value": "12288:C4jg5ZqdXUv7j+6khm14Qwxj+R4QBbfwxkZoLKl/n:Cf5ZqdXUv7j+6mpQwhQyId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634153216, "uuid": "6b801676-1784-4743-86c8-7271b00b90a1", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634153216, "uuid": "179ccd9a-f82a-4d33-b8b1-56fe51414273", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634153216, "uuid": "56e363ce-caf5-4659-944e-b1360f050d85", "value": "5c890f0670043a9ddbdf583ae26b38e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de74832-2c08-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1634117472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117472, "uuid": "91fd0659-5894-403b-a301-b313bf2f79a9", "comment": "Malware payload (RaccoonStealer)", "value": "be5a2897072048974790ed5be8c5898f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117472, "uuid": "6e0350d7-bd45-4beb-b5cf-1ddb6cc1f911", "comment": "Malware payload (RaccoonStealer)", "value": "1002dd3d5f4dd8e8c7d9ccaf9454cf27e6ef264eb408b8e9fdb5d01c9fe66b84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117472, "uuid": "b57548e0-47f4-47ea-b4c0-096faea4ef90", "comment": "Malware payload (RaccoonStealer)", "value": "5957ea62ae67226a51deea287e6c4c91fc131222", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117472, "uuid": "0097beb7-3907-40d5-82e1-7a73318d8d1c", "comment": "Malware payload (RaccoonStealer)", "value": "93082b5b77f11767d9aebd29040d87ee666039981d69e6ebaf54921a1ce9b69bf4a849677da9e5c5b19bcba49300cc05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117472, "uuid": "9779b746-3c6d-4e92-a55e-3549f0c2fcbe", "value": "T1BF15CE81E98455B1DC296B306A36CE3056377CB85E34895E23ED3E2B3FBB2D36025563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117472, "uuid": "1736d640-146b-4e9f-b0dc-091b99e6318c", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117472, "uuid": "3eb62f47-b5fc-4442-8431-b9305c9520cd", "value": "24576:EHLmCiIh81qfyn7yG/iUmrmoF3H/dxvBjdrDJ:RMc7D/ixpFH/dxvBjV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117472, "uuid": "7d70b954-326c-4dac-bfbc-8e78817cab91", "value": 901318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117472, "uuid": "a441c26d-5cd6-4fb2-a409-f17ce92782e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117472, "uuid": "f557b725-5d78-4928-96a1-6925400dd66e", "value": "Allegro-fakture.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22eee7bf-2c08-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1634117399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117399, "uuid": "8d89763c-d3c6-42cd-a43e-1fb84a754901", "comment": "Malware payload (AveMariaRAT)", "value": "065ee8fa88089e6576aad4b66d1322f8", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117399, "uuid": "8f188616-e781-4498-8b50-be2bee50294f", "comment": "Malware payload (AveMariaRAT)", "value": "11f7307f314fccd2b1162443bb699d885f5e325b4b638a10997d98247463acfe", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117399, "uuid": "183fcb66-4836-436d-bdd2-365187bf793a", "comment": "Malware payload (AveMariaRAT)", "value": "fadd1d9044f51212fa81c9f3fe676915c1f99d42", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117399, "uuid": "5cbf1dbe-64be-4755-baee-d43add70108f", "comment": "Malware payload (AveMariaRAT)", "value": "2c74c87bd0087191379f2831cb98a01e508c63b60113c1d3e9409ea3ebb64d9096189c818884d84810ac35e0360e54b1", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117399, "uuid": "9261aaeb-7751-4094-88ea-6406f6e80f9b", "value": "T136B2FA62B290426ADC7A4B7258774CC015F3BE79ADF5D92D94CC303B5B333E9066262B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117399, "uuid": "68ae53d2-0aa7-41a7-abfb-73314347d743", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117399, "uuid": "0a9d75df-9ff6-437a-88a0-347ddb86ea5b", "value": "384:ShBLFXZnAy2MeDFw6Lv9uEEF0zgMmW84z61crzkO:ShbBywEuxxdemX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117399, "uuid": "10672f31-c9de-41a3-b5a0-00c2dde2549b", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117399, "uuid": "293b2e06-e1df-4715-9e66-c6ab4125eb1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117399, "uuid": "cb6ed7cd-b54a-4dc7-bbb2-78bbaa9b953d", "value": "Request For New Qoute - Ist Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b255b833-2c23-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634129236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634129236, "uuid": "bbb4c579-b94c-47de-aaa7-88fba975e3fc", "comment": "Malware payload (AgentTesla)", "value": "85c3e9f75896a722fe9f25ec918ab46d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634129236, "uuid": "3f6dc6d2-32f5-4d00-950c-079cbc20d0bb", "comment": "Malware payload (AgentTesla)", "value": "1290ef7be0befbdc31eb2dc29ba4ae7526e74d3a1c085f51762b03475a9ef4d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634129236, "uuid": "a9f46458-a9eb-4be9-b037-5fbf408aad93", "comment": "Malware payload (AgentTesla)", "value": "e4e658cdd1f8e3b360c31045acbb2256a7707b45", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634129236, "uuid": "9987e6ef-e595-44ee-9851-3b3a12e5e4c9", "comment": "Malware payload (AgentTesla)", "value": "9f0463cfeafd7ff5b51251c80a64d4534e72edf8a6eb3f1ab1ec5a1a39793ea9db59e8a64790a4137a86af752e2928ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634129236, "uuid": "e27fc5ec-f36d-4b44-899d-aa1680eafd44", "value": "T173C423ADD395B5B13A85EF20C94964E037EC6FB4D5CFE58D0F0A8521790F728A3121E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634129236, "uuid": "3c423508-8b21-43b2-85a6-3f9c38c35b60", "value": "12288:PDY5hQ0vbn1SV9TOXWFi1ldHM2BN+J093IWc7E0yvf:cU6xSYLdvNC0V4X6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634129236, "uuid": "63d314c0-5397-4eca-b5d2-0975796fc942", "value": 561031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634129236, "uuid": "e43df563-7135-4871-951f-466f644f2c31", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634129236, "uuid": "96471ea9-615c-4449-8f23-0e71f325c050", "value": "Remitance Aowl internationa co.limited SWIFT-$ 111,480.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1559b357-2be1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634100626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634100626, "uuid": "40d5da05-8d5f-4d3c-aeff-1620a97917b1", "comment": "Malware payload (AgentTesla)", "value": "cea5140d06a241d425ecc6769f1611eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634100626, "uuid": "503898ed-8de2-4d42-b93f-3c6cb58f2424", "comment": "Malware payload (AgentTesla)", "value": "12c53f3f15ea57dc22cdc2ac4cea1671350d248a8933b6e57339cf13eacd6258", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634100626, "uuid": "db373e9d-38ef-428d-92b1-7d3efcbf46d4", "comment": "Malware payload (AgentTesla)", "value": "301c78a45dc99e3bad7cdeb73e42f7db89bc7ce1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634100626, "uuid": "651ac216-171a-4012-aa8f-8afe01b0bee9", "comment": "Malware payload (AgentTesla)", "value": "3e5d41c652436d61e71fd65f28241f3fc1dfb7fdf586b913b2eae3c1e0ca647a8b11876a537b5c940c43fe98350719e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634100626, "uuid": "353561e2-80d6-4f3f-ae2e-dcde79ed38d6", "value": "T148D41212AF09C65EDA994EB480A0E9305371CD87BC57FB5A8ED87CB737333D64846292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634100626, "uuid": "5f6aeba7-39d8-46dc-988f-462a223d6825", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634100626, "uuid": "1698ba74-5e5d-47f7-982e-ad835e4f838d", "value": "12288:GzOVM4k6SBOFieX6Om45KGtjETIAQdUE70A+yg+T4bQ6QZ9:GQgBO6LugIHoA+yWbQPZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634100626, "uuid": "243f6f37-bdea-47c9-b144-48a8682beb7f", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634100626, "uuid": "cdb37fa3-6590-416c-9421-78a2ab373ff2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634100626, "uuid": "83a9d020-046e-460d-8269-4f4b173ce066", "value": "tT5M57z8XiwLwf5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07eb83d-2c2f-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1634134468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134468, "uuid": "45449fa9-a5d1-489d-988f-a3b4641eea99", "comment": "Malware payload (BitRAT)", "value": "a30e613c35cac684fe1a5713929c6d2c", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134468, "uuid": "be31586f-5395-4500-b835-cf7a252c68b9", "comment": "Malware payload (BitRAT)", "value": "12ec3fd7177b0176a6c1a1f611f62514299e769697ed70354ce4bfd215c22b01", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134468, "uuid": "286e35b2-9db7-4e0a-8d26-e7043b95269c", "comment": "Malware payload (BitRAT)", "value": "63298c58fd74552e1077f6347ae16cfc4614b27d", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134468, "uuid": "3ed2f48d-abf4-4d9e-ba7e-687a0ea1ec4e", "comment": "Malware payload (BitRAT)", "value": "34a6b63dff9438d9642ecdb6fd05f4c90d5f1388b69fcf93b714009c161c10ce9caa37af08bdaa08874d2f9e626beb75", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134468, "uuid": "e71b2ce3-52fb-4a1d-8024-169c41f2f5e8", "value": "T1E28128B6113C1463DF6517F2A210BDEA0992F72345D78254B0BCFEE30B27229F9B2906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134468, "uuid": "fbc4bda3-a6b4-4acb-951c-ceed686d1b9a", "value": "96:I2WyD5rsK7emepoQYX4OLE/cLwgkhMSmSRLXtj:IUD5rsee2XTLE/x5hMSmsTtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634134468, "uuid": "1fa96685-3371-4ff3-b605-9a3efa61e6f5", "value": 3904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634134468, "uuid": "c8e39b1d-199d-4407-acf3-506f1137867d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134468, "uuid": "01cb860e-00ac-4e42-b285-1a6fc3a67685", "value": "Inquiry 001782021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8ba9da-2c36-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634137444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137444, "uuid": "569c666f-8cb2-42f2-9120-b94c03f5c7c0", "comment": "Malware payload (AgentTesla)", "value": "b260e86e981f82edde6d7677c9a0bc53", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137444, "uuid": "336a8a29-bbc7-4e91-9e57-0f16fd86909d", "comment": "Malware payload (AgentTesla)", "value": "143be0a978733c4e1f40d9d21da589d9752ff96573ca35d6748a8d7c7abec9fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137444, "uuid": "2230d3fe-55af-40a6-a84b-53017f85ec8a", "comment": "Malware payload (AgentTesla)", "value": "e7dfbb61312e3035c8bf9605b8d0216a13a45f10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137444, "uuid": "804c62c0-69e0-4dd4-a757-01a3cf0b79ee", "comment": "Malware payload (AgentTesla)", "value": "00acfc705d3df71ede6166d7f81d91e9985afd0ed5b4198d7b7e581ac6a24fcae003e5204471166697fe9a326058a46b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137444, "uuid": "c922e687-32ff-4697-8fb4-8bfa8b8f3896", "value": "T1A5E4BF64B747D51BCE354BF028ADE241533AAE111A48C32E3885BBBC2E73774169CDDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137444, "uuid": "4e2b73bf-ca7a-473b-8670-d88e2750d641", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137444, "uuid": "a9526207-7fe0-4ecc-8f58-4e37ed1ae987", "value": "6144:AOaY7WeQ+3HwOExxB3+AkmZlIKl1U7ZoQQ8SF9xwcRcSVztoOZA+YbtEdqzM9fqr:bIoGPl3XQ1SFeSVztokAEt9fhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137444, "uuid": "0d9c0146-5dc5-46a7-996d-269ed676e4c7", "value": 688704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137444, "uuid": "6d70e1da-56ae-4a59-9de9-e4b483b64603", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137444, "uuid": "84126bb4-82f9-4221-85d2-da5fdc7f852d", "value": "b260e86e981f82edde6d7677c9a0bc53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f640b6a4-2c07-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634117324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117324, "uuid": "3336fdb0-0f27-4f6e-a9c5-b0bd45353984", "comment": "Malware payload (RedLineStealer)", "value": "161c1e9b2be7a7f15ef5d5944f60a7ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117324, "uuid": "95c8c0a2-1044-4e4a-838f-51732540e071", "comment": "Malware payload (RedLineStealer)", "value": "1569ab96dc22cc20538d37f8dc3e1c8ce0e62ae3968f9b3b5d8442864640ca1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117324, "uuid": "e5223019-a4e9-4008-8d9c-f2111e3a7a15", "comment": "Malware payload (RedLineStealer)", "value": "5916429f529847ba6f91e1b15d1ce14dcc3b86b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117324, "uuid": "fe1b2fdc-3465-4fb0-80ea-b82fafdc0f17", "comment": "Malware payload (RedLineStealer)", "value": "bc34be997c8c3edbac509f0d47629222399437243f41134fb5114df7da509fe0d198710fa9fdab7a97c481ed2061170c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117324, "uuid": "4f2bc594-403b-406c-af2a-a7ab99491ad0", "value": "T1BC84AE10B7A0C035F5F312F84ABAA369A93E7AA1A72494CF53D516ED97346E1EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117324, "uuid": "65af8f73-6432-44f0-bea2-bbca528a15b4", "value": "4b52e566ef5b8727d87906b4623fc7d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117324, "uuid": "bc67f378-30f8-42ff-bd26-88b725b3330e", "value": "6144:RY3Y74ZLH0Q75NSA9VtGa67iKfjRiCcOJRRJeV0z2sDsoYR:r8Z08IAztGa67i81iCcOJRRZ2sDsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117324, "uuid": "a1e77583-d91f-461b-9bf3-fdd1ee3344f3", "value": 394240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117324, "uuid": "b025fe5b-7499-47e2-8ab7-3d13d09d2b9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117324, "uuid": "3fc1d128-f965-4ab1-bf99-0dd99f882841", "value": "161c1e9b2be7a7f15ef5d5944f60a7ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4713a653-2c3b-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634139364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139364, "uuid": "f1989415-edc4-474f-8686-a66f594ce4b9", "comment": "Malware payload (Gafgyt)", "value": "c46381faabf4b06944370cf8a31f8ab9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139364, "uuid": "ff6c88ce-1cd2-4902-bbc7-42e8f3bae4cf", "comment": "Malware payload (Gafgyt)", "value": "157d6fb6042c5c1383e73677f68b5472f56e5e16e68acd777053478c186b097b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139364, "uuid": "6ba3630e-fe09-4a95-8f16-a990041e0522", "comment": "Malware payload (Gafgyt)", "value": "ac1329fafa79866404a30f869cf5135233493294", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139364, "uuid": "d50d5d1b-a387-41b1-ada0-b78d4d1ebecd", "comment": "Malware payload (Gafgyt)", "value": "90c552081d66af9b018efd1be31715672eca9dedb7c3f7dd611b289142bd8dcc406720e355eb17d13cc9c87297a4f904", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139364, "uuid": "693370c2-1a97-4763-bac3-33937eec6df4", "value": "T199F33A05E6408B17C1E2277AE6CF824D33339B94A3DB33159938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139364, "uuid": "d0b2ea2a-f691-4481-8e03-c5690bc4758b", "value": "3072:f1g2iIFdVzqKA7Y6ISag0/RQqnyLRM/9lzNmFwfBxKQodn:tg2VFdVzBA7fISanWqnydM/9/mFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634139364, "uuid": "b4453d2a-bb78-4fb0-9e1c-fd70dfed60dc", "value": 159896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634139364, "uuid": "595d9181-9a58-4d90-897c-cb9bf58d165a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139364, "uuid": "663420a9-9b6f-41d0-b726-3bbd82c1f0f8", "value": "c46381faabf4b06944370cf8a31f8ab9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba19d9d6-2c1f-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634127531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127531, "uuid": "a9af92eb-6aa7-4940-8c42-6b4ca1f60062", "comment": "Malware payload (GuLoader)", "value": "62565cd855f3d8a58ddf57438ca9bf4c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127531, "uuid": "1005de40-c10d-48f2-b3b9-29ced7c5dd2d", "comment": "Malware payload (GuLoader)", "value": "165436543c5b26a9aa82c18963414f905c54f1b1db5b887e89b7ce7f53f736c1", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127531, "uuid": "75d47458-ba15-4933-a4a0-bc224e346852", "comment": "Malware payload (GuLoader)", "value": "3d99b6b69ecaa351e5f0ffab8941bcce8f627e62", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127531, "uuid": "cd800e90-772d-4540-b171-ac319164c37b", "comment": "Malware payload (GuLoader)", "value": "47345959530de95efd2fba9f909e341631cc0123424f300fe267da9cf3e2127d0ded1b61d3fc3a497c157c669d27c9fc", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127531, "uuid": "24bbb2bb-9968-484c-9203-e03c7a4ad618", "value": "T15C43F21AD5D69CB3885AA1CB524BC52FB055CA0B4893EACAA3C31D91CC70E8BF4B5516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127531, "uuid": "20f72d74-8e48-4b5c-9b19-834a86e32305", "value": "1536:N3DbFsSRW9cCfmfItw/jZfbvTuHwq8x0IiIlh3:N3Db2xWjZTTuHwq8WIiIlV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634127531, "uuid": "0f39db84-f5c2-4b32-b9fe-1c87d8676016", "value": 57301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634127531, "uuid": "0da3f0fd-bcb8-4d6c-854b-2b2eb3903491", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127531, "uuid": "dd8b1135-c22d-44ee-8035-2ba0c28f096c", "value": "DOC 10132021.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f29151-2c52-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634149127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149127, "uuid": "a00bb42d-7cec-43ab-8fe3-883ad71a5104", "comment": "Malware payload", "value": "a4a76c9ae8211bcd264532909f8c2875", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149127, "uuid": "e51da623-ba03-4bd1-ab48-e5cae80d15fd", "comment": "Malware payload", "value": "167a95957c76896288917c0d90f05bfa1c5761c048199fafd334d414b0296f45", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149127, "uuid": "79a1d889-7c9b-41ca-bfff-540c1ee2cfca", "comment": "Malware payload", "value": "4b9dcfd9c92c956f17a48a1b9dd2299f328a08e5", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149127, "uuid": "5d5dc7f2-a17f-4aeb-8ce5-f865f722edaf", "comment": "Malware payload", "value": "9cabca9f9354d8cce1bdd0670e7c265059fa719829e3ac80e761b7d93301c628f4cb0dda383d41c774f0b52a25d93704", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149127, "uuid": "44de0814-c054-4b0a-9ac3-77d00fa552ca", "value": "T154D38C427797CA4BE54813398EE3CADB3772FC21DE62470336497B0E5E7A6A08C17652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149127, "uuid": "5c279800-6aaa-4f0d-8b2a-2cd330b995f7", "value": "3072:vk3hOdsylKlgxopeiBNhZFGzE+cL2kdA6c6YehWfGMtUHKGDbpmsiitGmZyAqgOb:vk3hOdsylKlgxopeiBNhZF+E+W2kdA6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634149127, "uuid": "6ae7283a-1dda-492c-b7d5-7e8cc673923f", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634149127, "uuid": "023616cb-15ab-4a95-866f-de2fd2f7bd90", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149127, "uuid": "d8d4bac4-bd66-4bba-a7dd-34ad315c593f", "value": "SecuriteInfo.com.Exploit.Siggen3.21227.11912.8850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba961a6a-2be4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634102192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634102192, "uuid": "02523be7-3fb7-4ea0-a808-8dbff8147275", "comment": "Malware payload (AgentTesla)", "value": "b7f0639a11b732a65c062131248cb347", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634102192, "uuid": "e611166b-96b6-4fae-ac10-064b22ff0b5c", "comment": "Malware payload (AgentTesla)", "value": "1751dbf21c3326cb823498ed2d48b65f2a0f27282570061d05030c401b06c916", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634102192, "uuid": "3181b029-8d64-49b2-8aea-435a7c91f4da", "comment": "Malware payload (AgentTesla)", "value": "bdcba131f0b7200b7b0711bb0ee0f66c632d3756", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634102192, "uuid": "194dc631-1b95-4da7-aabd-635ee75d80b9", "comment": "Malware payload (AgentTesla)", "value": "75a09ea0be858877ee0dc0dc261288464598353ffa18847aa7742adad899a1f2b76cef946f05c6bb175e07ce634da2a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634102192, "uuid": "94e678c4-5cbb-4d54-be12-4179f52fbe1a", "value": "T103C42302F7A64A82E57E7FF42D9567010B783E3A28A0E3151EE671FE5506BD1B6003DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634102192, "uuid": "c4dbb083-42fc-4cfe-8b9d-3b74e392768b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634102192, "uuid": "5b0069e6-1111-428e-a224-895548e22ef5", "value": "12288:TB5NdOrd0RygoqyuEHUfBYEIPQRSmsBy/ZrRoxCW5kcw2YsSB:NLwrR/uXmEII5sByR9okb2cB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634102192, "uuid": "48434154-07d3-4d4a-81fa-4caaf22d8d6e", "value": 578560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634102192, "uuid": "2743fd93-fff7-4794-a0d6-4937bd3d0c13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634102192, "uuid": "e0e7e400-65e6-4f56-a1ee-151d77cd42ce", "value": "Payment details_10_12_2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ace546-2c37-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634137837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137837, "uuid": "2f016785-02cd-4872-8a12-db25ccebc169", "comment": "Malware payload", "value": "d4233fefc9328cc30b0ef014beb2f51b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137837, "uuid": "cb4623eb-361d-4f04-8118-8f63f3189282", "comment": "Malware payload", "value": "1827a3002964434b0acff1359241948e334148d3413312cfea326cae8f269758", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137837, "uuid": "625206db-0f28-4c6a-b086-2479ae89380c", "comment": "Malware payload", "value": "302180a5edb1fd653d7884bb60172e6edfbbeac4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137837, "uuid": "437d3324-6403-47b7-b5a8-8918a213b5c0", "comment": "Malware payload", "value": "4437df27fa0d9e723effdb20361a71e5613c7badf8ff2e50eae9cf98b5018e5c686dfe26dc1d81e5e9ba9b5c8030bb8d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137837, "uuid": "6eb7aabe-c885-4e4e-b6ca-d71efb41014a", "value": "T114A33A02B195E031D5BA5636056B8A625B3A3E31DF718ECF6F981D8D27B41D0BE30B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137837, "uuid": "d5a15483-b725-4b2f-800e-a04701c65c94", "value": "e034be823b0408374ea72871051c5c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137837, "uuid": "393c1007-58f4-4947-8858-851f4631355b", "value": "1536:XlGfGAPqPOicsu0WpmS89PdDeSGTzIfTw83qVlIHyaaEil3Wkly9ncobUfs+ulZ6:1GfGAIOqXSKS13nKixlyrquv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137837, "uuid": "141e2b06-e0ee-44d0-8495-47f12e35c7d2", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137837, "uuid": "2b35bfac-64ee-4ca5-b122-c5a69f201c17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137837, "uuid": "9557c7c6-6724-4953-8a47-1715b3b2fde3", "value": "SecuriteInfo.com.Trojan.Packed2.43496.25036.9111", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc5d953-2c79-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634166004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634166004, "uuid": "30c0ba38-5caa-4de1-99ba-762446b3e5a5", "comment": "Malware payload (Mirai)", "value": "ae6380961427af32dd67e916743333a8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634166004, "uuid": "0514da88-65a5-4c08-a5e9-17419429ba33", "comment": "Malware payload (Mirai)", "value": "19394a5172899598fd9401d3cb43a06864b19e6d9c508a66a0d15785c0917a1b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634166004, "uuid": "851ee630-acbf-431c-bc05-d07111dcad44", "comment": "Malware payload (Mirai)", "value": "3d85831919521c28916bd73c25cfe94359fa28ff", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634166004, "uuid": "00e66f55-6e30-4382-9ddc-aa852a798fed", "comment": "Malware payload (Mirai)", "value": "2bb907475f7d834b215960232d5e2dc1cd79103043f06b6660798ea4c6b0fd2c066e9d698076283c2e5a866e841a9873", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634166004, "uuid": "46a0f0ed-8abb-4fc4-b195-123c1cbe3cb5", "value": "T147C32C56EA818F03C4D61776BAAF42493323E754D3DB730689186FB43F867AE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634166004, "uuid": "05aef39a-9576-48c2-a0a3-f25f7dd24d50", "value": "3072:lgU/44TM2nDQwI25oFxhYJn6ZDI+oV+M/900i/:eU/44TMKFx5oFxh0nsI+okM/9xi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634166004, "uuid": "76a7beae-d267-49a5-9a6c-7aa9dbb53f0d", "value": 121479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634166004, "uuid": "28dfb490-e822-4ab1-ae55-3f05625ecaea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634166004, "uuid": "59741015-0df6-450a-9ea0-c203c5b0ec6f", "value": "hoho.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d148ee7-2c48-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634144904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144904, "uuid": "e9606dab-47d3-4cb4-9863-5e84ee4cccd6", "comment": "Malware payload (Dridex)", "value": "5b8f9633373c57afbd84578e0c5b0963", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144904, "uuid": "9a4aa798-d75b-4ed7-ba9c-439dc014bf5d", "comment": "Malware payload (Dridex)", "value": "197d83e75f9ba917d44de670921d541d6c6fb715a68a66446c5d6efbbfb6ae27", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144904, "uuid": "e8fc9be7-4510-4523-abbf-76c436116049", "comment": "Malware payload (Dridex)", "value": "e508fac289beae948b03932f5f8cc2d141e2140c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144904, "uuid": "c2f713d0-9108-4ac5-9fe9-d917099b7251", "comment": "Malware payload (Dridex)", "value": "5436d9b4b084a3a4f2ee13d6db1a95e6c6de41c5ac213da77be7a0a1201edc12f0fbc707071ea99441107144b4a38a0d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144904, "uuid": "3ae90f38-56d6-46e0-a63c-7cf2e1de84d2", "value": "T1F204DF34D6BB27D1F8DB0878B047F07BF51AAE59B12CC545C29AC05FA4EDA12B8B1913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144904, "uuid": "dd8ba868-1a90-474f-a4a8-6374ba0d77b9", "value": "4ae655604782e94c4041a6069971edd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144904, "uuid": "895b3143-ea46-4c19-b7a7-2383d20e36f4", "value": "3072:BqmhtjVkooePHOHX9s/4R1ltAeSKt84r5AMUpbSAS:IVopPu3q/4FCur5AMC2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634144904, "uuid": "14ffb599-4d65-4c87-980e-b397834adbea", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634144904, "uuid": "1690740b-574a-45f4-9cee-3970f659fdf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144904, "uuid": "7f264d54-e218-4b8f-bad9-1320a092cb8e", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.14298.1942", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947d1686-2bf5-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1634109429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109429, "uuid": "5caa5408-fa8e-4fed-bb74-20fea14bb3b6", "comment": "Malware payload (AveMariaRAT)", "value": "40ee0f2b6397ba813c5712fa3432ca8e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109429, "uuid": "3247da95-7f96-4e55-9a10-03c08a3f2301", "comment": "Malware payload (AveMariaRAT)", "value": "19c71d27d982912ace67114c8c60113ae7018c050705c4cc93cbc3703f506440", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109429, "uuid": "8cbc20aa-4987-4229-82d0-c1e0867eb927", "comment": "Malware payload (AveMariaRAT)", "value": "caa2b4c19f4cd3210e0f1dd114d55fed44a04535", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109429, "uuid": "cdb76e2f-d35b-4188-b45a-176fa0dc5c06", "comment": "Malware payload (AveMariaRAT)", "value": "1f673f636b9bffce04f91994e79a2aa693489d8054ef39e14bfc94adc512e3073a9dd6bf2120aa0a242b4ac71e5626b3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109429, "uuid": "2fa46fdc-d0e6-47eb-af69-857980adce1a", "value": "T1F5C4F0926EA19F1ED29F0EB80091E930AA738C813C96F7CA5DD03DA337777C64495663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109429, "uuid": "fc024033-72b9-4f76-82d1-bd9fb89d7bcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109429, "uuid": "d6133203-5c70-49fd-b937-eee943fa8a47", "value": "12288:q0VMZk6SBs2zGaDP3rSi/cfH/5Y4Qpz4KC0LBWyst4yM:e8B7zVTx/e/5Y4Qpz4KNNWhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634109429, "uuid": "82a330cc-3553-4990-b9d1-9795cb65f60b", "value": 595456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634109429, "uuid": "7ca2ba68-18d1-4c5f-a31a-8ddeea99032a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109429, "uuid": "bfa9b60b-60f3-4512-a1d6-d9aed7e29b97", "value": "Price List 102021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e97481d-2bcb-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634091408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634091408, "uuid": "682f1ac7-8292-4df8-8e6c-4ff076cad6e8", "comment": "Malware payload (AgentTesla)", "value": "1363b11e2105d3486b2b5e8479c57a12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634091408, "uuid": "ab3c3907-1e33-4cb0-9a25-2bce3d15bdd7", "comment": "Malware payload (AgentTesla)", "value": "1a2283bb101bc94c20d48d0ad06f11ce6cb7d0ad76e117a4176b71900dd4c6b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634091408, "uuid": "a25055d3-e62c-4c36-9b36-cf360f201be6", "comment": "Malware payload (AgentTesla)", "value": "b9d24a83153aa0af8b1d00214096ddc75d0464e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634091408, "uuid": "13404702-e4ad-48f2-bb6e-f9a1d45cb9b0", "comment": "Malware payload (AgentTesla)", "value": "32554c6b69ca89b66b7b8263ca419f38b619c8bbac39bc765ff740a9742d559ca0988dcf28ae4fd50b03c3f30fb38e14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634091408, "uuid": "f415c983-d8ad-4045-95fd-18d94a5a2cb2", "value": "T1F6D412A29FA0C90BD2E94DB85092EA745730DD947E86F78D4DE67CB73B337C58086482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634091408, "uuid": "91c62855-cfcf-433f-970e-c865fd9dd83c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634091408, "uuid": "9a7a2cf2-2b15-4e39-a43e-0b1a90f6a994", "value": "12288:6mVMrkaDkW1wpB8faLg2z05c2/3y4hYcCowre+fOPXBDcexQzNkSBx4:WjoWSP/LVy/i4h1hMZfYXB4BzN5Bx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634091408, "uuid": "feee8978-bfa0-4c42-8e3f-c5852f09696a", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634091408, "uuid": "a8f9d794-a2bb-4267-8663-19cc80d3e240", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634091408, "uuid": "def3794e-f9af-478d-baff-7a920464ad15", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0fdf555-2c09-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634118175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118175, "uuid": "3b511468-6b05-4df4-88cd-d7281468c944", "comment": "Malware payload (Loki)", "value": "80c6546b0a2097556b4218e620c63853", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118175, "uuid": "c2419483-b792-4a62-9b9c-5ab0514ccb58", "comment": "Malware payload (Loki)", "value": "1bd6ca0da8962970e264b56a8d713424cdd6fb905768867f4454218f3c84d7be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118175, "uuid": "fdd9618e-f806-440d-9518-27caf1fcedef", "comment": "Malware payload (Loki)", "value": "7626f5515da857e786a6f4334cd37a903516d752", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118175, "uuid": "20bb0d83-b2c9-40b5-afd6-7c50cb322d2b", "comment": "Malware payload (Loki)", "value": "511f375a660af70e89ad5941e9b82ad885145055218a7a8035e340dd7c90bdf5fdfec241633bc59490a45f322a22c0f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118175, "uuid": "a23efe76-0eaa-414a-96e0-f5e649c2d9f5", "value": "T121B401128F64D9EBD1998EF68562E5B4CB31EC80BD22FA5A8CD07D7B33337D20446196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118175, "uuid": "c6b04ac4-b8eb-48da-94a3-ebf2e634a371", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118175, "uuid": "993e8ce9-0bf1-478e-bd53-f6d0b9a12e8a", "value": "12288:XdbPkhjpn1PIA2P+Kn1hN/gs+EKdPKeJSB:NbPSN1Wn7xh+3tKzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634118175, "uuid": "6c5bc115-687b-46eb-b194-c978af731fdc", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634118175, "uuid": "e6d4014a-c7e1-420b-bb07-5099a51c0262", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118175, "uuid": "614e4529-1492-4c20-94ab-6bff1fd114af", "value": "80c6546b0a2097556b4218e620c63853.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d32c19-2c27-11ec-843c-42010a9c0014", "comment": "Malware payload (Alien)", "timestamp": 1634130739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130739, "uuid": "9bdba66b-0035-414e-833e-6f50aabed6d0", "comment": "Malware payload (Alien)", "value": "3fdc1f2f1af947fea9f7f59d688c9ec4", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130739, "uuid": "0b4d536d-5a6d-4866-baba-470272b0bcd4", "comment": "Malware payload (Alien)", "value": "1c2019d89c3c64af68eeaa8cf75612a1740e19b1fe45609bd06993ff07bbc31a", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130739, "uuid": "8815acc1-e68b-44e2-8fc8-88ae9209259b", "comment": "Malware payload (Alien)", "value": "2415e26161139c2a86b2d2719bd922b9e8d9fb20", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130739, "uuid": "369351ce-6635-4770-bcac-e94bedd4dffb", "comment": "Malware payload (Alien)", "value": "d5f1e813c2e29943ca3dc1d3c634267784877e7ff21621ae8cbe5c08ce1193a257bf6227dda143b3d6c180bb5781da92", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130739, "uuid": "38dc3357-34e8-4b6b-9f45-41fdc5138237", "value": "T1050633927F108892D1D798371D0E925BF93607DA8712EE2F26569818789BD901F32CFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130739, "uuid": "daf6ab19-a7d3-4ac6-a665-f3e998d84e82", "value": "98304:0frySSkNT7K4ClnZ5WEyYhBOR9h7pjjQyGntFoQrg+lN+p:CGSi441hBOd72oQZMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634130739, "uuid": "fd4916b9-1875-4623-9f36-e92dd5710d2c", "value": 3840707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634130739, "uuid": "68f152e0-e6b5-4306-a832-668bc9fa2b7d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130739, "uuid": "10ae78b7-82b4-431a-bc44-a81cb9bfee1e", "value": "Chrome253514.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9a9e1c-2c30-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634134753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134753, "uuid": "99fce31c-93f3-40a4-a40e-884e73296ae2", "comment": "Malware payload (Dridex)", "value": "eb663da7d960ab7736290075b46998ef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134753, "uuid": "dca6f2a0-3540-4933-946e-ddf628c03971", "comment": "Malware payload (Dridex)", "value": "1c3f402651ec7acc0f84753b8a3913ec5b9abb7e0350fe4c88fce7b3ed364ec0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134753, "uuid": "cf85db70-59c4-429f-9eed-a6f591a77fbf", "comment": "Malware payload (Dridex)", "value": "048f6ff1044ecd925654b86f8dbcc62a500691e0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134753, "uuid": "e655e877-f9ca-41ee-966d-34a3adf9b5f3", "comment": "Malware payload (Dridex)", "value": "6c734f5e6e907b0d698d43526cfdf8b91b54950f5acc93522c655034a1393f9fb194c97816ca73330520ee66d5c23326", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134753, "uuid": "89cce3ee-db78-4807-8017-83be32bab493", "value": "T13BD4F8013A54E821E7E955B6CF2AC6E85B183D49EFB0A4C778E17F0F2AA94F3D215305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134753, "uuid": "a730453d-ca80-44d4-89a9-6a7f4564e084", "value": "a5fbb54a2d8e086b0b1f07a086b817fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134753, "uuid": "696e8f41-47b6-4216-b616-9648e5e07ab2", "value": "12288:MuIBRuwMtjp4CqwqyaXPLAfx38TW9DiWUT2tq017JGoLbfW/:Dbb4wqyaDA5sTWiXT2tq07G2S/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634134753, "uuid": "1f0dfce6-894b-49f2-b929-ce9db5700a27", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634134753, "uuid": "af57c8d5-411a-4bf6-ad89-de9d9a1f95a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134753, "uuid": "d54e4949-702a-4891-b211-c5ad466a83c1", "value": "eb663da7d960ab7736290075b46998ef.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0786f5d3-2c70-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634162021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162021, "uuid": "bf4026a1-5c7f-4708-ac57-4fdb039b64ec", "comment": "Malware payload (Gafgyt)", "value": "656619f7da2158cb416191a136a8bcf4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162021, "uuid": "fffac758-948f-49a4-a2c5-1bf079f73a9c", "comment": "Malware payload (Gafgyt)", "value": "1c6c00c7c1254b33c16a3e7aa196ada129c930dbf8c66bef345d68e57de3d20b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162021, "uuid": "f0d27dd7-2a05-4e78-bcca-65d4ba205809", "comment": "Malware payload (Gafgyt)", "value": "be4bed7791781f3a7214f88dbcc953742e29c75e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162021, "uuid": "a16e6813-ad15-4120-97b9-c4ef3eab2f99", "comment": "Malware payload (Gafgyt)", "value": "f45f014770517290d0fa7732c192282f7af386b1ad1b808c150b017f472e3ea11bd6ef85ba79a6a06c15d3ce1db4fba5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162021, "uuid": "ae076900-3f1f-421a-9f4b-5cf23c601941", "value": "T1A4B3E857FB11CEB3C85FDD730AA68A01108DA99746D57B6BB3B4DA5CE74684B08E3C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162021, "uuid": "63772982-53c2-4a10-81a1-563413663ea5", "value": "1536:Tgz/qzNLW/fMiZIX98U0I/QwErQNO65hVwbfKdwwjF9GhCPR1Ae:Tgz/5f5g8utgW5hVwjKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634162021, "uuid": "07a3d0de-7768-4297-b696-da23c7e43d0b", "value": 116647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634162021, "uuid": "d1764621-f772-4f1a-9056-034fb0925029", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162021, "uuid": "ad0ecc64-dd2b-4037-9a01-e4c094500771", "value": "656619f7da2158cb416191a136a8bcf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98afae91-2c4d-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634147232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147232, "uuid": "95c65449-d8e1-48c3-9265-b62d8db0ee12", "comment": "Malware payload (Smoke Loader)", "value": "7486e9fcfb67535395f9de43b31761ac", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147232, "uuid": "76eaa8c4-d021-4ef4-af6b-4fad7ee4074a", "comment": "Malware payload (Smoke Loader)", "value": "1cbcf38576be160f81a7a93df62a3402d7965be062e4f1e0d88a81a44cd035a2", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147232, "uuid": "0b9142b7-1f67-445c-86b8-eeb0e7f583ce", "comment": "Malware payload (Smoke Loader)", "value": "03f3ae531809ce70c78474906ced833ea62ef4f2", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147232, "uuid": "258eb58d-a08d-4443-a275-d65da0bcfe51", "comment": "Malware payload (Smoke Loader)", "value": "0481db198e71609682c3689f0839613e8e26e8eeb19bf2a867c0599d480224a950705aa9e07c57a1fd1d02958c79a60a", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147232, "uuid": "1d600e02-77e6-467f-8728-831d9fcbb920", "value": "T139648C10B7A0C438F5F716F949B9936CA93E7AA1AB2590CF53C416EE8635AD1EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147232, "uuid": "a7e3344a-8df9-44dc-bcc8-72644cd7eb09", "value": "e97201e7ef5f430ebcbaea94835aaebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147232, "uuid": "02c5281c-78ef-4051-8838-1ed1bd2c2580", "value": "6144:FTSnQWAfDhIs/7vwPYb3phQ2SCvizm8R4Rv:ZSAfDhv/7IYph5viz3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634147232, "uuid": "f02eecb5-10c6-4c4c-a9ba-04c875849338", "value": 318464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634147232, "uuid": "adf748ec-e430-426a-af1c-f6033ebb7f93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147232, "uuid": "3d1330ec-371e-4039-87fd-cd064c500952", "value": "7486e9fcfb67535395f9de43b31761ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d060472-2c7b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634166970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634166970, "uuid": "ee8e680c-83ff-48da-a65c-bfcb65334060", "comment": "Malware payload", "value": "d00c507fc93850d691e025b56724d91d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634166970, "uuid": "76d5072e-801b-4daf-a150-28a0151d7eef", "comment": "Malware payload", "value": "1df4a7de1532dd1787e9a8d488016323409ca8052b2afecf9855d864b6c9b315", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634166970, "uuid": "ca84dc59-cdd7-4ba3-9d9d-e1d3a04a36c7", "comment": "Malware payload", "value": "a50258d4438d4a8272e7c0d8738440c29e34d71d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634166970, "uuid": "51af6a9c-d85d-46cb-858f-2f665b21b91b", "comment": "Malware payload", "value": "c665abcb787948ee29082694e245d3c0ffdf328be6d8f52d198b031aa6653af0eb214ca32c2daad52dab7ececc515352", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634166970, "uuid": "4a520f2a-8c8b-485c-915c-712655bf093f", "value": "T1EFD523C446416CFAE1795DB9A3A360B1B9313B14FE91E53A1472BC317FE7A20814DEB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634166970, "uuid": "11f314d6-7ace-424f-9fe7-5781dbd4afdf", "value": "49152:UdpGeZ+UDquS+InZDMKm4EcSowTlONuIaQhSPWFKwEVwrWv6pbGsTTSs+A8B:UdwSFDqbXnRPStluuILhIW4zwrM6pb12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634166970, "uuid": "f1fcfb28-161a-4402-82c4-540995bf6dd5", "value": 2779328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634166970, "uuid": "f3daa0a6-2b93-458b-963b-24313d7a5951", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634166970, "uuid": "742cbab1-46ec-4ce0-8865-d6ccf638ee5c", "value": "Porno_izle.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f377a1a8-2c36-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1634137506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137506, "uuid": "921f50ce-2416-432a-8f29-2aa9985b559c", "comment": "Malware payload (AveMariaRAT)", "value": "fcda3c59cd97fd418689d8513f23cb79", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137506, "uuid": "4deb73aa-1aa7-4880-bb6a-c5e7193cc07e", "comment": "Malware payload (AveMariaRAT)", "value": "1e54beecbd654f17bab2c6f883ea089943d68ae3e49aaea079182173dc203297", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137506, "uuid": "eacec22e-4739-4761-ac2a-9e6c949b0931", "comment": "Malware payload (AveMariaRAT)", "value": "4da890c39df36d0260d5f129795ceeabc0a30737", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137506, "uuid": "42c94282-6536-413a-816c-99ffff3466f4", "comment": "Malware payload (AveMariaRAT)", "value": "74ef7bf7a62512ee1770e40dcc3072cc802c034f3c7caae58940eaffab6ca4ce108f24fcbb10b4c5c6037c9584ef66ba", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137506, "uuid": "a7d795b9-764a-4a91-8dbe-759ab3c07757", "value": "T146259F23F2968573D5732ABC9C270A65AEEA7D002C74A54E3FBD1C1DCF292437A68153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137506, "uuid": "089b2cf1-1e69-4407-91fc-20f095aab4e7", "value": "33ef3fa8cfca6640b4d180caba182c91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137506, "uuid": "5694c7ef-9826-4950-91a5-b4726df6f338", "value": "12288:GrHeuodar6Dd3m4aS9FCZXhGiX1d0uVrLGaDOdJ4NUTw94rv4lprmi:GDe0W1m4aVNTc9jOiw2rqpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137506, "uuid": "6368313c-eae6-4456-b9b2-dd7e57edfa75", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137506, "uuid": "3c3811aa-d8d8-4f40-b9f9-9786df88ab45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137506, "uuid": "f77e9dea-a06f-477e-b4ea-8157a0c173e0", "value": "Halkbank_Ekstre_20211310_082357_541079.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53699cbf-2c57-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634151411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634151411, "uuid": "1f945571-7378-4842-a7b4-08e1f63edf8f", "comment": "Malware payload (RemcosRAT)", "value": "5679fa23039de34c76c5e4fec6a7830f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634151411, "uuid": "bd5ac745-3e91-4bd2-8373-2e21a5129da8", "comment": "Malware payload (RemcosRAT)", "value": "1ed62fd139d5efe1cb2650f52cf405d615dc19dae62744df9fb364cd1970a4bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634151411, "uuid": "d7f38ac0-ac77-46c9-a606-8a3a88697d9f", "comment": "Malware payload (RemcosRAT)", "value": "45debce29b9c5bb747df55268e207f39e954dff8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634151411, "uuid": "0f79ad8e-f9ee-450c-b10c-27c1b1b16d08", "comment": "Malware payload (RemcosRAT)", "value": "af2d65e8593f69355d6fe113d19a5991ce5ffc975f65209368d9f310c2d7e3e1a69b61601a881e5a78970b0431889da1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634151411, "uuid": "333281bd-c8bd-4b49-8078-39a9c4bfc9b3", "value": "T17B058D56BEBC1839C15150B88D4F87F66922AF303816AD812AD32D4FCF3676179353AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634151411, "uuid": "da208926-9eb4-4ad2-bdb8-aef696221d36", "value": "96a5031294b4d167fbfd58b7a8f0b330", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634151411, "uuid": "457312eb-ac4d-44a2-81a4-c95acba6e5e4", "value": "12288:oP3Sd0k2b6Yf1ls9oJ2mF6LIosXFHJ1kUk1N+BfZ8fQOwm6V:ofQob6CEoJ2OpXXpImZ8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634151411, "uuid": "e980834e-ab49-44b0-9839-169c02f5657a", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634151411, "uuid": "f5c693c9-36a2-4b6f-ab52-13ca39062269", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634151411, "uuid": "1e9ba637-1b4c-4e7a-b378-60079210f602", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d722f7-2c71-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634162585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162585, "uuid": "a01c3fa9-a086-453b-802b-b27602e77009", "comment": "Malware payload (Mirai)", "value": "4b6d2c90c5109a86e6d44074c88ce33a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162585, "uuid": "a7430faa-b318-4630-90e3-f51dec1a4677", "comment": "Malware payload (Mirai)", "value": "1ef8f13d4ddbd90df8b7eb013cd29951222d0042e50faf0ca053dd49cd59def3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162585, "uuid": "9cd58dc2-feb9-4040-9c6a-3d7f257719d9", "comment": "Malware payload (Mirai)", "value": "91dc58fa8656c087c6227f65daa7b130557862cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162585, "uuid": "637dd97b-1e93-4226-8b13-950d680dfe9e", "comment": "Malware payload (Mirai)", "value": "7c302d08f76e158193481ba5b84087aad1c086e01c5bc58df836795ba40f4b408102ccb4a8017c99df41a7668d794725", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162585, "uuid": "ba674df1-3566-4211-9e56-cbe390b8236e", "value": "T1C0D2E1016641FAE1D5B00236E8678A5B72253D79D1D130FB8A3C0DF8E6EAA1D47F4953", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162585, "uuid": "c93bd66e-0928-438d-9e32-e85c474f4ffc", "value": "768:FusHfRavjynNKnjFcZIhQzhKMXg4G9q3UEL7p:VRwynNIOQQ1KMwiLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634162585, "uuid": "4eadc287-7b4f-490c-8316-b4105d344ef0", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634162585, "uuid": "c070716b-9c71-48a4-a15f-1bc9752d5652", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162585, "uuid": "25cbeed8-e0c3-4ff0-a905-a5b5da106f2c", "value": "4b6d2c90c5109a86e6d44074c88ce33a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285edc34-2bea-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634104524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634104524, "uuid": "dfbd78a5-53b9-4894-8245-e9487e3e9aae", "comment": "Malware payload (AgentTesla)", "value": "1d4cd528f28caed7af200d3e9dec8c77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634104524, "uuid": "1ee7fc0b-637f-4fae-b6f6-b15230dd3c3b", "comment": "Malware payload (AgentTesla)", "value": "1f00546f3179546bedf70b587ca495c763e3987e426b0a2ef69c707b29144209", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634104524, "uuid": "26717e03-4f0a-4ffe-b1f6-18021311721c", "comment": "Malware payload (AgentTesla)", "value": "4c6f45b6ea2db49d527a59125a77d6f2c6f3449b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634104524, "uuid": "4a6e8cb7-bf9b-41a7-b632-aba69ca69846", "comment": "Malware payload (AgentTesla)", "value": "8e82a799d7fbaecb6125dfe2d0748e5f9c1d4138f34f2a28d3c217ff757a21559eec37902931b47f63295039efec302e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634104524, "uuid": "761acc38-37a5-4983-847d-e6fe04afd7d1", "value": "T136359907B2527C9DD056257354A071D3610938BE94B8C2F89BA27773C4EA3F09A8BF9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634104524, "uuid": "5736fab4-d37b-41d6-92d0-edc609315def", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634104524, "uuid": "9d969c24-efae-41a6-84be-7cf29f15ac2f", "value": "12288:9WoQMcnMPldjwaisqr9M41ElTdbxZs8wW56tKB3pgVygU:9tDPTjwa1qW4elSpeN3pgVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634104524, "uuid": "ff632ecb-f246-46a7-bea6-d8fdda9159ee", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634104524, "uuid": "1972549a-dbcd-46db-bc1a-c5d88ce9b470", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634104524, "uuid": "f0eeb223-0b4c-4ca7-9b02-54ad403da2cd", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.28039.22917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a3ca1a-2c4d-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1634147115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147115, "uuid": "4a49d026-3c94-4549-9b37-6363fb57d7ad", "comment": "Malware payload (BazaLoader)", "value": "60a361ce5f18ad041ca2b1f668828219", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147115, "uuid": "a6f46fc1-3e8b-48ac-bc89-0c3b54b95a27", "comment": "Malware payload (BazaLoader)", "value": "1f136522cc2cdea93e2086aa67ab07102bcef7e31b201489b43707986824b3f8", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147115, "uuid": "358d6565-5c41-4316-aa4e-e64a82fb7504", "comment": "Malware payload (BazaLoader)", "value": "ea43b8d17588710f01ce79c07cb7d79433d3623a", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147115, "uuid": "7ba62488-4a52-448b-918a-c899f5d6f1c1", "comment": "Malware payload (BazaLoader)", "value": "2cf7e08ce0f5ba893879e59abfb475522215fcbf6ea4943b992c381b13d5c78f6b962f2b4bdffbb9534465fc7298454f", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147115, "uuid": "bafb81a9-f785-418d-a09f-0ca19c9cc8d5", "value": "T138546DB6F2912DA6EAD1C879C216B1B4F28368373765E1D0B5A706D3102D4E4CEB6F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147115, "uuid": "1c6c0e7d-de79-47e0-b16e-2b25bedb1737", "value": "f2aa966974790b641bc88c5a5bd46a40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147115, "uuid": "eb63a64f-d61d-45ee-a800-be34bee1d2f0", "value": "6144:VWvccklaZIIq3+Q4gdD3iD9Rd3YdFT/od3kQM:VIcZao3+Qr4zMFTwXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634147115, "uuid": "4445303e-ea2e-40df-9444-3eb9ec9a7561", "value": 289415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634147115, "uuid": "9afbb529-045c-45f9-9fb9-28b8572806f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147115, "uuid": "6f91de2c-2aec-4c34-986e-f2ecdc4a92bf", "value": "60a361ce5f18ad041ca2b1f668828219.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9973a2-2c21-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634128499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634128499, "uuid": "8e5c3ced-f910-46c6-9fd4-b7a08131675a", "comment": "Malware payload (AgentTesla)", "value": "a823e7e92ae61a4f0a6404f9623a25ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634128499, "uuid": "e7a90c50-615e-4e43-bc33-fcbd71d2d08f", "comment": "Malware payload (AgentTesla)", "value": "1f40232f9a295b2010957d90ae1a8ec69312562269feb4ebec7c8272f38471ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634128499, "uuid": "f85b39c9-e0f5-4fc5-8dec-7047a2201cbe", "comment": "Malware payload (AgentTesla)", "value": "7031f662853429c7423d629eb562e52c82fd6855", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634128499, "uuid": "1b3eec08-b89b-4729-bdc6-fb8b599fb721", "comment": "Malware payload (AgentTesla)", "value": "9dd9f7936976af17c491fcb32f62864a04f41bfbe24b216f33994d8aad93b3478a0c408240fc4bf90b0fefe226742c06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634128499, "uuid": "fc6115e5-d402-45b0-b7bd-c0f8a716cde1", "value": "T14CD41253AFA1A99AD1514FB740A2EA30DB70EF44BE61F7264DC93CA337333D644521A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634128499, "uuid": "67ffb45b-a2fe-4c68-813d-5b2913e3ece4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634128499, "uuid": "36f43113-cbd4-48cf-a764-1d4fa3d604fd", "value": "12288:kkPkbOM04V7dvqh+mXPnoD1Xa425ZNY7VGe6pVPUMSB:kkPni7dSsmg1ImVgURB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634128499, "uuid": "4d6c1f28-79fe-42b3-b441-e8cc3b9a429f", "value": 625664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634128499, "uuid": "056177b0-b2d0-4e35-ae57-0fee6e60da0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634128499, "uuid": "0efd7f33-d469-49bb-8218-a461e45e8f3e", "value": "SURRENDED HBL CNSBIF0825FT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b849395-2c08-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1634117602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117602, "uuid": "ee32ed56-ab00-46e6-a866-0755ea869aba", "comment": "Malware payload (ArkeiStealer)", "value": "bc8f0bfb94d9a4455282bb072b79e858", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117602, "uuid": "812f2e28-f15d-46a6-83f0-bc9abfd2ca62", "comment": "Malware payload (ArkeiStealer)", "value": "1fbbaa6cfa20d6e11a3e5e4ba0702f608d474cbf5a86eef891fb57a671c684be", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117602, "uuid": "990e22bc-f6fa-4991-9c35-9add592558a1", "comment": "Malware payload (ArkeiStealer)", "value": "bb004397b82ba101f65a6aa9e8c7533061c01e2b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117602, "uuid": "ac08ce19-e262-4df6-b7cd-aa7ae076cfcf", "comment": "Malware payload (ArkeiStealer)", "value": "e79b186536bf649066a4c916e57240d6557e8560d25f1f16ecaeebb648434fa4da34189aa4e1be51f51719cac735a8e3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117602, "uuid": "3c4bdc1d-3e52-4d96-a2df-2aa65c59386c", "value": "T1A3E412217286E7B1D8B30871D869DBE14D776C418AA483C7BA763BEF3E612A05F35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117602, "uuid": "9c0c016b-d490-4932-9e02-e2926323ead8", "value": "1c763ac38c11e291bf3530d542ce2870", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117602, "uuid": "4bf729b7-e2b4-4542-a6d9-e8af2050af72", "value": "12288:7MJf6feSxogXZTR8Y9FriyGsJ/GGdeRFnntweXERTWsph1H8n:8RhgJ+0iyGpUerOVW4XH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117602, "uuid": "85a1d3ae-d331-4e92-bc40-4fb8475e93b0", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117602, "uuid": "8de0aa0f-0e0e-4399-9c21-317f92ca7704", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117602, "uuid": "3c534de3-0d0e-468d-b18f-30204fdc4c65", "value": "bc8f0bfb94d9a4455282bb072b79e858.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de0e4d4-2c47-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634144530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144530, "uuid": "a6360451-b55f-4692-a753-671b151f08db", "comment": "Malware payload (NanoCore)", "value": "c2f9ae069b620080b761d9280473e7aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144530, "uuid": "66b7d8cf-7b6b-4404-8ff7-d77d72eafe4a", "comment": "Malware payload (NanoCore)", "value": "1ff5df8d27ee5989ad0e7c7270bf3c6d711a4ea6141043dedf2ce7028ae1bf42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144530, "uuid": "5ccddef1-72b6-49f4-a1d7-854b10c46bd0", "comment": "Malware payload (NanoCore)", "value": "3df08169a1cb6ec49b4359e5b580c56da2740945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144530, "uuid": "105b6ec1-a6b3-4fb8-ac32-5bc0402dea1c", "comment": "Malware payload (NanoCore)", "value": "0be6cf1960d64fd286718b00c93f0fff01f050f786e6ed1b05280ea20af0a7a5bb4c6d381b26f81cc910131bd312aa94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144530, "uuid": "02300075-c1be-449d-ab47-fc37011bfe58", "value": "T1C8251202B7D18872D07319366A39AB515E7D78301F35DA5FA3E089BEEE351816234BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144530, "uuid": "c3388e2a-f21f-442d-b1e6-cae0f314e48c", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144530, "uuid": "845aad41-9709-4dfd-83ad-c5b38bc1c045", "value": "24576:rAOcZEhMGI1altq82FLLZcMdxwI1sDx52gWbh9dlW:tmUh2BVdx/1sDxIrtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634144530, "uuid": "ae5a1772-8a02-4bc5-9b7d-fd673cc77091", "value": 1023642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634144530, "uuid": "84e5c5a4-284f-4d0d-a4ed-952a90de0ffd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144530, "uuid": "bae42351-e3bc-4454-9426-d8c127babda7", "value": "c2f9ae069b620080b761d9280473e7aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3987ac25-2c4c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634146643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146643, "uuid": "98684013-a14f-425c-ae4a-90600ebaa1a8", "comment": "Malware payload", "value": "d9b8fa6f3fc0ab223862534a09f4e7e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146643, "uuid": "b2e72e2f-5e64-4cd1-b832-364929a6a4df", "comment": "Malware payload", "value": "203cdec559936bf85ac018ed1e6816ac09d9aff81b1158ede2644a502281a98f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146643, "uuid": "bf51f61c-8368-47e9-8e87-2d38df719119", "comment": "Malware payload", "value": "703061ade66bbd6a82ecdc0109787e6219e5f475", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146643, "uuid": "171af94e-c29e-4d19-a234-52a32e930399", "comment": "Malware payload", "value": "2e41ebed6cff8e7b1b1daba7734f153ca8d1690279d622cbe1378e1b62501b8fa9dcecce5ff667d021057ca0753d07ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146643, "uuid": "0edcad5a-2e8d-46f8-8115-231eab125772", "value": "T1D6C3F52EB7845B16D84819F8D5EB942417E3EAC32773D6853E4862DA0E413A4CDCFBC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146643, "uuid": "dc6741d1-76e1-415b-8899-d4b78f09f000", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146643, "uuid": "e0a39508-6b54-4671-ab5e-ff540d80aa35", "value": "3072:f3ZNi3GlgG4TWCGvP9Ohi8qKTcMMpO+bLyU:f3VlglWCGsAeQDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634146643, "uuid": "9349b90b-cd6f-4cc7-a58c-10c0ced99971", "value": 128512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634146643, "uuid": "b135b18b-d599-4076-af66-429751260428", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146643, "uuid": "6cd40041-4bde-4b19-a8b7-01a43d468556", "value": "d9b8fa6f3fc0ab223862534a09f4e7e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aadc834a-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634108608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108608, "uuid": "e6defb81-d8d5-4916-a0f1-52b07cff0c8e", "comment": "Malware payload", "value": "675f0730b0511dd664300b07dda0e496", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108608, "uuid": "4cf80577-abd1-4272-9a26-62cac3ff55f1", "comment": "Malware payload", "value": "208717468f9fbe2a1360cac5d53174ee999db037285cbdcbd620ebac12f7756b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108608, "uuid": "07085390-509c-4f7e-b9a4-7ada56973dc7", "comment": "Malware payload", "value": "e2532704b16db2d3b07ba53b5fb75539455bc4f0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108608, "uuid": "371ad7f3-c5bb-4171-93e7-7bc062486cc6", "comment": "Malware payload", "value": "7e55be6e07dac5ce76cd99b83a02902dc6630efe6b28569fc3627c815c6f757c0d5a55427f5845a3a13fae3dfcbe3fb6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108608, "uuid": "d0e46eee-0835-4363-acff-6d06e5090beb", "value": "T136B413AF7C80D55AF35368768207D122A8CF0899D41DFA1F89F405DA0A79DA81B01FEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108608, "uuid": "ef88fd61-1c2f-4c2b-81d7-9a9f88ebbc23", "value": "12288:xf4C+PnEJe1cwscHlJuHJb3PFpX+EejOBMWv0AO2W8+/PMSHVJFdW:xf4C+PnE81lscHqLPFIBOBMx8b+/PMSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108608, "uuid": "417d56c8-4ef6-4cbe-ba48-7350120b1c37", "value": 507777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108608, "uuid": "caec1b63-418b-48ba-b91d-4703c8c83b1d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108608, "uuid": "4b4002d5-08e2-46f5-a557-cdd7d62fac2e", "value": "GP_PO001_21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "235beb20-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634108381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108381, "uuid": "697ceba1-7d22-44cf-8609-7058cdd7e0f8", "comment": "Malware payload (Formbook)", "value": "18427b9e1b0494341170d883e691888d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108381, "uuid": "f6ccd02c-9d99-4a17-b125-7dbc3e56fb67", "comment": "Malware payload (Formbook)", "value": "20d0bd1ac88343ffc84035773ddb7ea0dcf14525fa9da7d3d8fd11239ab100fa", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108381, "uuid": "a4e5dfdf-f42f-450c-a1af-9354546b033c", "comment": "Malware payload (Formbook)", "value": "bb19d8da9b524b1749ad517fe4ddde5aa0d9745d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108381, "uuid": "347369c5-44d6-4367-8ba7-963f67ad70d0", "comment": "Malware payload (Formbook)", "value": "76071bdca2eb1291a04541d57bde454e58bfffbb8acec91f371980be9f69dd090fbcd1d345473b862d4e11bafffd348d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108381, "uuid": "1aaa386c-a008-457b-8381-2c0897fe61e1", "value": "T11D64236EBE3CDD6ECC075D349D35C8C80948CC7291A4A26350AAB22BD179E585AFF11F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108381, "uuid": "c530fbba-54cb-4e69-ac2a-717257413cff", "value": "6144:Y+4LfIkSNll5Lhl50keXF1lDWTlXtjM2n54bYKfx:YrUnl9lajF1lDWp/n54bYKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108381, "uuid": "3dcf6fb7-16be-4975-aad2-45552bcd864b", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108381, "uuid": "fe2d38b5-d8ed-42c5-b74c-233bc21d9d06", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108381, "uuid": "0c5cf24f-5323-4a6c-b71b-3042405f0baf", "value": "REF_MIDLGB34.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8ff707-2c4f-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634147935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147935, "uuid": "ea60f734-40d3-42c1-b3f6-c28daf0db254", "comment": "Malware payload (Metamorfo)", "value": "6029e560b25e77fa0dfb90c1f699e30a", "object_relation": "md5", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147935, "uuid": "f1100288-9999-45ca-b56c-a0e1c4b36a96", "comment": "Malware payload (Metamorfo)", "value": "21c15427e510d11a270acde17b9be3f4b521c2b79caedeba4241433355acfb68", "object_relation": "sha256", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147935, "uuid": "34fd2fa8-1bf2-4ac1-978d-779f09297f94", "comment": "Malware payload (Metamorfo)", "value": "b527ed1a06832418dba90812064bffccacc2b352", "object_relation": "sha1", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147935, "uuid": "3a3c12a4-bd9a-483e-8a57-ac36506c275a", "comment": "Malware payload (Metamorfo)", "value": "796adf42ebd8bee01b29930a83e69728d03629fc677d2a2e57ef3d073de09b7f04163f42d578c2eac2cdb87f2b58b5f4", "object_relation": "sha3-384", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147935, "uuid": "63978617-b9d1-4428-814a-f24d5d97792c", "value": "T121447D06B3D5477AE4DB03325B8F93628A72EC788663412B1249790E3EF1554B7B73E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147935, "uuid": "028724d0-b5f8-4d2f-a181-1ebb624bf80b", "value": "3072:0mAk2R903DaYRAkwgz88ereWn/7w05g0WaAMcB3RUN46ILJ9+ZB5yOannb:0mn3DaYRAV8er1nzTsaPrIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634147935, "uuid": "bb8d0827-3867-429e-87dd-aaf83a35b6f2", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634147935, "uuid": "17448c17-d667-466c-a396-00205a47944e", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147935, "uuid": "52542f4d-bc4c-4af6-b27c-24f929d3ee65", "value": "6029e560b25e77fa0dfb90c1f699e30a.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7e2697-2bd3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634094869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634094869, "uuid": "59306037-b3fe-4925-b386-f9527571c417", "comment": "Malware payload (Mirai)", "value": "1403a940fe1a6d34a6e32100d21ec0fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634094869, "uuid": "d58991fa-ecd9-4cde-a3f4-752ab054a709", "comment": "Malware payload (Mirai)", "value": "22fd52ae8c4365c946f9171782e6f705fcd01f50a222efca477028c8fb2fb93c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634094869, "uuid": "96b2c490-f2cf-4e88-af5f-ef56fbaf19b9", "comment": "Malware payload (Mirai)", "value": "71ffd8cb26c24fa991bcfd28c16279843e4281dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634094869, "uuid": "1cc1be19-c1a7-4679-8d5b-22d57991179b", "comment": "Malware payload (Mirai)", "value": "bb62fdd98e90857e0877fe96890d2a2688dc1097538ecdf084de1ef9a18aea2257ea352661fd98a7242949f1dc42c619", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634094869, "uuid": "95d00585-8b5f-4f2a-a36f-0bd4b2aee13c", "value": "T16CF34B47EA808A13C4C61776BAAF51493333A759E3EB33068E186F743FC665E4E67106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634094869, "uuid": "e7a0a605-380e-4c8b-8497-38f51f08b79a", "value": "3072:EhSPjDQpphCzINbzSGiYa6hj1nZ0VdxmQnPOOfTmxyga+M/9civnAD8b2:2kDQpj2Yljr0VdxjnGOfWygnM/99PJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634094869, "uuid": "bba35298-2b10-40f2-a6a8-3602b4ff8ef5", "value": 171384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634094869, "uuid": "d75805fb-3bb9-4300-9c28-2f597f3d1c25", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634094869, "uuid": "1f69b8d5-c7bf-4d07-8399-a5aa02e56ce7", "value": "1403a940fe1a6d34a6e32100d21ec0fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c27262-2c06-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634116785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116785, "uuid": "dd84fec5-070f-400d-b213-e3aa6b571019", "comment": "Malware payload (Loki)", "value": "d88da1299d510151ac926fe084bdd680", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116785, "uuid": "1a35765a-7eeb-43f0-a574-20ed159ecb16", "comment": "Malware payload (Loki)", "value": "233d30fc567199f5cda64e5c18091c5d9ae329b32aa8e4be23c0edb534a9b49c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116785, "uuid": "02e23d91-9004-47f1-859f-2ce191648e0f", "comment": "Malware payload (Loki)", "value": "b3577fedd31597cf74cb86df94c6e9233a324141", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116785, "uuid": "389a719e-b4b2-4d7f-9471-baac16db0a00", "comment": "Malware payload (Loki)", "value": "13cbe083e2c3cb85558f3830a1e3e46c36ca15642521db5c3c9742e51715c2bb8af439bbbefe4665fc20fa62a2aae896", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116785, "uuid": "3bca15fe-bdb4-4e2a-8432-2c6d40faee22", "value": "T15F64128FB4753624CD2C427181DBAC82CD5CAC6F8E6793B451A83F337462D1E86AAB45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116785, "uuid": "f4288070-a560-4847-861c-ad6dc18d4b56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116785, "uuid": "91d4a661-caf5-4d07-b223-2cb398dd358b", "value": "6144:I1C62Z3hEm+DgxUem5VFcVkt6abU4CSnZKJKFR+:Oh0P0eUeoFcet6a1CSnZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634116785, "uuid": "dd22845f-e2ad-46a1-9459-8b1db7e4a17c", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634116785, "uuid": "7078398b-3fa3-40b1-bdeb-c8ec1e0722c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116785, "uuid": "25698de6-6a7e-49a3-a7a8-b66ba540b6a1", "value": "d88da1299d510151ac926fe084bdd680", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7189c01-2c1f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634127526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127526, "uuid": "63840d56-ded8-43fe-ada4-198eaf8352d6", "comment": "Malware payload (AgentTesla)", "value": "83b576bdeabbf75d545c1de8a4e10d71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127526, "uuid": "6f359775-84aa-40a0-93a7-a494014c813b", "comment": "Malware payload (AgentTesla)", "value": "238ef35a86acefa9f6c65f57ddac35e0cb30af3258e60fbf2c4913e2d15bed9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127526, "uuid": "3b818a7c-e33c-4b5e-9575-77ccd9f77655", "comment": "Malware payload (AgentTesla)", "value": "d49a74b0c55411ee028e806bb56cc23480c6daad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127526, "uuid": "ff653581-f21a-406d-84be-482a6662c013", "comment": "Malware payload (AgentTesla)", "value": "9c7e3cafb5f8e034d5d540c99a8e6ea8a290da8a906dada32e1ced4cfc49464e0e3501f1540f1cd241268ca454323698", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127526, "uuid": "4624e699-a8f2-4c7b-b9c6-9044826d64b9", "value": "T123C4DFC1ABB6DF36DB745A3F86207A340F3E2E9682B2B95C354871992DB9F418100797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127526, "uuid": "b0c22179-f929-4a0a-85dd-24a644c589a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127526, "uuid": "5dcd1c3e-c95b-49f9-8a24-dbadbb808a5d", "value": "6144:17HLdPKQeXidOuD95180EQyCF5ReoRkck8mcKR8tJtW945/DYWcW5XLdekiMkhBK:1HUrilTufoF2oRkNLcKRA/qW577SB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634127526, "uuid": "f96ccba1-b0cc-4404-a46c-ed171a8e367e", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634127526, "uuid": "c4aae53d-4889-4568-8d1b-122421e3b1f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127526, "uuid": "db7b2ace-551f-4f42-b13e-9e7a62543216", "value": "RFQ#1672100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c085da7-2c48-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634144902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144902, "uuid": "3e5560a4-6132-4848-9196-76f9553b3545", "comment": "Malware payload (RedLineStealer)", "value": "cab181c59fd045c2d4c87f600bea3f6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144902, "uuid": "906ae9f8-64a0-456e-bd04-3a6124d94049", "comment": "Malware payload (RedLineStealer)", "value": "23d43ab9db13b64f8e3c99a71d43b8df0efe9e3821a9a7980518c5be1a27c68d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144902, "uuid": "10586382-aada-4277-b882-f379acad6aeb", "comment": "Malware payload (RedLineStealer)", "value": "c2914263d07b673ede585ce5230d163d03fed964", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144902, "uuid": "0e3b55c6-7787-42db-b9bc-79eb7e3ad277", "comment": "Malware payload (RedLineStealer)", "value": "be3143d0d0eaa361cb57f5278272b81a909c7e777d7d1c9733038bfd2c781c8c4b46069096d29a9185f9c691c889a713", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144902, "uuid": "389555d0-abb8-4672-bfed-e3fb19e552ad", "value": "T1D8F490C9271754B0E791E275AF7DC2BB02FE3A45072591EA28B0312D6DA4F8B710EE4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144902, "uuid": "3a215a9f-554e-417c-bfda-3d34e5cfc5d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144902, "uuid": "c5912afb-4110-46ad-bf08-4f5f117589ea", "value": "768:GH/cs/nybQSZOgEp51LohTjatig+ssluc3PmTyLZu3YEp51LohThJtig+ps+FYce:s+87LGHaYgV0n/mTgyp7LGdJYg0NBQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634144902, "uuid": "952792ea-b4d4-4f89-85fd-2f008b50b62a", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634144902, "uuid": "1facc228-b065-4be0-bbaa-79431e7d219a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144902, "uuid": "0ebd6182-a962-44a0-9749-952804897ae5", "value": "SecuriteInfo.com.Trojan.GenericKD.47123429.8055.16854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32cf43c-2bc7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634089805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089805, "uuid": "b412cf5a-be6b-48c9-849d-317a0a8c245e", "comment": "Malware payload (Mirai)", "value": "96ac5c4de588505b20087b10539fe1ba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089805, "uuid": "38172dfb-1cf8-4c29-a9c0-b371e9771780", "comment": "Malware payload (Mirai)", "value": "24653fc2913b260e6c6baeed4997a8730b28ebb256f14d94599b1e11ac807a69", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089805, "uuid": "f6bcd597-d9d1-447c-a01d-7edb43904659", "comment": "Malware payload (Mirai)", "value": "a659fc5bacc570a974b91e21b01a271ff9b2c850", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089805, "uuid": "06fde8ec-0e7c-46a0-b883-0668693307c5", "comment": "Malware payload (Mirai)", "value": "0735d962a39e643e9d6f509e9dfc37e465de1620789a84141399c6441c6f4385f8d38ac231eb7231db1afabc90a4aaa4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634089805, "uuid": "fecb5861-7cdc-4f19-a041-f847f1eb2cb6", "value": "T119045C42EA409A13C1C71777BAAF514D3322A755E3EB73028D185FB43FC6A5E4E2B606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634089805, "uuid": "88bbad53-77ff-48e8-aaa9-cde89f17e391", "value": "3072:ii25cBP5VMatQN3Wu0nWRHEYqZom/q4N6xpQ3u+siLWtly0LTM/9/UlwD8o2:z/BP5OOi0W4N6xS3miLgy0vM/9/862", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634089805, "uuid": "d738239b-da0f-4322-a1d7-b8848c2c45bc", "value": 180730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634089805, "uuid": "414a6ed0-b19e-4f45-9b55-dc719eb94f6a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634089805, "uuid": "3e4e1976-0ea8-450c-98e4-2f7d0953ae3f", "value": "notabotnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "705e0d99-2c29-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634131703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131703, "uuid": "f379dfc5-8a63-4519-a689-328f4effe2b6", "comment": "Malware payload (Mirai)", "value": "d1c5325c3f6d51e90ea99b9fe65b65d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131703, "uuid": "1e50dfdf-12c1-4d65-baa4-5c4626564f98", "comment": "Malware payload (Mirai)", "value": "24b3219162d248df705315a3456be757a5e4829ac975c0458a9a6b7de56d8dcf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131703, "uuid": "e72f2478-b45b-4816-ac38-b7c585a1e49f", "comment": "Malware payload (Mirai)", "value": "49d79d274ede74970d732ee338b62c54b02886ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131703, "uuid": "891eb5c2-a758-4637-9b2e-bc240fb1a109", "comment": "Malware payload (Mirai)", "value": "43c37c8559b7fce313915cc699a2a5144d0556c62e010e0ff06713073b33f3848df0b23f8e4f9c0b065be091f37a354b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131703, "uuid": "000033cb-fad6-4b21-96d5-29d9dfc6474e", "value": "T1BBF396367B618E77C80ECE7305AA45121D8C999B02D83B6BB6B4E55CE76BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131703, "uuid": "e10f08b0-0fa2-4e82-a469-766ec656a5d7", "value": "3072:hPwamjlfQw3hC5bVCRyJJLmrThPaLEnvPrNb:hPslfL3hAbVcYLmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634131703, "uuid": "c5bade17-0959-4103-b655-c88d5148ee1d", "value": 159492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634131703, "uuid": "99914c20-5be2-484a-81c3-477ae10bd158", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131703, "uuid": "d0a6842b-ef38-4f34-9c1e-c73457f3d82e", "value": "d1c5325c3f6d51e90ea99b9fe65b65d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379dc0b4-2c3e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634140627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634140627, "uuid": "9a9933af-5b81-4466-811d-86d7a7a86138", "comment": "Malware payload", "value": "a9839b4f10ea05da06ec589d17a59fc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634140627, "uuid": "4cc21971-fa2d-4cf9-9875-d95d3a7cf4f7", "comment": "Malware payload", "value": "251afdb3a2308448c714542afc58750eaa398a293290cbd62ea10e7f4e491f6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634140627, "uuid": "6585e3ae-f562-466d-b420-eb9405b5d801", "comment": "Malware payload", "value": "33a7ecd847a67efc6700732fe8ec84ff32c89f6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634140627, "uuid": "f985c5d6-4680-452b-af7e-901e9c0e8571", "comment": "Malware payload", "value": "31558d296767d2216916b5ed589f3e476a827152aed1e9d79942872fd04b7c22534b96575120b01f0af1d505e304fd3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634140627, "uuid": "79166262-69e4-4617-b1f3-fbaaee7587d6", "value": "T1E715AE4BF36042FAD06F513189CBC677E3B076A91A35A72F4290D9DD2F339126F1AA11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634140627, "uuid": "0be0a441-4a4a-4cac-a48c-a96af07ef060", "value": "045715ac29c84a0e47dab339e337bc06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634140627, "uuid": "dc2dd900-14f9-41bd-a3f2-c7aea69e8706", "value": "12288:jx1vJopzeLkTqhqeEmC7sOSaf1ei7fqJHf:HCzIkTgqeEVsOff1sd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634140627, "uuid": "74e82a57-5f96-4d07-8385-b63431aa667f", "value": 922112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634140627, "uuid": "aa10a18f-51a3-434e-9f21-fdba88753005", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634140627, "uuid": "eff3ef81-34af-4a45-b4e4-7a13bf38610b", "value": "a9839b4f10ea05da06ec589d17a59fc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6323f2cd-2c4e-11ec-843c-42010a9c0014", "comment": "Malware payload (XpertRAT)", "timestamp": 1634147572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147572, "uuid": "5dd15cf6-c952-41b2-92f8-03feaec19eb6", "comment": "Malware payload (XpertRAT)", "value": "04162b1bcb2ebb326fc52801821e42b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147572, "uuid": "3cb97d04-ee83-496f-91d8-a247f805a1c4", "comment": "Malware payload (XpertRAT)", "value": "259dbea8ad36ca1f502f7eba9257bf7111313f4ef76c34922cd34dd5808b5181", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147572, "uuid": "1210f8b2-0494-4b5e-9336-0d80fd57a0c0", "comment": "Malware payload (XpertRAT)", "value": "2443aac454b8299bdfea13017cc2339d605dacea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147572, "uuid": "9cbc15e1-5722-4238-b6c7-b58df667fca8", "comment": "Malware payload (XpertRAT)", "value": "7fef4200a91b6cf79c78723db043332160453e6ce89b370a5cf0c132d2d413d4cf6762846c7c6fa7a207a95dc05fee8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147572, "uuid": "c84c57e5-ac1c-4caf-a304-b746ae52c5b5", "value": "T177421B91B3E49BB6DC358A72FC2356000535F37ACC629F6F28C9502E5DB330916A2739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147572, "uuid": "ec660e6d-4aa8-475a-95f0-4f5f99ef3d03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147572, "uuid": "8a30d993-0d18-49ab-99b7-964bf1c1cab3", "value": "192:0olOAFhV+SL0bUkFkLtCQqMT0U2/JT0JN7KaeM4b:0uOo/+SLx4khVnT0UUKN7Kz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634147572, "uuid": "019e2b4a-554f-4534-a2c3-60d6d25e6a6c", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634147572, "uuid": "7b84087f-1b30-4a07-bb79-161611b7c272", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147572, "uuid": "d80bc3bc-f205-4053-a6e1-74bfbe3ddcd8", "value": "04162b1bcb2ebb326fc52801821e42b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8cc510-2be4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634102220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634102220, "uuid": "2b0935c0-6381-4b33-8323-51c7e68ccf1f", "comment": "Malware payload (AgentTesla)", "value": "6a755e7a88cf86f9fe62f3c96ce80bd0", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634102220, "uuid": "89632626-3ff1-484d-9cfc-8b473808d38d", "comment": "Malware payload (AgentTesla)", "value": "25ac04fb53e09596ca9d6b9c70baee70315d14b94363929fc4412e6e25f73e3b", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634102220, "uuid": "c9ff9ca7-c8af-4988-848a-d55c0b558897", "comment": "Malware payload (AgentTesla)", "value": "084c82f1e6799bd612ee9c6cd2f4cadd93859c1f", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634102220, "uuid": "8f47e42a-47fc-4794-aee0-dc0aa8a576de", "comment": "Malware payload (AgentTesla)", "value": "1e15ead5ecf80db3384c85ce936c669f72dcd7048b15e756101c544858c4529b5481e6afbfde95addde9e301a60040a2", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634102220, "uuid": "dcf190f9-1fe4-4c79-b173-fca4cc2dc0ca", "value": "T174B423CD917D66F58E9D36EC1D207B85E4EE5C71B28116D28E0E91A0E2F682B1E7700E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634102220, "uuid": "dbb95a0d-5226-40d7-8305-d26f0aba85fc", "value": "12288:9wl5HBZ63EnWeR9p5MrNaVckTCOOzTCgLrmsvy2GugLLOL2bW/VwyMqWuN8:9w/HBZ63AWs5CNsIlZfm6pGugvOLX/QN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634102220, "uuid": "e12c9fd3-fc96-49b6-a82e-bfe8a0b42c08", "value": 514516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634102220, "uuid": "a7464300-2c22-4b5c-ae57-e212f1f9dd64", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634102220, "uuid": "5b3c8269-0659-470f-ac6c-3f7bf670fbb0", "value": "Proforma Invoice.PDF.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15a83bb-2c2f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634134442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134442, "uuid": "81e21b3e-e84a-4d37-ba83-d9d627e416bd", "comment": "Malware payload (AgentTesla)", "value": "b58ebf9d4baa3896fafa096826c1856f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134442, "uuid": "faaecdb7-fdbe-4128-b57e-75dfbdb2a49f", "comment": "Malware payload (AgentTesla)", "value": "265e3eeff2979363a4ccc1bb928906252f8ff21822c78f6a1bbd2d7f28ae86cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134442, "uuid": "c4e61681-161c-466a-8c93-acd58f99f003", "comment": "Malware payload (AgentTesla)", "value": "b8e88159b3b7cf0d6e155d868082bc55159ddcd3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134442, "uuid": "e8e2aebd-2452-4581-be03-5c4ea2867f2a", "comment": "Malware payload (AgentTesla)", "value": "fc9c532f79a3b0618d9f4a4b43d496b3e68259093fa2e3a6f89668b0bc3ec2e952599d5004b12efd923e4b8c9b541b06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134442, "uuid": "08cad28f-abda-45e3-b936-0ba37859c770", "value": "T10474C0F87A8D5103EC3F77FAB45A810F917BAE964D51003358C0B4EABEB4A6D17607A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134442, "uuid": "e693b8ec-2d9d-4391-8b59-beb946d89abd", "value": "6144:yX+YFb3J2EWFBfXt88K/FbHpBicEFzsYn9TlBdueknUQFM6/c8Ho6w1A4xD8:e+4b3JBWP988KpHBEFv9/mUANw1A4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634134442, "uuid": "d3320b97-c28e-4e39-a538-56173fbd6e15", "value": 350952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634134442, "uuid": "a30ee26a-80f4-48bc-bddc-c993054dd5c8", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134442, "uuid": "2cc8d06c-6b10-4395-9875-2f3909afa979", "value": "presupuesto.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada916f6-2c2a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634132235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132235, "uuid": "f198dfe7-1770-4bed-a3de-45eb549459d4", "comment": "Malware payload (Mirai)", "value": "3f8aafbcd9263f0f9d1c91a4b440ec78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132235, "uuid": "0f439313-4efa-4f6e-b9d5-cc54919802a3", "comment": "Malware payload (Mirai)", "value": "2662e45f4fd3302857791b0ad82f2efb6913f658e6b9488a40e133b733097224", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132235, "uuid": "ca49cd4e-49ce-4034-bb0d-57187e426cab", "comment": "Malware payload (Mirai)", "value": "0aca6d38fc0f8157e41506ee4c8f921a5d6491c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132235, "uuid": "64d07586-6a47-4b05-8497-6affd33057c8", "comment": "Malware payload (Mirai)", "value": "772a28e1d1fd0132ea044e20152d5a9bd9554abb9fd526106546650c833f146770c32cb15dabfa0d372d232c25892a69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132235, "uuid": "14cea6cc-970a-46fe-9ac7-b7500bfbf7bf", "value": "T15773B70A7E329FACFBA9523447F78E11AA5833D527E1C685D19CD6011E7024E381FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132235, "uuid": "0cdf564f-4c6d-4574-9a69-069b75dd94b9", "value": "1536:3IHb8FMv77EKQHly6R1Fa6yBm3froxvdeEOPFal:Y78ivnEKMyAFa6yBmProxvUPFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634132235, "uuid": "2612d25c-2081-4b69-b9ce-2ce9cf26a4eb", "value": 76672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634132235, "uuid": "a464457a-a4f1-4403-b37c-edf0d8778379", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132235, "uuid": "f0eae984-6a59-4299-8205-872b27e1cdb9", "value": "3f8aafbcd9263f0f9d1c91a4b440ec78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932e55c8-2c08-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1634117588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117588, "uuid": "7398bd91-f337-46f6-8592-ca4160591838", "comment": "Malware payload (ArkeiStealer)", "value": "a1d952bac582c5d5f44c6f0ff09ebedd", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117588, "uuid": "a173c625-2294-47b3-8f1b-2126c95e2b88", "comment": "Malware payload (ArkeiStealer)", "value": "2692f4594cebfa3afca882274dc1432fea1ccbc7d3f37db3e15059722db1d97b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117588, "uuid": "c3fccbde-fd8b-4547-bd59-d12ab81e7369", "comment": "Malware payload (ArkeiStealer)", "value": "4dced96e35ea074c01e6bd4c5b8fc3c881c695e7", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117588, "uuid": "e7b95c64-1670-41f8-92ca-c980903c154e", "comment": "Malware payload (ArkeiStealer)", "value": "d8e87dd8c8a877d5eacafbf624794d017b0c983705bdb2af4242f7f125397bf4e0554f851d762784ac6c95fd2c29d3ff", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117588, "uuid": "66599fee-02d8-4102-a9f4-f73eaaf88c8a", "value": "T1A3F4F110A7A1C035F4F327F849BA93A9A93E7AA15B2854CF62D112FD87356D2EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117588, "uuid": "1a1506ff-9b48-41c3-b458-ca5884fbd23d", "value": "4b52e566ef5b8727d87906b4623fc7d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117588, "uuid": "a598a916-b14d-4ab5-8f37-3d8d8cd00958", "value": "12288:ISKRHSog/K2d75RuQvD5L1/tkNEhF1not3YjhEIDSs2PT2mbO4DJBb0/z/Oo:uRHSzR465LNtkNElot3OhEIes2iAO4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117588, "uuid": "34f3475c-e053-4fff-88f2-a7473fefb284", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117588, "uuid": "23d8bd2a-5f35-4f26-b2b0-399555d78d37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117588, "uuid": "b202f9e3-0087-45db-b43f-38b9eb6c5a78", "value": "a1d952bac582c5d5f44c6f0ff09ebedd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252757e2-2bea-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634104518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634104518, "uuid": "826d8412-d4f0-412e-8bca-97c851cd0016", "comment": "Malware payload (AgentTesla)", "value": "ce2760c2150b592ace526995ca5af91e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634104518, "uuid": "0d1cc0a6-dca7-4c3c-b3ca-9c1435d4b08b", "comment": "Malware payload (AgentTesla)", "value": "269351adab212ce5e190c8c45d694f497f8f62ff0d8a306fcc8f72e6578e3d16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634104518, "uuid": "9744ea05-f72c-481f-a81e-89065ad1412b", "comment": "Malware payload (AgentTesla)", "value": "a219deaa7ce9009c16250623d4bd546672ee1201", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634104518, "uuid": "9c47f9bc-0a8e-4c5d-8516-bb7869b9c251", "comment": "Malware payload (AgentTesla)", "value": "c232ab51c1110c171d7f644b51aca081ceaf56ad85bcd8635b36ce152fb005bc235562a0bdf84fe60fac2e4a57991de5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634104518, "uuid": "b1c2d60d-4b72-41d8-aa3f-b66d1df18dc2", "value": "T140D412929F61BD9AEA580EB24122F9318776DE80BD3BF3199EE23C6333337D50446156", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634104518, "uuid": "7a27a5d7-0020-44c8-b67e-415cc66e0d53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634104518, "uuid": "9e0be07f-61ed-42d3-9442-153e49c3f769", "value": "12288:annPktSBVv6sgaz2OaqeUxBymXCrJ3Prh/Wa121:annPrBVyRf5UxZXCrJjhea1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634104518, "uuid": "9755a3fc-05c9-4f06-8d01-b33afcaa7d50", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634104518, "uuid": "87f808d6-5268-4df0-aec6-a0ada43c163c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634104518, "uuid": "59a40550-448d-453d-bc32-d1913424d163", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.20932.12446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3d5fdd-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634108374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108374, "uuid": "b2dd5b58-07b0-4ae8-b3e5-4b14636bc3ed", "comment": "Malware payload (AgentTesla)", "value": "e8cba98a1072120f172eadef52f1adbc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108374, "uuid": "a31e414d-b5e6-4e0b-9928-94267a02a40a", "comment": "Malware payload (AgentTesla)", "value": "2a3f9ee6932dd327041b7a1a4eeb592575aecec28f45b94612dd31f098953dd1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108374, "uuid": "934cd4dd-eda8-44c4-ace8-c89bf4661a51", "comment": "Malware payload (AgentTesla)", "value": "fafcb361df4bdcf4e01258fc5a377d6a09c9d31d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108374, "uuid": "80909c85-7e85-43e2-aa80-3769a1434b34", "comment": "Malware payload (AgentTesla)", "value": "568ce358d9a7db9edf838aede74f9b6ec98053839ab54e6bd1c205687d9333bb0e415ec45e4688064305d16339bbd037", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108374, "uuid": "c299c0f7-12b2-467c-9777-b2c0fdffd46d", "value": "T1C4A33459C79F85A5CF44A333032A8A4906FCB73EB70251B6756C83313BEDA3E08A5578", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108374, "uuid": "de76f9f8-68e8-4b6b-ac7c-6083e685c035", "value": "384:JwoB/l2rN3+G82nuWFQJsxlSQqfYptZ4x:JB8NLhrS9ki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108374, "uuid": "dfe292f3-52df-43c5-85ae-6a098cb6aa2b", "value": 103350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108374, "uuid": "facbdcaf-7b5b-4bbd-81bd-50e849e4474b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108374, "uuid": "7c34541d-57ef-4546-ba81-cd92b98ea600", "value": "Purchase_order_21518.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ed708b-2bff-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634113541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634113541, "uuid": "fed47557-8a21-467a-8c2c-5052d43096ce", "comment": "Malware payload (Formbook)", "value": "f8ea89c3b7200c69d23f728662031463", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634113541, "uuid": "9b847b9d-7d2f-4ba1-bb41-1cdfcdeeb105", "comment": "Malware payload (Formbook)", "value": "2a5d6061c00f5845372fb38dd5840cd483f22576805af43ba2df82df9a455922", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634113541, "uuid": "10489101-92a2-483d-8a09-1216e3f6a1c3", "comment": "Malware payload (Formbook)", "value": "4783a6c208bcff600642b8524eb7ef978194ba05", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634113541, "uuid": "c0e3fe15-1444-4ba2-88cc-32388df65ae3", "comment": "Malware payload (Formbook)", "value": "e1b19fde05ccc0a52411bd5f1a931364ed2be0b7b13fd0e7e7ec818ec09dd843fb7b6ab999a2e1b0ca4e065fe501722c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634113541, "uuid": "bd018667-6d42-494a-9db6-3209c5fed3d2", "value": "T12F0533903D09933EE3D931D2AC22B652854DFD6A37FDE076F4A3E44E4832858AE4E535", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634113541, "uuid": "bbc1c78d-9f1c-4f69-918b-474487ea1cb6", "value": "24576:FVvnCh1ebMFaxDlfot7gUe7ETntAJ6FEVRRS8:Fch1hFSDOt7gTg9FEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634113541, "uuid": "4de07392-6daf-4d5d-a3b7-071653b329af", "value": 873444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634113541, "uuid": "59aa159f-ff32-4c19-ad6e-5673c47847f0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634113541, "uuid": "34fc6ab0-431a-4a6f-bdfc-fb50d13bbe83", "value": "Ord20211310570045368963AC.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bfd007d-2c66-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634157787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157787, "uuid": "47ad898f-7541-4303-b383-9bcf8ec158e3", "comment": "Malware payload (Mirai)", "value": "691004b8d7ef48ec9a48e6886567f1a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157787, "uuid": "12ab837e-a8bc-4903-bdef-554d296ca4bb", "comment": "Malware payload (Mirai)", "value": "2b2565a666c260ac1fb9bda4b7a0c20855101c9af63c26c0ad9adccd2d767b25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157787, "uuid": "33e801f4-b9c3-4de1-9a84-98e613881aea", "comment": "Malware payload (Mirai)", "value": "a227a50a80ee8b7ee91ee67d5a8396c0a4311ec8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157787, "uuid": "058f7de4-5a23-4835-847f-447547233cc9", "comment": "Malware payload (Mirai)", "value": "f769e1c5c0f027ec90322d711f9d72246a6681cc1d95f4100091597687cb41cd2d26316f24adc4744ee286e141900218", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157787, "uuid": "5cee0910-63f5-47a7-b174-5f4d50fe43d1", "value": "T1A4D2C032570140CDDAB1D5794BF517E43E300A20A352AC1B159EE247AE9B6A738F7BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157787, "uuid": "b25f0c65-52b5-46f9-89a8-4035328d5576", "value": "768:CIhDBeQokOmAKcFfRXGi59ITcR/Gd45CsahJgGlzDpbuR1JG:de7kOmQTGE/ud3XVJu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634157787, "uuid": "e4734cda-857a-4a2a-a0e9-b4600d4c50df", "value": 30668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634157787, "uuid": "1eedbc21-5098-42ff-bbc6-77aec7cea69d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157787, "uuid": "46c0f7e3-1a1f-45a2-baa3-7e0a62669e15", "value": "691004b8d7ef48ec9a48e6886567f1a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3a7b19-2c2a-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634132045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132045, "uuid": "45141d34-af5c-4c71-89e1-d56665294ec9", "comment": "Malware payload (GuLoader)", "value": "fb70ff484021669624233d0fbd77ec6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132045, "uuid": "7a9509ad-169e-451e-88b5-141dfe19029a", "comment": "Malware payload (GuLoader)", "value": "2b40757a6763aa725d86426ce3cd16fcf1380a9152837d4fbe5e5b085710054c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132045, "uuid": "96db1ad9-bc61-47ef-b3fc-7a9fc2912103", "comment": "Malware payload (GuLoader)", "value": "6820b13631967663ec2637c43c828468633051fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132045, "uuid": "f81cfff3-4340-433a-b9da-6f8f79721034", "comment": "Malware payload (GuLoader)", "value": "4d198edde52295d4ed9f835f342c70c66ddf3b3d24705e8aaa0f62e79aa1b5f30f56b488ca0b0bb4b865ca73b5993a35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132045, "uuid": "b032a83a-dd97-4304-8824-c15ca37bdf74", "value": "T10BA36BC1A6AC1CB0E8444DBD57BF496B0B2D7C33194A8E4F61443B9EC87A7C79EA0706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132045, "uuid": "380323cc-aa41-428f-a169-73217cb7efc2", "value": "669316531b5190f02843878b6ed87394", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132045, "uuid": "e2eb2ec5-bc8d-4ce1-bca5-8b9048bb649d", "value": "1536:tWD8iCOQRnNBM9rJvWMyWiWjkulM6AnhmXDLZBD:tW4iCOING9rAMy+M6KYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634132045, "uuid": "fe17d8f0-8326-4957-af9a-91933076e74c", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634132045, "uuid": "28c66ddc-50b6-4cab-9a30-b2657a6e23a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132045, "uuid": "35c1531c-e3e7-4b01-9bf2-404bf7ef495b", "value": "REQUIREMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e3862e-2c0e-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1634120282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634120282, "uuid": "ff3c3ec2-5b8e-4ef8-aef4-55523256b720", "comment": "Malware payload (TrickBot)", "value": "08ae1b229abf4a2e96ea710557a018e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634120282, "uuid": "6eb6decd-02c8-4a4a-913a-64531dd3cc0c", "comment": "Malware payload (TrickBot)", "value": "2c569748d3b03b89ce6088b96ca95502e8cb15900ae6bd561f9298bdae0e393a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634120282, "uuid": "40b299cd-fc49-4a16-91bb-b625e6a65efe", "comment": "Malware payload (TrickBot)", "value": "06f71c2c1d600426f6a38b78685e8c4a69d390f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634120282, "uuid": "5d0d56b2-7c57-4bc9-9eca-be78c7c8c023", "comment": "Malware payload (TrickBot)", "value": "e6b2e7eeccdf528e5f7cc2b761f0691d5eaa92f6b53704ebc969bb78a4a4d0f106bc40d463489aeba2415d8391a80bea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634120282, "uuid": "ff91b709-897a-442a-944c-508671eb5d3e", "value": "T120C49E2678509CF2D1012577CDB2E3F5AFAC36186ED2511BB3901B9EDC318A29E345EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634120282, "uuid": "ac91a9f8-4458-4690-8831-c2a6eaeb4d60", "value": "ffc20f0bbd3f72a6061b1c2845bbf7b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634120282, "uuid": "b56b5cf1-3068-404c-b086-d52de921956a", "value": "6144:Sq0Q8zcWR9T6XJrs5IKo9y/K+V4TkpK/b4vfjzg7tVDRjvqenycgRuVW:FnOR9T6CRpVa/oPg7bNScv+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634120282, "uuid": "e2b6dcc7-9720-42cf-bea1-dc2d7eaf23d8", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634120282, "uuid": "6d367cdd-c538-4416-bb41-49c2b18474dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634120282, "uuid": "568f73e4-a132-45af-bfb1-a97befbd5629", "value": "08ae1b229abf4a2e96ea710557a018e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be4df04-2c71-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634162592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162592, "uuid": "6d08635d-54b8-4173-bbfb-316db2b3fb40", "comment": "Malware payload (Gafgyt)", "value": "0a7df43b94eac9fbccae3c729ed0a45a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162592, "uuid": "f3d66d52-dac5-4a15-9781-af1c2b93b4c1", "comment": "Malware payload (Gafgyt)", "value": "2ca6c15b06a33c7024742571a0190809532b5b786182c93ed211832a88b65ee8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162592, "uuid": "cb766f76-af5a-4979-b14c-1d397c0f63ca", "comment": "Malware payload (Gafgyt)", "value": "16da1a5193633e98d64f375f42ed610bc380f7f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162592, "uuid": "2bd588a5-504e-4580-80c1-6212ebd30d2d", "comment": "Malware payload (Gafgyt)", "value": "885039bf5a464d9fc05915fc2f504ccfd73108d250f41fc1144f33e5f415346ac0469e2f483671068e36235876640f57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162592, "uuid": "8bfc2a94-fceb-4c6f-ab3f-762fd12562bc", "value": "T175B3D86A7921AFFEE06883310BF7AF20C7D521D626915386F15CE7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162592, "uuid": "d5c33ee3-5bc9-4514-91fc-8ec26ca5e5bd", "value": "3072:C/4g3Kd1r+5hZmxgA9OKdwwjF9GhsR1Ae:O9an+5hZLHKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634162592, "uuid": "966a6364-17e7-4799-8fe9-db9bba25bc71", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634162592, "uuid": "5e6b9ee3-c394-4ce1-8885-e0964bc1f745", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162592, "uuid": "8e348bfe-b15b-45bd-86e6-2f5f8969835a", "value": "0a7df43b94eac9fbccae3c729ed0a45a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dffc9668-2c09-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634118146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118146, "uuid": "fc43bea6-c959-458e-b83d-356e668d0253", "comment": "Malware payload (NanoCore)", "value": "1f221e6e2a07d553e3fcf5bdb5874b2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118146, "uuid": "111240b9-38e1-4525-acd3-5bed43642bc3", "comment": "Malware payload (NanoCore)", "value": "2d2f62269797be7ef763ac2da37e4c190381cfba8798e92e73ee9aa2084386f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118146, "uuid": "d2946fad-43d2-4b6c-bc45-4e748b2790ee", "comment": "Malware payload (NanoCore)", "value": "0cd7541409f63dda3781d18c61bdcd74782192e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118146, "uuid": "ee2b3f0f-fc23-4dfb-a448-2c87697dd853", "comment": "Malware payload (NanoCore)", "value": "4c671e8db71ab098e0a193ec4d9bd4b59d77b4ea70382c21ad7b038a18db9eeb04830fc9961be47eb1bff25f6f8714cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118146, "uuid": "51b44089-8fd2-4bee-87d0-228c51a66a4a", "value": "T1E1351202F9D68472E1B319315A35BB116E7E79302F25DB1FA3E8496DEA301D1A134FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118146, "uuid": "19da72ba-b7dd-48ca-b45a-cdf0242c3663", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118146, "uuid": "f21dda37-b11a-4614-aa79-0ef084179214", "value": "24576:rAOcZEh4lkCwJlOZIafXiba6TPY5I7nT1RMwazk:t6SCuKfXb6c5IzTXM7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634118146, "uuid": "04155dcf-244d-4697-8ada-02a6066555a1", "value": 1068179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634118146, "uuid": "9a806b90-0a03-4704-84f3-e6c526442110", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118146, "uuid": "c976254e-af3c-470e-8cea-10446772afc7", "value": "1f221e6e2a07d553e3fcf5bdb5874b2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea75f25-2c06-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634116775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116775, "uuid": "fe73012a-7203-4473-81d2-6e68ec852937", "comment": "Malware payload (AgentTesla)", "value": "c1e2ed8a9d93986fa4ea103b045f030f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116775, "uuid": "cf8c9488-8ba0-4297-b414-f5caab2e9d7a", "comment": "Malware payload (AgentTesla)", "value": "2df1f93e24ea43f1e2083d646a695936a1bfdc69365b13b9fad44d505072e826", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116775, "uuid": "f85c25bb-b0ce-4f2a-9277-c72fd67ee9f2", "comment": "Malware payload (AgentTesla)", "value": "441b9941b3468baf0ef95af921ec18d35589e45a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116775, "uuid": "8c167489-104b-4bce-8540-695c29e7f8d2", "comment": "Malware payload (AgentTesla)", "value": "b06d3d4f5c1f399e564360d7e22d02bba22b51eab616af27da010a3061a005a4fb13eef04759498c3523dd8d60f55e84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116775, "uuid": "d142a435-ed94-42f3-b751-d3ad600dea64", "value": "T15C2418566715D461CB5F417FC01A820831F1DB03A72AD2CF5AA5D8FA2F812CEF92B8E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116775, "uuid": "5809204b-0124-4fc9-abc0-a2ebc4d45657", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116775, "uuid": "3dc5dd0e-0489-4e28-b38a-4b2cfb6f59e8", "value": "3072:6GWTpMe/yADDH/lz6qJNrrVUsj6N4r48mP804jjot/FldxHG2aHWsvYHazNxtWa2:6hdrlRJJxU5N4r4wQNzm2a2svYHa5HW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634116775, "uuid": "1897923a-8d8f-4f00-9905-cfb49ad4c810", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634116775, "uuid": "72bed97f-10ab-47d6-a652-d797d68bbd76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116775, "uuid": "b4c70511-dfd6-4de4-a1d6-4f5263f81658", "value": "c1e2ed8a9d93986fa4ea103b045f030f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50832428-2c6f-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634161714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161714, "uuid": "c5921c85-b753-4078-9c76-c0b73a567eaf", "comment": "Malware payload (Gafgyt)", "value": "f8998f2a4ebf3ab663fb852c4dee8744", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161714, "uuid": "9fe42a63-3521-43c8-ae9b-f80055ad6690", "comment": "Malware payload (Gafgyt)", "value": "2e65d809310b06f59bf024064e38422f87f24d155ef138fead9331b933523985", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161714, "uuid": "a90c4518-8e46-4974-b62c-0b7941548fa5", "comment": "Malware payload (Gafgyt)", "value": "bbebb22ed4601c9fefa6ea60668249aad1bcb31c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161714, "uuid": "e7ff2a1c-b8cd-4857-a51b-fef11229bac1", "comment": "Malware payload (Gafgyt)", "value": "9ca5248507eb4b57ec42ab1a92bf27b79da1c6e958a0ee4c2a178b20dd9b9cc65c55c21dde902cb7c5379bcad8142207", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161714, "uuid": "5af9d15f-1f14-49b2-97c2-534cf21f43ba", "value": "T1D3C33B06F5108753C1C2177AB79F561A77232BF897DB3312A6247FB82BC279A0E39950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161714, "uuid": "52486d69-c8ad-413d-8b9e-c072d436dd56", "value": "3072:idwracAAviNmLpMQ1xW5hKHKSrbqlAdmyDQUJ1UX4Tn:SwraFgikxW5hKHKnlAdmyDQUJ1a4Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634161714, "uuid": "58a1c3b1-a3fd-4381-93f3-8643fb61be3b", "value": 118932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634161714, "uuid": "992841dc-0d3c-43a2-95ba-1088e1137065", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161714, "uuid": "b301daba-d76f-40b1-a24b-2335da400303", "value": "f8998f2a4ebf3ab663fb852c4dee8744", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54faec69-2bc6-11ec-843c-42010a9c0014", "comment": "Malware payload (Cerberus)", "timestamp": 1634089137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089137, "uuid": "aacd0d6a-f585-458a-a490-cf7ddb3e6fcd", "comment": "Malware payload (Cerberus)", "value": "fa67c0a6efdbbea22f1d48864ca31377", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089137, "uuid": "1cfd10a3-19fa-4577-8b16-dfc1d68896e9", "comment": "Malware payload (Cerberus)", "value": "2ec6a138a4a81be80cd65d15cb05f0b86c57aa1521fc02c8d34ba7ac16e131f1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089137, "uuid": "4d0029b0-bf94-4cbb-85d3-bd5ef7d378f4", "comment": "Malware payload (Cerberus)", "value": "bb933c5a089ab1a99c158eb9f6ba0619235094fe", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089137, "uuid": "f162dff4-9c2f-46d3-842c-054aad7f907b", "comment": "Malware payload (Cerberus)", "value": "8882d9bfd6c1fb0a083b95032cb59d45b2ac875ac479a3de83c4063bbcc683f5097e5286ab2fd3d4abc8b1402bc57260", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634089137, "uuid": "3ce3c305-0c6a-41e8-82cf-b8211bf3ec33", "value": "T172C512D54AB05CBAC8F95D30A74362A1B5302B5266A5E57B04F1F6B07FE3A348209FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634089137, "uuid": "135f0af0-4261-4d9c-bce0-db37bd787a93", "value": "49152:iNgKI7ZL11jzq+frOSaVrCsDfyV2zzo04/ef+QtLMfOsWM5kVz6cH:iNgzdXqAa5ZzyV2zb8eflOfUM5g60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634089137, "uuid": "a87072e7-5cc3-4f71-a533-8cf968de73e9", "value": 2678023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634089137, "uuid": "2f93c527-6db9-41a9-be8c-4dacfc62d97d", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634089137, "uuid": "8193ed28-b56e-4e6c-9705-cd56aaafd9f4", "value": "Android_Guncelleme.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d676c5-2c58-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634152009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634152009, "uuid": "9b84c069-9060-410f-b5f1-5c477a997dc4", "comment": "Malware payload", "value": "781ee529966b0e09a711be8d7fe0f3cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634152009, "uuid": "fbd9812a-f09b-4dbd-a20c-3ef3f6963dc9", "comment": "Malware payload", "value": "2f1e386982e2eec222d82dc5a03c52a9ad81b097058c896937feb47c1ee0525a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634152009, "uuid": "46af0a76-357a-4656-b02b-54475a62ff0c", "comment": "Malware payload", "value": "61b404c45457f2353e9a36db15c847b74138fcc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634152009, "uuid": "fb123a53-0481-4281-8ce0-a66481a459cf", "comment": "Malware payload", "value": "cc7befbc503d5d057e885eba03ec770ee4024fbbf80112bc1bccf7ca96700d98ef4b178e1e9cf5f271bcd5ecd9bba5b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634152009, "uuid": "46d81a13-5831-4d97-a4a6-5dc86790d3d3", "value": "T1FA74BE0131EB8476E47314314D78EABA0D6DB9350B5F49FBE3D4167A8E603C19633AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634152009, "uuid": "f69757dc-4b8b-4d9e-8f98-15211795d38e", "value": "7e6d410cb0ee9d4d9be8ad4e6fd75b64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634152009, "uuid": "1d2bf65a-5ff6-442e-a008-8060fda8ea5b", "value": "6144:zUSw3fbq4a6LKXpzdKgneetfFqJTTiabAOPSeQuQmh1tb0xaaSlOZN5PoK9Nier:z5w3fbq4a6Lap7CTRo9mh1tb02KOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634152009, "uuid": "fa68b3c0-a1d1-4abb-b56f-ede19a9b679f", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634152009, "uuid": "f3210cc0-6c93-492c-b419-fe0834d710f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634152009, "uuid": "43098f78-b98e-468f-ba20-b01d2f7f2f02", "value": "FANDER_MOD V3.03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a5ed5d-2c19-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634124922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124922, "uuid": "68edd96d-18ed-484b-a24d-9c875243c4fb", "comment": "Malware payload (Formbook)", "value": "6040407905ea1aa24dd58dc8befa4255", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124922, "uuid": "6691546d-62a9-43cf-89fa-12f8926497ed", "comment": "Malware payload (Formbook)", "value": "2f2831bdecd1f925134fd944fc57f84b76ffe872e01c66f3662f1f9194a4b362", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124922, "uuid": "806134e8-cdf5-4258-84ba-3bc069176cfd", "comment": "Malware payload (Formbook)", "value": "96ecf27fd10a6663cbfaadb7643abeaf4061ea77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124922, "uuid": "114c0889-caaf-4fa7-8d2e-bb30c984015c", "comment": "Malware payload (Formbook)", "value": "cec493a5f4d934b4d2ebda1e050f6f08b1209d3451f344975a0349884bf3b40571c7b912a5892110de4f44ca38a57448", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124922, "uuid": "6631d747-74a6-4b50-9059-9964dc53b6ec", "value": "T1C1E4BF4167135E0DEB528BB680AC50F452E9BC1FEC7AEB2D1E943114C7B6DD224B287B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124922, "uuid": "92576cc9-8883-4b70-a10f-003057560db8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124922, "uuid": "1e58ad7d-26f9-47bc-8c9d-c37dfef546af", "value": "12288:hSBIB+gqzVl16yDr67jAkWoDq5jAyWb3PnB5JRU/V18H:sBVVmEJaqdAtj/RRGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634124922, "uuid": "8fd54475-7644-4591-8f02-2f004d1e5fe3", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634124922, "uuid": "99a171cd-1c01-4b13-8b8f-543292015f16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124922, "uuid": "21a59e8f-7868-4e11-af43-b14cbef275b1", "value": "6040407905ea1aa24dd58dc8befa4255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d67f9c-2c6f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634161720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161720, "uuid": "4054f0f6-76ae-4fa1-90e6-f5470d685ac9", "comment": "Malware payload (Mirai)", "value": "16b9472de2def5703373ba0cd125d8d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161720, "uuid": "0d477661-9779-4a2c-acf9-9b4801d588c5", "comment": "Malware payload (Mirai)", "value": "2fd3d3ce0a6c5185255af0d34e1f55317caeda7ac3583d2d51d9a65286c7e843", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161720, "uuid": "c12fe9a5-a923-4c9d-a3b6-f74716b0bb51", "comment": "Malware payload (Mirai)", "value": "5a6b33fbddac037e8159b425194464909230498c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161720, "uuid": "ebf2f374-bda5-4d6d-8cab-c291688b0157", "comment": "Malware payload (Mirai)", "value": "5141c258ec1adc8130a27ccef9e34ed0c3c3c9491e9f71df56a1bceb2447957abc1eadd65289f1928d55673bc84b2b7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161720, "uuid": "e81bcd7d-5a95-4e9f-b2a3-5a4d5f27502f", "value": "T1CA337CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161720, "uuid": "4ab5ade1-ed43-4f60-a064-6a6141644f11", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvi:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634161720, "uuid": "a3001901-2ee7-4192-b520-5f302e7eb1b3", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634161720, "uuid": "0bbca31c-9b15-4f2c-81f9-46ab1df1b7b1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161720, "uuid": "0af0d388-3578-43bd-aaf6-ebdabfdde51a", "value": "16b9472de2def5703373ba0cd125d8d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647e6526-2c35-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634136837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136837, "uuid": "8d4344e5-c47d-4320-a2f0-8a5724e31530", "comment": "Malware payload (Mirai)", "value": "aaa3004ec75b74fe5e78936f3a63823f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136837, "uuid": "a309d83d-27c8-4dc8-8c9a-15a3923783ab", "comment": "Malware payload (Mirai)", "value": "2fe6f036ea43c505994dbe6a073a5edc01d6905dce840810bc2e5db7f5a9fe8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136837, "uuid": "3c9eeee6-e0e4-46fd-8daf-61137d362e6f", "comment": "Malware payload (Mirai)", "value": "0dd6d039ed3042edcef64f1cb3df9e929a88502a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136837, "uuid": "ffcdac42-4c19-49dd-82fc-6d747d0019b3", "comment": "Malware payload (Mirai)", "value": "f278b3f88c9a5e5fa2b08a59f3e88b8290bb112af8222b79ee1ab2566252c1daf3beb9c7bd71c516c43aae7f7191f5ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136837, "uuid": "b5073e59-ab14-473d-8b2c-2eaf43e586ab", "value": "T182832A9AF400DEBCF88BD6BA41664D0EB930A39016920F367767FE933C23095D956D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136837, "uuid": "37f8bc85-9113-416c-ab78-4352592cea47", "value": "1536:qLf0+QM5PHyVwi7f2YUiEy+DlOo7qL3Gfh8FG8fmLPR4oFGBOKEDbF+ym+j:qLaV5f5+DM9SJ8FAGocBBum+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634136837, "uuid": "b856cfed-fe67-4a65-a2eb-56d08596647e", "value": 84044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634136837, "uuid": "579aa3b6-055d-42ce-a5a6-0d53c895b1e8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136837, "uuid": "bce9f0f5-baca-44db-b8c8-85fab24d126a", "value": "aaa3004ec75b74fe5e78936f3a63823f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf6691e-2c05-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634116423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116423, "uuid": "5304656d-4c02-40b3-a045-714e45cdb0be", "comment": "Malware payload (Formbook)", "value": "0031a23b4bb6abcdccc5f8122de5fcb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116423, "uuid": "e47b7ae7-be75-4531-a123-1b6b1a06ad83", "comment": "Malware payload (Formbook)", "value": "2ffbb436257f6f348fade42e94df5737ab8b9d9848a220206992c52d917a7b5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116423, "uuid": "ac00ad05-e1df-4413-a849-83d0947ca100", "comment": "Malware payload (Formbook)", "value": "be50cdbb0af4c77229e3de0ec7f34088aae64dc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116423, "uuid": "49a4c8a4-eec5-4541-bcc0-5e7c15c18dd5", "comment": "Malware payload (Formbook)", "value": "6c07f632b39a1800eac1a24424c61cb67655da66c3d2e192912ec8639145f2ce2023f31b1265ebe9f5448f813e1b31f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116423, "uuid": "b6a1970f-bc83-42c3-a359-bf7a51d0e971", "value": "T1235412463393E9E7FC926EB089BB4626CBB74A4610B0119F6715CFB71C798C2D42A4C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116423, "uuid": "c4520948-591b-4bff-a34d-b23f745060d1", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116423, "uuid": "ea00b07e-b310-4a88-ad00-5cac58b3c9d0", "value": "6144:wBlL/c7HU+ICkZsFE03JDT37iHxU1D/RmNOZeXBiFkJTstHJXd0mU:Ce7HUDCysO0dLiWDc8ZHKmHImU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634116423, "uuid": "553fa385-8302-4d20-8c9f-889750e19285", "value": 290617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634116423, "uuid": "795b5767-15b4-44cb-b437-eb445e75f9d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116423, "uuid": "2b87f380-1c97-48e6-9e07-4fd0e73c953a", "value": "0031a23b4bb6abcdccc5f8122de5fcb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04fe591-2bf2-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634108188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108188, "uuid": "5043cef4-a374-4b21-b4a9-0142b6d32bf2", "comment": "Malware payload (SnakeKeylogger)", "value": "99ceaeed8cd0b632a1b8367c42aa090b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108188, "uuid": "2dd177a2-82d8-40f4-985f-bf4ff7ca188a", "comment": "Malware payload (SnakeKeylogger)", "value": "30c85356fef174bd800c9e8282e55414e430e2be08f92e0dce253729e414daa5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108188, "uuid": "8c8f24a1-6e51-4f27-9669-f667e916a550", "comment": "Malware payload (SnakeKeylogger)", "value": "bdb3c61254a3fbcb1b1cb6bed0c09b43db5eba66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108188, "uuid": "614cbadb-c68e-427e-8d1f-0b4ac9fc6b03", "comment": "Malware payload (SnakeKeylogger)", "value": "c0949cf157ca8ec8ed22eed7e854ab23835f2d4f8df06146dddea07281378fec797601a65162bf2151d105013a3de582", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108188, "uuid": "66a187ef-5697-41d8-97db-8a7c44766d31", "value": "T18ED45315F3929C11E567567364E051E391092CC3E858833DEBB7BAA318EA3805F5CBEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108188, "uuid": "bb192204-86fb-4fd4-831d-7a5254e298d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108188, "uuid": "91c6fe8a-f76d-4f41-81d4-566691280b16", "value": "6144:YH9o3Zv+A/+y4MZCu58L2raV8aHReGhQFYQRVjG6UqT:IoMM4MZC68wabHRe1pjjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108188, "uuid": "662d5396-31ac-4200-ab80-6717db3d1a21", "value": 624128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108188, "uuid": "237c6e98-5746-47a9-a117-60ac0ed184b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108188, "uuid": "61eeff0f-85dd-4517-8d8d-1a33651ceb18", "value": "Efe-8 GPP Project Steel Pipe Tender.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b302bb9b-2c25-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634130097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130097, "uuid": "344c21a8-cc2b-4819-b9c8-3cf498f120f2", "comment": "Malware payload (Loki)", "value": "ab04d329fc3c2ad9f6eaee1383f8801f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130097, "uuid": "52667fdf-9ead-480a-9b70-7f6d59a392bc", "comment": "Malware payload (Loki)", "value": "31d8d2f77238b76a14df9abb0e36e353b2eecf2209468ec7a958fc7072c1700a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130097, "uuid": "4684704c-ecaf-4836-91fa-c188d099c9e5", "comment": "Malware payload (Loki)", "value": "3e0f467eaf1b6fade5bf1d9e3ee3f4a2b21300fc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130097, "uuid": "c55e2662-5a7a-4803-b2ca-dd409ca6f923", "comment": "Malware payload (Loki)", "value": "bd46a372171882c64a066d61afab0da5f03e9e5f3741ed961eb392599d4aea090fa1b7f777cb996dbb858ee7d9eb8a00", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130097, "uuid": "9c54e607-3b22-4025-8fe1-458cab636659", "value": "T1F2227E5CD806F816D11144BCE05682F5FB9A50E3E611FD2E2194729F07A01CB9BDBAEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130097, "uuid": "aa719c74-e487-4c81-883a-b9fcd0afdf84", "value": "96:kHcIMm57P6z8XOEB7dmGJa6T/n/jNTTvCX0iEpZ4WX10C+I5aT9HkLqBpN6iAELD:ScIMmtPp8G/btCX0iSO8amWBXfc3z1EF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634130097, "uuid": "b88bfd71-d693-4d28-b7a0-50ccd18e8b63", "value": 10357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634130097, "uuid": "33250a0e-843a-4045-99d2-a0b09154a0c5", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130097, "uuid": "92830015-cb4d-4230-9790-c7d24455aab6", "value": "MYUNG_IN_QUotation_request.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba308f5-2c29-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634131695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131695, "uuid": "d5536849-17c9-4e86-a81b-bf23f0b77ab8", "comment": "Malware payload (Mirai)", "value": "67b7c727dd3477b3f4de52081fb9c658", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131695, "uuid": "f6a78702-7a3b-4592-9c7a-ec79462926f0", "comment": "Malware payload (Mirai)", "value": "31fc757a3b0f4f9940feaab2a14bc5feb90c8960ed4371e85aa68dc5bbc39610", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131695, "uuid": "ac9717f8-9939-42d6-8386-9f3249632ffe", "comment": "Malware payload (Mirai)", "value": "78513ccd3a0cbd7a3d020038d9becc562c187d54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131695, "uuid": "244c2d8b-6526-4c50-8c6e-3449118a21ee", "comment": "Malware payload (Mirai)", "value": "506d18a2a6a9dec8a04745b136bacba2fd6486427d000bf3b9515148c8b9e896f6e1b108821244256cd7cb106509a29a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131695, "uuid": "35baf466-af12-4b4e-9d63-b4efc8ac63be", "value": "T193A30832AB50C973D00301F511AB8B620D32FEBB196E6A56F39D3CB4DE36085A691F5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131695, "uuid": "1b8af0ca-eec0-4770-a7ee-b1e782b087c3", "value": "3072:FKVz15UEBhHFdpOtOrkNgEHUOmmFVcqq0GnDZT:FKtDxn5pEHUOmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634131695, "uuid": "e7778308-c6ed-4c74-b083-c79982f06a31", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634131695, "uuid": "bc49e2b6-fcd6-4255-ab88-211435258506", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131695, "uuid": "b7510105-8f31-4d2f-879f-29699d72e39f", "value": "67b7c727dd3477b3f4de52081fb9c658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1911667-2c17-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634124135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124135, "uuid": "7ffbacbe-61d4-4493-bac9-9db3a63ab6db", "comment": "Malware payload (AgentTesla)", "value": "17d8d53fd6350073f157116447743278", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124135, "uuid": "b495492d-5694-419b-9971-d856c29b43d2", "comment": "Malware payload (AgentTesla)", "value": "3383e5ed89a4703ac88c7b8bfd322fb56d035e0dc4c9bb48be02b564e28d1818", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124135, "uuid": "0009ffc9-7b96-489c-8906-df680c56c0cb", "comment": "Malware payload (AgentTesla)", "value": "e17ad61a624dc3f5a788c5fb652ac4ab6a4dddbd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124135, "uuid": "f467b833-6144-4d60-bb20-216283ad6c67", "comment": "Malware payload (AgentTesla)", "value": "95d33243a2f3c50b96e7d79398132498de9cf5cbc6a42ea4ba6ee6db73c4c02008a5f6a9b5a008c7c770efc3cd48288b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124135, "uuid": "c7e61e57-06b0-4a96-94c0-5cb51ade7a1d", "value": "T1A184AF6AF3708CA5F417827D8876E9352133AE5A5527480E334E762E59A33C350E7F8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124135, "uuid": "d29b74c5-24d8-4d26-a671-7717425317f0", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124135, "uuid": "119c1f4a-47b3-4ffe-81e2-6b4c12e915cc", "value": "6144:GBlL/BwNwqx8NG8zbLZyNCzMMl5svNd8xgfqdYi8cJT9PDf8xb7EPl71:EXwHx804bLZXK11qP8mTleb7ot1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634124135, "uuid": "7df68a47-7b71-41ad-a5e7-afd0b569686d", "value": 383393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634124135, "uuid": "cdc16413-fb60-4d5e-a8ca-029c8806ae23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124135, "uuid": "32747661-9447-48c5-aee0-50d9a9b2e81e", "value": "PO#13ORDER PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0880379-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634108671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108671, "uuid": "59fdae11-599a-40e0-829a-aa332ce05bd3", "comment": "Malware payload (RemcosRAT)", "value": "d44e8ea2bf9ef11397cf554489b50ceb", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108671, "uuid": "8132cf21-93e6-4571-9fc0-7f5d555976f2", "comment": "Malware payload (RemcosRAT)", "value": "33b01cf0eb422d872201670e34b732f76c980ae7ccb016068438272ed426a50b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108671, "uuid": "6bd8cf31-c071-48d6-8318-7ff23c3b9508", "comment": "Malware payload (RemcosRAT)", "value": "cf784209e517ea9ff3a17cdbc80940c975f6d005", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108671, "uuid": "cf2c46a6-1100-418a-8faa-748d841217cd", "comment": "Malware payload (RemcosRAT)", "value": "6e966ed22e03e68d50b1f86316f5c112d9fc0176a457dab88e97f279c2f8590229256b4b6375e244c9744cc9cb52b12b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108671, "uuid": "b420197c-af16-4355-9829-36ce3343c1a5", "value": "T1FA258E36F5E44037D4B323B45E2F5214FA3AFD016A3095CAAFE81E48CF626527CB5266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108671, "uuid": "0795ecde-f31f-47d2-9082-7c10dfd55782", "value": "33ef3fa8cfca6640b4d180caba182c91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108671, "uuid": "30258ee3-9580-46d7-98ea-5d92c5b0c16e", "value": "12288:GrHeuodar6Dd3m4aS9FCZXhGiX1d0uVrLGaDOdJ4NUTw94rv4lprmi:GDe0W1m4aVNTc9jOiw2rqpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108671, "uuid": "b06b891e-3ed3-4aba-bbaa-0cf6bd170003", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108671, "uuid": "9cf40ad8-a80e-4b86-9802-bff2a8e5113e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108671, "uuid": "e5366f7e-292e-4118-8659-b9c0b16e731f", "value": "DHL_119040 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d1b4dc-2c4f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634147947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147947, "uuid": "34974205-a67c-420e-a297-a7d359a9206d", "comment": "Malware payload", "value": "b6dbb03bdeb4ac4d44b2b4b51e33b335", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147947, "uuid": "9d0bc04c-89bc-4bf6-bcfe-7c03e27f004b", "comment": "Malware payload", "value": "34482c23a4e102c8fdc6b9cb90ceadeb9016a031fb4fb0d4912f463be30d1d65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147947, "uuid": "0043dc7c-21af-456b-a1d4-8a2daa89fc6f", "comment": "Malware payload", "value": "d0861d00814da221bf07c6c867bf40c1c9539936", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147947, "uuid": "a762a9eb-50b1-4f6e-9c5f-edc46bec0cb9", "comment": "Malware payload", "value": "22104b9d14a3c6634eb58800343c61f275b9c2b7c9da3f004592371e06ce378a8cf2aa4ab9606ad0bccfe1fbe66e1c3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147947, "uuid": "dd5aabf8-919d-46c2-a3d4-91186984b485", "value": "T1F366462869BB501D6573FF913EDCA9EEDDDF66632509686B1085030B8A12F80EF4393D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147947, "uuid": "60cb4130-b452-4bf3-9f9f-61b924081038", "value": "49152:Navem/BZdBvrE8iCPpgx1ST9gL/PdQ9xyFtFr2haqErLnArSdVLm7g9zt:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634147947, "uuid": "c2fa8325-dbcd-47b4-898e-79405b49fbf4", "value": 7116672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634147947, "uuid": "6c70d322-59cd-47ca-af87-1782d790457e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147947, "uuid": "2d0420af-0b20-45f2-a0b4-909a4fce73bd", "value": "b6dbb03bdeb4ac4d44b2b4b51e33b335.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066b6c02-2bf8-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634110480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634110480, "uuid": "de8c22af-e101-4873-973a-1358dd0409cc", "comment": "Malware payload (Loki)", "value": "7906f878f0fa7e0fee41d1f260752458", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634110480, "uuid": "89db179a-15a3-4467-b599-331f4a002739", "comment": "Malware payload (Loki)", "value": "34bbcedd23565539c07f2dae6dab4ce7ad92ac34557ad481d64d79f329f49776", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634110480, "uuid": "f5f2ecd1-aff5-4948-8db5-46dbd965b4d1", "comment": "Malware payload (Loki)", "value": "67cac9f0e8c47e4cb83d5b01570213a6f686b1be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634110480, "uuid": "80f1a126-6dfb-4189-a3cc-73088da3a4c9", "comment": "Malware payload (Loki)", "value": "5105f63540919992ce6f6554d63e84cbc63470be6f277a7c0b64e6250cdd014a9e073c91bb97a23361d8038cc891952e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634110480, "uuid": "e2606e77-b117-4a8b-9b5c-c5d24ad3e37e", "value": "T1FA826212578CCF25CA7F4A71CCB281E503B77F80CD165BDB69C4BE1A3972251CA92A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634110480, "uuid": "35588f6e-828b-49ad-a8a8-fd2ea72f3b70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634110480, "uuid": "3565c88b-968f-4eff-ad20-af52b47f4795", "value": "192:wveoDBzHsm3HnAninMeUFfK0/z0AE/xkcyjt+3rzASE:L2JH3nAinMeUFfwppz3rzAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634110480, "uuid": "426bdee0-5fb7-4291-b63b-482426873334", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634110480, "uuid": "c9fa81e2-a0d3-4b8f-be8c-ba2152735bad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634110480, "uuid": "48bd9452-4ad8-406b-9e1d-f9ad41554323", "value": "MT103-Advance.Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa35c678-2c0c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634119344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634119344, "uuid": "075ec53d-0c44-4787-b0bc-e8d3e299e7b2", "comment": "Malware payload (AgentTesla)", "value": "ce1211b6f7269ec8130b44c9fd1fb66e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634119344, "uuid": "83fbd83d-6c52-4031-9c79-4747ca49412e", "comment": "Malware payload (AgentTesla)", "value": "352b2204699a229521fa1869344b4092afab8dd1784a71932403e9cbbc07f24c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634119344, "uuid": "0c783df7-1ed8-46f7-9643-b2e4c5419dd1", "comment": "Malware payload (AgentTesla)", "value": "dcf168ee534a0e9ab3b921d2f618bf61fdc204f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634119344, "uuid": "47a45aa0-23d0-4b2e-b66e-d5c7e355bf6e", "comment": "Malware payload (AgentTesla)", "value": "1c3c5379b98fd4866197c7f1baf7f12a2a52db9d8769c583b75a03ec70813b92c3984dcdeeaaf4e0474da494eee63571", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634119344, "uuid": "29c95401-e253-4127-9f7f-0220eb68f411", "value": "T180D4D0647F99D84EF36A98781131DF84CA3D665B3B13C629DDFF647A92587802CC2283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634119344, "uuid": "fd051d8c-b103-4d04-aaef-ce78a6681f69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634119344, "uuid": "bc80412e-8009-47bc-86b9-23e85f53bffc", "value": "12288:D2YahLBzKEVZ7o0IPYG4DW6+7GbSV0nhBSBLg:Eh9zKQBovx3dBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634119344, "uuid": "295436e2-2bc4-4378-a2af-80b8d1652a97", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634119344, "uuid": "476415ba-8bad-45f9-80a2-6bb503e5a9d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634119344, "uuid": "06d2017c-cb41-485b-876a-2b5ddd5393a5", "value": "Paramount Order nr. 763ES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e5cda3-2c51-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634149113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149113, "uuid": "5479b051-e5cb-4a89-bee8-bc825fefa028", "comment": "Malware payload (AgentTesla)", "value": "9af590c0313585618ae71b2fa9512bd3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149113, "uuid": "729f5b06-515e-4986-b146-9cdbfd000d97", "comment": "Malware payload (AgentTesla)", "value": "35b7cd24826da2979b58a58b00aa9556072bf9f8e08ee14f9165c9845230e7a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149113, "uuid": "b360ce0e-3cad-436b-88e3-e5c4e86f9cc4", "comment": "Malware payload (AgentTesla)", "value": "72072e8b5c1a47cb73ec71cec71eb926124ae23e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149113, "uuid": "e3c135eb-44b2-4d51-b63a-7c9fdffb8a09", "comment": "Malware payload (AgentTesla)", "value": "0349e708317f256ddac285035d1567cfcba3b8a75b8044fc77471bbefdd7064e3be204765fc3dbf37674598063663913", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149113, "uuid": "5e76790d-126e-4b81-907e-a6a3e3e0d85e", "value": "T1A0E45A67F502A18EC436C6F9C6663E5267101C62D6BAC61F502331994B3DFC2AE7F263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149113, "uuid": "e76eba6c-1b79-4a04-964e-22ead7085c4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149113, "uuid": "c3794bfe-4c73-4e30-8cf2-397ea1042fef", "value": "12288:RYJrL8k/0cd9GZLf3QCelkiwhemQGN9Vs/ocYnKrY+LN1g4pHPRdkSO:RYocdcZbZEPwqGFs/ochP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634149113, "uuid": "40d77a32-f142-4632-9fc4-b253fea635fa", "value": 715776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634149113, "uuid": "c18dc7ed-8227-40d2-b31b-6f0e96bff5b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149113, "uuid": "1aec6e90-d1d9-4aa2-838d-1037eb427da9", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.2604.20213", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da4cb70c-2c1c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634126297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634126297, "uuid": "01930e8a-5d63-4399-b691-89618fb43f92", "comment": "Malware payload", "value": "737cffa815ee083ac9b2cda657fad6c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634126297, "uuid": "47db3a90-ff95-491d-abc8-316314a5d891", "comment": "Malware payload", "value": "3631ceab9eac4c52e320c9bf9f382f1ae228c96f389489bd913da6bd7d5f8cd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634126297, "uuid": "fbbf9427-9c3f-422d-97e4-cd1c8df3b2df", "comment": "Malware payload", "value": "7bdb08d00602819552350be5a51cad339823f4f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634126297, "uuid": "842dab62-1f11-42e5-b3c9-c7029d7f51d7", "comment": "Malware payload", "value": "3da04257231d2a2a1740ac25db63888e83235f3ed7c4b6d9a8f9f551b6b21f6de72af20c76854987aa65d84a11733dea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634126297, "uuid": "398d7296-906d-49e8-94db-d585aaedecb8", "value": "T172E21987F2B13171DE7C8931D6E3A4428F7DDD668D632A7E49D82F377893119818AB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634126297, "uuid": "bf8d75ca-2357-4911-b75f-d32881fd0194", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634126297, "uuid": "49d8c82a-3d5e-4231-83e6-d6d32710321c", "value": "384:9pzO/mBJUyhOIesPiHNipPsvkQCG3O3qLv8GjL22Nf2Vk1Uu+lPF/:9+sqHRFCoO3qLv8QRfqk1U1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634126297, "uuid": "8020ff54-14ef-462a-900a-c0898da764a5", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634126297, "uuid": "efa8814d-20d2-491e-a0ce-ad5a7b451404", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634126297, "uuid": "6f6ccac6-9fcb-47e4-a461-320f27d4599c", "value": "737cffa815ee083ac9b2cda657fad6c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51599602-2c31-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634135087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634135087, "uuid": "2f36e4fb-3306-49a2-a4bb-1785b5accce0", "comment": "Malware payload (Mirai)", "value": "76e7b439d3d26f73522bd7217b59af45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634135087, "uuid": "6630b4ac-7c64-471a-8dce-8abbd131dbaa", "comment": "Malware payload (Mirai)", "value": "369ea4b9bfb024380ac9a25a185051fc5d94da5bf39a7559dea7b096e326dd73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634135087, "uuid": "d107a64a-1f2c-4eff-9288-3a8accc8dc9c", "comment": "Malware payload (Mirai)", "value": "e9701fbedab12e06db996807ba7cefa2351779c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634135087, "uuid": "a9d3ff76-ce23-4ca7-b4bd-c781ff9deacb", "comment": "Malware payload (Mirai)", "value": "c49f5bd245d7b7ae144e7193f7651d5c28516be3f8f31e4d11736b9105fd9479dadead65006bdf6f8af22c2d7dd99aed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634135087, "uuid": "01da1afb-72d9-4150-827b-8b720b077cd8", "value": "T162735BC4E1C3E8F5EC111938307AAB729E77F13E7139DE9BD399A1339941202E61625E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634135087, "uuid": "5738ec27-5e50-4957-80ab-eaf106b41e2d", "value": "1536:b/DYQYs1ZokODichE+15UzOHIt09bfsH18ruUGDKVQSi:zDhzUkODichEcUzk40h0V8qbGVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634135087, "uuid": "f57d29d0-08fc-466c-80c8-28a3c456da8a", "value": 74640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634135087, "uuid": "f46dc66e-c857-4556-a296-32d6b86386f9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634135087, "uuid": "127d30cd-efeb-422b-8a5d-7e86d97d9ec4", "value": "76e7b439d3d26f73522bd7217b59af45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c86e845-2bda-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634097605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634097605, "uuid": "9dca6186-653d-4d37-94ba-5bc330475abf", "comment": "Malware payload (Mirai)", "value": "785fe00a4f87520353742863417bd97f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634097605, "uuid": "a7e6eabc-2d64-4b2e-8200-2e95d65bed55", "comment": "Malware payload (Mirai)", "value": "36ab99bb3d8971d925bfd1c3a4902e06d1f4785a82091b90ab07e78851d49369", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634097605, "uuid": "d6e746b6-d141-4d6e-b9f6-36a4bd5b688f", "comment": "Malware payload (Mirai)", "value": "604624f91a35151862625b1c9983541b97a0fc90", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634097605, "uuid": "af4eed64-b7ac-44ad-9c16-cf8f7d370821", "comment": "Malware payload (Mirai)", "value": "1c62a06ab73745ed94e4fc1d6f03ac137635c0a1808dcc5d98777786247df69aaee50c158657686fc6b947497e021ffa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634097605, "uuid": "8ade23a7-f0ce-419a-87f0-53b1e3442264", "value": "T189335BC5AB93DCF4EC1546712177EB328B77F03A612ADAC7D3899523AC42B01E50729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634097605, "uuid": "6dc18d7b-b593-478c-bc70-02a3085dbe50", "value": "1536:3hSgebzgP/AY+39afOsMJRdnhNMHSqMQxpwBNbr/Z:xZebkP/Ad39UMJRlhNKSDQbIbDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634097605, "uuid": "b9f90966-8887-40e5-90e4-892fc9e40265", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634097605, "uuid": "0a82ea0c-488e-429b-9a80-a08c761a74b1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634097605, "uuid": "869154ad-c1ad-4af7-8f83-9784c0cc952b", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128ea77c-2c28-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634131116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131116, "uuid": "6a03941b-76ed-42fe-bade-e2ed7db2e0be", "comment": "Malware payload (Mirai)", "value": "1118b1d38299f447cf1e50bb125baac0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131116, "uuid": "3c10995a-4478-43b5-8761-b8dbff22ee24", "comment": "Malware payload (Mirai)", "value": "37af44d4dbb8656c9669513a11df3069a29049af90335526c228823e0037fe0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131116, "uuid": "2a3be6c8-65b9-4080-a34c-48f3db69bffe", "comment": "Malware payload (Mirai)", "value": "81d1ff1f56f34a7aa13148ec87974a658d3f5868", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131116, "uuid": "f5b63db9-8c7b-4944-8888-d679abf090da", "comment": "Malware payload (Mirai)", "value": "84e5ba8794f4b37071be0d68d57fec1d9049a6efc5f68d61daff8bf4e96ff523aed072ea641050e6772389f7a5369e13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131116, "uuid": "c3e368c9-ee3d-4ee7-83b0-ff98c5b7de3b", "value": "T123D3E631F9044717C2C223FAE25E829E7F321FAB57DB33116A2879B05FE27891E65524", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131116, "uuid": "5b003b61-2290-4734-ac4e-8f3f8219d664", "value": "3072:fjWPXYwnbd9zrGCqywbseknixmP46aQyfPlfKsNb:C//bdPqywbvnmP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634131116, "uuid": "e34e049f-6681-40e6-a096-94dc42c7408a", "value": 132554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634131116, "uuid": "33b797df-cb39-4bc3-866c-ec758eb80f81", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131116, "uuid": "0f70b1fb-d909-48d7-8ba2-e49a004bc475", "value": "1118b1d38299f447cf1e50bb125baac0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed9ec1a-2c6f-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634162007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162007, "uuid": "e260a799-cd93-4681-a6ec-e4c68ccbb0ee", "comment": "Malware payload (Gafgyt)", "value": "fef3e4d146bbcd3392fad4dc0e43be83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162007, "uuid": "0ffa4aba-3e0d-4e19-8a33-c37ad8e5b8f3", "comment": "Malware payload (Gafgyt)", "value": "3815fa9540890b08f52ecce66b00082f7ccb3d5274a9005a2b59200d31b3e9d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162007, "uuid": "a7726572-d6e3-4e97-bdb1-ee00b5853032", "comment": "Malware payload (Gafgyt)", "value": "2afefa46ad3ffab978c4290564d2d62770d2ff2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162007, "uuid": "741de885-11a5-41c2-bedb-5ad6ae6ecc38", "comment": "Malware payload (Gafgyt)", "value": "01a83d5d7cd2e7a192507510cf760ad8eabb3ece0935c5ecb0a1714a7a3cd48ff3f842fe6d1c6fbe98e29ff3463ab17c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162007, "uuid": "bf0ee2a7-66f5-4466-82eb-d0ec3ec39563", "value": "T158A33A37BB130A23C0CA547212E30731BBB5D3D928FA5247BAA16DEC6F166803526FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162007, "uuid": "e18525ff-9f13-4f10-b951-775c629d4d6a", "value": "1536:xfRuqNM5h7t/RiRt4n5phaQoRKzO6F6OXj6ufeRTe:OqN8jRiRephaQoRKzO6F6OXGufcTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634162007, "uuid": "7d422974-37c6-4d04-8d50-c7b015749ef0", "value": 102442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634162007, "uuid": "c6a0b921-571e-4fab-b109-7a12f14ac7b2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162007, "uuid": "35b8c5f9-f9af-48cd-a962-74e011b7f74a", "value": "fef3e4d146bbcd3392fad4dc0e43be83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2939879-2c47-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634144726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144726, "uuid": "c1037f98-acf4-44c7-a729-a0fd15834cbb", "comment": "Malware payload (Smoke Loader)", "value": "ce5e05759483f6055bce5b8274808de2", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144726, "uuid": "29369846-d283-420a-bc1d-b95622342ce3", "comment": "Malware payload (Smoke Loader)", "value": "38e72fcbf8f38717011e12623c232bd859a5dcc2b6a42f82d11a1649693e432a", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144726, "uuid": "215fc394-fdd4-4d2b-9e1b-be0aee7d0a5b", "comment": "Malware payload (Smoke Loader)", "value": "f008ba62ef06097bb0894797f65dd5623553384f", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144726, "uuid": "2f7f021e-c343-42c5-9d9e-9daff47d6238", "comment": "Malware payload (Smoke Loader)", "value": "42132ef9f3771fca26ba610f641507d1a041bf742faaac8817599e7aa71e53937d1f7b7d28de462ce5018e85446c25e7", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144726, "uuid": "a7a80955-050d-4b36-a843-751620f1f287", "value": "T15F647C10B7E0C039F5F316F95AB99368A93E7AA1AB2590CF12D416ED9734AD1EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144726, "uuid": "9bf5f869-67ea-4419-bf94-569642b4c7b4", "value": "e97201e7ef5f430ebcbaea94835aaebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144726, "uuid": "92d4e80f-b00f-4213-a511-c69a17666aa8", "value": "6144:lsgmlpEWVOb92MvJywZipFvMl5I6LK5Zpl:+hlpEWVOx2MBCpFYI6Lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634144726, "uuid": "62427747-e498-4e7e-9e89-c898c6e7e7ce", "value": 318464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634144726, "uuid": "a7335671-1630-494a-add9-102f2b1e37f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144726, "uuid": "ece2944e-0b6e-40b2-8290-c037aad34ea6", "value": "ce5e05759483f6055bce5b8274808de2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe90e9d-2bf0-11ec-843c-42010a9c0014", "comment": "Malware payload (Lazarus)", "timestamp": 1634107435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107435, "uuid": "416f46db-a993-4ee8-8ca7-02878d3182d6", "comment": "Malware payload (Lazarus)", "value": "bed99a09a68eb8f8b53d2a9d0ccc085a", "object_relation": "md5", "Tag": [ { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107435, "uuid": "e28c497a-ec41-420b-b68b-5485ce10d129", "comment": "Malware payload (Lazarus)", "value": "3979b2d47cec119a9a22a80b1e5cdda7c59e97f9fc144918c20eeec5e27a6549", "object_relation": "sha256", "Tag": [ { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107435, "uuid": "212a85d1-8c12-4cc8-805a-7e5f555b47db", "comment": "Malware payload (Lazarus)", "value": "5d93026501eb6f6fd844eaa5f0db3d7cc9c96986", "object_relation": "sha1", "Tag": [ { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107435, "uuid": "90f0f842-3c91-40b8-a133-c13a538dfa27", "comment": "Malware payload (Lazarus)", "value": "541949c9ba376b18c297eed6d9dec16124c95fa910cd2fbc1b5480b7aad689538e75eaadb0edd179389614babf3ba282", "object_relation": "sha3-384", "Tag": [ { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107435, "uuid": "08212f4a-159c-4621-aa17-6ef1fdcfe0d5", "value": "T15DA2D07D828D0676DDD24D37C54461C8AD3BA9B945CEDCC62E2DB637BFB0AC44086234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107435, "uuid": "6d495b7f-72d3-4651-b354-3f61cf4077a8", "value": "384:FSQAiZyZUIBn0M+XVlEyGB4QsAqLHf3JuQkhvcBIGA9neWp6S7M+bPD:hAuyZL0M8YpsAq7JVkaDMMG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634107435, "uuid": "f731a088-8714-414a-87df-bf51d15c5fa0", "value": 21950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634107435, "uuid": "5d4e56d0-49ea-415d-a820-fff48de7effb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107435, "uuid": "edbfabc0-41af-441a-ad3e-2ad116a7d317", "value": "New Profits Distributions_MATT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263554f8-2c2c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634132867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132867, "uuid": "3ec4cca1-25da-417f-91a4-c12923eb227e", "comment": "Malware payload (AgentTesla)", "value": "93c96aa86db843d5dcb133319e0b2e3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132867, "uuid": "78790190-ae36-46e6-9612-3b3156097983", "comment": "Malware payload (AgentTesla)", "value": "3b0cb06f3b606c392631b22b02f5ef91a0dad1a80b154aef829ce9f4cbbbf742", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132867, "uuid": "bcfbb8dd-37af-4c40-8043-5075a6e61428", "comment": "Malware payload (AgentTesla)", "value": "2b01991391dacdc3abde3e0bb183b33fd835f3f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132867, "uuid": "45477fd8-ace4-453b-8aab-bbedb140ef1e", "comment": "Malware payload (AgentTesla)", "value": "08324a27381e7480fc49a2edaa5b22af82a61971e7d02a0d673dfee372b7a412ff0130b3c42ebd5ca5f589939791b1ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132867, "uuid": "4bd3d963-8835-424c-aff8-04a3fa246efa", "value": "T1CBD4AEAC7F94F88FD217CC7496709E54EA2DB06B2707C213E46B10BED64C696AE411E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132867, "uuid": "79f799d8-e23b-4abc-b0f3-f9b91c9ba147", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132867, "uuid": "f8b90dac-797b-43b0-9dc7-868be66f299d", "value": "12288:c4+LSBJhmO1VEDZJ4ZTy5xmpk52mfzR8IeAlWz2AUlfl3qt6MuOxTH9Xq9J/ZVJ1:cBuBJnVEDZWkCE2mtxU2AC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634132867, "uuid": "1bc9d2d5-9e91-4d9d-bad9-84023e4aec50", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634132867, "uuid": "8d25a47f-ee3d-4940-a03f-9117e323f798", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132867, "uuid": "c2649203-3c8e-4bf1-965a-70dc02c954d9", "value": "COMPROBA.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b18df3-2c41-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634141828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634141828, "uuid": "4a905cee-8b3d-4c3b-882d-4292b330f7d0", "comment": "Malware payload (Formbook)", "value": "54bb8fbbfe0a665ca59579a0240ce2f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634141828, "uuid": "7038ed7e-4161-4a16-b21c-8b91e9b0efc7", "comment": "Malware payload (Formbook)", "value": "3bd841c6957e9fdb7e9d4558fb417dca9d7317d087cdbbb270155d9a6698e657", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634141828, "uuid": "6b24780a-7d80-4f26-939f-f54933bbafa5", "comment": "Malware payload (Formbook)", "value": "0b97e4463c76df4541179880902bb6966ef3f894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634141828, "uuid": "034fe6c5-5db1-4a00-80ab-61585140cdec", "comment": "Malware payload (Formbook)", "value": "78212695f91c17ae74b0932d18e701188d10e77d8b003a819487582511afa07b4aff217a17df69c3e1fb2c0a1fe73c4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634141828, "uuid": "eedb397c-3682-4846-81e4-91ed3033947e", "value": "T1E905C619F342AC1EE557453355E058E3A1042CD3E9498339EB73BAA758AE3814F4CBEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634141828, "uuid": "87952a17-c28c-4fc2-8e62-32383f68a134", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634141828, "uuid": "faa464ae-2442-4a2c-af21-a2dad1c48c4b", "value": "12288:Y+zIPiLYQkt3iJHGmWG3HhY8muu8Rsni2U1Rr6s5yuuETV/O:Y+zWiLYQZaGXhguu8ai2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634141828, "uuid": "dc2935b8-ac2c-4706-bcc5-572188e6c0ab", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634141828, "uuid": "52dbe5d6-8c5c-446e-a746-35ef09533f61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634141828, "uuid": "03094d09-4294-4ffc-aaf9-db23f15a1aeb", "value": "EXPORT INVOICE 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f5e372-2c37-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634137856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137856, "uuid": "556f7198-799f-4405-abd3-1c5ebeda810f", "comment": "Malware payload (Quakbot)", "value": "2401581a7b61383ceee42105a4829213", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137856, "uuid": "62309126-335c-4847-8914-e7fe3b4a9f4a", "comment": "Malware payload (Quakbot)", "value": "3c07a7129dcc798b6d50a38c83ddab99c77d039be3aabea196c34c4ac037d4fc", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137856, "uuid": "d507f67d-1f4e-4c6a-ab8a-30d38b07a844", "comment": "Malware payload (Quakbot)", "value": "ab9dbeafb0d527937d1e4a1b8cc46587b0101a00", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137856, "uuid": "1f16d074-c9f6-4ddb-8e3c-c86e29ccaa85", "comment": "Malware payload (Quakbot)", "value": "948349ede13750c1d4220124df28a0ab9cfaaa8c38d3c7ed04dd8cc4a394e6291aff6b449db685704703b1b6cc6becec", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137856, "uuid": "25ea579b-b113-4932-9067-370ce4841842", "value": "T1B7D38C427797CA4BE54813398EE3CADB3772FC21DE62470336497B0E5E7A6A08C17652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137856, "uuid": "2e88e3a1-c09f-4cc0-af66-cdd4e8cb21a5", "value": "3072:vk3hOdsylKlgxopeiBNhZFGzE+cL2kdA6c6YehWfGMtUHKGDbpmsiiDGmZyAqgOb:vk3hOdsylKlgxopeiBNhZF+E+W2kdA6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137856, "uuid": "0b4cb952-e753-42a2-9ca7-f857b25acb62", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137856, "uuid": "bb8e1e27-5065-462f-a90f-ac475d7906a4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137856, "uuid": "d342b8ba-bd25-4a16-9bb5-10212af82001", "value": "SecuriteInfo.com.Heur.12255.28860", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08770e6-2c37-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634137850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137850, "uuid": "b060f133-93b8-4842-b87c-579b6ee91c02", "comment": "Malware payload (Quakbot)", "value": "b96b32f844b74fec0c540e548fd11a37", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137850, "uuid": "fa2b7f79-6517-4b76-ab77-ce1c693a135e", "comment": "Malware payload (Quakbot)", "value": "3c76bd8fd68f63f63680669b0e98ecf46fc48d023783646cdc7f38e69bc826f3", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137850, "uuid": "9bd8f397-bd27-4bbd-99fa-8090893ebdfe", "comment": "Malware payload (Quakbot)", "value": "299d0f8b705bdb48bd2d8db508894800af873cf4", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137850, "uuid": "6f6d4626-d2ba-4e44-8e13-023bf79dac41", "comment": "Malware payload (Quakbot)", "value": "d71bb6b4d5ff9bd628e5b6575bfb77f62cca92f0bfc2f0dc4b1991391a6d0a36ed534f9951375d67960050ba8c8b88f5", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137850, "uuid": "f5a38eb4-a0e2-4c05-8d14-c46d706c826b", "value": "T1E2D38C427797CA4BE54813398EE3CADB3772FC21DE62470336497B0E5E7A6A08C17652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137850, "uuid": "f562b5ad-da04-45a2-a0c7-f78b7b17f667", "value": "3072:vk3hOdsylKlgxopeiBNhZFGzE+cL2kdA6c6YehWfGMtUHKGDbpmsiiPGmZyAqgOb:vk3hOdsylKlgxopeiBNhZF+E+W2kdA6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137850, "uuid": "59c2766a-7fa7-4199-ab59-506b32b09d85", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137850, "uuid": "7d4b8e13-5fa5-48e3-9628-931f9280acae", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137850, "uuid": "a7687d43-8296-4a77-9478-5e3883cd1b3d", "value": "SecuriteInfo.com.Heur.16533.6369", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4711468-2bf2-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634108195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108195, "uuid": "2de6ea79-5ede-4190-8d99-bc404872013b", "comment": "Malware payload (SnakeKeylogger)", "value": "402d79de727a45d2a6977aeccddc5ea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108195, "uuid": "b9a927f0-0b9a-474c-a41a-c40db1fc5a7f", "comment": "Malware payload (SnakeKeylogger)", "value": "3d6722b9d2cc8214cb14a6901f08821594e4da646eefc822e9015a7c8056fe91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108195, "uuid": "1310b43b-b2b3-4579-8e75-b3dbb6c8c69b", "comment": "Malware payload (SnakeKeylogger)", "value": "ae4f9ba1f308443e2f96d983d62cff66124efefd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108195, "uuid": "e8e317a3-0c6e-4994-b8f7-5b39607feed7", "comment": "Malware payload (SnakeKeylogger)", "value": "65fc9e6d8f63402bb08052767c082e3e501549c7adfb68805fc23ca9ff1116d92ef5b52ddb81d62b0905515c78be8a5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108195, "uuid": "dc35ee40-f974-4d1a-8eb5-467430acd991", "value": "T19A94ADACBA1036DFC81BC572DAA85C64EA6078BB931B9203901355EEDE4D987DF144F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108195, "uuid": "55480bc7-e641-40f1-a42a-95bf2dae05ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108195, "uuid": "ecb63fd3-75e4-4ca5-9461-e36eabda9d11", "value": "12288:z6A/Q6KbxBgxBi36bXQPiTbdrdR6DCpCr:z6sQ62426", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108195, "uuid": "e428ba6f-146c-4745-b961-2490aa2e11ff", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108195, "uuid": "058dd645-0aa7-4d73-8c3b-35115d0435d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108195, "uuid": "18f4e7d2-0186-4ba8-8643-0c7117983ee1", "value": "402d79de727a45d2a6977aeccddc5ea5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53c48f6-2c37-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634137858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137858, "uuid": "44630237-76d5-40f3-86fa-7d2a12eb34c4", "comment": "Malware payload", "value": "b6bf42a76eb8cea70cb0a9ba2b8f31d5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137858, "uuid": "84a177a8-8153-44c7-8a90-fabf7125e1e4", "comment": "Malware payload", "value": "3d808601a47c9ae6c1c121a5eb3297ebb8a75f3663cc425f92fc541b90c8200e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137858, "uuid": "c49012f9-81f2-4981-800a-16666ec35dc7", "comment": "Malware payload", "value": "fc27036fefb683e218140e1f0af78f23d711a866", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137858, "uuid": "ef4bd37f-b4a3-4236-9ec7-6d08116e0118", "comment": "Malware payload", "value": "7f085578c05c6eb998cea0f6a89f2e48da18fa6c47bb88e4500aa36d07725a329794986ee57658701969b355d9a6ecf6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137858, "uuid": "21358f4b-b307-4217-8b9b-2e950d54b5de", "value": "T1EF83FA857081DD5EFAF04039ED87CAFAB1797C084C05C26771A9B7AE6C7BA20A381B54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137858, "uuid": "d6ec7dc8-842d-4255-8b39-9c2cc4a8fe21", "value": "768:/HvzTesDT2zxT3bP8GBvjsKNQ8p0g2BYZB3+HM4UXeru4XNox/7lN:HzTeYT8xLQ5oQ8p083qMXePGx/5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137858, "uuid": "f3619fe4-14e1-4f61-821f-cf62646042aa", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137858, "uuid": "ab2606c6-7917-460f-b5cb-3be24a197e4b", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137858, "uuid": "6dc9c5d5-93df-49d5-80a4-091586805c1a", "value": "SecureMessage.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37027eb-2c7b-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634167007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634167007, "uuid": "957667d0-b7a4-4a66-9c1c-1ca471992d9b", "comment": "Malware payload (Loki)", "value": "5823e499ad88c4329380e4a8221be769", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634167007, "uuid": "41a5f0ed-e95f-49ff-bc2b-b35aa2329faf", "comment": "Malware payload (Loki)", "value": "3df3b989eee8bec7d4f9f65e865335e311bd578308cf3b53c0acc5af48bc073e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634167007, "uuid": "f97842a1-0e9b-4492-94fe-8a9599e8bb19", "comment": "Malware payload (Loki)", "value": "23958f5b98c808a2dd8a6dbdbadc9656545fcb00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634167007, "uuid": "c0a49d18-2ee4-4adf-a7ef-b74bab956717", "comment": "Malware payload (Loki)", "value": "84e7256ec77c310f4b5eb4041679aaa1fb609bccf418c55ccc329b32c4b503ddc23cb8d18543ac5fdcc097d284666bef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634167007, "uuid": "d1b77e36-219a-4439-8bbc-4319c390fe2c", "value": "T13CD4B42C3B414A72ED0D8AB04F29DE08FB562F87625C6D92F3EB25CA876F0571D45CA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634167007, "uuid": "db8ad238-5c1b-41eb-8c64-e5aa334fcf18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634167007, "uuid": "0014807f-e7d8-405c-9c2d-a5f8d7265fbb", "value": "12288:F7SjSsahBiF/PgF5SBd3X3uIIIkIxV0DT:qABPF5SBd3X3B+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634167007, "uuid": "286e5ff4-0e33-4363-a471-43aac26c19ce", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634167007, "uuid": "c3a14195-875d-4738-908c-6349b5a675cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634167007, "uuid": "b792fcc1-7c4e-4d16-9275-a89fbd9ac179", "value": "TQL-74100063004211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cac68b5-2c2e-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634133925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133925, "uuid": "fc235ca2-1c38-4df7-bffa-28e945346a8a", "comment": "Malware payload (GuLoader)", "value": "d9b54bd175163eae11715a5b89b32aba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133925, "uuid": "069f678f-e820-4211-a0e4-02bf5bbb9450", "comment": "Malware payload (GuLoader)", "value": "3e123fbdc89e8c9c59a0c5a3a1c2d8fda13f5d8551da654bef2f17f34f578075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133925, "uuid": "9f5e2a21-8590-4f0c-94c8-483328cc4143", "comment": "Malware payload (GuLoader)", "value": "8a926c701db271e1f2edfec8890a865248e52d24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133925, "uuid": "28a34402-572e-4c0a-9f84-57ef7e2126f6", "comment": "Malware payload (GuLoader)", "value": "b6477a70d6a1980dfcb6ffd338e82d39adcd4f18c5c622fa85e366b158c13b4dc37f8e4ba3d1a4b5f9038b06eb95f89b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133925, "uuid": "6f2008d6-4f3d-4e02-b182-db22dc9354a7", "value": "T1EDA36CC3658C5CF1EE845A7E4BBF019B071D9D3384529A1BA6C8275FC83FB52989036E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133925, "uuid": "95e04da9-328a-4ad7-b848-ed71b9c7d58c", "value": "3d3cd1bd8dcc611a5734bf41f4e1a6a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133925, "uuid": "7435e4fd-3bd1-4ebe-9108-2393a2cbd828", "value": "1536:t1DeOJvAoJDsEzYRwBVRCFu3oCZTaQFus94kbbnLK3KKPD:t1zhAoJDNzYDQZ7cWLTK6KP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634133925, "uuid": "fcac6854-79a5-4f32-bc90-3f1fcdd7e8db", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634133925, "uuid": "5dd3c99a-1678-44de-aa25-b206ae5d84a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133925, "uuid": "b2fa4dd2-5493-45ae-828c-f06fc12d1f96", "value": "FACTURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f01638-2c08-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634117514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117514, "uuid": "3f4a8d2c-29d3-4c25-a550-bccbe230c328", "comment": "Malware payload (RedLineStealer)", "value": "0fbbe1c4d4a9ac3f303d2c2d7475d9da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117514, "uuid": "42fec464-0420-45d6-b21c-b5c766f11b0b", "comment": "Malware payload (RedLineStealer)", "value": "3e4744ac44833f8b3c8b928226d84b5f02df9ce3502ddbc629d2e0b5116628de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117514, "uuid": "3a5bffe5-3286-4d63-a45a-a299c01c4f87", "comment": "Malware payload (RedLineStealer)", "value": "b33deeafc68690ef2471d888b1ab5e59cd711580", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117514, "uuid": "dc8c49ce-4f60-4a56-9022-2362aa3bb2f7", "comment": "Malware payload (RedLineStealer)", "value": "80c02db116c50841428d4ff580ddedf9af1249c0581b2329766f973ed1679a8a2821e661935e3c36a975229bba08677d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117514, "uuid": "87c892b1-ebe7-4b10-9465-16006eaf380a", "value": "T14DE569672498C92CD416693BE3AE42F2752F6D08CAB5463B9A8C3D87F7B744904D370E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117514, "uuid": "0a4ba1ac-8951-4be5-adaf-2504dcc1e05c", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117514, "uuid": "72928fd0-6d8d-4a17-99fb-96714e987165", "value": "49152:tcFoP8fuZgaAM8ADRmrfLmamtWMVkqSNR:tgvEgaAMarZmo4kqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117514, "uuid": "dec41ff8-4d3b-416c-a947-d503d22c9a17", "value": 3047936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117514, "uuid": "b8d394ee-2541-411c-adcb-4a32a26a7abc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117514, "uuid": "ce3090f0-e131-4c96-9391-588dfe20b614", "value": "0fbbe1c4d4a9ac3f303d2c2d7475d9da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab220e7-2c06-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634116768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116768, "uuid": "fa5630ea-1bcb-476c-b768-b7a83634fb02", "comment": "Malware payload (AgentTesla)", "value": "56592fccfe45798224281a18dbe0d858", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116768, "uuid": "0b93cf85-f999-40bb-8386-1ef144e09a54", "comment": "Malware payload (AgentTesla)", "value": "3f54fc44f821171553f3265f875a2276ba37d050544ff674bab137d03a8f4ef6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116768, "uuid": "79c705b3-5fe2-4a38-b98f-e1a465755556", "comment": "Malware payload (AgentTesla)", "value": "2c2e77bd1990a253a2c4e6cc8aa860e85acecb9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116768, "uuid": "e192f810-4eec-47b1-9266-fc739cb481b4", "comment": "Malware payload (AgentTesla)", "value": "b1b58c760b02920b0af344d11e928556bebafe103f699d9d54de04a95c9947e6ee1602809528e1d44f92bfc09043a130", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116768, "uuid": "81d7cf5e-ca0a-405e-bb9d-031938b62c9a", "value": "T181C3F1807B88AC21D8347EF058BDEBC72FB2C3896543855939AAD4312D967CD6780FD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116768, "uuid": "2d74cbf6-f125-42ed-8138-0e70ffded356", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116768, "uuid": "46de0e7a-3d82-4077-a8ce-2ae187c70193", "value": "3072:mBNYCS0h0CTXYmvFMQ4b1LfqC/qMiShFq8ucyZ07Vr7+7:mBLS0hYmuQ4pfnSMiShs6yy71y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634116768, "uuid": "a172f7fe-de3e-44e7-bac1-d0439285a4de", "value": 125184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634116768, "uuid": "d3dd8cc1-72c5-4e74-941f-aa089afd2894", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116768, "uuid": "c73416f2-65d5-43c7-87db-23713986e74f", "value": "56592fccfe45798224281a18dbe0d858", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825ed338-2c41-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634142041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142041, "uuid": "0650baa4-2569-433f-8eeb-2172f228f52f", "comment": "Malware payload (Dridex)", "value": "9d180b40d96e6e501465aea2ee8614ce", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142041, "uuid": "23e69a62-d6c6-49ba-941e-dfa5483a5219", "comment": "Malware payload (Dridex)", "value": "3f72e4dab6400c931ceaac42150911473d353e3424a72c1cfe78ea6791090524", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142041, "uuid": "90b4c47e-832f-417e-9448-18be8cde72c4", "comment": "Malware payload (Dridex)", "value": "2c136d536ccb8eafeb4e4236396bc6cd1240a871", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142041, "uuid": "da731018-0fac-4f4a-ac87-1df54d500020", "comment": "Malware payload (Dridex)", "value": "613b614b5bac5a34fadb80d46a43a8d73aa08f5f06de143a972a1270fe7a6cb760fe19e5af44978f5ce6daa934cb3d07", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142041, "uuid": "85e7ef7e-135c-4668-a2da-ab4482ace210", "value": "T183D4F8013A54E821E7E955B6CF2AC6E85B183D48EFB0A4C778E17F0F2AA94F3D215305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142041, "uuid": "ec2db7fd-302e-4608-b8d1-6c4f782a7d82", "value": "54afd981c141523b8c68b6a5bfed7202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142041, "uuid": "1372b694-b52c-45c1-87ce-6080a5ef1a56", "value": "12288:9uIB/bwMtjp4CqwqyaXPLAfx38TW9DiWUT2tq017JGoLbqW/:I6b4wqyaDA5sTWiXT2tq07G2v/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634142041, "uuid": "1ddbf210-8586-47a1-b5ca-ab53cfe843de", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634142041, "uuid": "6c17bf51-cb8b-47a1-91d9-7fe691f488ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142041, "uuid": "918bad03-afc5-44b4-a5ef-0f6165a55dde", "value": "SecuriteInfo.com.Artemis9D180B40D96E.25394.30415", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4544193b-2c1a-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1634125188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634125188, "uuid": "8187e43a-8bcd-4554-8c08-6eb7a6f739b4", "comment": "Malware payload (AveMariaRAT)", "value": "55d99749553fb93316b66f480c35d7d1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634125188, "uuid": "3221b770-3ae0-4037-a02b-d05640c412e6", "comment": "Malware payload (AveMariaRAT)", "value": "3fac732646ab12565cfd2dbdab89d71b26fad16db25a6143dfb11bf6da3bce26", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634125188, "uuid": "8f55074b-4891-4d37-a23a-ec38c0da6c88", "comment": "Malware payload (AveMariaRAT)", "value": "27cad4666afbaa3b9730929fcc7cfe5d8f0999b6", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634125188, "uuid": "8db5df0b-1b1d-41f3-b606-0f08e6f31493", "comment": "Malware payload (AveMariaRAT)", "value": "5764f4b33b37724f2d053a31dce4ba1c559c63580c901022879d7e017fcf0f2e8d74ca5109953ecbb65ae3b59f7f0e88", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634125188, "uuid": "671f4219-63cd-4fbc-9bb1-5852f1f4b227", "value": "T19B54123355D3E9F7E6920F328BB58BB8D1F5CA104493228B1BE46F362D15ED1C629183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634125188, "uuid": "8c7261ad-dfa0-4f01-9d63-09b7a800e7c2", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634125188, "uuid": "0228a616-07b4-4c90-b602-645b19cc46a2", "value": "6144:wBlL/c/3mQU7BR4CJN3LhyQsFcwNwLFubDKbCZnryWE:Ce/3mTBOehyQsm7F45OWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634125188, "uuid": "2ea3704a-1517-4336-bd6f-7e5f5bb8930f", "value": 280709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634125188, "uuid": "f8b294c4-1f93-43b8-b853-8f039df45d89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634125188, "uuid": "f719c01b-4cdf-401e-88f5-bd7b305e4d50", "value": "PAYMENT DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5dbc8f-2c2d-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634133627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133627, "uuid": "f6d4e47e-2196-4a16-8058-002c55ce259b", "comment": "Malware payload (Dridex)", "value": "885fdb11664be585ed74185fe466975d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133627, "uuid": "21038d0a-212e-458d-bceb-4cbd1492bb52", "comment": "Malware payload (Dridex)", "value": "3fd6a0b667270f85b4d929748b6b32d1ecb65d01fc0e3cec4bbc025452530f07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133627, "uuid": "fce0e5a8-2357-4371-91d2-5ca6aae7116e", "comment": "Malware payload (Dridex)", "value": "0d915de1e4139437eea0b6bcc7dae6c9f188adeb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133627, "uuid": "b84c0fbf-f929-4afc-9415-6a25722aac73", "comment": "Malware payload (Dridex)", "value": "3e578424d9ce1fdc233b97e4313821328bb47db6715cc97917826d9057713e439fb75e27a98b76cf8418478ba910d77e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133627, "uuid": "31a804f9-9ca9-44c6-aee3-99c5531c120f", "value": "T1E1D4F8013A54E821E7E955B6CF2AC6E85B183D49EFB0A4C778E17F0F2AA94F3D215305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133627, "uuid": "4d69c772-6326-437b-849a-20d8771ca249", "value": "54afd981c141523b8c68b6a5bfed7202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133627, "uuid": "a113a1e6-e594-4d79-b810-7d7f4c859fd4", "value": "12288:YuIBo9wMtjp4CqwqyaXPLAfx38TW9DiWUT2tq017JGoLbYW/:/Db4wqyaDA5sTWiXT2tq07G2B/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634133627, "uuid": "b8fb6ffd-bb11-4a6f-b085-3165cc58189e", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634133627, "uuid": "3f603f9c-f6fb-4e6a-b7f0-0809f200241c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133627, "uuid": "623bf97b-45a9-402e-a4d4-0b90c1779532", "value": "885fdb11664be585ed74185fe466975d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d287fd-2c45-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634143959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634143959, "uuid": "f79fcca4-df3f-479b-a399-090cfcda69b4", "comment": "Malware payload (AgentTesla)", "value": "63ad6c285b40fc9977dd31abd60c3c63", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634143959, "uuid": "0fd9b1c7-121f-4624-8d51-3975bb0393e5", "comment": "Malware payload (AgentTesla)", "value": "4017126a09a166ae491e6e3fd2f3a094d17107238d8d10f262fccd87426ef1fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634143959, "uuid": "ff3b98ae-3e1b-4ffc-9105-d7e741d9b9d0", "comment": "Malware payload (AgentTesla)", "value": "767b9dccc06524ec3b93d7318c0ec08cb93572af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634143959, "uuid": "b9820e9b-24a8-4336-a8b6-4cdb5a2cbe1f", "comment": "Malware payload (AgentTesla)", "value": "e758d7f2c7f595d649d25f091868e3f403e59c16e869133a1611f69d8724ac848c3e6fd6eea46d40bdc48129de670b02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634143959, "uuid": "e6319d87-b1eb-48a2-b852-d6545beeccda", "value": "T168258316B3ED689FE013463254E155E79E043DB2A41A822DE67379E319BDF804F08BDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634143959, "uuid": "eaccab5b-8f85-49fd-95a7-d14d9b961000", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634143959, "uuid": "a0d709ed-e677-4970-8ec2-025ed1443c97", "value": "12288:5gPsmQOdtzvo61WdSL63YXNpXctLB4Vr1eGoSU4uPsJoZ0CH8Xs377TjN+mB/67g:5g0mPvtUdSHNpXcT4J40U4uPsJoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634143959, "uuid": "a7ae039e-c786-42e1-b401-02413bdc93e7", "value": 1008640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634143959, "uuid": "b6a1e984-3fa6-49f0-b03b-29cdc90e5a19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634143959, "uuid": "887a896e-e945-461e-b3a7-9adaa4956dab", "value": "DEBIT NOTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38adcc4-2c27-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634131037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131037, "uuid": "c7e63f2f-8196-4cc1-bc63-c352f48a095b", "comment": "Malware payload (AgentTesla)", "value": "6174125709ae03d69d71abe865fdc897", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131037, "uuid": "0cc652f7-bc08-4c8f-89dd-d5ee52e75fc6", "comment": "Malware payload (AgentTesla)", "value": "40707beb1bc42d406b0b4725039208d4883755d92fc550aba9ef4f6a43ad867b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131037, "uuid": "1e9d2ebc-59aa-49bf-8a48-01a341a6e594", "comment": "Malware payload (AgentTesla)", "value": "60099a6c03ad447b820ece2d597c83702bc25e7e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131037, "uuid": "ac2a42bd-923a-421c-a942-6b13aa4522fb", "comment": "Malware payload (AgentTesla)", "value": "7cfaa19ded991ac8f800bc5d8431bc3a13af7ea6f90ff2069ad91f2f7be46bcc1a88561d344c4a4904f53964cdefec5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131037, "uuid": "c8b84859-2c3e-4d4f-b2c5-f7b2adad2d37", "value": "T1BA05D518F342AC5EE557453355E058E3A1042CD3E9598339EB73BAA718AE3814F4CBEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131037, "uuid": "02404e47-aaae-4602-af0f-ab96724d7b06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131037, "uuid": "faa89a1f-1865-4f0e-b612-995e6aae3ab4", "value": "12288:EPLMpv2xS4PYX402aN2VT/3pW2rUyiOlzZXKrhIrLBhFvdXXZ:+LWexS4Yo0qVzg2rU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634131037, "uuid": "69a7d487-2dcb-431c-bab5-8db570c5bdad", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634131037, "uuid": "637c227e-91b6-47c3-b88c-06012e667c7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131037, "uuid": "f47e6a14-4352-4e03-a686-52f321afc218", "value": "Payment Information MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d90566e-2c12-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634121659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121659, "uuid": "8f2c59ba-bec1-4117-b2b4-0f8603ba6951", "comment": "Malware payload (AgentTesla)", "value": "3a11f85c02fcc2d7a8a87d18bb9f2e00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121659, "uuid": "faad7e07-6589-42e6-942e-4ab8e5923b16", "comment": "Malware payload (AgentTesla)", "value": "414073c9f16f8a57b4180f31dea2cd2b4b69b3c1e785cb40708fc314572c4fc6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121659, "uuid": "f161c29f-edd5-4423-bbd1-cfdaa309dcb3", "comment": "Malware payload (AgentTesla)", "value": "72bb7367e17f9b40d750ee67ac92f549f8dd356a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121659, "uuid": "51b68d79-fc32-4134-a348-4d1a982260ac", "comment": "Malware payload (AgentTesla)", "value": "a6c9942034f54870109232a5e8e3db0184ea5c1ed8ed6401290770653424b7a17cf70cb3c21f0c7107d825bf17edf511", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634121659, "uuid": "4497658d-fe23-41e8-99c0-18730e5650b2", "value": "T119D4E0647F99DD0EF3A698B85131DF84D62DA24B3713C625DDBF507B92AC79028C2283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634121659, "uuid": "08d9692c-0eb8-47ca-a1c0-e2883e6ff451", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634121659, "uuid": "06f55282-7279-43bd-825d-be8168d2456e", "value": "12288:cLAKnZTPmdDmnSSrDJWXC+M0G7CvWoNSBFg:ck6TumnpHYXC+sCOoABF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634121659, "uuid": "2c2266a9-4dce-416f-b48a-5b8688f83395", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634121659, "uuid": "1b8ce9ff-5a82-4841-8fab-4def54d36bac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634121659, "uuid": "b707b706-af8b-4474-b0ee-f8927782c473", "value": "SCAN001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bdd00f3-2c5f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634154915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154915, "uuid": "f6a94999-a2de-487f-a7c9-35d5f6b198ef", "comment": "Malware payload", "value": "e62736efcf51548162c75b2afb915345", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154915, "uuid": "07dbb67d-cff8-4828-a4c7-48e28830b979", "comment": "Malware payload", "value": "418b67fe185da6593d47174dd5b9e02eef840cbcff2696800b6c5bd7d3474bc0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154915, "uuid": "b3c68a98-9a51-4d86-9c64-dfa97caacf6b", "comment": "Malware payload", "value": "323ba25956e9cf83e790024c2cc60ff5a39a6b46", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154915, "uuid": "ca56c899-9952-4820-92c1-8c8d1607c33b", "comment": "Malware payload", "value": "d474a53dabd5ac4b1992c9286a1bc5bc618fe821bd4b4a786ebd1f957b1a47f5faac86bafb984554cef4d936bb07d4dc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634154915, "uuid": "53d02b33-5977-4383-a83b-f2eecd0526ec", "value": "T1B8D512D94E405CB6D1B9AD31A3A220B279351E32B6F2F56B0273B5317EA3F205149EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634154915, "uuid": "106b2ad7-ea23-41b9-85b8-cfaf42867b67", "value": "49152:NZd2k5/fL7KkU06gKMjEjLBFIr5VvGVqePnUYzvOoEj3h1Sxcj:NZMqT79U0RK6EjXWLuFUYbOo01SxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634154915, "uuid": "1bb519e5-5c9f-4a5b-b0e7-6c107ab07f1b", "value": 2774936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634154915, "uuid": "e4ce7ced-5e57-43fe-8124-4e5a3a03ee44", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634154915, "uuid": "c2a878dc-188b-437b-ab1c-1a5f658650b4", "value": "Androidupdate.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9950fcc8-2c2c-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634133060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133060, "uuid": "538cd4f0-ac6a-4bde-b71b-4fb53593095d", "comment": "Malware payload (SnakeKeylogger)", "value": "b090b4144e4293f45f16d885780066d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133060, "uuid": "deaf0e20-80b9-4a56-9215-1bd473c9a800", "comment": "Malware payload (SnakeKeylogger)", "value": "41b0cd91e2297f1884e43e57dc85608ccc5826769f540fda01c817a05e8474b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133060, "uuid": "d813b97e-fcc1-4411-9215-0651a235a77e", "comment": "Malware payload (SnakeKeylogger)", "value": "3bf83d8909138d9f50359ffed749dfa30a235916", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133060, "uuid": "94579532-7eb9-49b0-a6ac-9cd102f2e3e6", "comment": "Malware payload (SnakeKeylogger)", "value": "0b0234e54b692c5b09c71002ee8cc2c94e837f9a281de68ea4ee8a475acdd0b4c3f4caf77907cefad2a272904d04180e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133060, "uuid": "36b999d2-3901-402c-8012-cc69865faf4f", "value": "T150053B394D2682F787EEC66CD08C1BCEDEA6A4837B919F1EC496D7D2025770BE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133060, "uuid": "d7d45756-5e64-4cbd-a97f-0075d914477f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133060, "uuid": "f1edfafa-6e2d-4922-9d45-a3e26d6d7ce8", "value": "6144:Uf0T+UGrOaq3hB9qtvF7iNnEzvoDWIKa93MRjcogdSv0A/Pj1nqrvdUDY3:2IOOBqXanEzvoDW098NNhJnWv+Y3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634133060, "uuid": "b1fd6729-09ac-482c-83d6-ff8d65a0f1cf", "value": 811338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634133060, "uuid": "ca0add38-1071-4a03-be7f-7ad01c3ecbf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133060, "uuid": "d208cf20-3ad5-4387-a955-88e6a6aa0f1a", "value": "b090b4144e4293f45f16d885780066d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1121c80-2bf2-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634108189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108189, "uuid": "aa2f88fe-f327-479a-a0d2-9574d49f79d2", "comment": "Malware payload (SnakeKeylogger)", "value": "68b02fb8569daa4d84134aab2fac2058", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108189, "uuid": "ba40310b-5138-433a-a924-5621bc9e2f5f", "comment": "Malware payload (SnakeKeylogger)", "value": "42980d8f49b4f76609ea5427691703a697e0e5ef0c93403c1fb4948a47154fa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108189, "uuid": "ac17e6ec-21f4-41be-912b-71ac3f5151e2", "comment": "Malware payload (SnakeKeylogger)", "value": "de769c21769e3bcc1411b9935098fa8c73a00b03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108189, "uuid": "350f6a30-2cdc-4dd3-b2d9-32cb1a3fc0ec", "comment": "Malware payload (SnakeKeylogger)", "value": "f9d85eed66aedaa3938a496e8cdf38f3dd7d60fd6573b6bc14812a97f3b8cd9523e17e5ce4b33507f6d9720cea73f43c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108189, "uuid": "18cf00b4-9906-40d0-80a5-d8713bd1f1e9", "value": "T13EE4D62C3B415A72ED1D8AB04F29DE08FB661F83624CAD92F7EB25CA871F0571D45CA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108189, "uuid": "17e92d4a-f29f-4479-b8f6-3fcb4d815774", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108189, "uuid": "d4f252b0-14f0-42eb-a48e-435d3f904ee1", "value": "12288:aEhTXYQf1e9t1WATYvLqWd6al+k3j0h0JNV5NrNNzCpSUm+S7AodhifUkZXuBd3s:vQi7A+YfUkZeBd3X3B+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108189, "uuid": "1945d11a-0eaf-4fd4-bf84-ef83a317e9ed", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108189, "uuid": "2558a802-bbd1-44a4-9d30-af56a3115735", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108189, "uuid": "ea2b4f29-96ee-4fe3-ad5c-83235103ce52", "value": "IMG_0211678531077.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b11e7b-2c42-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634142660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142660, "uuid": "0ed6f505-af16-42cf-ba90-9390ed615b8a", "comment": "Malware payload (Formbook)", "value": "c54edc9ef9d72fe0fe048e8ac884626b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142660, "uuid": "d12f5fab-41f0-41f0-b266-1b0e9e377a95", "comment": "Malware payload (Formbook)", "value": "43fcb442b80665d42271689310ebd569e84f74287063a62e14beba808178e098", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142660, "uuid": "fb95a1bf-02bc-46ea-abde-3b76f9edd78e", "comment": "Malware payload (Formbook)", "value": "11dce70f33e490eb9b89726776915a374bb59a59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142660, "uuid": "725762d7-3682-48c0-8684-42f555523d75", "comment": "Malware payload (Formbook)", "value": "481af92fccc41f05474dbee7f127fb7810310f714895d0c627c83fbc3ec702ee98b74257a2ff5fb318c0f5e7731592d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142660, "uuid": "d9b360ec-4fa9-49cb-bdc7-4cde34ce410b", "value": "T1F025008261BD2DE7F9EC7DF252A2A32C1E148D8ACD30C250E56F78E0E937513D956AC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142660, "uuid": "a7a00744-d458-49fb-93f1-741f4f44343a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142660, "uuid": "ab0d3af6-cd16-4da9-ac43-683468e256ce", "value": "12288:lxGAAVPJ9rY0Vjf23ZgTJt8mwSwtpaYKXrEUpDK30dBlVhxYuWyrZFvn6+OhO:eAGNYoOiT/8mN+aYW4OHboirZFv6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634142660, "uuid": "d563cc01-9109-43bf-85fe-05706a039911", "value": 983040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634142660, "uuid": "fb165474-c8fb-472a-bd00-1f3e532431d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142660, "uuid": "a784bf13-70c5-43a9-ad94-927fcd16dda3", "value": "CNEW ORDER17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3f33b3-2c5f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634154919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154919, "uuid": "bd640924-91c5-4a2c-a44f-140eacffa483", "comment": "Malware payload", "value": "49813dea66420480e4e10a123a53f559", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154919, "uuid": "837a25e6-0f7c-42da-a3ae-e3eaccf87ae9", "comment": "Malware payload", "value": "442d3fb99a211111ddc64ed58af40f9a2acafb57ec80e36723ac8457f3859e24", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154919, "uuid": "b7ede33b-d784-4e89-92bc-596534ed311c", "comment": "Malware payload", "value": "c29f97939719e98f20ac84743139f243debf39d8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154919, "uuid": "fa6f8a6c-6e8e-4460-a78a-2ac191d53a9b", "comment": "Malware payload", "value": "fd5da91eef4f30b836c9e43b4c7939d77b7d415ea1212ffa1f77f37bf84762741810edf26ebdde0c5b6dee95a66cdc5b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634154919, "uuid": "d7af84f6-35d0-48b8-a0c3-045b46ed3e5f", "value": "T153D523D56A411CB7E17A9D30A35361A2B9301A50B6E9F5BB04B2F6307F73A70864DEF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634154919, "uuid": "d8e60bcb-4576-4531-b23e-1da8d4e5df99", "value": "49152:WZ47b6d1AoDzg5qipwRef/vuP//gdC/CNyCcaJgclzejTvGvHo356Xd:I47GAo/g51pwUf/vq2GCotaJvl8bSHoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634154919, "uuid": "3c4224f4-4484-420b-94d8-5b7f2f1d6295", "value": 2870542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634154919, "uuid": "7dbe1d69-b51b-4b6e-808b-115f8ea9dcf6", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634154919, "uuid": "4f7f0ad1-a65d-443b-b353-73697005ea0d", "value": "Aleyna_Tilki_Ifsa.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74fcfa8-2c4f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634148250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634148250, "uuid": "cc62376b-cb47-4b95-bbb8-dbc3216de318", "comment": "Malware payload", "value": "f669ee142e44f505a67fbf42fa023f42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634148250, "uuid": "e6455750-207d-45f1-95c5-911b50cb155c", "comment": "Malware payload", "value": "44e4f61a0d347cf7f59f8a1f545832b1ca375398f234feba4d0d06e4cb5031b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634148250, "uuid": "2f71d48e-d49a-46f5-95d9-fb5ae3a584cc", "comment": "Malware payload", "value": "f99d1c46f6a5e075a1c377d40e00ae2cce07bf33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634148250, "uuid": "d65dbfef-de43-4ce7-8ff5-84542f9c0588", "comment": "Malware payload", "value": "328714a0c70e292e5be57b59e2c7a94ae970744543994e20a091dba5e0c21973720e9eae96fef6d84bdf827e5383637f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634148250, "uuid": "979dc57f-b16f-47f5-9303-9196a41d1e83", "value": "T12295333A9E761152C127D83669D1121F8234B09818D9DCE70AA974FDADBD7B036E0F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634148250, "uuid": "73a0e374-7c15-45a8-a80f-78a823261504", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634148250, "uuid": "63f4e7a6-affb-47a8-8173-d6c68ec3c7d4", "value": "24576:cBIkYVpuCbX0b2UCS4BJo0i/oRWIJpPNS2Hb/gYU6ITBjquLYY09rCP632QFuBI5:cBIk+DYQ+wVgTHEq509rw6mKuqIOGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634148250, "uuid": "210fcded-363d-474a-acfc-863f273f68af", "value": 2046464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634148250, "uuid": "b41a9d01-5228-4a11-971d-d0a675f8ab23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634148250, "uuid": "efd0b01e-ef60-43e5-902d-30104aa1cf55", "value": "FarCry 6 setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85bd52aa-2c6f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634161803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161803, "uuid": "50da0afa-b857-4f9c-b774-65c2c1d71b08", "comment": "Malware payload (Mirai)", "value": "f5b0525862ff318ba38ddd019257c04b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161803, "uuid": "44c0a5f2-3d3b-4583-8377-c2a2932121f2", "comment": "Malware payload (Mirai)", "value": "45ee63cb03453e3544a2e03344f1e72b3af8500076d62fb22ff2f122fed73dd9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161803, "uuid": "ad5f7a5d-7e9b-4111-9424-c61c9c141c13", "comment": "Malware payload (Mirai)", "value": "a9ba5954967d6aea39419e3a17d9bfe6bdd7d7eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161803, "uuid": "d4f99599-88ad-4bd1-9d6a-83409dbcf6c2", "comment": "Malware payload (Mirai)", "value": "2d526fbdc7f40f8fd0bd2ec517dd536537e3fe2e24d0c66a927f2a76e06118eb7450860aa6c77f91dca99deead54de41", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161803, "uuid": "119e0c7a-dd9d-4d6b-8543-56179c546eaa", "value": "T1E223025320D3BA03E03098FA85628CCDB65AA67DB1BFB7AB25444D154C35C93ECB18ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161803, "uuid": "0f3186df-69a4-4516-8803-b5ac9841d137", "value": "768:oK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFJy9q3UELWt/iw+kvBGg6+fYtrBHx:K12O1LCNguovDPH7TcrfnLWhiw+kvBGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634161803, "uuid": "778e55d8-578a-4fc7-ad09-31bcb2a8c406", "value": 48688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634161803, "uuid": "9d6381f8-07b7-474f-822a-fe00d74bdd7c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161803, "uuid": "d28f927a-a1f2-4f13-b3ef-b7d244dcf82c", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "029f3ebf-2c1c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634125935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634125935, "uuid": "6d3d1b18-5862-403c-bbc4-6de39d23e8cc", "comment": "Malware payload (AgentTesla)", "value": "5b4b985c02058f62614678c24d6be52e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634125935, "uuid": "d3474c33-8455-4e12-a883-06d2ecc50d4a", "comment": "Malware payload (AgentTesla)", "value": "461d75b94ef071d3b413d7cc35732b2ed93b76a7bdf9f4577eaba89ecadb3429", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634125935, "uuid": "383e5bb7-eee6-46b6-b18d-9cd635fd686a", "comment": "Malware payload (AgentTesla)", "value": "c113bfa5c7312dbba20bd85a9c584a04de040853", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634125935, "uuid": "a0b8304c-1ec2-46a9-b957-c9c1d46c2fd0", "comment": "Malware payload (AgentTesla)", "value": "33bf693c9619f0be6e4f555fd23f9b1cf04e559bbe282a620a0374ff5f429e3a3d87ef664a211a0e0ae0c643a98d07e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634125935, "uuid": "208b2de1-41b6-450f-96a5-3aae5f63bd0f", "value": "T18263611436D4D216E1260F329EDAD3F63779BC146E8A833B3250732E6E3BB599B24750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634125935, "uuid": "50909cf7-e2df-42ee-b26a-3ac90ec3a749", "value": "384:3M+2PeDZFfiStzNA8YZNqD4MdUDNChU4MvsS+UFqclFo39D:v22fZz8ZNq/Mrdqcjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634125935, "uuid": "03eb65f1-1bbc-4e3b-8f4c-a590522f6578", "value": 69120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634125935, "uuid": "f5c6f395-002d-4be5-a8ae-9e530efd9c0a", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634125935, "uuid": "abc52102-f87f-4634-b9bb-a501f1cb6b4d", "value": "New PO for 434321.ppt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ecc66b3-2c49-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634145417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634145417, "uuid": "12c68c99-7202-441c-b7b8-478715a0c435", "comment": "Malware payload (AgentTesla)", "value": "2f4deae5668099f4be4cc7e62fc42af4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634145417, "uuid": "ad3445ec-ec79-4962-82b3-ab839be27394", "comment": "Malware payload (AgentTesla)", "value": "466e69c68f7e24ae7a669ba9b9f70dee579d2c52d1d37aa963686576ae428431", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634145417, "uuid": "7a60fa1a-d0a3-4afc-abde-2ca1fd076336", "comment": "Malware payload (AgentTesla)", "value": "152de3f42abde9fc46c470820ca8a9a77c91ffd7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634145417, "uuid": "c689c49c-01cc-4f82-aabb-33f615c2d5f8", "comment": "Malware payload (AgentTesla)", "value": "a9238954a63dacc1508035dcbb75ea3e50f93897a665860712b6678f86102680668f3e22a51df2568c4788fd02c15762", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634145417, "uuid": "19e69450-0b02-4a71-9c0f-f76215d74122", "value": "T1BDB4C0A4BF99DC4FF36698786231DF44C67DA14B3713C625D9BE507A93A87842CC2283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634145417, "uuid": "cf3c3eca-457c-4493-9e50-013dcf9bd412", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634145417, "uuid": "ffe918eb-fc20-4ca0-9146-6b2899df97f0", "value": "12288:RSBWJeRAJpKA8VlSTh+u+eLHNB31OXH0THEKHg0R:cBke6JB8S1PBRBYUj/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634145417, "uuid": "822c7f12-3f8a-4b4d-bb52-d610f3f65d19", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634145417, "uuid": "e5cb29e0-fbc9-4122-9761-dc9b3849ddbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634145417, "uuid": "a2a7670b-815e-43f4-b22c-999ac1106e05", "value": "1000$ Visa Card.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e6994d-2c52-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634149241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149241, "uuid": "7522d379-3de1-4dea-bfab-8b83eef31b06", "comment": "Malware payload (AgentTesla)", "value": "e68258bc101fcc0dac44a2befa7610a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149241, "uuid": "2021ffdb-d8f8-44bf-b2cb-96189d73c1b0", "comment": "Malware payload (AgentTesla)", "value": "46a4717e8b7dae8a9a587ceb9cd5a45d3bfc3aab00234b4b1bd3e449c2a73a30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149241, "uuid": "7b3a2761-24be-4eb6-9a05-556aa3fc06cd", "comment": "Malware payload (AgentTesla)", "value": "fd0e8669df17f05ea9b4a7d6a44cc0b66f60c8e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149241, "uuid": "784434d7-36a8-4166-b28c-346f06d7034b", "comment": "Malware payload (AgentTesla)", "value": "a3cc712abcd0d5ed4d2b3a7f447e0f85dc3909f796a137b41ac13dd34fae621e6b3ef8cc7856b0828e1216195cf1f740", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149241, "uuid": "fe3d5868-bb11-48dc-b1df-9559b4dedce0", "value": "T1C4D4E026330A91E7D6BB0BB46117A76D82B4EC662E70D7BC2CC1759B6FB3BD042154C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149241, "uuid": "410526dd-a377-4494-a837-39eef9f197c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149241, "uuid": "c3b7fb0c-f6bd-46c6-a88c-af94044adb07", "value": "12288:CpvBtyYx4xp7nhIuyRFN9q8/YnoWcl4OSBuYxQpFH5GgNYPr:Cp264H7nhIbTmhcl4TBxw5fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634149241, "uuid": "a22c110c-f2e6-484e-af54-76741d99e642", "value": 636416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634149241, "uuid": "9a1d0246-1314-4fb9-8a49-1aa676d6008b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149241, "uuid": "b20815e6-7fc4-42dc-85fb-a03806a3b9e8", "value": "facturas y datos bancarios.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6c4d85-2bc8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634090282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634090282, "uuid": "8b36c396-0d2c-4545-89a0-630bbbb93c33", "comment": "Malware payload", "value": "8e0be060385c07d8e8860749f9c721c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634090282, "uuid": "4df417a2-92ed-4f10-aff3-ddc00b849caf", "comment": "Malware payload", "value": "46c8ac53157328105a599fd431f76664c79b597ab7686e12897b2d07043f8d2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634090282, "uuid": "283c9891-157e-4401-8887-bc48f5875e15", "comment": "Malware payload", "value": "18d38d893ded507b058266857633083d1fbdbac5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634090282, "uuid": "43d67ff9-8e47-4931-aaa2-c0b26e91b216", "comment": "Malware payload", "value": "5519a5c86ad3787358a9e2d348ce68c7d0b1cd866a55d5f1102b47e6ad7a1631300a0d60dc8f69f0e90528c6f78fb405", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634090282, "uuid": "9e932f16-41c3-424f-8ae8-8fd21aca93fa", "value": "T120942338227BD84CE06F46BE3017AB5D9ABD4C186CF6C771BB493254EAFD28434C15A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634090282, "uuid": "157cb3fc-847c-4ca5-8827-4726c54c9bbb", "value": "63ac7c2799723925dd310860701c20d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634090282, "uuid": "f330c12c-287e-480e-9b60-d5b943e5d701", "value": "12288:6iaF391H826CgHKAMqJL0o5D7XssE0Bq7f:er1crCC0o+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634090282, "uuid": "1713d56c-2f17-4e74-90e2-46898bb5cf35", "value": 409856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634090282, "uuid": "bce31ceb-2118-4123-b94a-4597edf346ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634090282, "uuid": "cf25a7e9-87a6-4e13-b784-1fcd023bceb7", "value": "8e0be060385c07d8e8860749f9c721c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084d9faa-2c48-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1634144843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144843, "uuid": "180c46d6-c020-4752-97c4-24c225cbb4c3", "comment": "Malware payload (RaccoonStealer)", "value": "50f3588df57df36f71786cb7fd2876fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144843, "uuid": "b89b22a0-a523-409d-bcf7-6685b5fc7742", "comment": "Malware payload (RaccoonStealer)", "value": "4701e82080bbf43bfaf8dee522b66e11ee9029154eca770701e34e3a7822f263", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144843, "uuid": "0b7b5408-714e-4674-9c4c-ae3f26565f3a", "comment": "Malware payload (RaccoonStealer)", "value": "e9008ea9e6da7547fa1d8914d9d2d77cb3977e36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144843, "uuid": "43ca2680-f9d6-4422-b5f9-18a11e3a0d12", "comment": "Malware payload (RaccoonStealer)", "value": "55943e3b46958fd013e95a57cb6b5697b13d2f0af8fd6d42249cb1bea9e9d0b3f22b877af768c48bf1bdcbb3cd201d28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144843, "uuid": "9e52ef58-8e1b-4494-b317-e40bd13ef2c7", "value": "T10BC4E010B7A0C035F1F766F8497AA3A8A53E79A1672490CF23C51AEE57346E1EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144843, "uuid": "35f75d92-d6da-4c0b-95d9-8d2502222444", "value": "6914b510638d71b110829c8d3f3435fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144843, "uuid": "68c66e3c-cb90-4745-92c9-fb81387953c6", "value": "12288:BcW1HJ+I3MF7H2Jl7XOwIVN5j3vPJxXLT2CQoLm2v0vQGmD:5JpJlAN93vPjn24mhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634144843, "uuid": "8980c5e0-5b53-4579-b622-fae5e0d1f06a", "value": 574976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634144843, "uuid": "df0ebbd6-12ff-4c32-97ef-23550a722493", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144843, "uuid": "aa673c9d-e10a-46ef-9b18-6efcd7ace90a", "value": "50f3588df57df36f71786cb7fd2876fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f00adc-2bf2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634108070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108070, "uuid": "e2030c07-a186-43e2-959f-78b4c0768713", "comment": "Malware payload (AgentTesla)", "value": "0dc6e9a9b2edd1dcd61ca1cead55ae9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108070, "uuid": "7702a944-19b4-4c02-b795-41c79b8e5256", "comment": "Malware payload (AgentTesla)", "value": "470f0b85b6de45f2de6dc59a8858e814bffda487135ed449dcbe5b5e76f34f6c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108070, "uuid": "533c695f-e09f-48f2-8041-64a1b4721146", "comment": "Malware payload (AgentTesla)", "value": "5b0fc28b39570e5e9882d9a97939679e2239815a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108070, "uuid": "302f3ac8-1077-409f-b638-65e4cf06007b", "comment": "Malware payload (AgentTesla)", "value": "ef989af6ae1f83baed21251e040d5597ce69a1a0308d1e587bb8d0be1cfef588ba7627255fcbfa863a8b2bd2b6a16b5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108070, "uuid": "a3fea281-9789-4980-bb66-4c5d9e3ab0f4", "value": "T173D412835FA1DE8BE4A94EB78462D9714B70EC84BDA2F7195DC43D6337333D004A96A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108070, "uuid": "ae8d72a4-0dd0-4a08-9b91-5b5a996fea2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108070, "uuid": "6dc4181a-5c70-4639-b1ae-34d6daaf1c82", "value": "12288:EiS0PkhLfUJ83T1xSXy+tOrhgCTLQNujb5l5QQ0VSB:E50PaLsJ8JEAh/TLQ4Vlg4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108070, "uuid": "a95b91cd-c917-4ca1-93b9-845530f79054", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108070, "uuid": "72cd78ad-c1ad-434e-9cab-64dd142a7407", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108070, "uuid": "b26882b2-c582-43de-832a-813eb5e61015", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.15661.29832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5f2f2a-2bf4-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1634109037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109037, "uuid": "8958af08-3b92-47e6-8d3a-dd1187919738", "comment": "Malware payload (ArkeiStealer)", "value": "e70320db1a53b3226e73d2b8124b2073", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109037, "uuid": "1e2b12b7-e3d5-4e24-81d1-4974cced52dc", "comment": "Malware payload (ArkeiStealer)", "value": "4821e3c96ac5b45216470c24fe904e41c6060e8b392ed6265807b4c59e6d39b1", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109037, "uuid": "a6d1c4b2-66e5-44a2-ba52-a31d4e279c15", "comment": "Malware payload (ArkeiStealer)", "value": "119ac671f8030a7395030273931120b6e52b3d4d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109037, "uuid": "4943c9af-6d3f-4083-850f-bd7edf963108", "comment": "Malware payload (ArkeiStealer)", "value": "5e4327f815ce0d858db939da1bb19647d7306ae759948b44aadf13fed9593068cb83d82660e3cdeab1b369a7bf21218e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109037, "uuid": "d3804dab-55f8-4d61-8d63-3c7fa3fa5c20", "value": "T117439D01FA4AE911F39991B02EC3C6D5772A7C4DAD92A32B32617F9FFC359B04A11706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109037, "uuid": "7d4b51e6-e279-4d99-89a6-780ffed5d6b7", "value": "768:1AcUdkarMdzkx0EHG+Mo66b7Dt5cxJdo8rATdrQ85:1HikhRuzv6wD/cxHoI0rp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634109037, "uuid": "8efad95b-0790-464c-866e-9c540413d227", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634109037, "uuid": "d41c90cf-b1e8-4fc4-9f1e-39e2a21f4ae8", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109037, "uuid": "cd376b5f-df13-439b-92d3-a7c9f548387e", "value": "Invoice- 0535254 Oil_Field_4568742.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0e946f-2c42-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634142567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142567, "uuid": "b0e5d4f7-0d86-44fb-8ea8-858abc9165d3", "comment": "Malware payload (RedLineStealer)", "value": "7171b247521e630152953ce57aa6908e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142567, "uuid": "88f75343-1aa2-41a1-927b-c2fe0239085c", "comment": "Malware payload (RedLineStealer)", "value": "484989aa0548d25d524e8dcbea3e5117e31ec143d8b77aec8945e392ce7c72c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142567, "uuid": "2987d698-adf8-4423-8416-37ec31fae437", "comment": "Malware payload (RedLineStealer)", "value": "68d73bac868eef7f89978c73d896b7cb32bf4717", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142567, "uuid": "aa19164f-dfa7-4b69-8cb6-0fa34aac6fcc", "comment": "Malware payload (RedLineStealer)", "value": "870f82e56e22a3dc8d36ce530775f21a31ad446910d2eb3cb0ff823fb415dd350df80a06b6aa42963dc26e693d198dbc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142567, "uuid": "faaf85ff-8164-4a17-b525-cdd5e2971b30", "value": "T126257C6F6A0FD711E4942633C0831FF81A3F7AD67125EC4E3956AA16281E2F16B45F8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142567, "uuid": "cdfe0aa4-f64e-49c8-a0ba-498a22252b54", "value": "9c27955c0fd954648a90f6dace0af4f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142567, "uuid": "f3f2799d-3e79-458d-b2de-b0c7bdf164bc", "value": "12288:Li7NzBBOb8tjHQ/is1NyoyAXtogMAAZ9ZjZ4JpK6xpmG:OBBW8tjCiSyAugUHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634142567, "uuid": "f13187fa-fbc1-4c14-b9fa-8bc784eb89a3", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634142567, "uuid": "1b4ffbce-a710-46b2-84e8-02870075704e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142567, "uuid": "469cdbfc-8644-4769-a466-05fd93f07265", "value": "7171b247521e630152953ce57aa6908e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c1faa28-2c49-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634145466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634145466, "uuid": "4c0803ae-82e9-45fd-8b2c-3825e7167af5", "comment": "Malware payload (NanoCore)", "value": "8fa47bd825eab618785f5d694c1371ea", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634145466, "uuid": "04c471f9-aa2a-47bd-bc8b-8ece90a9553c", "comment": "Malware payload (NanoCore)", "value": "497bb8042e4c8036a243a97a6268c6202b01e33e6935e26e43cb1583fc34cd8e", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634145466, "uuid": "bb1c03b3-3710-4f27-bae7-a96f7650c8a3", "comment": "Malware payload (NanoCore)", "value": "880e89404e5ccd3a1c209b179050eba738e0e9d2", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634145466, "uuid": "879ff65a-708d-415a-bfae-c4f848e5dd98", "comment": "Malware payload (NanoCore)", "value": "dd27a63778d3bd6f446798a422f21deb1f4a0381e38b604f068d2bbc287481b8b17d13950bcbace85b2421a8219cfdb1", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634145466, "uuid": "3eaef0e2-18f4-4406-a414-1b19b3694543", "value": "T12C1533FBDCADC302A6D761126AE1E9D613539763F49B1B210A5C35FA3069AFFC090790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634145466, "uuid": "7d639da5-7cab-41c7-beaf-d78e930bba20", "value": "24576:Bf/oaf9S+kwIzREFo+/Gm2TPY3E7np1RM+a347:9Ai9SXwaS/b2c3EzpXMpo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634145466, "uuid": "ec0efe9b-cdfa-4be7-ae85-22e6e6bb4619", "value": 948506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634145466, "uuid": "a612357d-5938-4764-9a90-4995f937bd9b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634145466, "uuid": "10c23e98-d8b1-4ba3-ba87-71683ed87644", "value": "8fa47bd825eab618785f5d694c1371ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bbbc5c-2c4d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634147086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147086, "uuid": "2d954056-d33f-475c-8f85-13f53b7b878c", "comment": "Malware payload", "value": "00736f48927f05debbd6f81ff6b7d7ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147086, "uuid": "83ed218f-a2fb-4384-8d79-e7a2a3e91838", "comment": "Malware payload", "value": "49cd58237e78a994581334c51f96393b03e5e95185d23a6a0cfddccf58d71741", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147086, "uuid": "8e7331b1-7dc4-4de4-8983-415badf2608d", "comment": "Malware payload", "value": "3ebbe056c153b64395b0cac5d7263ccf90d46fe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147086, "uuid": "10343932-75da-4c43-8f4a-05296560839a", "comment": "Malware payload", "value": "07c9c76ac0ee8ac1e3aeeb63adff8a4341affe7125339e2f40d9edf3b4eef66a858c95a7674be705fae5413ea31223bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147086, "uuid": "3bf8980b-f393-4603-bbd2-570101ac79b4", "value": "T186E55D137644D53AD0E70B3A982BE3589C3F7F217A6ADC0A1EE4295C4E35D43AD3960B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147086, "uuid": "1126baa7-6cd8-45eb-bce7-629e74842a6d", "value": "84089da33a32dfe450671d0f3f838da8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147086, "uuid": "4abdcb6e-7d63-4242-a45f-0cba70058115", "value": "49152:0ZWZT0r5o7J9iEchiSryV40bwc6C8CH73T9yx5buWk5:0zYJ9i10bwhC8w5yx5Sf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634147086, "uuid": "ab4c91c2-40a2-4f64-a522-9b7b4525d400", "value": 3177472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634147086, "uuid": "c70c7c94-9dad-4052-9bf2-99fe3e1a68e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147086, "uuid": "4028b702-ae6e-4a43-b9fb-c76e8854d25f", "value": "Fromix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da7add1-2bc3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634087809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634087809, "uuid": "9beafcfe-520a-41ef-b051-d18660c09f32", "comment": "Malware payload (Formbook)", "value": "47f7e7a32e8ee493383a5381731a6923", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634087809, "uuid": "daa24a03-f239-4716-af26-c6f0fa521651", "comment": "Malware payload (Formbook)", "value": "4bd4b9f79c629ce5f602b3cc8bacefb6c3779498d66b946be9da734111659f23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634087809, "uuid": "5316377c-eaeb-4cfe-af20-c995397e5127", "comment": "Malware payload (Formbook)", "value": "365f44bc5922a304fa8c02a8376dd8f531da6072", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634087809, "uuid": "d5a1645f-5819-458b-9e17-c49082d31d7e", "comment": "Malware payload (Formbook)", "value": "0b0eda5a1520c168afc9c6916ad7f8ada9330cd8624ea35fcf143bac500023dcb0e0b888c639d26656f0c04b7396f466", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634087809, "uuid": "e37c0a10-98e6-40c0-82c5-e78629ae1870", "value": "T1B2D4BF4E93214393F1182B74DA7D7E1942301C7C78D2EBD8B9A5766BEDE1BA6143302B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634087809, "uuid": "4ffb9164-0b83-478f-b4c8-5fdc2134c863", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634087809, "uuid": "809d8070-85f3-4c2b-91bb-5282fb0a5468", "value": "12288:MCftTR+enVzps09iJW5LGcxP/CvB6V7XN1jDUXAP3rSkIsSB:X9Ve25p3Zvj5DfGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634087809, "uuid": "ac6346b1-930c-4577-94d0-3206cef2eb70", "value": 633344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634087809, "uuid": "4196282f-866e-474c-9bb0-7b2bcc92fe00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634087809, "uuid": "a21e6955-9840-4d24-8e6f-96ba2c1e2891", "value": "Inquiry.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6960fbaa-2c51-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634148871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634148871, "uuid": "13d1593b-df4a-4125-a4b1-6a205ff0effb", "comment": "Malware payload (RedLineStealer)", "value": "06c097cf501489bda13f306f3da1d120", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634148871, "uuid": "eeceabf1-5720-48d2-9149-32c744f10414", "comment": "Malware payload (RedLineStealer)", "value": "4c7fcf68b64aafefc3a6c92265378e21801543c9f2bb100742f55c78a310468b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634148871, "uuid": "35e31a85-dbeb-45ba-b8d0-ecbb97676ac2", "comment": "Malware payload (RedLineStealer)", "value": "1486604d6a059079b9ab7071cda001f6dce776f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634148871, "uuid": "46c54aee-271a-4e47-923e-70386fb4faa8", "comment": "Malware payload (RedLineStealer)", "value": "cdbf500dd636a8c0f95db00f4422460a034fb755d3156c6be095f9cff4a2d9a58f60e1792e57d97fe7332c6d2e13fe49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634148871, "uuid": "fa7c63ab-e47b-4054-abff-128d8d6b6f9a", "value": "T110762333A6341085D4E08C3A953BFEB471F51E678A42AC7868DEBED325336E5B123947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634148871, "uuid": "a2959424-c661-4a28-8d53-61ed634c9861", "value": "172750858dcc0719eed08c952858023c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634148871, "uuid": "058b53a4-791b-4614-8d4b-e9a684010800", "value": "98304:Xzd5cnjKTpz88GMkOulWx7lMmig2R9aNZTTwBlq24907VXPQEYRr3B:Xzd5Qz3vlqlMpg23aNF8N3BXdkrx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634148871, "uuid": "cf213595-8e16-4a9b-8304-3c50769bb186", "value": 7788512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634148871, "uuid": "dae805d8-6186-46b2-8c4f-51d4e145847f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634148871, "uuid": "0587e12e-297d-47a8-85d1-142e892778bd", "value": "Far Cry 6 Codex Torrent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4575d13-2bc7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634089807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089807, "uuid": "d3210567-f859-407a-8691-7113221f753a", "comment": "Malware payload (Mirai)", "value": "119d737d2bae8e2efe4f871b79f2be65", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089807, "uuid": "bacd333c-2921-4e3d-a471-5de08ec85367", "comment": "Malware payload (Mirai)", "value": "4d393656d396235c4db4c516366e2917529de6e8861d6d97bdfca4ab4d52e1d4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089807, "uuid": "4d9941bb-9c10-4d44-b2c5-9923608599f4", "comment": "Malware payload (Mirai)", "value": "a318b8f9d33bd7f14ba66972712a58f285daaa06", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089807, "uuid": "f90f6624-f688-402a-a950-c72c7f265119", "comment": "Malware payload (Mirai)", "value": "4f00b86fab3394f94c27fa5922fa9c705a47d07b42cf87c2ade865da27826e75db8b363e6707f4810f870f34a3dcd134", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634089807, "uuid": "2f561031-b426-491f-a519-5f79906fe763", "value": "T13DA31882BC81DA26C7C15377FA2F508D331663D8D2DA3242AD291FB436CE91F1D7A645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634089807, "uuid": "c8d9556f-7aa3-4eab-a158-b4f4f5f20678", "value": "3072:mNratzbzAHTJkscO118eCj84AZ7LHcFYRl:YOtzQVt8efR7LHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634089807, "uuid": "8c49f1e6-b8b4-4bfe-a3e2-d1fae496d6f9", "value": 104860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634089807, "uuid": "1d642aff-397b-40b9-bfb6-dfd21301461a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634089807, "uuid": "0f61a553-d0af-4eaf-a7fd-9b9fd097e92a", "value": "notabotnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09478861-2c3c-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634139690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139690, "uuid": "f9e3ceff-27c6-447e-a88a-758a7c1c3a2e", "comment": "Malware payload (Quakbot)", "value": "aa054899f7ca53d4055798125f777008", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139690, "uuid": "293439a5-8b6a-453b-9c3b-1f469e726796", "comment": "Malware payload (Quakbot)", "value": "4d446547a8316ca8424aeba6e4901be6cef1be7af7f51ed4f5697581a647e540", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139690, "uuid": "3990e934-c4c0-45b1-a401-086a673b9005", "comment": "Malware payload (Quakbot)", "value": "b6762beb155020ad7118ce67cdf2304b7fa47b5c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139690, "uuid": "7ecc630e-53e4-4fb8-873b-6ea81c58387c", "comment": "Malware payload (Quakbot)", "value": "5a59df8fe3b612ded396c065e5a47c0eb8fa314b20efc281b2390990253b74f4de7aac221779ae1cd1128821445e0959", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139690, "uuid": "4fec87e0-2ede-42a2-b961-9127a393ca35", "value": "T1E8C409A5AD0D8C73FDD42A3052836E082E1B7FD2B17C318F356BF6146D6BB94A891E14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139690, "uuid": "3f0eece2-2411-41f5-91ac-9a615b630ebc", "value": "9a30e75c82eff20dfe0e0897d34cb07c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139690, "uuid": "7f3a307c-1ae3-4813-8c4c-656761c58489", "value": "6144:VJVAfqX+2Rr+nxQDBO03fHEera3bpt5eH5:VvAfLfaEkAz5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634139690, "uuid": "d32f948a-975d-4b0b-b24e-31fe28036396", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634139690, "uuid": "9e3ad02a-c8f8-4408-9ff3-d1b98b56c7a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139690, "uuid": "b6ee390e-12b7-47db-8359-f10e47b72e84", "value": "aa054899f7ca53d4055798125f777008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac1a1bb-2c38-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634138324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138324, "uuid": "9ffb9929-fbe2-4460-a623-25397681034b", "comment": "Malware payload (Metamorfo)", "value": "3dd2b03e3f3364443ec4e0c3cbbb2bdf", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138324, "uuid": "e7520ec3-566f-4044-a95f-41752acfd996", "comment": "Malware payload (Metamorfo)", "value": "4d9ecb2e385784195c4d2d0060bd8b848ae493033464fcf8fd0fde436f1afef8", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138324, "uuid": "4629d565-3e56-48f1-a839-e82c09171275", "comment": "Malware payload (Metamorfo)", "value": "076c8bc998864c95f03690742591c27d36c8d0cf", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138324, "uuid": "fb956d75-0bf3-4827-90a2-b9d8f47f975c", "comment": "Malware payload (Metamorfo)", "value": "e1b4ff3f689efccf169e34177ef9c3982673218e889f03fe7f5196353d729442255d6dc53eab7155e71b77abadc04e4a", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634138324, "uuid": "b1999b42-f1b2-4062-bdb0-a0de2d7cec16", "value": "T18031BE091EDA1329C3B3CE7A107BA2464A76FC51AE934F9D80C497DE2861054FC34E5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634138324, "uuid": "489e4f86-b610-4934-a112-47d1f650e001", "value": "24:8+JUHRlVo5kcbA+PjFMf+/P+PBhMw41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+vcw1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634138324, "uuid": "287925b9-f7d2-4e61-ba77-7f944ae6c532", "value": 1552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634138324, "uuid": "b7681320-48be-45d4-8fca-f2fbf3548268", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634138324, "uuid": "e252d9f8-12f5-4945-8c66-5f85eab96f84", "value": "Curriculo.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ee8d89-2c07-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634117081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117081, "uuid": "00052813-691b-412f-ae84-a1471d527922", "comment": "Malware payload (Mirai)", "value": "426484db2d2a9a0dff59cffbeaffee71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117081, "uuid": "99d7ca0a-c9c1-4972-9fa0-6eaa60981e57", "comment": "Malware payload (Mirai)", "value": "4e2300421f56a07009aa644506ad1b075eca1b5df67471efa7a889b2eec901cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117081, "uuid": "73696971-49b4-40a7-ae84-54763cfca732", "comment": "Malware payload (Mirai)", "value": "cf4e813aec03302bd11b5aac2b0f3159d6b6d497", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117081, "uuid": "9e0857bd-f883-40f8-8007-82736d949d37", "comment": "Malware payload (Mirai)", "value": "ad784ef9a1a45b7fa24e1b25875e92a7ec2b914f60bd0ff0f36393700d185618a8bcaeb8b238e32e68c2b4b6998ba822", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117081, "uuid": "da74d3d1-403f-4956-ae07-c6b087d4ef4e", "value": "T19743F2316A372572E3A57073A58E8A80B1D12F7EC03934320B62071962DB6D2F7D37A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117081, "uuid": "4736df2f-0753-4f9f-bc6b-e05c982602c1", "value": "1536:Ay42/9zWML+0LpEBBVyhLP9y/27g6dPVnAFGrD:8qiMLPpMBVyhLYu7p7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117081, "uuid": "2d24eff7-f297-4ae3-a781-3d744d6709b1", "value": 59196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117081, "uuid": "e9cb57c2-883d-47c6-9c82-b36502eda075", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117081, "uuid": "67dbf7ce-9ebc-4a81-b824-4338c3b91e68", "value": "426484db2d2a9a0dff59cffbeaffee71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765447cd-2c1f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634127418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127418, "uuid": "7eab8419-261e-473b-a410-317047bb466a", "comment": "Malware payload (AgentTesla)", "value": "55bbf9f6fd5ac38d15e4febe362ecd7d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127418, "uuid": "4c0beff2-2635-4b71-8dad-02bdd7d05646", "comment": "Malware payload (AgentTesla)", "value": "4eb8219a42cafc5df4f7abe9b112039e45e54ec27b92a32885875097b494acf3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127418, "uuid": "178e8209-df4c-4801-b47e-263c54ffe2ea", "comment": "Malware payload (AgentTesla)", "value": "5ff641d8f7f54843063a6fc69bc4eed5b982dddd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127418, "uuid": "48518436-4983-4440-9d62-2284f96d5695", "comment": "Malware payload (AgentTesla)", "value": "da6a20a560f16d8fabb8b6b798b09bcf70b3145aee9c4a7e3958e6e17a16576389af02a8dceb6ea4f03449e35f2c7460", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127418, "uuid": "352a01a2-69ef-4333-a900-c362c582c6c4", "value": "T15884AEA1F289D896E8471DB7487BDC3150E7BA6C9874461E114E77291AF338320AFE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127418, "uuid": "514cae88-dc1c-4d32-8112-65cea122ab08", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127418, "uuid": "ebe45bac-b21c-4623-9d72-98a31cb2de1b", "value": "6144:GBlL/geASlJa42A9ohTe73OhjftpAp9Kv3JzY2F4Zxq5QqiMqiBKgS4:EieAJ42A9HOhwuxzY2F4ZeQqi0BKgS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634127418, "uuid": "4fdb27f7-864d-4813-b947-f3d8c0cbb949", "value": 383393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634127418, "uuid": "10b1b4bb-34bf-4a6a-b9c8-34722ebf6763", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127418, "uuid": "1ee4a13c-e186-435c-9db2-d80b3cf58b86", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8c8f9d-2c06-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634116635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116635, "uuid": "0317a91e-eec7-4999-a9b2-ba498d0944db", "comment": "Malware payload (AgentTesla)", "value": "e72cfc505a04738c223b68891648a3a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116635, "uuid": "340cea69-e184-4f9c-a76c-31862767d7e8", "comment": "Malware payload (AgentTesla)", "value": "4fb5377736624d79dfce363b511b8ea682556789140aa24a7045553eb237bc05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116635, "uuid": "40948ed2-2e88-46c8-94bc-2c522b0c2da0", "comment": "Malware payload (AgentTesla)", "value": "83e41cc20431e1a4a09e8bf1a851327fc5dd417a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116635, "uuid": "2db83fe6-b471-4551-a688-2979f1a7ade1", "comment": "Malware payload (AgentTesla)", "value": "fa8474841d27330e22b89be3525ff9481fe693a94274b7e26c93b1c81758d9a999508b6755f9b419777c8d3a9b9932ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116635, "uuid": "9631d3f6-8ad6-458f-82c7-03f950890aff", "value": "T1E6B4CF697F89DC1FE35A88785171EF84C67D62473B13C626D8BE907B93A87842C821C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116635, "uuid": "54d82fd9-3ee3-4c59-8116-61a28ca6d5f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116635, "uuid": "3d5108d5-17a5-4635-a3ef-3c8ee5eaeaab", "value": "12288:o00OwNpAv3D9PaV+yfsipEvVewzzzT6OHLzeXSBU1V:elFEdeQzljBU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634116635, "uuid": "427ae8b8-69a5-49b1-b2c6-55169098986a", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634116635, "uuid": "26886ea2-38f5-4dca-ba13-ac85594cf7df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116635, "uuid": "73f52c6d-106e-4f48-9466-b000433cc19d", "value": "Swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cf7b99-2c4f-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1634147897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147897, "uuid": "3c99afb9-712c-4785-9f6a-12ff9983993e", "comment": "Malware payload (DanaBot)", "value": "a77a0a1e3e245240b2f827d031ba4510", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147897, "uuid": "015c8273-9bb0-42c0-94b8-3b54ca6ef8a7", "comment": "Malware payload (DanaBot)", "value": "4fbb399e44f5e84cbc719d8e99028029adf60f524ebebab04d22513daf3bce9c", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147897, "uuid": "f0554f08-1bbb-4f71-9459-b2a86decd02a", "comment": "Malware payload (DanaBot)", "value": "6bfaeef8171e2f3b3d6d5abd9a7b02450ab22d42", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147897, "uuid": "f70ef2e1-ca80-4b83-b3ef-60679c47e301", "comment": "Malware payload (DanaBot)", "value": "e28f1506630cce60383b4ed19d6fc60aa5b5b79bc5b74939ad89659617bc54a6cef06dabe1e96752eb1637f12bb8041b", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147897, "uuid": "ad2e96a9-9a0c-41eb-9541-39e0b20a325c", "value": "T149451210A7E1C039F0F366F45979A36CA53A7E90AB3591CB23C41AEE5A35AD1EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147897, "uuid": "2966c5ad-43b9-469b-b8d9-7cf2294b5dc2", "value": "e9d1f1739ab48fbfe7c7128688524302", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147897, "uuid": "582f7732-47f7-4e25-9043-c16c11b67276", "value": "24576:J1VqL5OBAbNy307nscZDFigU1XJUJgfUR05G3E0tqN+TUx7cB44bYrhs3c:D4fs4sZgv325G3E0QNcK4bYrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634147897, "uuid": "731b953a-022a-459f-bfe5-0d4ebf95962a", "value": 1233920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634147897, "uuid": "3c74f74d-c7ea-4ad5-9c43-22a6c0131f26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147897, "uuid": "51448671-9be5-4f00-903c-1995aae37646", "value": "a77a0a1e3e245240b2f827d031ba4510.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a19e8c-2c09-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1634118013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118013, "uuid": "a189f1f4-3ae2-46e1-9551-ff91f0d973f7", "comment": "Malware payload (BazaLoader)", "value": "458228b460f972d7935723acad55f9ba", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarISO", "colour": "#EBCFBA", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118013, "uuid": "b7fb3bdc-c8fc-4f6a-9058-d310fec0b269", "comment": "Malware payload (BazaLoader)", "value": "50561167909de0e777c5d81ef72d0981b996fe46df881ab34b9b106aabbe7560", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarISO", "colour": "#EBCFBA", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118013, "uuid": "bcacb340-689b-495d-8bd6-5450f638d48c", "comment": "Malware payload (BazaLoader)", "value": "4ab23bbfa840acba573f2e585bbed01257e2aae3", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarISO", "colour": "#EBCFBA", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118013, "uuid": "3995a17b-4113-4fed-96a6-8c00f372ea05", "comment": "Malware payload (BazaLoader)", "value": "0c761929ac77e4c04a5421f53be66c49c74ddb6ad7640d096accfb25664ec624b06dca4ab767eb2c66722415ff30cb50", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarISO", "colour": "#EBCFBA", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118013, "uuid": "75cd47f6-3f77-4dc2-adae-7ee3db34d5d7", "value": "T10A45E7E5EE2291D0F4BBE070C5917617B8613C6953398BC74200672B2B63BD4DA7E78B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118013, "uuid": "40e913bc-3ccb-46fd-a00d-3c70edd3bf8f", "value": "24576:aAm1pTsWeU8tV+VwKYs1tRS+7SPFL3EOGTWqG5QVEzAJ24GOy2ipi8z71aaDpZBG:aAmbTsWeU8tV+VwKYs1tRX7SPFL3EOGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634118013, "uuid": "3707a91c-2f3e-4d26-a9e0-d1c3cb0d75b9", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634118013, "uuid": "27c4ba74-213d-46d2-9c12-746aeb2bee7f", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118013, "uuid": "2f35e6c1-a0a7-4908-858b-9ac0bde94248", "value": "Documents-report-08.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1217a52-2c34-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634136563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136563, "uuid": "724a6b84-9bbe-45ea-b92f-a133c4e79b6b", "comment": "Malware payload (Mirai)", "value": "41b0d6ece05a0115f0a719e9dc152190", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136563, "uuid": "034e77d7-b40f-4f5c-8d0c-17957efa3bbe", "comment": "Malware payload (Mirai)", "value": "50f23a335a13c93bd021217af2ba114ce75dd3af9ddb7426f6c81ef4733f780e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136563, "uuid": "7b21993b-a332-4d20-9ab3-d487101373c0", "comment": "Malware payload (Mirai)", "value": "22b539458554692cd3a8faeefdf9e752a6012100", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136563, "uuid": "745a2447-9029-403b-9183-e40142992c94", "comment": "Malware payload (Mirai)", "value": "d0504b8cb59321e96a8821bc77d8799842aa47446d08e36a7ed11d874833f7a9d33ef3e379d3cd057b3c4e71b954e504", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136563, "uuid": "ee1dcd0b-1729-4468-b811-f326715298d5", "value": "T1FC832981FC41A622C7C11777FE5F018E371553D8E2EA32079C285FA03A9F95B0D6BA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136563, "uuid": "0bca168f-7914-4db5-b1c5-eae202608e44", "value": "1536:NySHwrZKkRozEsK3nU33eZtU5SWmAHPeTriW/SnvL:NySQ9Ko783w9yPe31KL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634136563, "uuid": "ffe2d4a5-565b-4781-a967-2da4978f0cc6", "value": 87172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634136563, "uuid": "d58db751-ce34-4371-8e56-6f1612f82efe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136563, "uuid": "bb90b85c-64be-43aa-9029-95958ecb3d32", "value": "41b0d6ece05a0115f0a719e9dc152190", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144a48e0-2c52-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634149158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149158, "uuid": "2abdb746-a504-43dc-a17b-d2ef5b4b17c7", "comment": "Malware payload", "value": "20966c3ba521fcc25984ab8310e29f55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149158, "uuid": "428b22d9-25ed-4787-a333-709975266280", "comment": "Malware payload", "value": "522395519fc98a15a72728c30e9afe1c64d7f8d9c96515c239c8a401c2fc4886", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149158, "uuid": "59fb3273-9590-4c21-8052-ff28cbc82b8b", "comment": "Malware payload", "value": "e297d0697d1d94ba7084db3441307cb24ef85e2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149158, "uuid": "ee76289b-e0e0-471f-85be-228f130a01d7", "comment": "Malware payload", "value": "91185d611d422cc1a34e47f929afaf8894d323b3f15c376c6ca2c2bcf1f2be52e1621861b139640548d67a49a506aa57", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149158, "uuid": "84286035-d146-4e37-b2e6-c670615d3225", "value": "T1DFA4238E3CA4F786C47610382FE23A4102F8197C392AD1EF57A17955F24A6FAED4D05E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149158, "uuid": "a1127595-5045-4be8-96d9-76306a8f3bf4", "value": "12288:JlkctLdYh1WGvmT5C3bz4+oCeI6u1DAcC3Qn6XeQ6ZTy1:4/XWoG69NHtCcZTy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634149158, "uuid": "c4b61132-3a6e-47b1-99c3-af7ba7e8f79f", "value": 470144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634149158, "uuid": "79dcd0f6-9cba-4ec3-8986-a48cbfb35f45", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149158, "uuid": "6041d4ef-3853-4089-b550-5232e8942a41", "value": "Nuevo orden001.XLXs_____________________________________________.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f330efee-2c2a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634132352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132352, "uuid": "6417ed07-8e25-47d2-a70c-4d135d2bc945", "comment": "Malware payload (AgentTesla)", "value": "6e971b073f7b6e6189893c5a94f73728", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132352, "uuid": "c284aba3-8c81-4775-998f-229003ad3e90", "comment": "Malware payload (AgentTesla)", "value": "53306e291f4b95091dd7197a2810829faadb5fe5c8c85ffcaaf3bac79e3fec7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132352, "uuid": "2868aa9e-6802-49db-926d-b9b59e8f9f9e", "comment": "Malware payload (AgentTesla)", "value": "5129f403704d376fc8c1752e86c61d1de21f1859", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132352, "uuid": "414c5e5d-e13c-4f44-adbf-ded1d44f4769", "comment": "Malware payload (AgentTesla)", "value": "a55f04f1cb568f0e714c74d024b2e07a6205f3a9b7a76186ff7bc28ed2ead1ee42eafc359f4ee432189d138e4966bfd1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132352, "uuid": "dca25dc6-77cc-4bde-8cc5-a0142df03760", "value": "T1B4C422016A644343EABF2BF960AAAA052779BB66FC31FB0C0DC2B0DF09173558760757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132352, "uuid": "eeac870c-e108-4b25-8704-0f9c5e12ce71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132352, "uuid": "a260b2bf-36c5-47f5-b9df-ce8e59caf402", "value": "12288:LKSBn3N8IqF5JMZmtP3cHt9223GKGTJdxrwm7mmcz/7f:TB3JqF5JMSP3KOIGKQ3umc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634132352, "uuid": "eae5b67e-7373-4186-9381-e9b9d4ca3f87", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634132352, "uuid": "9a9789d6-e85b-40ad-a146-1180af455ef8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132352, "uuid": "34d2e610-575c-4fc0-86b7-c8fc5b8444aa", "value": "AWB5032675620_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e991073-2c79-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634166006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634166006, "uuid": "de225bfd-d6cb-4ae3-9d9b-9c196c36d54f", "comment": "Malware payload (Mirai)", "value": "d0bd9165f2b4cc794203bba57b79899f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634166006, "uuid": "a461b591-a32b-4ae8-b8cf-2474a5c47320", "comment": "Malware payload (Mirai)", "value": "53e9e711b11e16d221fb29e11d725d9ed8b37c61828ec770474cc73a4396bfff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634166006, "uuid": "35281934-658c-4ace-a5b1-981326f3f204", "comment": "Malware payload (Mirai)", "value": "860e1b31eb7b1a0c280f31624417147b741a35ef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634166006, "uuid": "61fc9309-3751-48e5-8164-21ec9b2b634a", "comment": "Malware payload (Mirai)", "value": "b5228390fcd39500e2dad50954f4e9ea30897602b875a04dbb9dd1183aa88106f8b1f130a9cf4a050f008ccf46b55fbe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634166006, "uuid": "17bac1ae-064a-4f8c-a700-42f79ea96428", "value": "T1D5237CC0A543D9F8EC150AF53173EB329B76F07A2129EED3D794A532D842702E64729E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634166006, "uuid": "44b83f87-2d8c-4747-adef-0779e6e31dac", "value": "768:gjo8WnBsux3TUi32+4qbBYSWLAs9QnbH+YMbJoSVO+Meb4ai:gWBsux3TUiG9qbBYSWj9QKY8JoSVO+1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634166006, "uuid": "cade2281-8db8-4304-b09f-c0ec27fc6756", "value": 45656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634166006, "uuid": "f0c48d17-95fd-470d-ba46-15319c1d6603", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634166006, "uuid": "ce5f2aa1-a471-443f-ae21-87d2f3da9297", "value": "hoho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eab5680-2c20-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634127727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127727, "uuid": "00d717dd-9fe0-4548-8b89-28a0b93bc31c", "comment": "Malware payload (AgentTesla)", "value": "882f26094cc86f5f805ec1b7ab8e72f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127727, "uuid": "7586fc60-24c3-4d7e-a3ea-737b63c77488", "comment": "Malware payload (AgentTesla)", "value": "54020d44cfe0f76931d5b9546bf8f90db48209c2ccccac706b3fcceed86ab9ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127727, "uuid": "a310e86e-3508-4be6-88e4-69044f3fa482", "comment": "Malware payload (AgentTesla)", "value": "c2f29986f2de43f029fc7ca78cf0efc35221cbdd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127727, "uuid": "65c13d63-4ea9-4589-9678-86831259ee0a", "comment": "Malware payload (AgentTesla)", "value": "d6340a3a4abb329857e8279d07c5bd945fb8850e537a6ac37c6de938624c02f38a0a32d5c257b441c0a57873a4792b78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127727, "uuid": "78246bc5-d42d-45cf-a86a-17b0dd3e87ee", "value": "T145C423D2C4B762859A73FA497FC2242835AD39243F6151E6D923E23B3103D64E72D8D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127727, "uuid": "4e328722-ddba-4ea4-b6ec-d3a3f891c391", "value": "12288:owDJ398/o0NPN2QxIajb8bekk0NMpOBdMmd7TxbKU1/HbjxiLbGgTp55xntU:/J39cjwd3NzTMmfhfbjxiOgTpZtU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634127727, "uuid": "ae49dfcd-bc4a-42ae-95fa-f231285d4c1b", "value": 550959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634127727, "uuid": "bab44011-bf6f-487b-9962-d8f1215f07a9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127727, "uuid": "9d5d08b4-ad60-446e-ac64-fc2052780b07", "value": "AWB 94000302-2391.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37b8c9e-2c37-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634137828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137828, "uuid": "a726498b-ff1f-4ba0-a55b-db2d631ae7a8", "comment": "Malware payload (Metamorfo)", "value": "5b313ff1b19f17dce652e33076ac2ede", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137828, "uuid": "5ae3b106-63b1-4703-8060-ba8d4029cb79", "comment": "Malware payload (Metamorfo)", "value": "54cfc60c3000990978d9a2cbb92ea3355de937f6920456c02c6ffe12314c66d5", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137828, "uuid": "b7722aae-0226-43ae-a6f7-e775fccfa3d9", "comment": "Malware payload (Metamorfo)", "value": "600f5ab146da58d778ad04e5661e9440b05fd309", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137828, "uuid": "97dd5720-ec1b-495c-ba97-deadf2188ec9", "comment": "Malware payload (Metamorfo)", "value": "063941c87ab4f5eac4989fc314bf9af5e73651b2f604ea6aba580296720ee2de766aee5465f47d897e39ba9b4e2e2944", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137828, "uuid": "0947b2cc-e595-46cf-8eae-dbdc7e293642", "value": "T1E231BE051EEA1329C3B7CF7A50BBA2474A76FC51AE934F5E808497DA2851050EC35E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137828, "uuid": "a3f11ce7-8227-40b5-a24c-1c47031d6d64", "value": "24:8+JUHRlVo5kcbA+Pucu+/P+/Mw41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+mKB1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137828, "uuid": "da4bcf02-dee5-4351-9e93-1624a0dc8200", "value": 1558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137828, "uuid": "bbb88893-9a01-4297-b781-243885cfebb1", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137828, "uuid": "d7130e1a-7745-42bf-b487-9fa0307dbb74", "value": "Anexo - 008131021.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f149969b-2c20-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634128054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634128054, "uuid": "3dceebf1-21db-497f-8db2-f275e5906c32", "comment": "Malware payload (AgentTesla)", "value": "142bc170a3d4f0f08ef8a77eacd94766", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634128054, "uuid": "00b0c3b8-3a5a-4c9f-b607-977312df71ac", "comment": "Malware payload (AgentTesla)", "value": "551c222081882fcb8968d315fd1c74b57572404d9f1a0d15767c4a2ed9ca348e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634128054, "uuid": "6dba3556-af1e-4ca1-a655-ca21b55eba4b", "comment": "Malware payload (AgentTesla)", "value": "687012c964f744f6bf83626bc1d2e372820b6207", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634128054, "uuid": "8eeaefb3-1869-496c-8ffe-58273cac07aa", "comment": "Malware payload (AgentTesla)", "value": "0a7ef5fa1a757d890c8866d05acf872bd37fcd84b7bfdb3812766f45f2766742c32a22d7c6444428c5bff6233321dbaf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634128054, "uuid": "518e4b23-a646-4aed-a198-b0be7dfddfea", "value": "T176C423D9C8A168F19E05FF89B197751414CFBA925EC79B1CC39F848263E903C1B6E6E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634128054, "uuid": "ae5d094f-623b-461c-93e0-49e5d74834bd", "value": "12288:b8EU4EsSEEU4uwIEFO+K/UpvrSNZF4LXjj8c21DvcApFb+IRi:b8z7U4rIEFNdTS/FqXkbvbFbrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634128054, "uuid": "33c894c7-34b0-42bf-bc36-70a4c5871cef", "value": 548618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634128054, "uuid": "e411d9d2-d97e-41f0-ac8f-e326a53d7c8c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634128054, "uuid": "f728877c-8fb9-4999-999a-12c3a3831e79", "value": "Purchase order.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb935fa-2c2c-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634133071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133071, "uuid": "098cee7d-cc1b-4703-9b3d-d65c885aa14d", "comment": "Malware payload (SnakeKeylogger)", "value": "aac2b9c21e1d1dd48035677164b421dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133071, "uuid": "f3396bdc-9fb6-4852-92a1-d26c8fbb9ba0", "comment": "Malware payload (SnakeKeylogger)", "value": "55922cb5afe2b53f46a2c8080747c94d00901d49e93e0ee2ef1fee22f7fda164", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133071, "uuid": "4535d996-4e28-4ad7-978a-f9a1cef293f8", "comment": "Malware payload (SnakeKeylogger)", "value": "f472607429d90c1a4b597e195a712492111d06f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133071, "uuid": "a2ac1003-4e1f-4b6d-91c8-a0a9a0ef0e65", "comment": "Malware payload (SnakeKeylogger)", "value": "9307bb9233ac1cf873aa91c0b77bfe6786c5451b2b0b8071520e314784c30c2ac08437aa1de914e4e7c47d9c8ca442d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133071, "uuid": "783764ed-0b6b-4907-bbc3-77d771d656a3", "value": "T1E494BFA47F95D94EF36A9C781131DF84866D624B2B13C625DDFF507A92ACB903CC2283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133071, "uuid": "020cb58e-4684-47e4-96e8-893056c2e3d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133071, "uuid": "0872752d-886b-4f42-9f3d-60f70ae578ed", "value": "6144:luux2PfPY+G4LCPhlceA0laZPc034SVmBSi4PZzZn7MkhB26YB:JEPunjVQlc64SNiMz6SB2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634133071, "uuid": "ab53a364-f206-4858-8a93-7c41105355f7", "value": 428032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634133071, "uuid": "8e07f3e2-afc1-4a40-bd3d-0a089b4eb80c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133071, "uuid": "9ac1722f-0a94-4e0c-b499-77134987e60f", "value": "REMITTANCE-54324.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff04b9ff-2c07-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634117339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117339, "uuid": "7c472de4-7146-4012-a0e7-731ee83c3b20", "comment": "Malware payload (Mirai)", "value": "baafa97f21069000acde27b86c857cb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117339, "uuid": "26fbc0d2-6922-441d-b824-299b3a76ff57", "comment": "Malware payload (Mirai)", "value": "5595b9e66277d223bdb3c7563cb77f5c89d647e423e16ecd33efe87fb5166818", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117339, "uuid": "f16586aa-7956-4441-bd87-d7686552fba9", "comment": "Malware payload (Mirai)", "value": "f0c61156335945502c3845204537a79f73b0d823", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117339, "uuid": "4c950a51-3b60-42b6-b089-19c92110f254", "comment": "Malware payload (Mirai)", "value": "7d796720ac8c2d2b546f577d19d830c46f1f3a1b11c095bfd03609d3a7aef9874b3e5b4925538833ee6de6f92e6002e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117339, "uuid": "28917b11-d46e-45fc-ace7-710bf89b201a", "value": "T169E2E190237D2507D29B507F95EF0A86D4B1D8C1AF40C32D6AFE97979EA28121FB0E1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117339, "uuid": "fbdd60c5-f0be-4d37-8665-849f3dbb6f75", "value": "768:tsxgthQKpS9XsrUVOh6N2S25EbUMBIlFr5gZUKEWDbJdf:ts2tFq8CGA2S9b3BI5dKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117339, "uuid": "f10833f9-7a93-48f2-a8f9-b3fda031fb77", "value": 32692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117339, "uuid": "1abdea2f-34fc-4819-a201-67a24bf34844", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117339, "uuid": "a451ca5f-763a-4d21-8a21-17f9e16c8172", "value": "baafa97f21069000acde27b86c857cb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c34972-2c4e-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1634147793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147793, "uuid": "92f60459-cdf1-427b-a801-2471ce8ae5b2", "comment": "Malware payload (TrickBot)", "value": "b8939069483b56e8cfe0401041c190d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147793, "uuid": "cd4a6706-6795-40bd-ad93-26743452d168", "comment": "Malware payload (TrickBot)", "value": "567f3596efedff8475d2a21640284f3c12c3053521e9e280ad425f0d5062fc17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147793, "uuid": "6a923964-0df2-42d5-b6b6-7b448ba66b91", "comment": "Malware payload (TrickBot)", "value": "80f312009965c0248fb3846b336d6849fc59a2e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147793, "uuid": "242a9c70-72d0-4c29-afa4-fff4233b9433", "comment": "Malware payload (TrickBot)", "value": "2cc91f706e6aab346cd71ad8bceaadbf08e748753cfa31725a9d1977c9b8ac11578064b9df56669b66160b743b190ae7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147793, "uuid": "cbbdf611-797b-4304-bf40-965db5f13556", "value": "T17E94E102B1E88E76E1630A3D0EE497355EF6FF745B36D59367D17A1F2E320880D252A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147793, "uuid": "b8c43926-67b2-4d42-9072-d72209b63c37", "value": "535fa6479108b5163f64223c5e835312", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147793, "uuid": "1f0add4a-1672-4017-a21c-b1a6888ce653", "value": "12288:C4jg5ZqdXUt7j+6khm14Qwxj+R4QBbfwxkZoLKl/n:Cf5ZqdXUt7j+6mpQwhQyId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634147793, "uuid": "557b8906-9018-4d18-81be-9d3922842292", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634147793, "uuid": "7b747295-12a1-4196-aacf-a411162bf55e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147793, "uuid": "d4c179c5-8790-4e16-b79f-b29707dc2bf8", "value": "b8939069483b56e8cfe0401041c190d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86cc2e40-2c3d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634140330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634140330, "uuid": "9ffebcdf-6d62-4484-b194-f193c0236341", "comment": "Malware payload", "value": "ab083f1294796b947de5390ec853243e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634140330, "uuid": "7cef8af7-65d3-4aae-b9a8-44fdda770d70", "comment": "Malware payload", "value": "56b7e6dd46e38a30ead82790947a425661ad893f54060381c9b76616c27d3b9f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634140330, "uuid": "1e95d345-8513-468f-8f12-6636a622ead9", "comment": "Malware payload", "value": "51c565eb38611491f7c157612cb804f1882fd0b8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634140330, "uuid": "9c381f8e-c2ee-4780-ab59-d490b1e8544c", "comment": "Malware payload", "value": "9453823e81548f396abf6bcf183fc1bbcce264dfd42625bfb3e039ec39fc350a1e6d575f0d220c26e3dcacd26b8b009f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634140330, "uuid": "44ca0f48-27e1-41d7-83d3-ff9ff81374f7", "value": "T196836B0176E1C071E6BE29355470D6B12F3EB921CEE09D6B2B660A3A0F302D1DF35D6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634140330, "uuid": "8ce10bfa-3875-4438-a0f1-d9209c43542d", "value": "b4f294e881202fad9a2db7abc6d16118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634140330, "uuid": "1dee9db7-855c-4b8a-84c4-e4c4609afe13", "value": "1536:whlulxmMnFu8NoST0jBKYSveHKCZMWKp0mlZabhsWc5cdlOU4MSFn/:whl4xmChT0jBjKCZMWM8golL4nn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634140330, "uuid": "c301055e-3580-46e2-8a24-b7f750a6b507", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634140330, "uuid": "f31515d5-6754-49f7-8973-20e2fdaf8425", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634140330, "uuid": "5727c909-b4b3-4f54-88b4-2dc584b32776", "value": "1634069448.6985812.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8735b4d-2c17-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634124120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124120, "uuid": "5f47d676-cd10-4502-8e5a-96ae610e5ffb", "comment": "Malware payload (AgentTesla)", "value": "e24df90a4b415b995665294fb3fa77b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124120, "uuid": "1dfb1723-e219-4a1d-9e07-7c1d4a4efe54", "comment": "Malware payload (AgentTesla)", "value": "56bfecd3fc01ecbad95e54f3a06b659e56b4ae1005e25c1435d2b89837421da8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124120, "uuid": "09f18905-6bb5-4bbe-bb73-1c9a031ec108", "comment": "Malware payload (AgentTesla)", "value": "87fa789bb151a6f1b112efb3d89ccb4e3371027a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124120, "uuid": "fc227351-c1d3-4fa9-8913-c320707c0f92", "comment": "Malware payload (AgentTesla)", "value": "ccc0dd45093ee42609e33e018f1e233f3aba3f030d28bd4d5fe0a2ee392a5abd5efce5963534baa276c0cc1f616e2b3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124120, "uuid": "ec4f997d-641c-4313-b8f2-ecf31fb242c1", "value": "T1BBD41212AF626A96D55C9EF391A3EA70D730DDA0BD61FB440ED47C6733373C804856A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124120, "uuid": "152b8d76-7cef-4a72-83f4-86d2019a0af2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124120, "uuid": "d2cbdc75-2234-4c6e-ba89-17227eb8ffe4", "value": "12288:Oq2Pk5SBi5rH77JYrwE50CWzmIr3c2rdkXXlVdOb0TMRQZljof:x2P/BgH7Kww0UIb5rdsXHcb0TrTjof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634124120, "uuid": "ce2a6738-938c-4749-9372-4704a97e9dcb", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634124120, "uuid": "ba642172-f867-42ae-a82a-e735d23e5acc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124120, "uuid": "b4d07afa-22fd-49ff-84c4-4fbd93aa5c11", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b17036-2c09-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1634117865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117865, "uuid": "5fedffd2-ad3d-4c49-98cb-2569b15d02b5", "comment": "Malware payload (ArkeiStealer)", "value": "4e4b45b951159e3798959fd4cea6eb1f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117865, "uuid": "e6ab9c52-e74a-4c7c-881a-b10bd150fc41", "comment": "Malware payload (ArkeiStealer)", "value": "575d3a4edbf03fc3bead2e44d9f8a65047ff8f7e90d9130eca7a6825bc92fb56", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117865, "uuid": "3cbf992e-ab7c-4751-be2e-d692ae99a007", "comment": "Malware payload (ArkeiStealer)", "value": "7ecd8e3e4eeb55f561b3a5b394fc96871f06f459", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117865, "uuid": "751f1e6e-7a60-48bc-8cfd-9f1de8feeb55", "comment": "Malware payload (ArkeiStealer)", "value": "a98eb5c4b09b6e029f4e88707c4188ab538097db446bc63294c64febc631d1d6606fbccd648ccd1a75e45af1523d9cab", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117865, "uuid": "d7832235-d4c3-497f-9538-2beca0cad2fb", "value": "T1BB558C9C762072DFC86BD472DEA81C68FA5474BB931F5203A02715EDAA4D897DF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117865, "uuid": "20020784-855d-4993-81d2-d0983bf03a1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117865, "uuid": "a5f47718-26d0-4401-9496-9826496cede3", "value": "24576:qzIUqk4qGdsQSOLp8x+0AQSbAxhAtkoic2zUJAiJQsccZ2tkTU/dzO3hOIb9Ta:wKldsQDyj1SbAxhokVi4LkTSdzO3hOIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117865, "uuid": "61c886f1-7524-4705-954d-6cd58434b8d3", "value": 1342464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117865, "uuid": "89411f81-53e3-41c9-ae81-aa0f3fb664c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117865, "uuid": "a1850c82-1614-47c9-af26-68974b8d15cb", "value": "4e4b45b951159e3798959fd4cea6eb1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c8e1b38-2c2c-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634133065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133065, "uuid": "0b4a139b-ae92-4336-a715-8e7d44efeb47", "comment": "Malware payload (SnakeKeylogger)", "value": "543a9db368c33915bcf44b7aa00013cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133065, "uuid": "345c13d1-b06e-475c-a921-3bab04043bef", "comment": "Malware payload (SnakeKeylogger)", "value": "57c6ce03a179c46ceb169eae0d76ee19fe224b36db65139cf5eefa94c35e5ba3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133065, "uuid": "ef26d139-6aed-4de6-ba0d-45ad1084b65d", "comment": "Malware payload (SnakeKeylogger)", "value": "99ef6b338b105e698f8cf0ef12a2d37f331e39d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133065, "uuid": "315bd56e-f21c-4ea5-ab46-f56891eeba49", "comment": "Malware payload (SnakeKeylogger)", "value": "a0d959104158d23b1970cb911cb8d9dc699803c3fe888bd4f7d06f2dd37889f4e56265beb05bec18513a15732972d04c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133065, "uuid": "39c64e6a-1a3b-49ad-858f-b8cad0df029a", "value": "T15AF4F00D3610D360D6B45FB2DB56D8F313236E48E6E3299B6EE77F273AB8A51C106409", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133065, "uuid": "adba4362-12e7-4be3-a63b-77d9cf146c0d", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133065, "uuid": "298a8b76-5eb2-4d52-8d97-2e04cdc2258f", "value": "12288:jJ1FGs+9KgR7BnkPnoGAi8mOZY/a+bm8qrIYKQeuls9:lH+9DR7BkvoPnMa+baUYKQeKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634133065, "uuid": "27b90f37-ae00-41b1-bec8-d7fe347fd8a9", "value": 728200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634133065, "uuid": "13443bbb-9c9d-44ce-a3ee-0fc729c6e7f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133065, "uuid": "e0608807-d2e6-4aee-a03d-70b0af4500d0", "value": "20--09876543456780981234567890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5edc9ea6-2c71-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634162597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162597, "uuid": "f8db508a-efd5-434e-bf66-b16579a135d8", "comment": "Malware payload (Gafgyt)", "value": "148c25fb447ef7bd7f413b55cc96ebf5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162597, "uuid": "89703908-4911-4c0c-b410-f04e39706a9b", "comment": "Malware payload (Gafgyt)", "value": "57c80b21954fae939f84dc3bd7a92930c24d26a4399015cabc8c0602c3e238b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162597, "uuid": "93623115-b753-439c-afbc-0efdd3120d92", "comment": "Malware payload (Gafgyt)", "value": "d7d4475edfeebede8833ea357fc08b8c007117f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162597, "uuid": "f455db9c-9c73-4036-9971-839b2d7da481", "comment": "Malware payload (Gafgyt)", "value": "6cdead0d34cabb8272494975d17fb2f13cb6c13aa6f041592cbc5035a8aea57a765084083ede698373e7e34d603c3d90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162597, "uuid": "791f71e7-a40c-41cb-b18c-e80777fdbc9d", "value": "T11EE34B09F6408B53C0D32776B68F534537239BA5A3DB33069928AFF43FC27A94E22955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162597, "uuid": "2798c46d-19a8-4e7c-b66a-b9d88bb2525a", "value": "3072:tdntU2haO5H1XacBoGmh9H5K5hDiGRvEM/9f9T637m5wTsL/Qpyn:ntVhaO5H1qEc9HQ5hDiGRcM/9l+7m5wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634162597, "uuid": "64d7b287-91ef-4daf-a74f-a98b11a7a27c", "value": 156296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634162597, "uuid": "427333a2-090a-4300-aee5-4fc657b80eb8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162597, "uuid": "529fca27-eb57-4de6-971c-1d1d548ef89d", "value": "148c25fb447ef7bd7f413b55cc96ebf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f3b6af-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634108383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108383, "uuid": "c710cc7f-3309-4e33-b52e-78d5fbc20f24", "comment": "Malware payload (Formbook)", "value": "b924ae846b956ddbb6a3e52dbea4be3c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108383, "uuid": "a65a3ac5-6c59-4ab8-9586-52bfc6d3db2e", "comment": "Malware payload (Formbook)", "value": "58111ffd215e54c4ed7abe72254d39226764c9ea202983d135de7f67420e3fce", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108383, "uuid": "482cc303-eb94-4161-b3ba-d26a90b59a6e", "comment": "Malware payload (Formbook)", "value": "253b7fea1a0e08c5b82d12540af23e1cc6302ae0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108383, "uuid": "7e6f400e-e45a-4c91-a6bd-5369939b5f4d", "comment": "Malware payload (Formbook)", "value": "6d3f2025d8931bd5fa0221d43528a12533eef4fc062d2e7fb86a6e9244732bdd6996e87fad983130853b72962e6d8d57", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108383, "uuid": "28fd9985-5d79-4386-9476-492d8475db4b", "value": "T12B64C062FFECAA0EF972257E1D8BB5008DE67C5501562EC015C63C48BAF29EE1E45D23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108383, "uuid": "ad0aae82-4f2d-4eb9-beff-d1e1bd584177", "value": "6144:OuDWRgMkMSljadk5zbas96uZJ5N7rX/0rX37agpbKOGUw7:TWuw2adk5zba8dJXvsjmgpbnxw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108383, "uuid": "91df7c43-9cd4-442d-9d6e-06e73cb26d8f", "value": 328920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108383, "uuid": "86943bff-a035-44dc-8287-dd0c09ee600c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108383, "uuid": "3766f0dd-a972-4ae0-9fa9-11941a7d3b95", "value": "PO08485.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed110b53-2c66-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634158111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634158111, "uuid": "8ca3d181-53dd-4709-82ee-918505044c2c", "comment": "Malware payload", "value": "4078aa71d541412492dca732e7a4724b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634158111, "uuid": "bec52d83-1df1-4d33-b43c-7270e1ceb933", "comment": "Malware payload", "value": "582c2dda5f1db3872450ce34212515fce0f2201b2d5961d08cdb80556db7c50e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634158111, "uuid": "645f5eee-c0b8-449b-bf9f-b754b43badad", "comment": "Malware payload", "value": "c19adcb3808e32b2244eac8dbd5d3b614b09d378", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634158111, "uuid": "1da64efb-e587-40d9-af8a-56da36a2c5e5", "comment": "Malware payload", "value": "77f9813d0dd4b70fccb04a2a58f10bd62ba8ed224a7804247c54a3efda83883034ca9785dd9822d3f93e1094a3bb4201", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634158111, "uuid": "6f74a3b9-47de-4ca0-a5d2-8a314419a2c9", "value": "T12C43F706374B4722C96C63F140FB152143F1AFEB6273D6D72E8931D91502BA39E4AE9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634158111, "uuid": "827250ad-8ca2-4970-9805-dbc4695e46df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634158111, "uuid": "1e5c7623-8e1e-43b3-8096-85507f3c5ba6", "value": "1536:MenKBmGpvKCiUBin92Ep7kK1tdvtBogH3hk:MeKBmGpvKfUBinpkKndVl3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634158111, "uuid": "8b09c6d2-0e57-4e6f-817d-7e4c07a03d0d", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634158111, "uuid": "f156df51-4928-4ff8-b9cd-0d00907cacb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634158111, "uuid": "611eae05-3b14-431e-9733-92139d866e38", "value": "4078aa71d541412492dca732e7a4724b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "297dff80-2c08-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1634117410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117410, "uuid": "54ec6a99-26a1-4e43-b0bb-eb0cc017e72e", "comment": "Malware payload (TrickBot)", "value": "248e481c88ebc02dcd6879f09f117384", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117410, "uuid": "e12ae086-0ac1-4a2f-9be4-f6d249e1520d", "comment": "Malware payload (TrickBot)", "value": "5925ecddcc4b4ea9017aad9abe70dfc47bb6aa63bd01a84536a8cd3cc039d781", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117410, "uuid": "360bfea9-3038-4ac9-aa50-7ec698b58c77", "comment": "Malware payload (TrickBot)", "value": "a2ee2742e6d68aabb042db14d752bb52bb494f37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117410, "uuid": "28bb2360-c3a5-4240-b522-8f71b999dbe0", "comment": "Malware payload (TrickBot)", "value": "1eb5d1fb5966f4a0ae14ad1b51121a018acf094071942c95fa1ce7ca74f25132d9eebc2af400e9e6a7301936668b8c0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117410, "uuid": "5bdc2887-5e1c-47c8-bf80-7dbab021ba60", "value": "T18BC4BF273850DCF2D1012576C9A2A3F5AFAC7A185FD3511BB3901B9ED9318A39E305EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117410, "uuid": "9cbf8db6-6549-4a5b-8983-50e6b2c1a803", "value": "ffc20f0bbd3f72a6061b1c2845bbf7b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117410, "uuid": "dc44618e-0b5e-4c15-a78c-c352d4c1482c", "value": "6144:lJsQ8zcWR976/rrs+zmrY6v9w25rcv4hUhYjSUkPp5DIbT6oweUis:bvOR976Da5lZAv6hjA/cMVis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117410, "uuid": "6f454dc2-e0df-4f92-84fa-669fd95e0c62", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117410, "uuid": "d1902a95-09f7-426b-9968-467f2a8463ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117410, "uuid": "d744e718-b784-4291-9011-7a73b51d865e", "value": "248e481c88ebc02dcd6879f09f117384.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229e2086-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634108379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108379, "uuid": "be84bc2e-2423-4f3c-8a92-a67fed795d11", "comment": "Malware payload (Loki)", "value": "b5ce198aadbc571b59320453f1307e6e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108379, "uuid": "f4f487d4-8f2d-41bc-8446-9e9ee050808e", "comment": "Malware payload (Loki)", "value": "59365d6f6ac64815147cf32f96babc5a6ff402ad0385564c1ea4e2703c8db788", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108379, "uuid": "59d29d2e-c631-407c-a5b0-48a192f4835d", "comment": "Malware payload (Loki)", "value": "75c27e8914dac1d3a108e6057c303039621e0df6", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108379, "uuid": "474c8ec6-e048-46fe-a682-5a9d94e08e88", "comment": "Malware payload (Loki)", "value": "5c2039a792087f5859ff61d5d524eaf149605f84449f1c3669a42bfb54f1d39bef9b2137d1e64630f604095b3ef97410", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108379, "uuid": "819f5d1e-1c3c-4709-af50-0cfe765a5f04", "value": "T14764C19E7F4047A5C7B314B8EAC2B371EE4EBC522AA968123CBDF14C16727507894C9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108379, "uuid": "a9ef9b0d-10ab-40ea-8e6a-a70a21fa10dd", "value": "6144:hrZ7oESX/adoQlXDLlji7iKojoMcs0NU5afIoC82zQVK2J:/kyaQlXDLEfeb10a5agX5zQxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108379, "uuid": "41f23aaf-ad06-442e-b3f4-d76cd10a4a68", "value": 329192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108379, "uuid": "81ac7ef5-401a-4dc9-813a-b0fbb01fea3a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108379, "uuid": "5dc2e122-d381-4e06-96bd-8a7b72b2274b", "value": "Contract.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96dd961a-2bf4-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634109004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109004, "uuid": "78face86-1740-4ff4-9ad0-6dccb9a3f82b", "comment": "Malware payload (Loki)", "value": "d6b4bb4540d22a6973893d580b4b7ca7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109004, "uuid": "7d2187d3-dcce-4a29-a277-779754b50513", "comment": "Malware payload (Loki)", "value": "599464ea222d3dcfb52b46f2c59c87c68c0ffd81f22f1cf5f1c9b0c4ae2ea22a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109004, "uuid": "f395ba6a-3029-4349-8e05-006d6f544fda", "comment": "Malware payload (Loki)", "value": "e2e6d170ebc41387732b3febf2302d31daf07189", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109004, "uuid": "ef2b349c-b66a-433b-a1e6-d46994eb1e68", "comment": "Malware payload (Loki)", "value": "642f37df2736a9f9400731d8eb550d275478cf2fd3afc34d4fd5168d48f12141ed92739cbf24de778b511f1a40e07bc7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109004, "uuid": "b9dd5c24-07ac-4556-ba0d-021114523613", "value": "T11ED42393B1D4DF9BE41B66391CC3D09C7E08EC8CAEADD10B3A55BB5B4EB97358102819", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109004, "uuid": "a38f4b22-fc30-4c7c-bea3-3ff4be8bdd09", "value": "12288:MbqTtukI4DLk+N76BI7G+eDYYQgc6gID6ijVAm5vbZ82NHKLtO2:cmukI6Y+N7uDgl6gI9VAm5vzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634109004, "uuid": "1502fc53-3d7f-4329-bcd6-cbadd7b34c89", "value": 644096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634109004, "uuid": "e715b285-361c-4766-9f74-c00f89615e71", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109004, "uuid": "0d65f773-b62e-4308-9694-8504875f918a", "value": "IMG_11502772017866.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1fd0369-2bf2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634108190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108190, "uuid": "a7b8d0a3-ce23-4e36-99dd-13273dba6153", "comment": "Malware payload", "value": "46320f3fbdddca05782a1913983d9be7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108190, "uuid": "49a40f9f-6f30-40e3-9767-7de7887d0fbc", "comment": "Malware payload", "value": "59ef989b195f3041a91a837de312ff31972dd6fae649c054a5bdfbd63e60494d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108190, "uuid": "583ce3ca-5a69-4abb-8cfa-c7d2030d4d3b", "comment": "Malware payload", "value": "db21642e77d20508ef68e90dbfbba1ed7518688e", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108190, "uuid": "7c54b267-eb40-430e-a757-e61f8e332d91", "comment": "Malware payload", "value": "558df89b86ae5e20a8d88d4efa5e8b38b239e30fdc2077db9715bd87fc288137dce412edacfbf742e8be6434a0d3ab40", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108190, "uuid": "51acf70e-6d1c-4261-a6a7-c34eaaccdbc8", "value": "T15F958D23F2A24837D0772B388D5B6768AD39BE106E38684F3BE41C4C5F756807D652A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108190, "uuid": "fb2dfaff-3bac-45b9-9c53-83ca73cd5d1d", "value": "24576:9HQD/BvYgwqPSW5ATiBmoXN+kXCj8WOeEaElzw4ooc90I6lAZKO4jNTpaCdETU+F:9HgpvJSmKEaElzwps7lF6TPjOYLEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108190, "uuid": "97559f51-faa3-41e3-83c5-2d5f15d0b32d", "value": 1886720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108190, "uuid": "59e0f66e-31dd-4727-b7c5-90780e644c79", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108190, "uuid": "81807d39-1901-4d13-8ff7-c6684003af4c", "value": "fatura - tqebhzcyowihagcyljcd.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3e2ac0-2c36-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634137521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137521, "uuid": "664c8cfd-83a3-49fe-b27a-93aace7931b2", "comment": "Malware payload (Loki)", "value": "4cecd51e58a6005d68a799c925091f4c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137521, "uuid": "348b05f4-385c-4315-8b97-c3b8f2a1dc5c", "comment": "Malware payload (Loki)", "value": "5a00c69b3acbacaa3837bdd2f30ac534eb872da62d8a325007277793e1fbaeee", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137521, "uuid": "7efaf028-dfe8-4d4a-b5be-be61658ce516", "comment": "Malware payload (Loki)", "value": "1794fc32a83497e5de3c0fb7ee93c1384d534400", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137521, "uuid": "4810fc1a-55a1-4a13-8b18-f56529d09c9a", "comment": "Malware payload (Loki)", "value": "13a458d5005500b92aa61a23eea53a22f472a324e1db8dd56e172e9803939329ccadf3ba97f9034828ca1a535b6262f5", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137521, "uuid": "9ce7cfc1-0d77-445b-85ff-a01b80f2d952", "value": "T1EB849EA47F99DD4EF36A98781131DF44CB7D664A3B13C629DDBE107A939878038C2287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137521, "uuid": "3877b02a-6e4d-41ba-b3cd-d4319f9e30c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137521, "uuid": "7471ba0a-fed0-49fc-b655-3bce73087f98", "value": "6144:DWEKlq0ZYTXxYvt8JWJsdxHprci5MkhBT6YB:DWEKY0ZYTUJsd7mSBTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137521, "uuid": "caca5b52-05e0-4485-9d31-d34f1833d159", "value": 395776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137521, "uuid": "9284fc38-0bf3-4dea-bb51-36b01d0be325", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137521, "uuid": "2e16ff41-8c4a-406a-8f32-547432eb36ca", "value": "DHL VN DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10dfbb7c-2bdd-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634098901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634098901, "uuid": "f8df24c1-e73e-4a8b-820d-86fdf49c9095", "comment": "Malware payload (GuLoader)", "value": "88a1597fed610168d8f9262e7fd7ac0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634098901, "uuid": "4575421a-b349-49ad-91dc-54505e9111df", "comment": "Malware payload (GuLoader)", "value": "5aac8ffc5b47783f1e3390e977698fefe72aad1545833d8b9524c0467706f72e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634098901, "uuid": "8a6e7409-3f74-4191-adfc-3e21cbe7863b", "comment": "Malware payload (GuLoader)", "value": "1b0ba07182cddd329e923de078156f01766b28aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634098901, "uuid": "d3fc082e-b251-4ecf-abb7-13d71be16ea8", "comment": "Malware payload (GuLoader)", "value": "e1844cc2cdb72b6bd94aaa797005a755c761b8110f82abe664d0e4781a350e257f4f811aaa931f03a5bee214edc8e15e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634098901, "uuid": "131984cb-dc24-473c-ba15-145cd12c1ae3", "value": "T15AD3B501E2DEDD55DA56817D4C438357BFAA7E425CC3281B3A2E16C83FEA82172857CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634098901, "uuid": "4b11ab0f-39d6-4627-b8bb-3d4d8af243bd", "value": "0a8e5f9658f839d07c08aa4f38837bac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634098901, "uuid": "e32988ca-193e-4047-a81b-f9307b2b41c0", "value": "3072:iR/BHGaXqggRUwWE7hOdnXhWZ2QLqw9mh7ObETDuvTuqZccm+Fp/rFwYUniR6eqY:E/ZgRULmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634098901, "uuid": "46794bb2-da3f-4d98-9a89-7db8e37c5ce6", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634098901, "uuid": "a7241557-d9d0-4b10-be17-4010a58da197", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634098901, "uuid": "6bb9a4b5-f525-43ec-97cf-01a146581069", "value": "DOC 10132021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40200938-2c08-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1634117448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117448, "uuid": "81db7d02-fe1f-47d0-a636-876fe1cb7af8", "comment": "Malware payload (DanaBot)", "value": "74bd1c1cf67e38be20997ce3936d24e0", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117448, "uuid": "e0c08e95-6532-40e8-a447-f1332cb58bae", "comment": "Malware payload (DanaBot)", "value": "5ad9430fa6ba804f26f8c23bc0bac10cb23969ad7e9b521f9ec2000f9477e327", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117448, "uuid": "80e4a391-daa4-43c1-ae2b-3969a5a2ab5d", "comment": "Malware payload (DanaBot)", "value": "992594b1731b93ababbe278a460fe36f3ad42c99", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117448, "uuid": "9ac24797-9dfe-4177-8e08-905990255ef7", "comment": "Malware payload (DanaBot)", "value": "1f08cdad12d22d8a7cfd0f9bf5b8bb310ef64ef0a8b4736c81a7e723dfadec7d4fcd6d687bc9a42315120a86ef26e16a", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117448, "uuid": "133823a6-5a43-459b-8a02-a83fe300f7f8", "value": "T126451200A791D034F5F762F45A799268BA3E7AA1AB3490CF63D026ED4735AE1EC31713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117448, "uuid": "93577a0c-c1f1-47da-803c-bad4887ada4a", "value": "4b52e566ef5b8727d87906b4623fc7d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117448, "uuid": "84e7a3db-debc-4b23-8c6f-08918c0ed2cf", "value": "24576:qRXrIU2kDlBW17rAlK0YWc8qptHN8lboBXTbwPcOCxt:qxrIU2kKAlPY74Abw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117448, "uuid": "f9b42b45-66c5-4b5f-8c2a-439caa82093c", "value": 1228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117448, "uuid": "3a933941-01c3-4270-b352-3b6ba7f0e2b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117448, "uuid": "40da83d4-ef36-4dbd-a028-1392dc123671", "value": "74bd1c1cf67e38be20997ce3936d24e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c358b16d-2c5e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634154605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154605, "uuid": "749f40b4-c0cd-4114-8060-f22e15757f44", "comment": "Malware payload (Mirai)", "value": "2a5f82f931482216077d12c33bc14b45", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154605, "uuid": "245b675a-ef68-4355-98e8-1193643a01f2", "comment": "Malware payload (Mirai)", "value": "5bd1e85f8248f43c0660fce2f8810da11f7d2d6a88cb7b4e947a358853158fed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154605, "uuid": "8cdc6523-5180-4b8b-a166-8734dcdfce7f", "comment": "Malware payload (Mirai)", "value": "623ad2fcba5c3f48f4e229a60233a9306372ad37", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154605, "uuid": "138c8676-4ab1-486b-9cac-91a7f3ce8ae8", "comment": "Malware payload (Mirai)", "value": "4a4649f3f854672a5afb877536cbcd9a4d61b68f508978f7f302f328becee6b67bb457f69eae276b524970da7c8e4e07", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634154605, "uuid": "5c5d5022-8bc6-431e-af90-788019a766b6", "value": "T1FC330170425E78E78DB03E73E9BC2E45448B125C659A7332586287A9BBC04F63CD35EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634154605, "uuid": "9c6afe3d-0088-4ab9-83b2-cc0c25fe495b", "value": "768:9B7G4FpPWC83eOz1D/Gg8ulL4AXNYsl9q3UELuvpLgKxL68oN5T8RpFDDuLA:9zFp383eNg8CMyD4LcLzL68+TEFHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634154605, "uuid": "3b5bc966-0f8d-41e7-9665-6b8a220cf740", "value": 53636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634154605, "uuid": "70ed979f-06ac-438a-8f46-d5eb0fb16a5e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634154605, "uuid": "b5adb571-2c11-4620-910d-cb456b6b1a33", "value": "Tsunami.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd5c6b3-2c07-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634117341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117341, "uuid": "436b8668-858a-4d47-9abb-5ad9463fd4b4", "comment": "Malware payload (RedLineStealer)", "value": "a90a9d5cd8940dbb782292a2206a2ba6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117341, "uuid": "3edee830-b9db-43e6-b35b-835a2953323a", "comment": "Malware payload (RedLineStealer)", "value": "5c4ed9fd9a7d3408b9a7d39b5c14ac9ca1ea516026f3ad2a5ace2dffc92cf220", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117341, "uuid": "e9c6af01-4e7b-46d2-a94e-495e791e6080", "comment": "Malware payload (RedLineStealer)", "value": "c6d769a3abb053dd1d86b8f6017682de785a4a30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117341, "uuid": "5957bc99-eae9-4dd1-8e5e-c176d17cacb6", "comment": "Malware payload (RedLineStealer)", "value": "981004dad847354698e2cc3b079c766b2e040d8727396e9694ae049c499e0f2d250a2ebee3dbfa708f4da1a5e9591dbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117341, "uuid": "03bec6df-87f2-44fc-a0f9-777a315829e1", "value": "T15684E021B298E7B1C89719B0CC25CAF54DFFBC41552490CBB76A3E6F2EB13809A39355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117341, "uuid": "7df3f073-b6fd-4d03-a87c-9e8bb47fad20", "value": "1c763ac38c11e291bf3530d542ce2870", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117341, "uuid": "788185c4-5e5f-45dd-8478-53974b5a0bf6", "value": "6144:xWScCWt4rA/QQTZJ2YQGTeFRWBRlyigVo+6SwVx98aC3JWrE:oScR5TP2YQOeFIwVo+iH8nc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117341, "uuid": "8ca93bfa-4ab1-4bc8-920d-6c600c413191", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117341, "uuid": "64894835-aec1-487e-ad31-57b2cd177510", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117341, "uuid": "15f61343-a6f8-4ed8-8f3e-b5aac45728e8", "value": "a90a9d5cd8940dbb782292a2206a2ba6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d7a923-2c1c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634126290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634126290, "uuid": "57e097d0-6344-4056-9a71-52b7811c1c00", "comment": "Malware payload", "value": "dd6aac67abb0fdb3b36e1cce880290e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634126290, "uuid": "63500b22-4d1d-4084-8add-e1893157397e", "comment": "Malware payload", "value": "5c686c375d2b6ac09d7b11bb7ac4a7110ad29730a36f237f63a6d540ee187ffe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634126290, "uuid": "b8cc4679-f59a-41f1-9685-6d13ffbd852e", "comment": "Malware payload", "value": "d9c5007c4ff6f1fc85234cde268f7e1d21853407", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634126290, "uuid": "f3f21998-8656-4f35-b8d1-07f8aeb0ef7b", "comment": "Malware payload", "value": "eec51454cfe5efb7a47ef6c86a00520215633cfa5b9f379b0ae6f1547ff3a6090debd5af3d0411a4bdc9d6a0e3090f95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634126290, "uuid": "9bfc4d0b-13cb-44cd-bfae-e72741344f7f", "value": "T1A1E22AC7F2B13171EE3C8931D6D3A8424F6DDC268D632A7E55D46F37B893029858AB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634126290, "uuid": "2a1552e7-5056-4787-9ed3-6274a41fdb9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634126290, "uuid": "49dc7a0a-229f-4f11-85ce-4c600ef71d7c", "value": "384:p/efmBJUtbOIesPiHNipPsvkQCG3O3qLv8GjL22Nf2Vk1Uu+lPFh:pWusqHRFCoO3qLv8QRfqk1Ur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634126290, "uuid": "a835eb77-e26b-4915-85da-e4d225905d8e", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634126290, "uuid": "039c5703-2780-4730-8af2-6b1a15a57759", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634126290, "uuid": "b218f33a-0727-448d-831e-e9d114bddaa6", "value": "dd6aac67abb0fdb3b36e1cce880290e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125ab0ed-2be5-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634102339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634102339, "uuid": "a6c0b6ce-bf31-48e5-ac0a-52fd1b335711", "comment": "Malware payload (Smoke Loader)", "value": "3a7ac1ac60baac512bf45e412aacb90c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634102339, "uuid": "a0a9bb8a-031b-4e37-b8fd-a97f299efa87", "comment": "Malware payload (Smoke Loader)", "value": "5c88ec7f348d5b457a2f155bbd9b0353c1cb840e0e971013c0ebc58aaee3b715", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634102339, "uuid": "6173201e-d535-496b-b1c0-597eb9199867", "comment": "Malware payload (Smoke Loader)", "value": "d579493a2190a8f6f44a9094148a494c5368cdc7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634102339, "uuid": "cd172df2-4a2d-4336-894b-50a818ff71f3", "comment": "Malware payload (Smoke Loader)", "value": "c527e0704a3b822a658ab074640b6b5989bff785d8f88b69949a00a8c70d86443bd17d2896edea138f9c3dc8f35466c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634102339, "uuid": "811e402a-f751-466f-a427-439c4ab18d3f", "value": "T195647D00A7E0C038F5F312F959BA9369B93E7AA1AB2590CF53C516ED8674AD1EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634102339, "uuid": "709331c0-4425-488e-8f81-6f3ba2828648", "value": "362b424337999aee119a9c1dea92a737", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634102339, "uuid": "136b125c-24de-4e6b-ac43-3c2c758ba0a5", "value": "6144:mLVf3fw4e0wZ4EJjz9QkLOfIf/Hp9hLVxCygVM:4IjZZ4IH9QkOfIfPhJxC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634102339, "uuid": "2e92e13e-1bce-42ae-bec6-7d67e254bd17", "value": 318464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634102339, "uuid": "1987e7f7-0aa9-427c-bc2e-fbe056936ffa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634102339, "uuid": "d63681c6-7f5f-483e-bb75-8199d12fa223", "value": "3a7ac1ac60baac512bf45e412aacb90c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0aeb0d-2c13-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634122275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634122275, "uuid": "aaf310f3-7275-41e8-81b3-dbe75756c32c", "comment": "Malware payload (AgentTesla)", "value": "8e6d87a522a8dc2160c6054675e53f89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634122275, "uuid": "52676b94-6ed4-47f9-bbad-ad0a2cf1564c", "comment": "Malware payload (AgentTesla)", "value": "5d0f0d5ed35d172e1195625659d50b791392474ec89cb8ce1f44b6a4a2baa5ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634122275, "uuid": "b05d763a-e7b2-423d-ab6e-487ac02884ca", "comment": "Malware payload (AgentTesla)", "value": "18db9326b7f2635601c466eceb05eedb994a0e39", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634122275, "uuid": "74170c54-df97-465e-8c49-9e3d34b13f41", "comment": "Malware payload (AgentTesla)", "value": "4107ce47bd08707e21289eb9676127f33c0182fbb7414fcdd993978240ed1a3e470e8cc169415fe7f910b50db3e1d982", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634122275, "uuid": "736bf622-380a-492d-81c6-6e561de59417", "value": "T1C0E47315F3929C11E567167364E051E391092CC7E898833DEBB7BAA318EA3805F5CBDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634122275, "uuid": "7bbfecc0-6341-4a7d-882a-d7c69cd9889d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634122275, "uuid": "f85af9d1-8ed2-4dbe-b8d1-36b818683e33", "value": "12288:pbqrMIo0L7QuJczfznrNVI7XK7lI5TxySDIU:pbqrMG7VJcrNVQ8FS8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634122275, "uuid": "0fefd667-99d3-4559-bc31-2039bf4e1f1a", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634122275, "uuid": "29fb9421-194a-4364-8051-5a02f63b98fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634122275, "uuid": "9c0c50d6-41ab-47f2-908b-b8e8ace64ce9", "value": "E-Remittance Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374751a9-2c66-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634157806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157806, "uuid": "9b342114-162a-4cd4-956c-c5a0cedaa48b", "comment": "Malware payload (Mirai)", "value": "a2c317dc86bfdcbba56609c5aa4bedb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157806, "uuid": "ffc8bdcb-0f7b-4e45-bce3-25d68babda54", "comment": "Malware payload (Mirai)", "value": "5ddbbeaa013240feb7d819be41104113656ab6062bccdde2bae19248d592f81b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157806, "uuid": "3e72b0e6-9ba0-4f1c-bc1d-4eb9e4ebf602", "comment": "Malware payload (Mirai)", "value": "9def24445f404648843845bdf4ab4aa20b23eda5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157806, "uuid": "08b94160-4184-4dcc-a197-1fbfa6f870b3", "comment": "Malware payload (Mirai)", "value": "67173bd6fe42088e230d99a1386e8d46f14be12e85407f460a5001611b2df9a405de9b14771844419cc22f1aa7429323", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157806, "uuid": "940d5c7e-800c-4022-930d-a80b1b134907", "value": "T17CE2E15CA3D9E452CEAD1C7485EE21718917DB6AE39A47C863300CC87B65C4BB60C2FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157806, "uuid": "5dab5e59-c720-4613-9594-a2075c32311b", "value": "768:5St4XCbjUTS6H8dV4J4YP+aqLvHtGkiWq:5SSWjX6WA9grHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634157806, "uuid": "c9ca6997-af3a-43fb-a7fb-1fd35ab216f9", "value": 31688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634157806, "uuid": "7ae3d594-6a4f-467c-94fc-e274fca13cf3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157806, "uuid": "1ca5fd5d-b652-4c73-bcb5-0c3a4e2ba999", "value": "a2c317dc86bfdcbba56609c5aa4bedb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f7b85d-2be8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634103686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634103686, "uuid": "be5d93fa-72a0-4689-b010-d595047b067c", "comment": "Malware payload", "value": "0515fae3ffb232b85b1ed643079f41bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634103686, "uuid": "f784875a-8620-4632-906c-ab964228b218", "comment": "Malware payload", "value": "5e7c522813d84acc0a54adf9fecb54b95cd786a6014cc54fa03d173d98192e64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634103686, "uuid": "94243a9e-035f-42dc-930c-d0d9f22b87f0", "comment": "Malware payload", "value": "62e81e26deaf7da2177bf484185a3c2c4acc37e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634103686, "uuid": "30b5a2c7-9494-4653-92a1-6b18fdb2c5a6", "comment": "Malware payload", "value": "8aa33b009cd77822c78cb88fcc6fff19de17fdaddaa1df2fbe84230d0ba9e4bcb808f67a547193f4e3a04f3420cc8897", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634103686, "uuid": "27a2e5b1-c0f4-4e6a-a6a1-75ad03706b85", "value": "T171B533BF81C11D1ACCE10E3AA992D8C71A873E5FA46A38CD66BFCF5C24DB5D41544A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634103686, "uuid": "b802ff5b-06bc-4bce-92cf-f4878a08d6b8", "value": "08ce2bb5c289c22487015109b09aeba3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634103686, "uuid": "5ebfaba0-20cc-4a1b-ac88-838d28f538f1", "value": "49152:9YPAAdRxnjgxy8IQcJoutDiwWY+XAymZrxsfMCi1fykS+BbqifpBwz:5kxnClADKYzdZ+fdi1akS+BZ/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634103686, "uuid": "7099f29f-4efd-42e8-aa87-e13417e4f774", "value": 2469888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634103686, "uuid": "0385b287-8e05-4ff8-853c-c009255dac3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634103686, "uuid": "90509d70-a8d6-47a6-b2ae-c94712b7aaae", "value": "0515fae3ffb232b85b1ed643079f41bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00685b4a-2be4-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634101880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634101880, "uuid": "221fd73b-d813-4ff5-a5b2-e7cd25066a0e", "comment": "Malware payload (RemcosRAT)", "value": "69592a4c05dc07e07f02c33be7dcb545", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634101880, "uuid": "1bb39860-49ad-486b-b77b-a561c0f01619", "comment": "Malware payload (RemcosRAT)", "value": "5edc3743e963c60dd0fbc8c89063bf0e622fd7237b07cc52fe9a04772c85fd8f", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634101880, "uuid": "af3b1ac4-c954-4c1f-a1ad-e55fffdd12d2", "comment": "Malware payload (RemcosRAT)", "value": "cda62bdb0788a441bafc6614f76915d99d72c7a2", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634101880, "uuid": "630abe33-a45a-46df-8f01-bc1c612c7007", "comment": "Malware payload (RemcosRAT)", "value": "512e7b93c3030aef2e4a2410f8a34d84de94b39d336b066f2c1aafb4468c910bfe81775bf8ff3668b1c73aed609737c2", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634101880, "uuid": "28561528-4097-45ff-b2c0-7f3bd1ef8a65", "value": "T1A875AF06A7E2843BD4332A38AD2F429B5A31BD0015386D856BF81D4DDF3CB857A691F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634101880, "uuid": "5401112c-5b28-46fd-91d2-cee7c1c99944", "value": "12288:7p+vmyY9beSkj77NADGFvGq+EOvLkOUvIVPJvC+0yRK2urqoXkXsdr64lprmi:7MO3g13Wih+kOzPJp/FogKrRpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634101880, "uuid": "5b383564-bc13-4a5a-aff0-d5d6b78c3a81", "value": 1572864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634101880, "uuid": "18875a6f-d6c0-4484-be6c-b387c50a6ab2", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634101880, "uuid": "49ef8ff6-d251-4538-8e26-b898fb02a071", "value": "Enclosed file.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4824e2ce-2c27-11ec-843c-42010a9c0014", "comment": "Malware payload (Cerberus)", "timestamp": 1634130776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130776, "uuid": "2ba2e2bb-14f0-4ba5-b448-157978e0966c", "comment": "Malware payload (Cerberus)", "value": "c355069aa66854eedfe1ceb5c835afc8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130776, "uuid": "7b9a73c4-5f35-4c20-8d06-bf0cf9a39eff", "comment": "Malware payload (Cerberus)", "value": "5fe4ab4e8f4c83190d48c2f04828b54c2a69c793999c9232594450d21771a5cd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130776, "uuid": "d0b8bb05-90e3-41d1-9435-f566573777e7", "comment": "Malware payload (Cerberus)", "value": "1c92c43eb06250a3d22e36822ece3f937cbcde65", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130776, "uuid": "18639771-9f1f-46a8-ad34-3ecc72f2c2b0", "comment": "Malware payload (Cerberus)", "value": "f381089eb4c328a6a9472c546b5192bd85595bbdf6dd393142b00f70942fe29ee5c99d201544799d06e21943115574db", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130776, "uuid": "532ade38-c20c-4c38-9930-d0359dd794b2", "value": "T1D1C512D946815EB9C1B94D30A343B4F279356B00E7B5E57B4CA1B8307FA7E20A648EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130776, "uuid": "fcad1962-9266-42a3-954f-95ea8057dcc7", "value": "49152:VaqQs8YjVKs+BFFcfLa3viDyrrlGlJyde7s/YWztLU8tqhHysrZMOdCy:rQZeKswELafiG3IlJyde7CXLpW/ZMOcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634130776, "uuid": "eb00d44a-a186-478c-9df3-b83eb4cb0598", "value": 2680360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634130776, "uuid": "a992470d-0b69-4ac3-8dca-1557c6f3f626", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130776, "uuid": "11d1bc82-4768-441a-8207-22a04cd6f71f", "value": "video player build_obf.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e653d9-2c30-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634134693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134693, "uuid": "b86656df-3e32-4e30-ab50-fcb770b8abae", "comment": "Malware payload (GuLoader)", "value": "ad0acd6357140bc9830283e198be84a0", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134693, "uuid": "65e82aae-fa0d-4b52-88a9-d6e52364c943", "comment": "Malware payload (GuLoader)", "value": "604aa44e93bb1fa423997df155cb941c5163723e1075182c80b4b9a5e5b4a768", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134693, "uuid": "27f3ddf9-44c5-4350-9c81-95308900fb71", "comment": "Malware payload (GuLoader)", "value": "936adef06a76fe84a9b9a285764e9b8ad2b19b12", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134693, "uuid": "edf72b85-b3ee-4ba4-a4b3-7d61ca58d2b0", "comment": "Malware payload (GuLoader)", "value": "3590d2161f114035a5fb8e0b4f4528194766849688ed59d9a24b8bc7ab122e40c342c94b9506124b292bc3a76981f1ec", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134693, "uuid": "ee64c17a-a725-4bba-959f-f2f74dbad19d", "value": "T16C5302A49EE95CB1697D00FA6DFB84557602F2C1624DAC7B3D9B38831C2D32CC49E476", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134693, "uuid": "475d97fe-d33a-40e4-a5af-bd173ba4172b", "value": "1536:be5agoj8fHY47NXB8CF2eRKjUywTubUynes:bqoA4+NXB8C9GUy9Pes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634134693, "uuid": "4dd94080-ce45-45c9-b9de-14f21cbe695f", "value": 64783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634134693, "uuid": "cfd0c193-7921-45ab-8d96-70e44e06a8fb", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134693, "uuid": "71bebff3-da66-409b-8641-1bad5bb021da", "value": "DOC 13102021.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022d9f8a-2c3c-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634139678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139678, "uuid": "fb1377c9-3601-4bc5-8c30-4a24ac73042f", "comment": "Malware payload (Quakbot)", "value": "9be188ae25897326093bac560a28547f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139678, "uuid": "df7bb152-eabd-4944-8ca3-865268d63c6e", "comment": "Malware payload (Quakbot)", "value": "60dec66650791888553dddee48fdd6a894e977e117947ae3e71367e5d44f1fa2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139678, "uuid": "577983a4-a2e4-4cab-b830-331341d60b6d", "comment": "Malware payload (Quakbot)", "value": "f8c004df37c37864e7f48d7c44a651d96ce19a5a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139678, "uuid": "8f6587ef-4a5d-469a-be25-036ed22dbb40", "comment": "Malware payload (Quakbot)", "value": "92a7c1806be6bece68c02d7692ddff51333b4a0c6b3a7f9a53fb447c16688f524ae71ad90847f18d224cdc9e93f54299", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139678, "uuid": "56778c76-e9b5-4b02-a74b-e8dc9e3888ba", "value": "T1AFC409A5AD0D8C73FDD42A3052836E082E1B7FD2B17C318F356BF6146D6BB94A891E14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139678, "uuid": "664031ea-a8af-40e4-9f2d-e10dcba039da", "value": "9a30e75c82eff20dfe0e0897d34cb07c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139678, "uuid": "98fb17bb-d573-4778-afde-6cfe3ba0e65d", "value": "6144:VJVAfqX+2Rr+nxQDBO03fHEera3bpt5eHP:VvAfLfaEkAz50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634139678, "uuid": "2d8d75ff-ab0a-4886-90a5-395b8a8bba6b", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634139678, "uuid": "7791ee33-8721-4411-b85c-bfcf751a082e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139678, "uuid": "f48cfbdc-9901-4a5d-884e-7d7c606ae388", "value": "9be188ae25897326093bac560a28547f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eeefb37-2c17-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1634123835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634123835, "uuid": "0020a60c-9e6f-4746-96fc-1e936fc1bb98", "comment": "Malware payload (AveMariaRAT)", "value": "65198338f06eed3c69ea9dd3f0dd78d8", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634123835, "uuid": "2eed9b5a-8d56-4926-90ef-86e0b8b0cc06", "comment": "Malware payload (AveMariaRAT)", "value": "61bf05f0d9de8ef9871d7b7f7fb4a75c3889d6d3c046a9fefce08e1883764e5a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634123835, "uuid": "9f6d1568-d9cc-417b-be2c-638f15822434", "comment": "Malware payload (AveMariaRAT)", "value": "cd98a5af03018bf65b2e0709a1829c624caf8c80", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634123835, "uuid": "a9474d09-514b-4c19-a852-b1d3b48496b0", "comment": "Malware payload (AveMariaRAT)", "value": "efa552ef09da0d890201c8caaa04ee3b5a43d038665f2f428210fec7e3b54c1ecbf1ecde1df6837d22bd924e93f7f1d3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634123835, "uuid": "6f47cdc4-ad8c-471b-9de6-abe5c0cce970", "value": "T1C8D46315F3929C11E567567364E051E391092CC3E858833DEBB7BAA318EA3805F5CBEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634123835, "uuid": "a70f1d3b-3b15-48dd-a5e8-d808937e28b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634123835, "uuid": "5b48adc4-a607-45c2-ac19-86a4472a7782", "value": "6144:4m9no3tm+13p/z8NkxKMnI7XJyE7P16maGvhNxGbjw38E6Uq:4mloDTznxKMgXJyExnhNxGHwsFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634123835, "uuid": "541e1ac9-2cef-423c-8ead-5691d827a941", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634123835, "uuid": "3eccf731-6614-4958-a5d7-1e9587221825", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634123835, "uuid": "584b1f0e-95a8-4f22-8ed9-5ca4f903ce3b", "value": "ORDER CONFIRMATION.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2828938f-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634108389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108389, "uuid": "d334e577-e0f8-4be2-8159-512a7fa45dda", "comment": "Malware payload (NanoCore)", "value": "cf9700bcf6687a0f9bc3b205b43b40ba", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108389, "uuid": "e554d8b1-32f1-4a2b-ac39-fd90c4f13a8e", "comment": "Malware payload (NanoCore)", "value": "61c38201d62bd19e606f4f4e78805932442d872aea57651ab949b96bbb6b4121", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108389, "uuid": "fb5c48fa-a09c-4613-bf20-8fddc5a5ee7c", "comment": "Malware payload (NanoCore)", "value": "1bcc9522f4f8e1938939e2721b834c5f51cf81d1", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108389, "uuid": "25cb19d2-35d2-4f86-8d7d-dcfe0c25fbaf", "comment": "Malware payload (NanoCore)", "value": "73f2e8a7e9f8fabb8e5d1b8210c3a6c20f242a0e7c58c68c71f82930462640405cef981e834f8230b3d3154636741453", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108389, "uuid": "c024c4f4-cf84-4c82-9b29-95bc87b5cad6", "value": "T12E64C0E8DAE7E759E5A351B3180CCC84A09FEFFDB3E6A12D22617627303570C6927950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108389, "uuid": "a39879c0-130e-4961-893c-af8be51db5b4", "value": "6144:oFdtTEkYk4nzohTixTbXW4cRk8zHlcEbGQsIJTz81LKD7barZBS:oFdtxYk4eTgSDJHPDs+/8RUbalY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108389, "uuid": "17782a5c-f47c-434e-abbd-a3722b3c5f02", "value": 329288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108389, "uuid": "31831ad8-c887-47e8-9eb6-01710bfbbdcb", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108389, "uuid": "e90a1fbc-95d5-4a2d-a20d-e0af5a35646f", "value": "Import order764536.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979bdd27-2c27-11ec-843c-42010a9c0014", "comment": "Malware payload (Cerberus)", "timestamp": 1634130910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130910, "uuid": "451a4cd0-ceb8-4410-919e-e60ac6f638d9", "comment": "Malware payload (Cerberus)", "value": "45f493e525bbe41865d76d3f60d22bde", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130910, "uuid": "6c5d62c5-2087-48f6-ac1e-bf4bc4431c94", "comment": "Malware payload (Cerberus)", "value": "6208a4c0def1a46852a98bdd37621568ef64be7498d50a7f132faa422ec4c68b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130910, "uuid": "9147c557-3bc8-4845-9b73-7a37923b0957", "comment": "Malware payload (Cerberus)", "value": "32a1fb26ef90f64411cc25d30a868933c8c56597", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130910, "uuid": "cdb5eb1a-8cbd-4592-a984-dab6a49ad59a", "comment": "Malware payload (Cerberus)", "value": "789075cd96598d822eb00e6371dc76211f9686864628690befdf366b0568f78ff6a6391fcc3b845a52910acde8bde845", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130910, "uuid": "ae20094d-2e36-4178-a5c5-ad7be83ee0f5", "value": "T1CDC512D54A819C7AC2755D31B3C361A2B9301F28A6BDF57A067BB5307FB3A508249EF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130910, "uuid": "5402e612-bc73-4592-a603-20e8753bd779", "value": "49152:NhpWv0OvsuOV8H6SfYjoj0v9riRKbNRjQjXL8GarkiZb:NhAPi8HlQjPi6RIL8GUkiZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634130910, "uuid": "2ef3d7db-d76c-4f84-9f49-87f4008170b0", "value": 2669308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634130910, "uuid": "96f30d81-4d8d-4848-9547-05e048008fe6", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130910, "uuid": "e3884c10-909f-4c49-8b64-60ac8db8ea68", "value": "Android build_obf.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6ea455-2c34-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634136553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136553, "uuid": "cfb5b7f5-34b8-4a19-b4ff-386205c571fc", "comment": "Malware payload (Mirai)", "value": "1e745dd1c2a6bd1d3a4b0422aae4a945", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136553, "uuid": "cd65cf74-abbb-4170-8e0a-47bec7e27366", "comment": "Malware payload (Mirai)", "value": "625cc4bdcace1e16d96c234aac824f24cd89960c0a5541be1a9423c217ae48f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136553, "uuid": "0af9bbbf-e523-4091-84f8-3211c17b8bab", "comment": "Malware payload (Mirai)", "value": "0331fb5743afc3cab177d062f3b3b488b49abcd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136553, "uuid": "d284d74b-07dc-44c5-a5d6-2875cfb22b77", "comment": "Malware payload (Mirai)", "value": "8ad03aa38d088fe8406f25f058e719b5c4479720637b5fd4182fd7d700b82184e4a50cfc73544455deca742146f32c94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136553, "uuid": "813068d7-6048-431b-ad9a-d3eacb439caf", "value": "T17CF33C46EA418B13C1D71776FA9F414A33229B94E3DB730689286BF43F87B5E0E17909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136553, "uuid": "e1d4b4b3-33c5-4f0a-a590-d2010b5bfaa0", "value": "3072:dUW6GNytXhMwMh4uaWGLKWdwffuSFYEJPdslWM/9OalM:dDVyte3SuaWGLKWefDDJPds4M/9OalM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634136553, "uuid": "6d709e61-ff40-4999-9dcf-b48ae36e793a", "value": 165371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634136553, "uuid": "d2b048b0-bf85-48b8-99ef-d0ba561fcc12", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136553, "uuid": "7bf38fe6-7d64-403d-82f9-3e5fe2303994", "value": "1e745dd1c2a6bd1d3a4b0422aae4a945", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82db01f6-2c44-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634143330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634143330, "uuid": "7969dff4-c4f6-4c3f-ab49-a7a62273917e", "comment": "Malware payload (Metamorfo)", "value": "d13d644d111ba1ad4a95d7c6dfd9b669", "object_relation": "md5", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634143330, "uuid": "1e75f4a1-4412-42d2-bccc-5817a1099516", "comment": "Malware payload (Metamorfo)", "value": "630793d812d85e763f5042ec21cfa2d5da436ee535fdd1ccd00b52c45f82ccb9", "object_relation": "sha256", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634143330, "uuid": "2a286d52-c568-4e17-adf0-fb7ff79c8fcb", "comment": "Malware payload (Metamorfo)", "value": "3c9871a124d2eebeb68ebbfd49fe9b05320a4972", "object_relation": "sha1", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634143330, "uuid": "2f5be5cb-97d4-45e0-8cf8-b431a29b0c95", "comment": "Malware payload (Metamorfo)", "value": "75121ff7cd299af514f1fe5a33ab48ac3a7f0a9647c0b1a915c76e3be7944873839a5760d7827c4934979de8e7113ff7", "object_relation": "sha3-384", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634143330, "uuid": "2b1a67ea-8d33-4f18-b687-019d9b24d146", "value": "T195447D06B3D5477AE4DB03326B8F93628A72EC788673412B1249750E2EF1554B7B73E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634143330, "uuid": "99231e76-3a75-4bd5-b126-7ecd7f64e7ea", "value": "3072:VmDk2R903DaYlAdwgz88ereWn/7w05g0OMcB3RUN46ILJ9+ZB5yOannY:Vms3DaYlAI8er1nzTbrIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634143330, "uuid": "62c0a33d-2757-4195-99cd-db0d3d34e7ac", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634143330, "uuid": "28e209a3-14ef-4ed1-a252-92e5fad7e761", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634143330, "uuid": "8c43e8e9-abcb-44a8-b1ca-5bbf7cccfffc", "value": "d13d644d111ba1ad4a95d7c6dfd9b669.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26364552-2c08-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634117405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117405, "uuid": "2ded1c1d-bc9d-4e72-9fbb-e32802f838a4", "comment": "Malware payload (RedLineStealer)", "value": "a95315bfe63e10f8c4cb025911e0d9e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117405, "uuid": "8df89b21-c7d3-4193-9e44-25316156c507", "comment": "Malware payload (RedLineStealer)", "value": "63111192795dce2d1f91e5065f9878da7e3a0f025e284f96130bebda1b11ffe7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117405, "uuid": "913ea98e-f4b5-4839-8d83-5dc04fb8eca6", "comment": "Malware payload (RedLineStealer)", "value": "55849fe3bd62285096f6828183a02a014b75f8bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117405, "uuid": "90641f8e-2958-41a3-98a0-21515edd619e", "comment": "Malware payload (RedLineStealer)", "value": "abe16c4d2d9f0183ce58ae34ef6ac28c0847acf2833f313433aa4bded1af2c64eb7651795545a44d8d59e991528f668b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117405, "uuid": "3dc139e2-bae6-45f8-b5f5-1533be1ef255", "value": "T103A4BF00F7A0C034F5F316F859B99269B93E7AA1AB2494CF62C51AED5634AE1FC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117405, "uuid": "01344f9d-3d06-44ca-891a-7a157c21e602", "value": "4b52e566ef5b8727d87906b4623fc7d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117405, "uuid": "21e354c9-296a-4f78-b802-45f585d07e57", "value": "12288:AR5eAD/DfJssQzOhD3JiBLXdO6PpO5yLz70BcNwZ:4XDQzO6BXZRO5yl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117405, "uuid": "c0e7179f-dcbd-4795-920f-fd2f4d95822e", "value": 458240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117405, "uuid": "70513513-aa8c-4b39-9c97-8808599d3a82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117405, "uuid": "3394ccb1-0e9f-4afc-a70a-1b41c60a3610", "value": "a95315bfe63e10f8c4cb025911e0d9e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e24a1a-2bf4-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634109002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109002, "uuid": "dab9b774-67f2-4592-8d0f-6871f26f46c7", "comment": "Malware payload (Mirai)", "value": "cd5a8ecb44c3ff6ac3d563a38ceb5919", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109002, "uuid": "15f6201f-1978-4fef-8e63-be88cd69c16f", "comment": "Malware payload (Mirai)", "value": "632b20d3e4883a23969f1b1be7e9e6556f02cb543e3ebf0fca9d9ce4360b1fb3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109002, "uuid": "244de1f6-1c87-4068-8776-8631fb23ef24", "comment": "Malware payload (Mirai)", "value": "f57451103879387553d3cd69bad5a486142342e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109002, "uuid": "923a4e31-77d2-4159-884e-c306735dc52c", "comment": "Malware payload (Mirai)", "value": "fbdeede3d390021546d1bc3b84505f4e686f25edd024d7c500239c7f74ba17eba9db9708e9ce3307d55fe5f4776033ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109002, "uuid": "bff50e8a-dc86-4e3a-8cbf-55e62aa2433b", "value": "T1D693282569392E26C0D0A5BE21F78710F2E2625E26F8C54E3D720E4FFF24A4069537F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109002, "uuid": "b6c75738-66b5-4ad1-a15e-74dbd51298be", "value": "1536:aIifAbSkLEXB6lTzSdskrzIyc7U1BxA6vMsHXjET5nt/I:Ly6EfLx5vMsTENJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634109002, "uuid": "f873aa7a-1ca6-49c3-aeaa-3b7bb53081b2", "value": 91456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634109002, "uuid": "8dd3ce3e-89dd-4d94-9402-571df7d4a82b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109002, "uuid": "38e4c526-f8c4-4875-81fa-eead189c56fd", "value": "cd5a8ecb44c3ff6ac3d563a38ceb5919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac04020f-2c10-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634121065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121065, "uuid": "5188faaa-79fe-4231-9b51-b13386067807", "comment": "Malware payload (GuLoader)", "value": "a4ef1695bddce6530a28e0d72ae7f8c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121065, "uuid": "a4acb7a8-f01e-4b01-9477-2cce3528463e", "comment": "Malware payload (GuLoader)", "value": "64939ef2abe9b397b1f99bb4ba00c7e49be75f14013647c8e0605fb5fdb3b14b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121065, "uuid": "d7935332-53fd-4904-82a9-1164f8d8976c", "comment": "Malware payload (GuLoader)", "value": "3905f0749e1c55ad4d8fb2a1969cf3f74bc0aeb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121065, "uuid": "e76ea616-7dc8-4e16-8520-4400f4d84efb", "comment": "Malware payload (GuLoader)", "value": "5f6ca98865df418bf1126352062445a7ad60939f9b5c288f85a1b27440d995eeedb5528c508be9310ff98749e35409fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634121065, "uuid": "de54accb-7596-4613-955c-a3a0b38b5e1b", "value": "T1B7D380A166B08FD8D1A79A7F13E1876035327E340912AD47FA9CBE1E4E721E0D59072F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634121065, "uuid": "eddbdfe1-5237-4d95-8ed1-f4a931493824", "value": "c727a98e677fb7bd25bb06d2a2d956f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634121065, "uuid": "bf6d7387-4a77-4b1a-ba8e-fd8a5f7a496c", "value": "1536:b60o3DE9DAGxjVgGRye1a8/RCqnDc2zp9f91pgSvcXvgsuY6FqJZ8wYut55mhLB:u0o36MBEyydnDjg4kIut5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634121065, "uuid": "0d7fc6c9-bfe1-4d56-afa4-2452aa3ed1f3", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634121065, "uuid": "cc065d37-9dbb-41dd-b8eb-fdd563dca433", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634121065, "uuid": "b7b4ea1d-7f66-49d6-ac12-97e0ec09cb26", "value": "correction HAWB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b549e119-2bf2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634108196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108196, "uuid": "0b9d899f-6452-425a-a11b-8e8ae6b85d25", "comment": "Malware payload", "value": "58c39c864f7d97e83b35ec909100a3b9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108196, "uuid": "e29e1608-d418-40c9-bc90-feace9f58535", "comment": "Malware payload", "value": "650cdde29a08ff6030aeb9ae677993b6af5ac7edb18b89c7ceca9e997344c3e2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108196, "uuid": "99fdd61d-f0fe-43a7-9533-28058bdd067d", "comment": "Malware payload", "value": "a2a4411184231eb21db5e9cf68950d87976621d3", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108196, "uuid": "812c9fc0-1b67-4371-a322-a12cc14f6191", "comment": "Malware payload", "value": "c89e7f1b929ab217bd32fca07c8af1455e2b443a30d580b8f3b891af9a3e5a0ed37a4728596e19c49e7e9618be40a529", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108196, "uuid": "7cec9eb2-5e5f-450e-ac3e-7aed61c45558", "value": "T13D959E23F2D14937C0732B389D5BA769A93ABE112E38584F2BE42D4C5F3978139252D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108196, "uuid": "5de95ff6-e9cf-4dfd-b2de-7ede1749cf08", "value": "24576:bxACAa4WINdi+Rg8W5AFhFEXCUVPTQLTAC7yOId1WxC2Yq2EX6UmmBUejaXaDyTK:bx5AhP+VPTQL6uY3G6uITPCOYL+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108196, "uuid": "228a299b-b914-435f-bfc5-15fdfaa98346", "value": 1956864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108196, "uuid": "2333f184-b1f3-49bb-a180-d3ad56fa5975", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108196, "uuid": "2bcb5312-4b23-46bc-a676-00a6909efa1d", "value": "deudas lqirwotqeeqcyjgnxkrclcwvupaqd.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72dbbed-2c51-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634149109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149109, "uuid": "5782669b-202c-4c70-825a-0a27c3d9d17d", "comment": "Malware payload (Dridex)", "value": "4e883f7247e1ef95ab0cfc974a5d3b88", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149109, "uuid": "e42ffe10-ff8c-4afd-8f52-0f86478b9664", "comment": "Malware payload (Dridex)", "value": "653aa17fbf6949e5bdba2599a9a3df4bb8ec259a5cf0eb7c3b08b6813c4283e7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149109, "uuid": "8f8a897a-09ee-4e73-b585-0f4304df4862", "comment": "Malware payload (Dridex)", "value": "99049f145d976731e946f70adc70cb243ca93fc9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149109, "uuid": "7ebcc1fc-eeab-4069-8b17-300144552f8c", "comment": "Malware payload (Dridex)", "value": "f4400811d940435d0b08891a6b80504ee0e32b00d808e110f254d2529caa863610b471173e95b9b60747cc95b9bb40d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149109, "uuid": "06cc6563-9d86-4e98-b852-942b3d7ed1d5", "value": "T11604DF34D6BB27D1F8DB0878B047F07BF11AAE59B12CC545D29AC05FA4EDA12B8B1913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149109, "uuid": "4c8f68db-18a9-48bb-ac35-5d7a1fe35248", "value": "4ae655604782e94c4041a6069971edd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149109, "uuid": "3407f3fe-2580-4275-9f20-d9f6b9893c12", "value": "3072:vqNhtjVkooePHOHX9s/4R1ltAeSKt84r5AMUpbSpS:ywopPu3q/4FCur5AMC2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634149109, "uuid": "f173b904-2672-4591-9869-d3d8edd44eae", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634149109, "uuid": "f4c74088-3e42-4512-935c-b36f852e1e88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149109, "uuid": "a3334966-894b-4687-86d9-e0a678620697", "value": "SecuriteInfo.com.UDS.Trojan-Downloader.Win32.Cridex.2908.28351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1de4a2-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1634108642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108642, "uuid": "1e29c6e4-1da2-4e6a-9e28-fde809b86e8e", "comment": "Malware payload (STRRAT)", "value": "bfbcace74b631258aba1f56063aad65c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108642, "uuid": "6b992a76-88ba-424f-98c5-46a6bd8b376f", "comment": "Malware payload (STRRAT)", "value": "657d9892d80d9f2b34a0d180becd8cfa3ca662434e7e4223c403f046cb096eb0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108642, "uuid": "4366aa80-6d52-43a9-95fb-24c3c7b97e64", "comment": "Malware payload (STRRAT)", "value": "9231f382419c3d05eb1815d9a44ff9f0ef14b05c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108642, "uuid": "4cdbb62f-225f-46f4-902f-db30f83b0204", "comment": "Malware payload (STRRAT)", "value": "f363cdb2ec7735a31cf9ebd7a9184dd33c3eedffa83671596eb28c16d3c4705a0455697af3364dfb38e24ae3f68c960e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108642, "uuid": "6f6c3bf7-5a5e-46e4-af6c-6f28d2c1d533", "value": "T19A04BFD058C35D1FBD26123DD4E15097BEDCC79ED581B48578BFABC28FBA42B800929A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108642, "uuid": "a9852fdd-dea1-4354-908d-396ea78aa03c", "value": "3072:K8ur/AOLjOb33tg6LMVlEWNw4VdIG3BOwRlGdcMXT2LgaZYu2CQgQ:ezAAjOpg6YPEWq4VdI+BHyX7Wn/QgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108642, "uuid": "db20013f-3f24-44c0-882c-e63a6b4b335a", "value": 187575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108642, "uuid": "3d051939-1d88-4cf6-a278-f8662fdcfeb0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108642, "uuid": "4d9c32bf-bc3f-492a-830d-b21bce1d0486", "value": "PO 2006-020 MAQQO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce533be-2c54-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634150299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634150299, "uuid": "45fea0e6-09a7-4c14-8520-0cd228afac83", "comment": "Malware payload", "value": "b9104a5c754e4959b435dbecc22e6e4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634150299, "uuid": "c5002691-591b-4b60-aa6d-ffd936cfbecd", "comment": "Malware payload", "value": "672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634150299, "uuid": "d2a70230-406c-46ce-820f-41ec4f244c1a", "comment": "Malware payload", "value": "6fdf844fd140e669b8eaaf7fc8970edff41abeaa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634150299, "uuid": "bde9ccf0-c3ea-4b59-9ffc-d1052d24c9d5", "comment": "Malware payload", "value": "808afef93cf815b528bc2a822bd16e6677dd50c47dfde1b7f0739baedac733a4ae1a2d3ae13ac5f182fca781c8c47bb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634150299, "uuid": "5d85aa8a-a1bb-4c5b-8e4f-609b8d1ee892", "value": "T154648D10B7E0C439F1F316F959BA936CA93E7AA0AB2490CF52D516EE46346E1EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634150299, "uuid": "09bafca9-880b-4a4b-a141-5541aa44768a", "value": "e9d1f1739ab48fbfe7c7128688524302", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634150299, "uuid": "0a61a650-03f8-407f-9e08-302b45750555", "value": "6144:HBq/wYCeVz76LjmwUzHZ+732vsGd6pJpND0S0++8OGGg4:hqYYP6LiweHZe32URpJv70++E74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634150299, "uuid": "611ef2e0-3bb9-45ab-a062-906815108550", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634150299, "uuid": "f9a5a86f-9a37-4adc-b0c4-73836bd99781", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634150299, "uuid": "ce703ce3-5dde-4d7b-b1c8-f9b73e74c469", "value": "b9104a5c754e4959b435dbecc22e6e4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad95f90-2c63-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634156551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634156551, "uuid": "eec2f206-19e1-41f4-aba1-b576414820b1", "comment": "Malware payload", "value": "0cd5d49bfd3eaeab2805bf5874ef00dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634156551, "uuid": "3306e79d-cb51-43c4-9267-6b5a05892b80", "comment": "Malware payload", "value": "6851e85d8f6074bdaf251a40eab78a0603d47d0a7896406d132de7129a1579a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634156551, "uuid": "ced63f64-387c-4834-9b46-e20b190acbaf", "comment": "Malware payload", "value": "52d3ccd0e5c484505e4d7e5ca96ceb301ce974f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634156551, "uuid": "d079b2e6-fb55-4c13-ad6b-40ef00003015", "comment": "Malware payload", "value": "95a98d71aa4ce83903bbd74d7052ff5356991edcb3092d6f733452b0e4801bbcba68774bec20736def14f3d1b7ef7c75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634156551, "uuid": "ff78527b-4a71-431b-8637-8de36229adab", "value": "T19594E102B1E88E76E1630A3D0EE497345EF6FF745B36D59367D17A1F2E321880D252A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634156551, "uuid": "8cca7ee9-6b97-4435-9bf1-5cf33b304113", "value": "535fa6479108b5163f64223c5e835312", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634156551, "uuid": "2908d421-04a1-4886-8a3b-540aff9ea164", "value": "12288:C4jg5ZqdXUR7j+6khm14Qwxj+R4QBbfwxkZoLKl/n:Cf5ZqdXUR7j+6mpQwhQyId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634156551, "uuid": "51d93ead-0f19-45ab-98c4-e800af8e7082", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634156551, "uuid": "66e638d7-af94-4ed8-a42a-1dce8efe99dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634156551, "uuid": "55c37bdc-d667-4853-b154-928b20fd6cbb", "value": "0cd5d49bfd3eaeab2805bf5874ef00dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e8e5e80-2c37-11ec-843c-42010a9c0014", "comment": "Malware payload (HawkEye)", "timestamp": 1634137552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137552, "uuid": "4427660a-c156-430a-87c1-8508dcf5d87b", "comment": "Malware payload (HawkEye)", "value": "7d11e82579e2a0628ca3c855afe34fd1", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137552, "uuid": "ff8139b5-954a-4115-8d6e-5718e5c24529", "comment": "Malware payload (HawkEye)", "value": "691cb999c6be0f430c14a9411abf6796f174c8d8f3c3edc4b819b3b35972d832", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137552, "uuid": "078af96e-f2c3-4678-a846-0dbb77b04bba", "comment": "Malware payload (HawkEye)", "value": "d6abbbe7f991e79c3bc51480314386c0cce5f2b9", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137552, "uuid": "566947d0-2317-4300-8e1d-8cc394a7e6bb", "comment": "Malware payload (HawkEye)", "value": "95f08a3f9c7efc5d14271ab82f07359480da00c8b4c00faaaeaceedc9ccadfc882453cb46f9a4641b06be42460478486", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137552, "uuid": "2785ff9f-8fa7-4bfb-9631-856a0d928865", "value": "T10C35E0597A50759FC4578D724950DC309A60AC627F0BF203ACD33EABBB3F6D68E051A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137552, "uuid": "15e1e895-3e9c-4b69-b9f6-564aaf2f8f32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137552, "uuid": "8f5de561-4ea3-428c-9827-4f23fbe5f851", "value": "24576:+yEc0kMMFANUc0FBcm6YAVjfsxogLMkB:1Ec0LWI+EJ3jYo3kB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137552, "uuid": "47fc84e7-8d0a-4d5c-877a-d179e276ab53", "value": 1078272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137552, "uuid": "907afcfa-fb55-4aae-92be-bfc0ae720436", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137552, "uuid": "fffbce04-8ad4-4bbd-ba42-870d5b5b0ceb", "value": "DHL_AWB 518877882999_887755468_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1a1995-2c41-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634142057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142057, "uuid": "601cd3db-1942-49ee-97fc-368c0835cbf6", "comment": "Malware payload (Dridex)", "value": "3a2ad0214792e9fe227f0f4506fb4a38", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142057, "uuid": "7b10fdab-66de-48d6-8681-c0e8aa1b5b88", "comment": "Malware payload (Dridex)", "value": "69b266a06229673e16bacf6fa94ffb8b4d8b662cec510d4c210c512d47a80327", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142057, "uuid": "fa8b09e8-a750-490c-b2f4-525521e5e526", "comment": "Malware payload (Dridex)", "value": "3b07616a1935a1c2b0176d1093a9d304314895dc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142057, "uuid": "4b964285-3f2b-4d39-93ce-0d2a9d3cd0b2", "comment": "Malware payload (Dridex)", "value": "ed79ad115cbc389fa60cf0302f8da49619a17f70c2588f320eff688853e24909a77edbec3917afb0bd8f8b12c8837055", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142057, "uuid": "1aef34b2-67b3-4d80-9874-f9b48b3f0194", "value": "T143D4F8013A54E821E7E955B6CF2AC6E85B183D49EFB0A4C778E17F0F2AA94F3D215305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142057, "uuid": "06445558-5c74-48e3-80b8-b084294db741", "value": "54afd981c141523b8c68b6a5bfed7202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142057, "uuid": "895b2b78-22c2-4f94-a308-3b74f4a4c20b", "value": "12288:duIBkYwMtjp4CqwqyaXPLAfx38TW9DiWUT2tq017JGoLbhW/:oob4wqyaDA5sTWiXT2tq07G2w/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634142057, "uuid": "e2e62a07-ed1f-4bba-98ed-8e87ae92e1a7", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634142057, "uuid": "aeed0c95-7b00-4425-a219-d9125d46e02a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142057, "uuid": "1d346f9a-16fb-4873-9ca1-ae548c89ddd8", "value": "SecuriteInfo.com.ML.PE-A.28995.27863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e39b18a-2c2c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634133068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133068, "uuid": "37fd14f6-24a9-44ca-a5b1-2b2bc32c4f2a", "comment": "Malware payload", "value": "62479aa39094e34e4b01d9c31acbb3cf", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133068, "uuid": "f59159da-ea31-46d8-a528-45379658d7e1", "comment": "Malware payload", "value": "6a45010307a4b89187d29d0aa7ecbeae00475073e2e27a12143681e6d09b1f7e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133068, "uuid": "bf75b8a0-24c0-44af-a6bc-354a77d14f4a", "comment": "Malware payload", "value": "ba6285899570878f5707e7fe325821f0bd83c510", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133068, "uuid": "57b0bf5c-aea7-4ffc-940e-b70f6429c2f5", "comment": "Malware payload", "value": "7d74fd10f0c69ae71a78c3efd36892c3ff82ead8b0301f7ce8eea4455c341f2266f0da3f54c6c0dc7063f135d1a4123a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133068, "uuid": "09d72503-6ae7-407b-a9cc-dc2d8fc8036e", "value": "T15E958D23F2D28837D1732B389D5BA3689939BE102E78594B3BE51C4C5F356813D292E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133068, "uuid": "2304cb1e-733d-49bf-9d80-766629765c43", "value": "24576:yJte5OYe3MCzvzXW5A3WvlhyZB5Sk0UsClS1lDFtMQFEhwdG4B/d1AGHfTU+Iom6:yJAOYe8MWvOSk0URle/tMsRTP4tA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634133068, "uuid": "f41a53d7-7830-4b8c-9db2-27fb5f2467ea", "value": 1903104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634133068, "uuid": "5e553461-91af-4671-a42c-e46423eae72f", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133068, "uuid": "2f710251-c73b-42b4-adab-2bd65db94cb8", "value": "fatura - ipzozceilxsqhysvaszk.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4af3992-2c3b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634139656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139656, "uuid": "fe88b8d3-612d-4c49-95b9-ee8e6bfa6e02", "comment": "Malware payload (Dridex)", "value": "4e6d8b34d4441d66984a1b4fa51fe561", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139656, "uuid": "c32d9b94-41cb-481e-8ddb-6d72623d5b1a", "comment": "Malware payload (Dridex)", "value": "6a5cd724baaebc19773830980de192cfa10e9d921469153399e656fbdd0ff972", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139656, "uuid": "33d81f45-7371-48c5-8d1f-7ee39dc211fb", "comment": "Malware payload (Dridex)", "value": "a991079981a98f9cf3ceba151ce56d39fa522b5d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139656, "uuid": "8f840974-a91d-4ed5-aa8d-2d81619ea2f8", "comment": "Malware payload (Dridex)", "value": "9a864fba27ab0e3a0a1c25559bc0d2cc0ee4b5b57b16b4a89cffae501516720841d25c0af5586f5c5b0a6ef12d388c5b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139656, "uuid": "e3489c49-3256-4564-a657-1a826ea0f252", "value": "T1364422DFA51DB060D15A247929FB3DED33B04FA918838E1D6492C5C86DB02FFC64A68D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139656, "uuid": "a9f74b05-9470-446a-a127-4847019d1006", "value": "6144:Z2BnliBa6liM4XDrGY4Pz1m9HwmI/V6IgcRU0gp6qIoe5:Z7RiM9TPz1m9HwmIbxU0gIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634139656, "uuid": "ccdc70cb-9c88-4cac-8874-3c65cc506e50", "value": 275947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634139656, "uuid": "091a3411-4eaa-4e3b-9b20-962752b08be2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139656, "uuid": "a5f8b258-4e5a-4e1f-9d06-a07104ac3d2f", "value": "Invoice-64145512_20211013.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c82817b-2c07-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634117067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117067, "uuid": "b7de01b0-c447-4c0c-b365-15e667be5cae", "comment": "Malware payload (Mirai)", "value": "3a00a7dec9dc2dfc166722e7e57dab1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117067, "uuid": "7fdcfa9e-6ed3-47e0-a9ad-a82191dc1661", "comment": "Malware payload (Mirai)", "value": "6ab7cabd1d28119bbd365f1047a9f42618a6d62f49a5d1623e4f16dced369e31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117067, "uuid": "550d0201-1daa-426a-a689-5482fb6dc7a5", "comment": "Malware payload (Mirai)", "value": "ffde7807018c09fc3d0ecebb8df30158f4e92934", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117067, "uuid": "729c4869-0466-42f9-88d1-ca02ad9c8e7f", "comment": "Malware payload (Mirai)", "value": "570c398ff4692ad9e8664a34071c1bc3458d2c79a97502a731ffe2ef203def89eb5afd0765642f3026a50c7a35cd61b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117067, "uuid": "32e07dbb-7f58-4032-8de3-dada739fb1b1", "value": "T117A2D17194893462E331443EFB7DCF82A9661278DBF9366361288F78384494D4AF8AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117067, "uuid": "97e788d0-86aa-4396-8540-9976f4364242", "value": "384:n9hD5SzPyWvLaE4YNpfH5Gk3htKhTiz8jVDxlbOHeZBbuKfhfhymdGUop5hX5:z2ywF4YTZfRtfzwVD/O+ZBbuKfhfs3Us", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117067, "uuid": "276cfd27-659d-490e-811f-afe232777e5a", "value": 22564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117067, "uuid": "1e0e1459-508d-43b3-a358-7a2357388292", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117067, "uuid": "04bedf56-206a-4748-9f7b-861b9c8f67ab", "value": "3a00a7dec9dc2dfc166722e7e57dab1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6905af7d-2c48-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634145005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634145005, "uuid": "a8d35b1c-c478-4b50-99c2-ad0fcd134093", "comment": "Malware payload (GuLoader)", "value": "83046fa32e563289dbd98efe27f884f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634145005, "uuid": "7b51e657-6fe2-47dd-a24f-c695d7e35e8a", "comment": "Malware payload (GuLoader)", "value": "6b3d06b20b3ae5a3dd8d3a2eb9eb1f1a86d9ba5eb59f5ef75cfa1b2f28dcfd6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634145005, "uuid": "ffdd6c6d-1b6e-495b-a536-98a3a3f3147c", "comment": "Malware payload (GuLoader)", "value": "fdacb1537161c011f5803471b6971225010d4e71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634145005, "uuid": "a8d212b7-5380-4af3-93af-3e29d70f9fa5", "comment": "Malware payload (GuLoader)", "value": "3392237d231232014fb093b040918f4be67a8280f7b1346fb9b26691c612fc86c19cb597d8311a74b8b58c1357a589eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634145005, "uuid": "0a8530bc-4f36-47b5-baaa-057a4a2d57fb", "value": "T1DFA35BE22ADC5CB0F98459BD577F417F131FBD3309919A0B1184270BE42EB825AA1BBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634145005, "uuid": "6a9b6836-8475-4505-88cd-7085dc218608", "value": "3d3cd1bd8dcc611a5734bf41f4e1a6a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634145005, "uuid": "1905e3e2-210e-450c-af9d-962c1adfd104", "value": "1536:t9BDgiAEkkSAIJQpaehY0gB0PXUhzYMns1h7IuDhaD:t9BXAZAADehhgB0PXAzYMnekuDha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634145005, "uuid": "8113dc84-32ee-42a6-aeb6-de0f62984472", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634145005, "uuid": "9d000837-e726-48b2-82be-39bff248fed3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634145005, "uuid": "60bad329-bb35-4147-9fb0-55c6e2f0c5bc", "value": "PEDIDO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f85c323-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1634108347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108347, "uuid": "4770ef5f-5588-4b5d-9348-0fb2241d31bf", "comment": "Malware payload (DCRat)", "value": "a521f746f0ab71b078bf803283ca6858", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108347, "uuid": "71c50505-31b7-4495-a4a1-4a9a423467ee", "comment": "Malware payload (DCRat)", "value": "6bfc5cbc2bda202ebe53dcaa38c822abbcc04ad6fa45ebee8edd33dcb02b943f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108347, "uuid": "bfaed6bf-acbc-4687-9626-0032f3bec0d0", "comment": "Malware payload (DCRat)", "value": "6ba7221724e0837fbd97f0c43b3aa6eebc8aca21", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108347, "uuid": "12ad5ef2-3093-4639-a2ec-0ec58cc215b5", "comment": "Malware payload (DCRat)", "value": "392808d33ed1d5ff33b726b5349d10d097d37230493fcfe9f24c895c015a41144632cb111080376c8ecfc54eebed8a71", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108347, "uuid": "02d707b3-9809-426e-a30e-2c39a443601f", "value": "T144334B1037A8CD26E1AD7EF568F255088679F1DB3903C65DACC850EA9B43BC597022FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108347, "uuid": "7e7a0ec0-b932-4d27-a697-0c24906f9a2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108347, "uuid": "69c15ee0-cf1d-4d3c-a06d-983ab304a528", "value": "768:FOEuILWCKi+DiZmEU5iMn8YbKgeOe37tMvEgK/Jo9o8/VTZVc6KN:FOtmZuTzbdwMnkJWVTZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108347, "uuid": "14fe6db9-f832-45cb-b5a7-be0b0980b74b", "value": 52736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108347, "uuid": "f342a2ed-9355-4072-abca-ce9ce3f3ef8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108347, "uuid": "2e750930-4b7a-4067-a337-26d629c29b92", "value": "a521f746f0ab71b078bf803283ca6858.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be679dd4-2c34-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634136558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136558, "uuid": "1acc871f-7053-425e-bff8-20694cc7fef2", "comment": "Malware payload (Mirai)", "value": "46cf57a463718af6ce1dd2996359d8f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136558, "uuid": "e27fb797-0e84-4730-99cf-dcf108960556", "comment": "Malware payload (Mirai)", "value": "6f7948e1d6974ef13b6eefa8f6028a548cf7acff368187cb084f0e078bb414fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136558, "uuid": "90cf316b-4513-45c4-810b-ca1fb29b0e72", "comment": "Malware payload (Mirai)", "value": "dced8bd28db4c512b58975e521298ea37e8c2c6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136558, "uuid": "5bbe0567-5a23-41fc-893b-6fba7a0973bf", "comment": "Malware payload (Mirai)", "value": "ecb1290b73d5610294cd45fcaf4328a42633599066560aba4c81a25a9222be05ddfc1c5eeb742d346ed8332852117ecc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136558, "uuid": "3133cf69-334f-4f54-9722-c84dcd2f4cdc", "value": "T146833924BC391E27C0E4A17A21F7C722F6F5228D21B4866D3D710F4EBF656407A47AB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136558, "uuid": "ee255911-e219-4e28-bcf0-de2a5eb42f02", "value": "1536:FrWZnHJSkunDANOJpkAD1+fUH4ZtNMMCcz75ZXbtAR:xWZQJ0ugft2zczVIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634136558, "uuid": "4c030da8-790b-4f5f-9c62-5811c2cfc1fa", "value": 87844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634136558, "uuid": "c728d733-ec65-4612-83ce-6b6719f2515a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136558, "uuid": "d0e6de6f-3bef-4900-bd2e-2fc72385aed4", "value": "46cf57a463718af6ce1dd2996359d8f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1745924a-2bed-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634105783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105783, "uuid": "e1221981-946d-40e0-ac9c-c166594e4e29", "comment": "Malware payload", "value": "70b07a67b618a6352bf35a735645b156", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105783, "uuid": "15a12fb0-e2a6-4c83-9df7-887226c823e6", "comment": "Malware payload", "value": "6f8992b2f3f1c58410293cc0b598dc74c2b1d9c165ad98d9ff5e12884148745e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105783, "uuid": "987288da-b46a-419a-ae29-87a0b5566e55", "comment": "Malware payload", "value": "61f4bf9b3d1dba0f023e95aaef50e2cdb6b1c6ae", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105783, "uuid": "9f96a389-51c8-4f23-881c-c2fbdf2b4c62", "comment": "Malware payload", "value": "67c4a7c73b685ddd77e849845aa6ca743508aca1b0d8a41f550fdbfb3ef9eac007faf4240ae59f02087db3bdc81b7714", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105783, "uuid": "463466f1-abde-4cb6-b307-94a98b342dad", "value": "T156F5AF43EA085A67C03A43B77E530E792A2A9F09C5426BD724283F4D3E771990F4E7D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105783, "uuid": "b7177223-a7bb-47d4-8f04-e9c0d0c14e28", "value": "49152:VSHNRUk7W42gKzO+4GgAYzfro7BTj2cS8js1pM6HdD5umePDr2EjD:VStp7W46zO+CzfroFOcmjrHdDCr2EjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634105783, "uuid": "6e0020e0-326f-4dd0-a1a9-75d7a9f64ad7", "value": 3366981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634105783, "uuid": "d87c7088-e9fd-4001-9277-ac09ec66bc5e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105783, "uuid": "620dbf4f-9395-4fcc-a106-a5086bc58526", "value": "6f8992b2f3f1c58410293cc0b598dc74c2b1d9c165ad98d9ff5e12884148745e.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c0e811-2c07-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634117075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117075, "uuid": "cfaf8ad1-2507-40fa-8a7e-c6957d9d16f1", "comment": "Malware payload (Mirai)", "value": "814e069b5dc2acae3a01d16f451e2ffb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117075, "uuid": "fa9a58d3-e680-46b5-ada9-c79b2ad66724", "comment": "Malware payload (Mirai)", "value": "6f9c3e1ecd2ff745d5cb9fc9e24beb7c444046e1f6b1842fec50de1cea0eda07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117075, "uuid": "40991f7d-4d92-4f48-8966-186234d0dce3", "comment": "Malware payload (Mirai)", "value": "cc6ac0a101c1deb533862f8be5db903d364def44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117075, "uuid": "64f2e422-c116-4f7e-9ddf-859766ad1942", "comment": "Malware payload (Mirai)", "value": "653282c4c164cf4bb436453fc768b0586a276a415a86f97d25d2cf9610b81f17facba92c04aabb81e334ae739d44e1af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117075, "uuid": "ce3ac0fe-edfc-4de9-bd65-11c19c1c5596", "value": "T1D7E2D13095CEDBA0CFB00C36F53547C4775D9E29B2B937B01E6181A4A88A459A3BE1DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117075, "uuid": "50993712-661b-4438-b62f-474900fb2360", "value": "768:5n9AQxCfpxQfh1o/Xy/cDyOrvWOpHdXv6s3Uozb:vAQxfjfNsvWOpHdXfzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117075, "uuid": "119ef959-2116-4075-a85b-fe37774e35f8", "value": 34088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117075, "uuid": "df95ca28-f94d-46ee-b19e-dbe50042b51e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117075, "uuid": "543e3c37-df38-43e4-ab43-eef67e470ef1", "value": "814e069b5dc2acae3a01d16f451e2ffb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a71086-2c0a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634118231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118231, "uuid": "5d435b91-b88e-4cf2-8a3b-7ff6a6cfd4d4", "comment": "Malware payload (Formbook)", "value": "05e1afc06d4d498c518db928c538439e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118231, "uuid": "ae76e95a-5c00-4277-b4b7-90d8a519c0db", "comment": "Malware payload (Formbook)", "value": "6ffe756ce71f1457d7dd480357f3545f123b750fc4bf30683b59887d491948a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118231, "uuid": "354e1d23-5434-48a3-ab75-080719dc5317", "comment": "Malware payload (Formbook)", "value": "483a2e9f7da3fe655a885b0b704682f394ed70a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118231, "uuid": "e440c600-5677-4cfa-abb3-b23000c82173", "comment": "Malware payload (Formbook)", "value": "582dd1351246a70a7e61d3e375b85af80877d5f3ff2fdb37dbff18afb40bce68ddf76e930544fb6e181c80eff4c64ee1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118231, "uuid": "d05f5f8d-726c-4cff-a8d5-b033f4f026c7", "value": "T11DC4C0A47F99E84FF3668C781131DF84C67E655B3B13C625D9BF507A92AC78028C2287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118231, "uuid": "74a91f02-d93d-4c0d-b8b8-dc86a9049e31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118231, "uuid": "d0889a3d-8e47-412d-a7a0-8aa23e1b4d2c", "value": "12288:dSBz/nnqAEjkLUuX9X9FGFZUeP2ltYK96R:QBqFuX9XvGoeultj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634118231, "uuid": "9bd59b9e-8fe5-4335-b7c1-3042fa757761", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634118231, "uuid": "5c4076f3-0a4b-4bce-8eea-99424b83266a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118231, "uuid": "9dc520de-bee4-4dbd-94da-ea0620d508de", "value": "05e1afc06d4d498c518db928c538439e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6d93d2-2c41-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634142063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142063, "uuid": "42154f56-43b3-43a6-b6a2-467fb9c1b918", "comment": "Malware payload (Dridex)", "value": "890084ded2e61e7542a65bf1fde020c0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142063, "uuid": "e3bd0b18-d221-48d4-a710-3d7d235cc155", "comment": "Malware payload (Dridex)", "value": "708772002783922cd42ebaa4e1471fe0bedfdecacb99d98925483317e09c9994", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142063, "uuid": "9ac95baa-18ea-48b7-9d15-0262163d530e", "comment": "Malware payload (Dridex)", "value": "4abf13fa6836bc37056dfa46ee9ba3944b755333", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142063, "uuid": "e6c70d64-e21a-4689-a10f-8556512b8901", "comment": "Malware payload (Dridex)", "value": "17b1581506e65f53518a7b25ecb02619daad8f73a004eecb0907f673fd71d9a9a2aaffd578974a35fefe37b2e81ffa4d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142063, "uuid": "003237a8-b0bf-4533-b42c-36cc260ffb44", "value": "T1E6D4F8013A54E821E7E955B6CF2AC6E85B183D49EFB0A4C778E17F0F2AA94F3D215305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142063, "uuid": "9cdcc779-460a-484e-bf5f-6c16682e1c3e", "value": "5eb95f99453a8a6fe3d6300e286747db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142063, "uuid": "370bd50c-00df-4496-8988-0b371f5e4ebe", "value": "12288:kuIB1lwMtjp4CqwqyaXPLAfx38TW9DiWUT2tq017JGoLbwW/:7Cb4wqyaDA5sTWiXT2tq07G2x/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634142063, "uuid": "d62108f7-91e1-4605-bafc-08842c8249f1", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634142063, "uuid": "579dc221-f9b6-4618-9806-1c40a7a17d29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142063, "uuid": "3b9dcfd0-376c-4c03-b549-ea4ba01d45f0", "value": "SecuriteInfo.com.ML.PE-A.4995.4290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a304f9ae-2c2c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634133076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133076, "uuid": "857b4f3e-1e1e-4744-9489-eb6fa3d4891e", "comment": "Malware payload", "value": "577dce3ab5a99e1c170c3573ed5f406b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133076, "uuid": "357249e9-c9af-4355-853d-fa364d4994af", "comment": "Malware payload", "value": "711b1eb44e073c8ce5472d69e8935962eacf7705335b73a0f47b5f6303b3bd9b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133076, "uuid": "18016803-688f-4b4e-88cb-8cb6cf5fef9f", "comment": "Malware payload", "value": "2a27b0859dd0d32c00a2512469772f6413b91f62", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133076, "uuid": "dea11e01-e446-47cf-bcfb-50f54cc9096a", "comment": "Malware payload", "value": "53e784f39aee7bc77cee7ece8fe3547e07e60f207db5119465d7af0d4c144e303cb90f34263ebedae556afc8faa2826f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133076, "uuid": "61f6b545-a495-4644-900e-b62875d82ef7", "value": "T1A8958D23F2E28837D1732B389D5B63689939BE102E78594B3BE51C4C5F356813D292E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133076, "uuid": "1e88be9b-e155-462a-9468-882fd61be2e5", "value": "24576:kxj+CzvzXW5A3WvlhyZB5Sk0UsClS1lDFtMQFEhwdG4B/d1AGHfTU+momOe5OY33:kxaMWvOSk0URle/tMsRTP25OY3EA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634133076, "uuid": "f954bc6c-4056-4c75-a740-f4be577a9435", "value": 1905152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634133076, "uuid": "86e77304-6557-4b4c-a553-6c1d08dbc0c8", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133076, "uuid": "3c3ec2e8-9795-48cf-a8fe-ed461193c87d", "value": "fatura igpympadaulgvhgeipvx.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5e26db-2c2c-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634132904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132904, "uuid": "f603b87f-7a86-40fe-a793-9ffee1a75a67", "comment": "Malware payload (Loki)", "value": "33b0088b3c388e0685e28644215acd17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132904, "uuid": "0902b32a-9b54-4a12-b74d-5a7fe26ad3d1", "comment": "Malware payload (Loki)", "value": "711d41ba139f51e91bbb8f691f91e55655a0ad5a40f61a6bfebd9fe3d1ae2e37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132904, "uuid": "01495c29-3979-4c8c-981b-c31abfc9cd04", "comment": "Malware payload (Loki)", "value": "434b900b114a6c2c093cfc81f918174ff11dd373", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132904, "uuid": "324ffe43-4870-4e9d-adfd-15513840923b", "comment": "Malware payload (Loki)", "value": "1d0572ba8aeb2eeef9fd87793358c7a12550de41f1bca670d56a635b1af2b1b102b7dff2b9eb5cc21059155787bdb3c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132904, "uuid": "1ea3a4e9-5917-4b80-b3c4-e845a55accbf", "value": "T1C9647D10A7A0C034F5F316F959BA936DA93E79A06B2490CF63D51AEE5634AE1FC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132904, "uuid": "4c688f88-30da-4bb6-93be-e43ccbb77a10", "value": "4b52e566ef5b8727d87906b4623fc7d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132904, "uuid": "bbfc944a-7d7e-499f-969c-d7ac3c22f954", "value": "6144:voT0SEkXJBRbN0t4ZjbFixOXqffdzNhjFZQcp+:wjEkXJBhN0t43FixOXqfzhhZQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634132904, "uuid": "a7d7c2f8-a58e-417e-8dad-a8686e601624", "value": 318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634132904, "uuid": "0845d9a1-5f55-4374-ab1c-232a2ff67555", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132904, "uuid": "714e81cd-4594-462e-8f93-c8d3d32e717e", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3156ecdc-2c0a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634118283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118283, "uuid": "013097f5-1acc-4718-9a20-16f0179913b1", "comment": "Malware payload (AgentTesla)", "value": "9a2ec127f757d01ec14cb2819ea6b056", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118283, "uuid": "c489a324-4809-4376-8e4c-caee72894016", "comment": "Malware payload (AgentTesla)", "value": "72ca1f350787785c5257cbc9706080657d2b7a14d5d97546af18eea7456a086a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118283, "uuid": "cfe57e66-3269-46fe-b6cb-7ab6d1c17310", "comment": "Malware payload (AgentTesla)", "value": "626283087b14aa29088caef20e2b9b7abcc9de1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118283, "uuid": "410f84f3-be17-498a-94c5-8436982e0e60", "comment": "Malware payload (AgentTesla)", "value": "21dd95e45e935f79d303b054b9d498a08c932cba3ee4fef79a219e0b49bfe179298f0ecc8a047dcaf504270047fe6560", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118283, "uuid": "3cc52da7-fab3-4019-921a-71de5b261783", "value": "T1CDB4AD3223984750E0BD67390873504B13F2B54ED325FB4EBCA4568D8E65BB07BA77A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118283, "uuid": "3251b9f2-b7ba-4579-8636-760f0f27c71c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118283, "uuid": "8cc86490-2cc8-4db0-9daa-2e6c96df8b72", "value": "12288:Jg+C20H/zCEkOkh68Qxn/YgyNBhTiCFp3:mOyrwh9Fp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634118283, "uuid": "1bfb73ca-d4a6-4d61-a63c-06c0bc2d5fe6", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634118283, "uuid": "8c7cd6b1-7e4e-402e-86d3-7c7fe7bfab2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118283, "uuid": "32427839-168a-4998-8c10-0ea9208f0dfa", "value": "9a2ec127f757d01ec14cb2819ea6b056.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd1b4d8-2bd4-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634095028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634095028, "uuid": "90feebf6-881f-4141-b266-6c2c722bd044", "comment": "Malware payload (Formbook)", "value": "3029a36f03c0bb9cf0df21837c0abba9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634095028, "uuid": "055a6fc0-e66d-422e-aca8-1fc821fbff30", "comment": "Malware payload (Formbook)", "value": "7351be6f0f343fff3cc33d3b70a75a1a1de3a5d4c9e74b9a4af32f14461f5de5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634095028, "uuid": "bf16e52f-3ef7-4820-b46a-505fdebf8582", "comment": "Malware payload (Formbook)", "value": "832ec6f1c93bd8d8f0fcb963a786df0fa4e1c7d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634095028, "uuid": "64c5d63d-238b-4410-a9f2-8207f64ca5d3", "comment": "Malware payload (Formbook)", "value": "c9fe51ccf0f9c8d8038b5359378a1f2fea7b1c03901e1bace5e2bf8bd47f8524fcb8053c007d80ea97d8756f8aeb8a6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634095028, "uuid": "a2ce1338-6117-425d-985e-b05b206ffa38", "value": "T162A412A23BD0D477E52206304961D6E49374AE086F65BB477769BF6F3F330C6AA06381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634095028, "uuid": "e3a57562-8b38-4f0a-b906-4caac7cc654d", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634095028, "uuid": "017fcbc9-fd2e-440b-a838-f5c7f1743f2e", "value": "6144:tBlL/FvG1n/sm6wcyzjb94LNz3zdhzG3MSWoVJJosCkxyICUx8YXcTrzl++VKRHm:ban9uhiWKJCSPCWwvUk4HoiJRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634095028, "uuid": "89772f3a-83d0-4c92-abeb-2434345dd6f9", "value": 489959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634095028, "uuid": "5248641e-c5b1-4950-8007-869a77df5eee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634095028, "uuid": "3b95ee9a-b117-4c0b-a422-d68213943023", "value": "New Po 09902.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df7bf7de-2c64-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634157229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157229, "uuid": "4c3ec4c2-d7b4-425b-b348-6a8e418d4943", "comment": "Malware payload (Mirai)", "value": "4ee3205a25ad623fa98b015df7a87417", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157229, "uuid": "fec8e696-3bc2-4f78-85ef-f42c515afc0a", "comment": "Malware payload (Mirai)", "value": "73719ebf060959b2aea1b1b63464acd9f62157e80d1b47e81a0e9e994163c473", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157229, "uuid": "43a50a31-42a1-4187-91fe-c0c99da3376d", "comment": "Malware payload (Mirai)", "value": "23763634ac5ef10e4dd0bebded41a3ad80579dc3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157229, "uuid": "ee3a102c-88e6-435a-9742-18320b9da624", "comment": "Malware payload (Mirai)", "value": "309fb52403947e31da4ea37461f89e9702f2db6243658ba1ea7a3c14e9549469448602dbf5629e9bfe24f67077975bb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157229, "uuid": "cee58c54-a02e-4015-9d8a-c987dbf26e57", "value": "T1DA53AFB2D8949EC0C509437860708ABD5763ED467A1B1EF19E4985AE400FEECF25D3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157229, "uuid": "90319ada-60da-43b8-a72f-420f4afac999", "value": "1536:K/qnUFJ3aesqtb43p8dpj9/zqWsjcKF7Cov28:KywtVtb4IppBsAKF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634157229, "uuid": "9a1bef62-ec22-4b88-9da9-d827bda58b5c", "value": 66596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634157229, "uuid": "17a427b1-055f-48ff-a32a-026b6661700e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157229, "uuid": "50dc055c-674e-41a7-aacc-e8fd43bafc07", "value": "4ee3205a25ad623fa98b015df7a87417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094938eb-2c0a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634118215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118215, "uuid": "554e6b7c-c2b4-41a0-ae78-d9e418694b59", "comment": "Malware payload (Formbook)", "value": "25aa37e21c29b7cff02509533b585ed7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118215, "uuid": "f7c62af2-f738-4aae-bb57-382bad40edd2", "comment": "Malware payload (Formbook)", "value": "740a2bc7e9c8eeed76ef0f812c6c89af35c414317d76ac5b50b28ca0728d103b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118215, "uuid": "69752747-fed0-4f12-9df5-d8a83e8bba19", "comment": "Malware payload (Formbook)", "value": "4374948e203cba151ebdc43e11e6e115046270e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118215, "uuid": "20ec7db2-a6bd-434d-b91c-47c91c944a11", "comment": "Malware payload (Formbook)", "value": "20cbf2589738c48a4b33e5a8a5f8cdaa3e570a10d83a218a3bfad53ee5acb31ed1e4992b34645b76ddda7f3a5c1d98aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118215, "uuid": "e83695f3-ccd9-4e53-b709-ce8e9c782476", "value": "T17F642821A2B0CFE0E1A386BF33E94725713A6E3416116C96F74D7D5E5EB22E0A46131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118215, "uuid": "381aca64-cfdc-4629-8ce0-1b16c9b9321f", "value": "c727a98e677fb7bd25bb06d2a2d956f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118215, "uuid": "f338f421-df78-44a2-88ba-551352079743", "value": "6144:w7XxnWJoyJuoMQF9CxX/tO7JS4PIcJaL:w7BnkRMQHg/tGTPBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634118215, "uuid": "4d01d94c-f00d-4621-878e-7d83aee329de", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634118215, "uuid": "40f0fbec-51fb-4a1d-afbb-015965fa95ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118215, "uuid": "4a026acf-6f54-43be-ba86-d0077580d9ec", "value": "25aa37e21c29b7cff02509533b585ed7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89298f54-2bfe-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634113276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634113276, "uuid": "975a9391-cb08-43fe-a3b5-73bdc3544249", "comment": "Malware payload (AgentTesla)", "value": "bf065f763426838a9ee8519a62870b04", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634113276, "uuid": "c982dd44-76b5-4ba0-9fb5-996e994baea3", "comment": "Malware payload (AgentTesla)", "value": "757d0e796bcf035b1103bd023886fce225d2a4a67a626d47cbcd18cfa2de9d56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634113276, "uuid": "efd9b414-a8ae-47ec-a234-bd515e6c8727", "comment": "Malware payload (AgentTesla)", "value": "de8ba98525938505bec4b2e671ef1c5855c61577", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634113276, "uuid": "931b5cd3-ea17-41b6-b137-eb900b678c38", "comment": "Malware payload (AgentTesla)", "value": "97d209d67c812d14944d6ae5ff27ce2acdc1595a1d34b43ec6e4718cea302706bb772b9000ec88a1873b5cb02293c9bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634113276, "uuid": "300230ae-482c-4839-a75f-36b176386c8d", "value": "T1C5D412838FB1DA8AE1194EF34162DB348370ED847D66F6295EE5BDA733377C60022496", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634113276, "uuid": "9e0cb7fe-1f72-4ef0-bfe5-dddc3e90e798", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634113276, "uuid": "ddae3c6f-31e6-450c-b4de-93894edc7ab3", "value": "12288:wlPkYfNzgTbq+TqPgpgL5z/JdmzVhzOolPCWVhIFiK8arTMZ4WYVFkcbV/SB:wlPJy9pgL5zrQDzOolPtsNTMZXYzkcbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634113276, "uuid": "378c3e79-7066-4827-bcb3-661238f8e184", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634113276, "uuid": "9bcf3900-e794-4ecf-8fa2-4868f5993b82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634113276, "uuid": "d6d4f813-5b57-4333-b54a-a3725244189a", "value": "Invoice Lists.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55085105-2c71-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634162581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162581, "uuid": "48b69763-b9df-45da-8739-e713f7080c17", "comment": "Malware payload (Mirai)", "value": "1c26e2ef1214b68e588917ccad1ab503", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162581, "uuid": "eada56d8-b46e-4dba-a56a-33c1641b1427", "comment": "Malware payload (Mirai)", "value": "75a072cf9302fe41e670b7b267199100b0ef1a0bd2ac2223b7484afea671f212", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162581, "uuid": "3ff63b73-8d9a-49b5-b202-f0becd4fc167", "comment": "Malware payload (Mirai)", "value": "f619250328276cda1fb4594322980330aada9ce6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162581, "uuid": "2d04a541-c409-4af1-ae3e-2a06a1b0f483", "comment": "Malware payload (Mirai)", "value": "1f7776021b01a6d596eb1733d2923ac6f582fad0be23fc2e352cd2d849ee47b6081e91eb307cc855bc525761ac373c31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162581, "uuid": "37912bbb-ab08-44b4-82eb-49bbd4e3ca78", "value": "T1B8B2D01EC0AE2E70FEAB7D756941E2C17BA15BDF3B62CDC01AC157110622D681F9C6D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162581, "uuid": "66533335-2c3e-439f-8488-a99ae6df3bac", "value": "384:XA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIo0VAM4uVcqgw05Vxb:DApCdvwJr69VJoA8FZtxCo8D4uVcqgwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634162581, "uuid": "fb0a3d24-ea0d-49b4-8053-5294d9035718", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634162581, "uuid": "c72f3de7-3d60-44d8-9f64-5cd9f2fbaecb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162581, "uuid": "2fccc9fe-dab9-47f6-bb68-28ee9da4e5e1", "value": "1c26e2ef1214b68e588917ccad1ab503", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810d1f4c-2c65-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634157501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157501, "uuid": "4bffee3a-448b-42a3-8c66-ea8ba8c79a04", "comment": "Malware payload (Mirai)", "value": "f63e4876d4e41cab20c06964715771b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157501, "uuid": "29afbbe7-ceb2-4748-bd22-e6fae5ead7fd", "comment": "Malware payload (Mirai)", "value": "773fecd56d8e6dfed707149bafa57439b872ea9320bb63fb1d7365085f6df1d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157501, "uuid": "a3af61f6-5b9f-48ce-be2d-8500e22caff9", "comment": "Malware payload (Mirai)", "value": "37fbaad7e87ef07aa326eb7ef264a52db4af9b4b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157501, "uuid": "30f58011-b172-42b4-a56e-868c1a35c554", "comment": "Malware payload (Mirai)", "value": "6d0e00b578d05377d37bc3a1059251260c92c7e685bb5f99bfd6b0873bc4682cf1fe7e34d54c160be9bf710e02454954", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157501, "uuid": "a234433c-2ef0-4e12-80f8-dcf24884d7f3", "value": "T117B2D0C6109E76A5C1A0907AD3ACC783BB4F4F3052FF35673A5D90A872C2C46B669303", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157501, "uuid": "4be1dd84-c192-404e-a2e1-639132fa3ad1", "value": "384:zBCgGWxIj7wun0baGNmOK8uIETxySuN+b+x4ymKyV5SLyrX1eeV4uhymdGUop5hA:fcN0bHNiIExySuAKQ5Sk1ZVRs3Uoz9f8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634157501, "uuid": "9c886d85-547a-4a18-ad10-c792c5f7558a", "value": 24784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634157501, "uuid": "88ce1310-50dc-4244-9042-635acf4e9393", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157501, "uuid": "f00511c3-336f-465d-94a3-db9359351092", "value": "f63e4876d4e41cab20c06964715771b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f978fe8-2c0a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634118253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118253, "uuid": "aeadd036-d163-4a6d-ae71-a7654dd697ba", "comment": "Malware payload (Formbook)", "value": "7f44706f1c5ed5d723262bfa03b5500e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118253, "uuid": "05c47ab0-7463-480f-b08d-be86d011b376", "comment": "Malware payload (Formbook)", "value": "7903434967ec18733812c4bdd4acdff871bfff5ce40528442272cf230822dd10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118253, "uuid": "a8747071-d8b0-4dd1-a11d-7789edc2c463", "comment": "Malware payload (Formbook)", "value": "2c8b87e78b625e5436a559e92ffffaf4d7d5f3f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118253, "uuid": "83ced80d-5069-4558-8918-0842330f72f7", "comment": "Malware payload (Formbook)", "value": "2b4e4be76833e4f723f328122d8251ef99afa8fd6adb6a4cb280ed0a56cce23afc04a7b9679f745faffedcfb393c4709", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118253, "uuid": "09258b67-5b2b-4d9d-b1cc-3dc2f2d64491", "value": "T19AF4A515F3939C11E567567364E051E791092CC2E858833DEBB3BAA318EA3805F5CBEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118253, "uuid": "a6cc5103-c6c2-4869-8de0-36c084bc3849", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118253, "uuid": "4143cc4a-196f-4151-b9ec-320209db18a3", "value": "6144:Jo3K9Dnnyx65H+MfjJN5M/lqLuyRkXBymUQOuRH6vDdpQ2T7BxzaJK+Go6Uq2:JocqGJaJ7BzUQOuR0RpQKExGZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634118253, "uuid": "13ff3698-5e1f-45b6-b2d5-d6d5e61cbe29", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634118253, "uuid": "fbd91be7-bc67-4424-b17f-d057ebaa66ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118253, "uuid": "b8924c4c-02a9-49c0-81c1-31cc734e94bb", "value": "7f44706f1c5ed5d723262bfa03b5500e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecb0efa-2c35-11ec-843c-42010a9c0014", "comment": "Malware payload (MirrorBlast)", "timestamp": 1634136935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136935, "uuid": "095aca6f-62cc-461d-ab5a-2e40dffd2e8c", "comment": "Malware payload (MirrorBlast)", "value": "7c05adf036c6086367e8963e989ac6f8", "object_relation": "md5", "Tag": [ { "name": "MirrorBlast", "colour": "#08A768", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136935, "uuid": "72ed1710-027f-42ac-b112-3f978ec401d1", "comment": "Malware payload (MirrorBlast)", "value": "7904e73defa12c220cdc04d059cfc8acf3ae96dad41c7bb26381f076f17004cf", "object_relation": "sha256", "Tag": [ { "name": "MirrorBlast", "colour": "#08A768", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136935, "uuid": "adeabbf3-a7cf-4473-88d9-cc464bd8b808", "comment": "Malware payload (MirrorBlast)", "value": "4c255ea7ba6e67add64061820561e6912a14d949", "object_relation": "sha1", "Tag": [ { "name": "MirrorBlast", "colour": "#08A768", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136935, "uuid": "50a30828-0441-4526-82fe-4c5fb695197a", "comment": "Malware payload (MirrorBlast)", "value": "29aecec77111207f5a85903d92c858e099ed53b571b4a6d3d22680554c80693b5fac3067ab1237166e4edfca58c7c966", "object_relation": "sha3-384", "Tag": [ { "name": "MirrorBlast", "colour": "#08A768", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136935, "uuid": "7841b455-60a8-474d-9631-bddb89a7b865", "value": "T13DB3AEB2B2D2C819E948477A4DE7C6A72763FC819F5347473248FB0E2DB46908E17A07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136935, "uuid": "19b3c45b-744d-4311-9ac1-69a0fbbfc2ba", "value": "3072:gdcKoSsxzNDZL2Qiw+4868O8KKA4Rdbwrk3hbdlylKsgqopeJBWhZFGkE+cL4Lxr:wcKoSsxzNDZL2Qiw+4868O8KKA4RdbwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634136935, "uuid": "a7d6671f-2da0-40c7-be5a-6c7455746559", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634136935, "uuid": "1c48b593-9506-4589-a3b4-17f7f48c8dcf", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136935, "uuid": "39688dd1-cbbe-48d8-9231-b4c251220b54", "value": "Bericht(entwurf).xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5105c1c7-2c53-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634149689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149689, "uuid": "283ab442-ffd5-4b5d-a3fe-ae3f06e90f70", "comment": "Malware payload (Metamorfo)", "value": "b6aad7e2780189d1fc59b7ec4ee91bd6", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149689, "uuid": "aef68e06-3b85-4f98-8ec0-28f8c400752e", "comment": "Malware payload (Metamorfo)", "value": "796e81a3d6a5b39d216066c283609793d893078911d3fb13e7dc367c5ac1973c", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149689, "uuid": "65e58c76-7954-4121-bb9e-77611648e946", "comment": "Malware payload (Metamorfo)", "value": "97a4bbaca8c3d871dc92c225663115491424417f", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149689, "uuid": "6e656f43-f981-4f64-8966-db26d2809415", "comment": "Malware payload (Metamorfo)", "value": "eb3c53053237348a259e9c3906ad37401d54ef41fdd7707ee9591e359e7fe9100a2981be39490c390964f72d13ccd240", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149689, "uuid": "16cc4cbf-6ae0-4fc9-8dfb-9ed018ccd63c", "value": "T1C031F0051EEA0329C3B3CF7A107BA2424A36FC51EE934F5D808487CE2861050EC35E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149689, "uuid": "d1c0db43-a7ac-4896-8a62-4cd1e86d3b66", "value": "24:8+JUHRlVo5kcbA+P4d+/P+/Mw41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+1B1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634149689, "uuid": "b4e0e47f-ecf4-4ba8-9fb2-56f162053aeb", "value": 1548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634149689, "uuid": "a24000bc-121d-48fd-a0c1-529bc6052826", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149689, "uuid": "e5bd3b36-3c74-4ce9-8542-aaeada31856c", "value": "Curriculo.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c1ae13-2c4e-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634147581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147581, "uuid": "ed8e8525-4202-49ac-b5cb-d981fd6c8fc8", "comment": "Malware payload (NanoCore)", "value": "5b3262b61a5eaa3ebe7e8bdc4958fc3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147581, "uuid": "745e4469-3790-4b2f-94fa-e58de0d08444", "comment": "Malware payload (NanoCore)", "value": "799a0831a87f80ddced683cf26c082c58c936a1bb868dd0e97552a9f035ba4ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147581, "uuid": "a171cf6c-8e0e-4452-96e4-5960eafa2ac8", "comment": "Malware payload (NanoCore)", "value": "112314d871226e07180bf2d0a2852120cbc1399f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147581, "uuid": "da921278-6149-4029-a54d-b1957a2d89e7", "comment": "Malware payload (NanoCore)", "value": "94b907c2c59a72074ceca083b0c2dd5294810f7c685e9eb94efacdcf9fffecae3e10b89156d2a4907800f97a19bb1d0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147581, "uuid": "3b591a88-4511-48bb-8641-1055df1a38fe", "value": "T191421B51A3D45A7BDC769A72BC2755000A34F33ACC565F6F28C9102E9DA33151AA3739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147581, "uuid": "25a94eed-590b-4aee-8d85-2b6df1e8d5e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147581, "uuid": "fd7ceb77-8958-414f-b640-9af9321fe779", "value": "192:RylWethV1SLBdCYpy/zFkKt7QqMT0U2/JT0JN7Kae6b4vT:RYWetP1SLuhk6snT0UUKN7Kj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634147581, "uuid": "f7f4e62c-4190-481f-acff-5d24287a15c3", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634147581, "uuid": "a5b24482-e81e-461b-ad5c-5f4ab37f7b8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147581, "uuid": "abc23705-3c2c-47cf-bab5-59857ffa6a60", "value": "5b3262b61a5eaa3ebe7e8bdc4958fc3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7f5626-2c4b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634146381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146381, "uuid": "a8029a89-3efa-45c1-999a-8f305a435bbc", "comment": "Malware payload (RedLineStealer)", "value": "90a0832fbc4fc1339678fc7561a8ec90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146381, "uuid": "0eb69642-9286-4adc-9ca8-42699991ed91", "comment": "Malware payload (RedLineStealer)", "value": "79eb109f62c883549a6a2b1dbe9428efcc66ca8dcf57a91b87f88d08499b6369", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146381, "uuid": "d7c94921-6d8f-46a8-9416-e1e795ed4842", "comment": "Malware payload (RedLineStealer)", "value": "c362f758b633e7fd68404e5425ca8af4d1fc0e65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146381, "uuid": "61fec482-8fc9-425a-ac91-de39b15ee456", "comment": "Malware payload (RedLineStealer)", "value": "0538f2610a5fbbbf2c59c1d845f20cc1ccacc15cfc97b6b689066cef3e94d74ac67f205c7f40c25891ccd7f5d62a86d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146381, "uuid": "9fbfd0eb-899e-4590-962f-277b90bd36aa", "value": "T1BB46336F87178998C97502BE891FFF4962703A41EB4F16EFC9F09C7EB62511B920107A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146381, "uuid": "3e43e601-c3d1-46a2-aa37-2f403016ede5", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146381, "uuid": "c94de348-3afe-46fd-bee3-1276d7361a80", "value": "98304:TWUlwaBElxrX/JsjfpConmg7EydO208ZA4UVqiwgyy7op3qhqdmvhvAH8e1:T9lTMj/JkLmcEf2a4WqiHU6gQvh4V1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634146381, "uuid": "7559ce13-2e37-4423-995c-f67a6afa7b5f", "value": 5353541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634146381, "uuid": "f1ffe884-fbee-47a7-9463-96095357cfdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146381, "uuid": "ae7dff40-b90e-4ef2-b9d5-f6683577dbc8", "value": "BF2042.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82fe3107-2c4e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634147625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147625, "uuid": "cf507451-cb38-4dc1-b203-1531cd1c27b4", "comment": "Malware payload", "value": "dc9c507060466984b5ab2c58ad4f31f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147625, "uuid": "759110c6-602a-45f6-b378-f5b75a8cba06", "comment": "Malware payload", "value": "79f54a550f13781f7b9b3589c83295608d9e89b25deb2ffca656f406862aa8b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147625, "uuid": "93ce47b2-8467-464c-ae66-3b926e964b76", "comment": "Malware payload", "value": "5eb3ab523222a1e1b0ac419a18e0bb5ec32e5dd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147625, "uuid": "a9f42963-c3c1-4e0a-a91f-8006e9d98db7", "comment": "Malware payload", "value": "78fc90c9753ab1a86538dd3f013941943e5755eeeea76098d6287d453952d1d3c10dd8dfe2c91670f852922734ca4283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147625, "uuid": "8d7e47cf-79d6-4237-868c-f89f6207ca59", "value": "T18FD2D0212B58C052E4BB8B354CF3634256B3BD9A2096878EF8C5432C3CD6366DEB5739", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147625, "uuid": "b29fd1de-aa60-4894-af00-3fba61829e55", "value": "768:Fhg7d73RBqrq3qcbf3xu4dn5DHff5V7CS8F9FD6O:E7xRsuHtu4dn5dVV8F9J6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634147625, "uuid": "2d66d81d-5788-408a-acdd-213b5b6b3403", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634147625, "uuid": "d0c05bc7-efdd-4b1d-9fe9-85aec2dbcb99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147625, "uuid": "a62cd6ac-4632-454f-8d65-b87261437306", "value": "YZF2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31501060-2c48-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634144911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144911, "uuid": "6e5aeff6-8a12-4a42-9e8b-e73134e42198", "comment": "Malware payload", "value": "fa011c77c78933549bc583a553c23d8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144911, "uuid": "370d6d39-c225-4b20-9ad9-dc256f303253", "comment": "Malware payload", "value": "7a4348142c3b70bd9a8eb11c25fbd2ed9cf9fe350e770a183102c33e0557dceb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144911, "uuid": "1ee41043-0019-4559-8744-c3f9d8d6d37e", "comment": "Malware payload", "value": "2c756c075448eaf41cfffd450d3f2b0e91ca1d9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144911, "uuid": "8ddaa0dc-9346-4a12-b5f1-f19ac032431c", "comment": "Malware payload", "value": "42617923140beeb805d95861760887d01bbcae4f3ad9d5a3e2f3ec46847d5f502f96b612e2d238369f1b0ea2dd94f5dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144911, "uuid": "8760eff9-c883-4903-987e-a56d335d7a8c", "value": "T1C9D4ECC8331331BEC656C431AF7CDD7BA6E83466432A81D25463319DAD5CF87AA0D8AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144911, "uuid": "15cc1df3-f64e-48b5-8773-4277619d4368", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144911, "uuid": "69e84cd7-1076-4f1c-b268-02bcf765392c", "value": "12288:M62tOTGfLSfZAOyQq5J/zTtjIpQfUEnPVFRYPl8Et9sw:vcfGZA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634144911, "uuid": "266bee6c-58ce-4353-92c9-24821fcecf08", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634144911, "uuid": "bae97c22-3ec4-4460-974c-cd68d5cb363f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144911, "uuid": "dc70e488-b5e5-4522-9dc9-14ba38f3089d", "value": "SecuriteInfo.com.Variant.Bulz.774808.20481.8465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d9a2d2-2bcc-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1634091692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634091692, "uuid": "05c36069-0f28-4167-8726-5fb65bf795cb", "comment": "Malware payload (CoinMiner)", "value": "84c23d26753d0e37805940f21dd41835", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634091692, "uuid": "8f9e3aa1-8f91-4ea3-a6ae-a282d3190b1f", "comment": "Malware payload (CoinMiner)", "value": "7a9a5d9e658b0978ed46091f7b7e62ca5f994eb3c3a76867b7f82a965cc336a4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634091692, "uuid": "fac03fe9-cfe0-4f29-890f-1e7386b78b58", "comment": "Malware payload (CoinMiner)", "value": "5fc6556b721855169ba57b668edf79ab07272a73", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634091692, "uuid": "b37fc1b5-95e3-4357-8846-6cb45d390c12", "comment": "Malware payload (CoinMiner)", "value": "b653af8bd5141b1fe6c13fcaa54285eeee6b8fef55cdabc262c542474f5632dfd6f28538677895ae530ee1c4c97961cd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634091692, "uuid": "23ca5c3b-d95c-4458-807a-7664557d7551", "value": "T18695335E61BD5247FE26C4392925D7E02A4B3D375050F3282A1BA63B8FD09DC63C5B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634091692, "uuid": "8f8d1ada-80c9-4e88-b001-22ef452a3bff", "value": "27516fd8750f40bdecf52a1420a0296a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634091692, "uuid": "6fd9b0f1-6935-4c4a-b4df-a15d015d8f32", "value": "49152:myjbVHCWI3XqNhuFcDyUn/Bt1uLZKpuzXTnXxf6bG:LbFeHs4FYyUnZjicpSXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634091692, "uuid": "98c54604-b611-4021-9a91-b6b3e9015e73", "value": 2038784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634091692, "uuid": "44c7c242-4c2c-4cc7-a5e8-393deb5c248a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634091692, "uuid": "64b25815-ce6d-47b6-8f29-b99f2cbba72c", "value": "84c23d26753d0e37805940f21dd41835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d01f5e6-2c1c-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1634126167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634126167, "uuid": "f90654ce-adec-4611-a0cd-dbcf7c3a0cfb", "comment": "Malware payload (AsyncRAT)", "value": "3511a40e0973645c5269104622d6cef8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634126167, "uuid": "9a7521fc-8fc4-4c28-a3e8-bcc9f79bc61f", "comment": "Malware payload (AsyncRAT)", "value": "7a9ab75d21dbeda753523103025aa091e84b613864651f1b4b25cc83a0a6baa5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634126167, "uuid": "ae5423bf-bfb0-48ec-b987-c77429c8a5a9", "comment": "Malware payload (AsyncRAT)", "value": "239468a094d7e96b830f3eeabe799c2cc22d7159", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634126167, "uuid": "f2578a80-166b-4940-a8df-a5bd286167ba", "comment": "Malware payload (AsyncRAT)", "value": "c7f8bdcf52d20d3d7e6dc79835bc08c3b154498f29272cf347f9766145e0fe866f94404b2db419cf3fd12b88793c7ffc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634126167, "uuid": "cb895b36-f69a-4cd7-8417-7a75a80e0f5a", "value": "T15A748DA47F99D90EF3659C781131DF84C63D664B3B13C629D9BF507A92ACB8438C2287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634126167, "uuid": "02327e82-bf93-4530-a2e5-60e9abeef6e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634126167, "uuid": "6d7dd631-c033-45da-a058-c48c2506b9c9", "value": "6144:MOlEcEbOcCIWUyp7aEGlJKSTNS+u5XGMkhBjbYB:MOlvwvCMyplq3xu5FSBjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634126167, "uuid": "6229c1f2-fbb2-4ef5-8a83-1fa43fc5eb7f", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634126167, "uuid": "52c6cef1-c32a-4a05-a808-dd6b9fcc4ed6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634126167, "uuid": "2b453387-70a4-437f-8f17-5f6dfd6c332a", "value": "0009876545678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde45811-2c44-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634143483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634143483, "uuid": "21fd008c-56f9-44e3-bbda-b51699c5f99e", "comment": "Malware payload (SnakeKeylogger)", "value": "be7028fb61742317f9450fc8c9768539", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634143483, "uuid": "e36ff58f-54aa-45f7-a1a0-5f26402af204", "comment": "Malware payload (SnakeKeylogger)", "value": "7af01cda21a434323eee7b499bea116e84f06e5985d3fb3aa5775630b4d660e2", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634143483, "uuid": "d8ea5188-3183-44fc-bbbe-f0eab57664b0", "comment": "Malware payload (SnakeKeylogger)", "value": "e16742a254b880987bbe606602ebcd26d3c25596", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634143483, "uuid": "02b7196f-bf67-47ce-87f0-b0338dbbc165", "comment": "Malware payload (SnakeKeylogger)", "value": "ef2b8a166d2d28ec4dec613a6e885cc3589aee1f324633e760e3b8aa0410c4bc46e44653376024cf572444815fd7337c", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634143483, "uuid": "ce3e3fd4-0f1a-4c6c-84bf-f9539515fe32", "value": "T15874D1A77D2125D1EA43B9B2AF8702ED801FBC6581B7C1FABDF3BC2400B9AD74459518", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634143483, "uuid": "08b5286f-c564-4ab2-a0de-bba5bd7c7859", "value": "6144:+5wlWAVAhQCLMcBctBPM23LiJQWUpL29YOeJGpb0EKemsLCKtLCX5:GMqhQcBcPU2Np3pJGZbKemsL/Zo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634143483, "uuid": "ff7f434e-9466-4e32-95a6-dcf2d74f5daa", "value": 350936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634143483, "uuid": "4b4682f9-4611-4666-9068-63f24db4f388", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634143483, "uuid": "3c28c210-1fa2-40c5-a9fc-a8762eedb604", "value": "Paymentslip 10132021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74de66c-2c30-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634134936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134936, "uuid": "11b7b1dc-2b8c-409a-96ec-e5ddf60a071b", "comment": "Malware payload (GuLoader)", "value": "261b89797cb2864afeb6f968106b42c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134936, "uuid": "c3ecbe6a-c7f0-41bf-93a3-3f0c2e4a620d", "comment": "Malware payload (GuLoader)", "value": "7c8515b78f74b188965d84c98cfed02aee2d242c5365bc04a7690705c8b5c743", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134936, "uuid": "f41b56c3-c599-4563-a083-a9398372eeb3", "comment": "Malware payload (GuLoader)", "value": "3a213afbd149f81b7727efa53f02a69bab52efed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134936, "uuid": "38fde531-c18f-409d-bf52-1daf3d328ca9", "comment": "Malware payload (GuLoader)", "value": "5fa460c4b7f43a8216b53070de840f5ebedc3e83f3338b235ac5eec7789bb126ecac611de11a8c1b45cc2abc1819fbc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134936, "uuid": "0a5ecb81-6e5c-4b96-adf3-e96d345b464e", "value": "T1CBA36CC3698CA8E0EA4059BD0F7F5427172CBC735C458E076088171BD96FF82A9A976F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134936, "uuid": "3869ebce-7be6-4329-853f-5d1de7b906a1", "value": "3d3cd1bd8dcc611a5734bf41f4e1a6a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134936, "uuid": "15797886-4a9e-46cc-bf4b-79508cb80ee8", "value": "1536:t3DDioJJrBe6nw1t9UX6wV7HmRC3Cf4D:t3ni63e6nw1neGgyf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634134936, "uuid": "1843de35-449b-4fc6-a8c2-abc0296d8471", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634134936, "uuid": "a7b9c50c-becf-46ff-8a0c-bf542b40a801", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134936, "uuid": "6eac2c72-9de4-42c9-baff-7309b1361889", "value": "Delivery note_241493.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a6f021-2c28-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634131386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131386, "uuid": "73b55abe-a399-4f1f-bcbf-5e75dec365bf", "comment": "Malware payload (Mirai)", "value": "7a01c6a1b4bf5d616180196869cfec97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131386, "uuid": "5bb1b1f6-3282-4af0-8fcc-3a3bbf7302d9", "comment": "Malware payload (Mirai)", "value": "7d68c3a4e8dd99f3229e923a1c9021bc3601bd73820e0809b0dedbcde7594935", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131386, "uuid": "50e48ecc-7a24-42d7-b8ac-78d46c726392", "comment": "Malware payload (Mirai)", "value": "283d80a7500cf1ccc4d6a08e5517a7a81f7bf7ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131386, "uuid": "6affba53-7389-4a51-979d-aed992173096", "comment": "Malware payload (Mirai)", "value": "bd605980df8497b253b6d29c236043a347f61a0d00eaed95606a90ad5d7e0bb0b3054c919281d7e39770cedfaae29dbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131386, "uuid": "73a69207-d22e-41e3-9445-84a3fc6b7a13", "value": "T104C3F972B900DF66F00A92B504D78B227E30BFE70E932661735B3966DD361D52CA6F48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131386, "uuid": "6a047c83-e5af-45e8-8dbc-462e4ebe416b", "value": "3072:/hoEcWuWl6FWTMYdUZJyTZLuUjmm/QcuLB1niDNb:/qbWP6FWTMLyTl3jmm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634131386, "uuid": "d0460790-6ade-4354-afab-25e2ac2e9baa", "value": 120602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634131386, "uuid": "e5505c07-1171-4b24-b1e8-3160226747e9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131386, "uuid": "8a4698d2-00d4-4f8f-a01d-ce22ee1b647d", "value": "7a01c6a1b4bf5d616180196869cfec97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97761e23-2c1b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634125755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634125755, "uuid": "544f74c1-f775-45f9-99b4-69d16bd746f8", "comment": "Malware payload (AgentTesla)", "value": "dff63bb0e526c691348ec2c45a789a94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634125755, "uuid": "b9f700a0-d613-4557-b537-b56ead67743f", "comment": "Malware payload (AgentTesla)", "value": "7e75e8e5338cf7b9f4059d5cc8e8c9c9dfa465a3d3514f6bed5078576b0310b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634125755, "uuid": "d0306ae6-d145-4a3a-b8b0-8bad676cbeea", "comment": "Malware payload (AgentTesla)", "value": "7ac19523d20a32b03f8811d022f832ca4e4c8642", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634125755, "uuid": "a6686a55-4239-4c2b-a508-2a933ef3df0d", "comment": "Malware payload (AgentTesla)", "value": "6b1e7b644455cfd3478c7ecb9045984a033d76477ececf6f8abe52d9c9f6c470416b47313c00b472209daf3228c73b20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634125755, "uuid": "f49bb17e-0958-450f-bc04-bdbd005ee439", "value": "T182A423DBFE17E70C193399DBC25ABE46E3A602FA6603BC9D01B3D4B90126465FA140D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634125755, "uuid": "97c1c2d5-efaf-4eb4-900c-a1a456cadf9a", "value": "12288:+5unsXZzCqM7PuUNJM6X4uNp/hQmeKThj:Cu6y7PueJAuPhQYFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634125755, "uuid": "b9c3e8b4-3312-4a1b-b5f1-be684b00f044", "value": 467233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634125755, "uuid": "855232a3-2d50-4b3a-bb8d-629817da84e2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634125755, "uuid": "23181f37-29bc-42a5-ab39-78d4c0dceb76", "value": "PI 1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426050c0-2c20-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634127760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127760, "uuid": "bee71d4c-0d4d-4738-96f8-8af1248ed56f", "comment": "Malware payload (AgentTesla)", "value": "4ed1ab189c59d6cea668c376d5ad722a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127760, "uuid": "dad8918f-9fee-4ce8-8cfd-6308fda83d0d", "comment": "Malware payload (AgentTesla)", "value": "7ec2d1f247a3b1699defc0042b8caf081737d897462ade5c7c4d2345a5d665c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127760, "uuid": "4d5dbb7c-485a-436f-9dfb-a1d2eb98d617", "comment": "Malware payload (AgentTesla)", "value": "1457e3cf72001e5b66082db579336e4d605f00b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127760, "uuid": "f4b4a976-af7c-4a78-9dac-041dc79206ec", "comment": "Malware payload (AgentTesla)", "value": "74fb974e6d44a4f1119f9f54e2021886eba04f9fdc5dc4b6065191e29feb2fe9462b5191e1fcf71ea2dab52d68881c83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127760, "uuid": "cf0f2581-478c-45c7-a6d0-3fbafcc3a3d8", "value": "T18E542333C4802B4199E75BB2EF5026643A93227D49C991E31FC6BE6843252F6F7D4E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127760, "uuid": "4858a09b-fbf8-44d3-8177-fd103434ff5c", "value": "6144:Ady4tIxmzHeOJOXe4MwRRyScn0Q6JEOWzfAKimCZYcGfOro:AHP4NRrcnzkEtfHimCHGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634127760, "uuid": "8933911d-139f-4940-aa44-cb5604408e75", "value": 287945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634127760, "uuid": "6b652ef9-1e34-4707-8dbb-388069220b6d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127760, "uuid": "811efe9f-fb85-40e4-b404-1077716af7a6", "value": "PO#1135 - \u88d5\u5049.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2666e31f-2c34-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634136303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136303, "uuid": "15ab212f-547e-4cbc-acb4-bd41b09d08b4", "comment": "Malware payload (Mirai)", "value": "5b9e1df559478b0f2ff289ca63c2ce6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136303, "uuid": "b7ca7fbc-2d1a-4d01-8b9a-849d67cd7bea", "comment": "Malware payload (Mirai)", "value": "8063573efe5551186993410cb04682cdc0a235a83af331fb4876d255c1edebc1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136303, "uuid": "be97819a-1a71-4c75-9a91-81e98dfb446f", "comment": "Malware payload (Mirai)", "value": "e607a7f859c08be16cf68662a18f1b53cc378fe1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136303, "uuid": "4d39440c-b8ff-47c0-9722-c5929fcd3af4", "comment": "Malware payload (Mirai)", "value": "ca09495c16d653649689ae0916e37946914039255b6382fcfa8dd51b66ab84ba7e10ee2e1a2b0f5af651b94186ac2601", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136303, "uuid": "7ac4b938-5d94-4314-9af5-067ae759a1c6", "value": "T12F735A01B3584A47E5A61EF4393F1FE197BEEAC022E0F5856A1ED7465172E33484AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136303, "uuid": "a72d962b-3284-4132-98d3-b713ab9cab34", "value": "1536:DNpp9RXI1vgi0uvH8zomzrKRyxOReqpNiSejOjNfXM:Xp9djCOomzrE2Se6jFXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634136303, "uuid": "89d4cec0-55c1-4fd0-a4c3-4b7b379af0fd", "value": 79080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634136303, "uuid": "413e9fdb-861e-4808-91d8-610961b6eb4b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136303, "uuid": "e4b935c5-ce86-41bc-b529-3afc5ba587b5", "value": "5b9e1df559478b0f2ff289ca63c2ce6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1606bf-2c0b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634118762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118762, "uuid": "7e3155ce-9068-4a1f-a9d8-b97258090102", "comment": "Malware payload (AgentTesla)", "value": "4a35cc20014bc25b0bf312a55cd79609", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118762, "uuid": "c103491a-e66d-4b42-b01f-11a8c2c2be59", "comment": "Malware payload (AgentTesla)", "value": "80f80fce8f653421b7750979b47f30d366e6cf9467c042a12fceffe1d78c3259", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118762, "uuid": "4eb6855c-4b06-4e56-a254-a2547c5a6da2", "comment": "Malware payload (AgentTesla)", "value": "25b66be227377fda713e49a2cc3bc1b17255250f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118762, "uuid": "ff495070-c21b-4c07-b369-e73be569d3f4", "comment": "Malware payload (AgentTesla)", "value": "e22e40866a26950663d39db4aaa9a454f73815304a1e721a50dfe2c9fbc13739479abc4ff9d166deba0bef68b7751607", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118762, "uuid": "09c3b2aa-cc66-40a0-b9bb-ef174c71be7e", "value": "T132D412039FB1999AE5A80FB24062DAB1CFB0DC80BC81FB555DD43DA737737D9048668A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118762, "uuid": "17938692-41f3-4002-a2c8-3642045442e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118762, "uuid": "1b5a0762-7f45-4dab-be36-8a52b6f56958", "value": "12288:SH7PkWwh1tacvUOe7uYdUZdAeoh5vQ5Z7D43jyl3VF9BnSB:U7PZYac7ouwUZSaZ9llFbSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634118762, "uuid": "4a539bed-ff2b-4897-a1a3-9f6105b8e251", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634118762, "uuid": "64dfe30e-8de7-4177-ac58-838e60528694", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118762, "uuid": "e24df97e-a21d-42b0-b8cf-122b73a0438a", "value": "INQUIRY CONFIRMATION LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df97a93-2c55-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634150489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634150489, "uuid": "8032db31-6b53-47aa-83bb-ad6ac7ee07cf", "comment": "Malware payload", "value": "75a44ee79a0e443b5a16f5fae46335fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634150489, "uuid": "b58f08fc-0ec0-478d-8ea1-758dc11b3143", "comment": "Malware payload", "value": "8211e183cf4cc7512e0be720022cdbada7211f7b9af4fc2aaa6d4e2dcf149a63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634150489, "uuid": "d260fccf-8617-4f6e-a82b-a089a4d237dc", "comment": "Malware payload", "value": "707283e5f25127873ce0683a4640515b5287d167", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634150489, "uuid": "e459aa25-461e-417f-aa65-6c7a190ddc8f", "comment": "Malware payload", "value": "1f4c49d1305367479376b8b491b86d85b317053aa4a8c0efdfe56454a588221913f4c71421e626c9fee5adda5e3edde9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634150489, "uuid": "3548c901-4dcf-42b5-a075-d3819b85134f", "value": "T107B533C6F2CE7C51C25AC1F3B76A860D166DFA2B563A13305D7801EB4C81B4CA2A77B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634150489, "uuid": "0aa67543-dbe9-4b83-8237-d2f4bde5cc2d", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634150489, "uuid": "0202f1c0-9027-4910-af51-d8099e706f22", "value": "49152:PUmQMrskR1u3DUFgvnMafgmtKck7sLeGzAm4H8ZQ2l2:Ph10TegBfUcZenHgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634150489, "uuid": "1048a3d3-cf09-4186-9ab5-a07d85c3f8ac", "value": 2317280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634150489, "uuid": "e680442e-c327-40d9-a3d3-554f7e1c26e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634150489, "uuid": "33228646-e831-4cfb-8b6b-f403c1e36488", "value": "NBA 2K21 Cheat by Spyro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b847ee39-2c34-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634136548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136548, "uuid": "9db73523-c55f-4628-8a28-b67421438cb8", "comment": "Malware payload (Mirai)", "value": "91cd39dc7a5dec71dc48d052da939857", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136548, "uuid": "50cf3860-9429-4799-8545-a29307ab3009", "comment": "Malware payload (Mirai)", "value": "829e541ea5fd75a18c8c0b8334e96053e78e6cb12f33786f7ffdb808b7a6bdbf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136548, "uuid": "1f8382b4-bf96-4080-9147-6952551c0876", "comment": "Malware payload (Mirai)", "value": "e2c961e2c7b4eebe2d4e7e75bf0c5c6866b4cdf2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136548, "uuid": "2255418a-75fe-4412-87a3-d959b5a7d36b", "comment": "Malware payload (Mirai)", "value": "a786b25a449b3f2ff20bae497f36da532849e2373d72ccca90a4464c1ac26f5fe66336c374eec671c596ecbe6dce13a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136548, "uuid": "f45797b6-68a0-4ee4-bd3e-6ae22781c13f", "value": "T1B4932986BC419A11C6C21677FE2F118E331257ECE2ED73138D245B707B8B91B0E6B95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136548, "uuid": "94fc77e8-59cd-4930-b4b5-5aedda3c6518", "value": "1536:XhnRcUWoXufJ4Au8YKzvs/J5zVMcOLaUl9aFmLbRMIiEg188Qxc/5SYG:EUW+lAuG0hMRu0awg188Qxc/E1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634136548, "uuid": "ba6a54bd-9990-4e16-ab5c-5a103ad4c17b", "value": 95476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634136548, "uuid": "72a0c207-5a90-4cec-ae11-668593a62379", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136548, "uuid": "81c43a08-b214-498f-a536-75ae994b6a74", "value": "91cd39dc7a5dec71dc48d052da939857", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590d223b-2c0f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634120497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634120497, "uuid": "980abe05-c83b-4108-b630-d585a25c74f6", "comment": "Malware payload (AgentTesla)", "value": "6079ba17197559d10fea706ddcd30110", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634120497, "uuid": "f8377ab5-3dfb-47fa-ad00-53fafcffdb51", "comment": "Malware payload (AgentTesla)", "value": "839d79e688de173b5a593ecfc6738dc9f0943ae891e339326ff5ce464ec83bd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634120497, "uuid": "4d897790-06eb-4349-bafd-f4feb968c6ca", "comment": "Malware payload (AgentTesla)", "value": "320c0cba08dcd2ee49deb1537b714499832e5c25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634120497, "uuid": "5d6a1aae-8a3c-4005-8ecc-8c7bbd16dac9", "comment": "Malware payload (AgentTesla)", "value": "2b469aa26a7386561f5f2f5524f73185f8ea65df6c9c7db803533727e80f1807c3ee82578a58fbe0bac97f1dba9adaf7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634120497, "uuid": "778b4b46-0ce4-490c-ab9c-e7b8e68b07a3", "value": "T1EFD4D0A47F96DD4BF36A9CB81131DF84C67D62473B13C629D9BF507A92AC79028C2183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634120497, "uuid": "dcd1e8cd-fd22-450b-a7e2-ab17f7e937b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634120497, "uuid": "e1ec2470-3a17-4bac-a437-08c6708e52c6", "value": "6144:sMkhBpfZVrRPpkWff22FBaJd2+FNzvbU0Bg7GLZ+BXoEAs+jbtaxxClUQtoxTfYB:nSBpxxkWo9PWyLZ+KEJGaQUBTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634120497, "uuid": "f9b992d9-83c6-46e0-b28a-0a287d1c935a", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634120497, "uuid": "b4bbb91c-97b3-41b3-8c8d-f47ecd48330b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634120497, "uuid": "5957cf99-4670-4e83-8c84-175ef84482cd", "value": "Scan01000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd30f35c-2bc4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634088479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634088479, "uuid": "27e8090e-dc50-4b18-a551-254fe6c0e6eb", "comment": "Malware payload (AgentTesla)", "value": "691001491c968bbc73a4d1c98e3bbbf6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634088479, "uuid": "16906414-b64f-4bc8-9067-5ea53dcdcfcb", "comment": "Malware payload (AgentTesla)", "value": "84c4af3a72552f827a6a2b44a64ee3e06bb01f65e657b8982e5ccb49ddbe7211", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634088479, "uuid": "63061e4d-1453-4490-9f07-0567aad7460a", "comment": "Malware payload (AgentTesla)", "value": "666e2f657c0ad9e3ff6065065fc6091a026c5edd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634088479, "uuid": "dd82815a-4c3b-4901-af9e-d672f27903d6", "comment": "Malware payload (AgentTesla)", "value": "82b98c6c9483985238921d8482cfda2ad306d28ab5ce17a2386e0f0cc902e7213459bb843eca00bf0894932eeb762ed6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634088479, "uuid": "a5907ffe-9b56-426f-be21-6ad9f0aea291", "value": "T179052301F8B98F14E71F9875AC4724C50273AE098C4A7BCE34A9BC7B75B92416D8177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634088479, "uuid": "5ad3f85c-7e5d-467f-b344-90ab075a286e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634088479, "uuid": "8c218f90-879b-4889-914e-2555d569a504", "value": "24576:47nP/7McFLACYz3+vVU2P5DXTekrr3wO:4Du32VnPVekrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634088479, "uuid": "791600f3-fac1-4e39-85ed-551fb53e6255", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634088479, "uuid": "f492b0a3-9769-4d16-b45d-2ab4760cc50e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634088479, "uuid": "baa57f74-5857-4c9b-aa9e-78c8e065852a", "value": "2021 Company Info + Product List.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8e3f41-2bf1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634107806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107806, "uuid": "f7c72530-9835-4c52-b8a1-c9a1a358f824", "comment": "Malware payload (Mirai)", "value": "c8300c7a53fa98b9038ae695b6bcabfe", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107806, "uuid": "0864f834-7140-4501-a548-35db913813c3", "comment": "Malware payload (Mirai)", "value": "84e4f8a9425e79efceb88ac9e6b6496e406e028bee5d5e6bb42b13a4ad1e2c1b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107806, "uuid": "e189e498-edc4-4789-a1b6-7838bd66b4c4", "comment": "Malware payload (Mirai)", "value": "1b28ccc30e1fc99a2a7b26b39dac42d37f2b92f4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107806, "uuid": "78af16e1-8fce-41b3-a4c7-dad0beb2e9fd", "comment": "Malware payload (Mirai)", "value": "a43154acfcb0bda772b8e1b3807039d7f159de73ea98593f8ae8b54bcb39d781cf6304d1a9885030108e8ba2abd28450", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107806, "uuid": "6cab32d6-d1d1-46e1-a854-86f3f079ae6c", "value": "T137F2F1B3D13F8954F81F50771AEDFD8E2540872A156881B91BEC20B79C5EA4EA7187CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107806, "uuid": "e1411c5c-d9df-4be9-bc69-07e4606bff9d", "value": "768:oZyl3PVBasO1HV0l92zdsyA+3VgeBeDOJ8h6rn3ypSvqNTnbcuyD7UHQRjv:jl/pIyi65DE8Yr3ypPTnouy8HyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634107806, "uuid": "a453fecc-19c5-4ae1-8bb8-d0145d53074b", "value": 36140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634107806, "uuid": "aa09bc32-2001-471c-9439-a8a31d2d6e71", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107806, "uuid": "75b2b2c8-9cfa-4fd4-b7e0-c6f3155a5e2a", "value": "x86-20211013-0650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fda298c-2c12-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634121662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121662, "uuid": "b510517a-2aaa-463b-b49e-3a32b7e7b8af", "comment": "Malware payload (Mirai)", "value": "47a0d70367b213708124f926d411514a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121662, "uuid": "15b5e3da-ea38-4b20-8df3-da665c380df4", "comment": "Malware payload (Mirai)", "value": "861201e02ecc8042166dd13f3634dd43ebd15b76bae2e13177e9c8d01a915f67", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121662, "uuid": "c407b6a0-4039-4727-987d-9ff03eb3850f", "comment": "Malware payload (Mirai)", "value": "0950549f09be744e825c29a32567d56d663ac94d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121662, "uuid": "6f838dd5-0e06-4c07-bc9e-da11423f780a", "comment": "Malware payload (Mirai)", "value": "e7dbe30ca16504487b003e90e8ec88a55419bbe7678db67dfa54e17a7a0328553c34d35e02b5ff81b19faac2047df767", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634121662, "uuid": "6dd65738-47cd-44d6-8a7e-f9abe67dd6f0", "value": "T138B3C80D7E219FBDFBEC823447B74A259648339A37E1D584D1ACE9011E7024E742FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634121662, "uuid": "6e51f9b7-7ba3-4555-baf1-54435e2ff8a5", "value": "3072:rXo4le/RgyNMXDrXNRKeC04zNVyPrqx7Zh1:jo4lAiXtRKeC04zNVGOF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634121662, "uuid": "cdec0139-8a7c-496b-8157-83ac9fc8afa5", "value": 108276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634121662, "uuid": "17a5d12c-ad21-4d21-a2de-23e0becd7040", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634121662, "uuid": "89afb67e-55ae-4e7f-b56f-0e2a040aa04e", "value": "47a0d70367b213708124f926d411514a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74851098-2c49-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634145454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634145454, "uuid": "41714307-ad4c-47cf-881b-dcc5f4466229", "comment": "Malware payload (NanoCore)", "value": "ad11013370f4f8e0461dcf78e223287a", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634145454, "uuid": "d1b04c61-6ed5-4f49-82bb-ae0bbb3b81fb", "comment": "Malware payload (NanoCore)", "value": "8627a4712f0f6f4cd02e154ac0e9e1ded5e254ce9dc98b930baebcb9395d71df", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634145454, "uuid": "1a4506e2-7bd7-4808-bc41-6fb87739579f", "comment": "Malware payload (NanoCore)", "value": "a55978fb2eebf6707300ca36d831e2d01c682484", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634145454, "uuid": "9d91edbe-e141-4407-91c2-685d93a8a93a", "comment": "Malware payload (NanoCore)", "value": "6cb234dc0b4872a43464b7abba6fd79ec5aaebade25653cada72ec085869599080c6e0e0afa884e99b2b6042929ccbc7", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634145454, "uuid": "aa55708c-5f7d-441f-b9f8-0757f0417e01", "value": "T1B0253397EC6B879A6873142B06BDB35082FF5F63D59AE7000B412972F43B87691E1BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634145454, "uuid": "2eedce93-b6e3-484a-9e16-97fa658857b2", "value": "24576:vf/oaf9SvXwJNBkuU4rFfQjG9+mTPYHU7nd1RMmaNS:3Ai9SPqcuRUmcHUzdXMh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634145454, "uuid": "a1dc2637-63c6-4bc7-bba8-0f5ed6dae906", "value": 976698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634145454, "uuid": "eb895449-74ea-47e9-89e3-022220d09fe9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634145454, "uuid": "39338913-812b-4dee-a0f6-b3eb91123d47", "value": "ad11013370f4f8e0461dcf78e223287a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f4ffbe-2c20-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634127976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127976, "uuid": "df430ab7-0810-43c8-bda1-76045ff70bbe", "comment": "Malware payload (GuLoader)", "value": "1232806812f946a2afabc5f5fe489de5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127976, "uuid": "8ab285b6-416a-424c-a23b-a3ed06c942db", "comment": "Malware payload (GuLoader)", "value": "86907475c81bc4700fc465c758592c51e905feed8aecdc0c10ccb6a8c650218a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127976, "uuid": "822d5314-b83e-42e4-b46f-841aee6a89f9", "comment": "Malware payload (GuLoader)", "value": "f9a820627667403e90b3a387de0b644f8f0ddc31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127976, "uuid": "72f273bd-d39d-4ac9-a3f3-ef0b4886e67d", "comment": "Malware payload (GuLoader)", "value": "44ebf0462196a90fb34fb16b13b3abbfc51ec3893ea35662e87d27b7c7b777bcd3830673c3a9b40a235a86e1955d3366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127976, "uuid": "bcdd1da7-c9c6-414d-ade2-d92626fde189", "value": "T12CD3B2A126B08FD9E0A7967F17E6475431327E340952AE47F68CBE1E4E762E0D19032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127976, "uuid": "5bab9437-3252-485c-b1fc-094bb16a1a0c", "value": "c727a98e677fb7bd25bb06d2a2d956f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127976, "uuid": "b5fc8ace-bab6-4e72-9bc3-bf3e622842d7", "value": "1536:BO7rxt7IPeC+EPGqwK+L1zDfCyuOiye7cuA+gg+5fTMZ9cBjyG3VqbfuYpZN88M+:U7dK2CneTx3Cyi31SQLGZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634127976, "uuid": "9902fbb5-caae-484c-84d7-575e4835de68", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634127976, "uuid": "75f1716e-1fc8-4377-9e62-353e246d0a85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127976, "uuid": "ceb2c9ec-808b-4497-8013-e7ddd389d760", "value": "Statement of Account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e9e931-2c4e-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1634147462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147462, "uuid": "868a318a-4560-4806-9595-fc975ea23bd6", "comment": "Malware payload (RaccoonStealer)", "value": "8868027f8fd74497aed4e368e30b8969", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147462, "uuid": "349a46f5-c56d-41a9-b5b1-496bb3d46c58", "comment": "Malware payload (RaccoonStealer)", "value": "8795a656616316101fcc0ccdc8c6a014dbbcb143882dd39c1e4d4dc61c6293b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147462, "uuid": "bf60cc0e-2eca-4199-aa65-c23d3218f051", "comment": "Malware payload (RaccoonStealer)", "value": "43eea26d29d73cdb3738ab7638cecd541cf66f33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147462, "uuid": "461e3507-0cce-44b0-a47b-52d6c5963069", "comment": "Malware payload (RaccoonStealer)", "value": "c13fb26645e329d0d666a59b0ad28b19391627d9a14a4c0b21f884184b7015787447aa4da9054dddb9dae084de33bd4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147462, "uuid": "cec70553-3630-4551-8a17-473611a16067", "value": "T107C4D110A7E0C035F1F726F84DBA9769A92E3EA06B2494CF63D516ED4634AE1EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147462, "uuid": "ccf81dc6-df2a-4a15-8841-a0ba95da5dec", "value": "e9d1f1739ab48fbfe7c7128688524302", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147462, "uuid": "d31b93b3-a51d-4c67-8881-bd12c19172b0", "value": "12288:+Kxiy4uxtgq4fegTMWkSWqCUfFpFzqcMh1p1BOruaXu:Ay4uxo2gwBUpFzqccer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634147462, "uuid": "5f73a8f4-5541-4b79-8ee2-e90c861312fc", "value": 574464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634147462, "uuid": "65ef8adc-41d5-41b7-8ae0-f5a6e83c9cb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147462, "uuid": "539471b2-8d55-43c8-9933-46616ff875ce", "value": "gzQ1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c6898e-2c4f-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1634148081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634148081, "uuid": "ae697100-42c5-49e5-a166-d98d74e0bbc7", "comment": "Malware payload (BitRAT)", "value": "e60399a0e9761e7653376e878875ef3a", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634148081, "uuid": "af4221af-1495-44f9-a0b3-41335cc05e4f", "comment": "Malware payload (BitRAT)", "value": "881003326302ab243f71138e2e39517677c9117fd73e50f8989ee9b39e86407b", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634148081, "uuid": "86582eb8-fa94-4c03-8d70-4fa30bb42d72", "comment": "Malware payload (BitRAT)", "value": "a2d96bbe0837fcb7a1057e69c8b77960a81ae2b9", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634148081, "uuid": "b9d8291a-6e27-461b-b12d-7d900fc7d85f", "comment": "Malware payload (BitRAT)", "value": "f7406b7e8acb39fac57d05f714a757c66605e98740ac173484f88143f1bdc0bde6bcbbd6b1abe4c13eb5cd9966f105ad", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634148081, "uuid": "32c8a669-a510-43eb-9a07-624cde554cf3", "value": "T1DB852201B6A0C039F0F7A7F84975A268B83E79A1672499CF63D42AED4774AD4ED30353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634148081, "uuid": "54a3f122-a6c5-4332-bad9-7de670551c2e", "value": "e9d1f1739ab48fbfe7c7128688524302", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634148081, "uuid": "69ae2784-a3c6-43bf-9115-623dfb3413af", "value": "24576:aGAASJ+e1ne+6Iyc0mauZEpTZIc1h9A+1TcVDka13/n/nMFaWaiEpwqnyGpXS28X:xAALe8+68auZuZ6SMJPIaoE2qne28X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634148081, "uuid": "da645a25-683a-40c8-9839-e2538cbfde75", "value": 1776128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634148081, "uuid": "203a9cd1-d5af-4112-8d1e-9772e40debd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634148081, "uuid": "be4e01bf-1094-48be-9b3c-e79a6b58c48b", "value": "e60399a0e9761e7653376e878875ef3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a4c3f4-2c2b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634132577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132577, "uuid": "f56efe5d-35a6-480d-9110-c438c83e60bc", "comment": "Malware payload (Dridex)", "value": "5a5bbd8c04147c15575a07e24bdef22e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132577, "uuid": "a73802ae-f857-47bd-92da-563ec1bf0f0f", "comment": "Malware payload (Dridex)", "value": "88a94091ec39cf0fcb60f326e81f2a12ac40c6f41072f04dd0088d9c435e2d31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132577, "uuid": "155e24a0-2ddb-422c-9170-2d2e22321ebe", "comment": "Malware payload (Dridex)", "value": "e4506ef09698fb678f9e11190723499e0ee3b0a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132577, "uuid": "774e9f7b-e552-429c-9bd5-8689e85ee9aa", "comment": "Malware payload (Dridex)", "value": "c8d0f02414a17737432bf36dab1702c4674fe8541c76bb98acaf14cefe4ea72cd3262a4f8b263f58267ddd08952a6fcb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132577, "uuid": "f2294edf-3d52-41e5-bef1-1574311c93fd", "value": "T1DFD4F8013A54E821E7E955B6CF2AC6E85B183D49EFB0A4C778E17F0F2AA94F3D215305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132577, "uuid": "8c49bf15-c3a6-4cbc-8e66-6fd315ebd429", "value": "54afd981c141523b8c68b6a5bfed7202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132577, "uuid": "542886eb-f9cc-4c7a-85dc-d7bc0d6f821a", "value": "12288:uuIBfTwMtjp4CqwqyaXPLAfx38TW9DiWUT2tq017JGoLb2W/:J6b4wqyaDA5sTWiXT2tq07G2L/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634132577, "uuid": "b935f697-3dfe-40bb-b9ee-e55e86671c2b", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634132577, "uuid": "5d8026e4-5b43-4aa1-a70d-6218b7a92ba9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132577, "uuid": "ffcbfa10-02b6-4353-a45d-30cff98ea014", "value": "5a5bbd8c04147c15575a07e24bdef22e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8917853-2c2f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634134455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134455, "uuid": "bbe08158-c5fd-4a49-ac12-3e8648c16c59", "comment": "Malware payload (Formbook)", "value": "9a43d5d2ffc56e823280ca84f6bb870f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134455, "uuid": "4c59026e-f0da-4c37-babf-f6487e7de8fb", "comment": "Malware payload (Formbook)", "value": "88c07a30074065b292335ae5d4a45f905fa8a6739d3031d2f8236d2d9a27c681", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134455, "uuid": "21eb1b7a-46fd-4e09-aa24-01add60d5b7f", "comment": "Malware payload (Formbook)", "value": "f0945075b44bc2cb2c96b168d47a269eb0d714ce", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134455, "uuid": "e2651193-bf99-44ae-9ce7-dca7f7d141d7", "comment": "Malware payload (Formbook)", "value": "b7bf811bd612f2c4f7f3559b8281fbeeb7df6d1d3fa8b9e2f6de585dfc67b8caf366f389a8053775427b52b737107563", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134455, "uuid": "3e2f89f9-3c34-4032-905c-7aa715d49310", "value": "T17E74D1585B03B4F5FBC960B28766174829125CC06F893B19A6E73AFB3CF68A015B3DC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134455, "uuid": "c066e764-61b2-4fe1-96aa-51e73d4378b2", "value": "6144:1+24gh/BSPohIzJutURE/sI/j16YhtJHUf8HslNtrF5HyY8d:1+24gh/Chk1BlUf8ctrFYxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634134455, "uuid": "a5fbda28-93a2-483d-a882-662044e9d264", "value": 341944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634134455, "uuid": "00f60c87-da59-45c2-8bd0-c776b936a4df", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134455, "uuid": "9a70a495-e43e-483e-ad51-3e90f774afb6", "value": "Swift.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd5aca3-2c39-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634138409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138409, "uuid": "26deba48-1bd0-4b58-b224-3685b74f1adb", "comment": "Malware payload (AgentTesla)", "value": "b6b11ce450f713daa2e27dc07c2652a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138409, "uuid": "b4179869-71e9-40f9-93cb-7da151da7e6e", "comment": "Malware payload (AgentTesla)", "value": "8947b59e82b1518358d0cd119d2b1f9fcb732bb84b36a3ec6a3eaddc2909f67c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138409, "uuid": "7018d14b-35c7-4f9a-8a59-c6f8afae5b23", "comment": "Malware payload (AgentTesla)", "value": "0ac53eef30d37c4788fad3421e03a0aeeb8994f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138409, "uuid": "80f0095b-7c1d-40b6-aafa-468446c5220d", "comment": "Malware payload (AgentTesla)", "value": "158d76a0487373f54b3fd4835cd1b308a555e280bdae01b00676f53f5056474818c9da361785370df76159eb57c572c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634138409, "uuid": "180a3e1e-d271-4b42-b652-b865c20a35d8", "value": "T1ACD4E021334A8263E6BB0FB46013A32847B4FD256972DB7D29C176DF6F76B8092119C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634138409, "uuid": "abb43f6d-01ce-4d60-9038-1acbd92737c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634138409, "uuid": "ebf63cb9-2a52-438b-af18-fc1a91e0ee22", "value": "12288:LUMbuOeZrN4g7duCISibUaofWN/l2GlGSBnQpFPENgNi8:LU8eZrNJLHfWbl7BnUE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634138409, "uuid": "16ce39e5-b09c-4519-819a-ba35174acf17", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634138409, "uuid": "84cc008c-e1fe-46cb-aed5-0fdcdf1e07c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634138409, "uuid": "b5ed508c-c629-43fa-ac93-a362c9f4df19", "value": "invoice_2103006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e429feac-2c38-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634138339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138339, "uuid": "c533c7a8-d06d-4f96-b16e-0130655a1165", "comment": "Malware payload (Quakbot)", "value": "6f0fbda5aba183a77329ced0b074e955", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138339, "uuid": "1de9779e-4e37-4dcc-b354-ffd09139ada6", "comment": "Malware payload (Quakbot)", "value": "89d36570b04dbd402dfa2c7949b9f022d57d727ca2fdcfc83f03961838085965", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138339, "uuid": "fc4b50ae-156b-4e28-86bc-c618f4a9252d", "comment": "Malware payload (Quakbot)", "value": "1cf9509d80c0f181e3972cf24d992b0bcbcd926e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138339, "uuid": "5a58e14a-51af-44cb-ac21-ff8175eae990", "comment": "Malware payload (Quakbot)", "value": "ec91a9d46ff48a837c84a3b039b43f453e00adb0570c0da76b324597b8850cb3d23f6498c696d52b9f5cd9c60d0937f2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634138339, "uuid": "9406d0ef-5f6e-4f4c-806a-e8d0933b0361", "value": "T129D38C427797CA4BE54813398EE3CADB3772FC21DE62470336497B0E5E7A6A08C17652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634138339, "uuid": "995dba7e-3b64-420f-9170-226ab578cc6e", "value": "3072:vk3hOdsylKlgxopeiBNhZFGzE+cL2kdA6c6YehWfGMtUHKGDbpmsiitGmZyAqgOb:vk3hOdsylKlgxopeiBNhZF+E+W2kdA62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634138339, "uuid": "45061dc1-a567-49c9-a0d2-3517a7b99a9e", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634138339, "uuid": "758d6f11-6a00-40bb-982c-1ff86baff62b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634138339, "uuid": "88ec0a48-e635-40a4-b991-35e6f311d30f", "value": "Outstand_1081799368.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09cb068-2c15-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634123328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634123328, "uuid": "404bb629-99c8-411b-8786-817681dcdd7e", "comment": "Malware payload (AgentTesla)", "value": "3c04ba9289a730237701b53b071d31ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634123328, "uuid": "af9cd23b-449c-4ebf-abc3-a5db2ddb5209", "comment": "Malware payload (AgentTesla)", "value": "8a4f78ab0e47548c87abdc6caf54836208a1350d38351fd442129eb022bba227", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634123328, "uuid": "117ec183-b3ee-40dd-8a7a-474099b1bf0d", "comment": "Malware payload (AgentTesla)", "value": "d28ea7fc0cc3981f50e915ed5d3851549be8a694", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634123328, "uuid": "3c524bb5-2cb9-4ffb-869b-f87904cd5afd", "comment": "Malware payload (AgentTesla)", "value": "30b126433458ba829ebd1ee341aede3209cd71a00db873880d223a9465064ab484536b629ac94889d98579673811c4ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634123328, "uuid": "a9575bd5-b7e3-4d6f-943d-10840b82a165", "value": "T11AF49515F3929C11E567567364E051E791092CC3E858833DEBB3BAA318EA3805F5CBEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634123328, "uuid": "7be61232-5e92-44c9-b1cb-61a4bd7d7da9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634123328, "uuid": "d4cf6463-c7e3-4ec9-8471-5da0236ee689", "value": "12288:21o2i0Y9eELs7316OepenNftqcybhwFagU:c2LC31EpeN11ybhWagU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634123328, "uuid": "f3e734b8-476e-464e-ada8-85e377f00544", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634123328, "uuid": "2a5bbbdb-6a7e-4718-b5b3-defce26d65ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634123328, "uuid": "f1d64641-331f-4498-b129-8bb0d052a85a", "value": "R6QyqCNJgljVTjY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203d6556-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634108375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108375, "uuid": "bbb0c83a-e1c7-4aed-940c-e52a4b5e3ec9", "comment": "Malware payload (Formbook)", "value": "b325f93b71858cdf0680241ee06c99ac", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108375, "uuid": "3dda7ee6-c351-4642-b42a-cb08ec2af8ac", "comment": "Malware payload (Formbook)", "value": "8c6d3b3391546003ec3e79b35a851c14f03711eb6897047be63c5a8e289a64a6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108375, "uuid": "188c0354-31c4-4d93-8f08-680e1d1111fe", "comment": "Malware payload (Formbook)", "value": "62397a0e3f51d0a2536688d6b91769e54aec340a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108375, "uuid": "f5639e46-5e21-4a92-b861-11579248ff3d", "comment": "Malware payload (Formbook)", "value": "3d3d3c71c7333fea90f5da685f43284aa5c0cbf1d46e4ac6c446402337e174314addac94d7f96653791913ac9b5e1d1f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108375, "uuid": "c07f3bda-37a2-4e9a-bd74-eaf2e31dcc73", "value": "T1E464C0255C4D372DEF1022B78D3085F6B0B7EEDE8A612AF059B1324856784C9E5CA8FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108375, "uuid": "1f1791b6-804b-4bc4-81e7-f8f4422878d8", "value": "6144:rD55l5C/iJQdklwOaJ4JksD95zC6AizfOI0CzRdnFv/3L9LCv:v55l5Zm8ug95rZzRrz9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108375, "uuid": "9fc27398-e591-48ca-bd5e-4efe8b1087ae", "value": 317384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108375, "uuid": "1bd3b975-40f8-4be3-8ebb-bd4174f9efd7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108375, "uuid": "f9d8e4db-674d-4e84-bbb6-03a697a07257", "value": "INV#409.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a756063a-2c06-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634116763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116763, "uuid": "8d736ecc-ce55-427f-8fa4-3624d7302ce3", "comment": "Malware payload (Mirai)", "value": "348c689d0c8f527be7ea1252405260b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116763, "uuid": "2f7de3a1-24f6-405b-aa25-991db8f009c7", "comment": "Malware payload (Mirai)", "value": "8cd3793f5efc432cf396f336213c02a066933ab5fe21767ec77238819def4de7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116763, "uuid": "a5d60e4d-c2ef-46d6-ab1b-74a1d9c099f3", "comment": "Malware payload (Mirai)", "value": "c9e53e78e304233e2237b8959a182a22cba38579", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116763, "uuid": "0357c5b6-de65-4de6-97e3-3c173b5aeb5c", "comment": "Malware payload (Mirai)", "value": "502b5f8940b92eb883963f44ad3ec7874730fd61d49eb61d6568d8252ad143db95254c5e6cab111c6ea648394c40a2f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116763, "uuid": "4ae8dd40-b262-46b6-88b3-2a189feecad1", "value": "T1AAF2D0D411004CD1F93AD9B4FEEB43527D291FE3A5039E4A0B41E7998ACB4A5B9D37C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116763, "uuid": "f1f2dcf7-04ca-4a05-81df-a01a85d6a684", "value": "768:V/MAdxJVBe9+IVuOX2Tddad+3AnGQ/Fg9pUibJKu4JgGlzDpbuR1JQ:WKJg+IVlmTYG6hibolVJum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634116763, "uuid": "89f24fa3-7d2e-4233-a9e7-c309ee9fce32", "value": 34700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634116763, "uuid": "63f36568-d382-478f-8ede-882b2f3e3384", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116763, "uuid": "e2aa0c58-838c-4f23-9389-a2a9230417be", "value": "348c689d0c8f527be7ea1252405260b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc118cd-2c25-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634130091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130091, "uuid": "e815f39d-a544-450d-a727-347dffeecf9e", "comment": "Malware payload (Loki)", "value": "b06f39fd76ece9eaae3b3e9e84b1eac6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130091, "uuid": "0d37763f-972c-4f19-8a69-bc2db05d7d0d", "comment": "Malware payload (Loki)", "value": "8d5726af8decf629b89691ac057ed73e3a887eb6cb01425bc5b88c7d5a43b199", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130091, "uuid": "b586d787-144c-43a2-9b7d-1f6266f8fa48", "comment": "Malware payload (Loki)", "value": "4b20dc2bc6ece0708bd913c21e7cc436b764cc53", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130091, "uuid": "c0577a39-3dc5-41a8-98fd-11447753db66", "comment": "Malware payload (Loki)", "value": "d6d612304ae69e4203834d960969822d58a30eaba055e468e20727727031d3a97fd82479cd2eebe6ee6909f25c10a3c4", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130091, "uuid": "ddfa2b6f-9586-45ed-81fb-849159cc21b9", "value": "T1E5C4F143CD068E83E969C3BCBF061DB96B4E5618E89273FE18711DCE6F512220D8B56D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130091, "uuid": "f1c2ec7b-4111-454f-a842-2caf2658eb9d", "value": "12288:Vveq0+wGs5D6HAqwbRXb6WODZX9RumVKKbFyiLwu8Jzza:hzZwd5NnbQ9RVK2kuEza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634130091, "uuid": "36bb3229-0ee1-4a0d-900a-1e23fb393065", "value": 577791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634130091, "uuid": "b17a4a8f-8236-4b9f-b838-c95d616c3870", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130091, "uuid": "b2246dd9-f90f-4519-917d-bc153c018117", "value": "Invoice_Charge.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420d0519-2c11-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634121317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121317, "uuid": "16311d66-d218-42dc-9d62-dffcea445cd2", "comment": "Malware payload (Mirai)", "value": "a3b5cdf7001faf4f3a59ba5384ad7546", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121317, "uuid": "d1907fb2-3dec-414c-99f6-a8503ece2f0f", "comment": "Malware payload (Mirai)", "value": "8dc1058fc0a0da2a965e1d8d7cb209562cec8991f794056085275695d0b25f14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121317, "uuid": "8bb1534d-78ab-4a24-a48a-c08e3e3ef56a", "comment": "Malware payload (Mirai)", "value": "89d98d9dbb9e82f5acc629ccd4682128aad7438b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121317, "uuid": "3344d672-14e7-4bea-a5d3-ad40ef072c69", "comment": "Malware payload (Mirai)", "value": "e19665e5e301358e465f8da46609c82da67e8f3300319cbc050f3c1c71976c24e0a8b987faaf99295959af288b9ab059", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634121317, "uuid": "98d22f02-5c3e-497d-9625-ee403f268c8d", "value": "T10A931A46BC809F01C9C5167AFA2E218E331317BCF2EEB2139D24AB2477C656B0E7B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634121317, "uuid": "015aba66-0908-4eda-8ae4-75fafda07938", "value": "1536:kMnrEAw75SECwI4EWCe3vBxLbkPrVQAIsP28lzaiVVc2I6itnudqX4fr5tYTDjYH:kAe5PCYlt3JZIV6sP2uza7nudqX4frPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634121317, "uuid": "7a8a07de-017a-43ea-8e5c-35704745d15f", "value": 96140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634121317, "uuid": "47bc33d6-8be2-447b-8ea4-8cb7b309b7f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634121317, "uuid": "cc232de4-4c86-48a7-9d94-12d2af5ba55e", "value": "a3b5cdf7001faf4f3a59ba5384ad7546", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6dabd4a-2c59-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634152517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634152517, "uuid": "9ab16c48-c169-46c8-af07-eb1809d9c887", "comment": "Malware payload", "value": "9943014b8d52ebe1a2a5159e03e43b96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634152517, "uuid": "b8b9b6f3-fee4-4b98-8d1b-e25808f096bb", "comment": "Malware payload", "value": "8f5cb4441a5dbc15671df7e76e0113e9e18e2e86e4fd2bb2282e67ac2bd7cf42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634152517, "uuid": "27991794-e834-4012-aff5-cbafb479b19a", "comment": "Malware payload", "value": "1b7de769846976e731697d2fed8a4d214853c93e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634152517, "uuid": "7b73723d-c975-42cd-b6cc-e47972f0a31b", "comment": "Malware payload", "value": "f541092f6d502b320122a7f3ee886245f88e7a1aa758ffa1701b339d2d53bac7372131aedafee259a4fb54966bb0dcd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634152517, "uuid": "a04ec983-1e6a-4490-ae1d-470f2815825d", "value": "T12DB533C0F6486598DE4FAF789A93A3EABC00FAEC914421BCA2D75B31404DD1D544DBDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634152517, "uuid": "47b96522-3200-4fb8-8af3-1e3013455cd4", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634152517, "uuid": "d735c43c-7d69-4f61-9ddf-f38438907e34", "value": "49152:oDG3cGF82ulc0q24up8MgMu6ZBxJv3Sm1Ojo0asvwH:Wm/u+JCVJPvOjLzvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634152517, "uuid": "805740d1-2d58-498c-b537-bd38cc008902", "value": 2328032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634152517, "uuid": "18cff517-0286-4592-8e5a-14f67b2024b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634152517, "uuid": "fbaad9a3-947e-434a-bd64-fcac2a4ed076", "value": "ARK Survival legit hack by Spyro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2758bb58-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634108387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108387, "uuid": "b9c34c0d-5d04-4a11-a695-3fc78d9f4a90", "comment": "Malware payload", "value": "d8325e61fb9e1ef03f0313badbd34420", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108387, "uuid": "4a7581ce-a2b9-46e0-81b6-447d57419fc7", "comment": "Malware payload", "value": "8f98de5d884d9a447f6660faaa633f972a2bb8dfe8092aee4391fdba927d0fa4", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108387, "uuid": "3a7da1ae-20d2-430e-b472-68bb9fe7be51", "comment": "Malware payload", "value": "b3c09aa838b8827d406329a7d8097a1506843bf3", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108387, "uuid": "90fef735-ba0c-49cf-b191-2667729f76e7", "comment": "Malware payload", "value": "6af8a4d587024a3f14cddebec219598bf87420be92034415a76f407d422acee5c0e12e9b03f748d5f7ea4d7b1de8f78b", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108387, "uuid": "40b167d7-7985-429f-a63e-816e623610cd", "value": "T1F964B0B5AE10C6A5F35D16F2873C5EA8B4F4EC080F9995328EBE35E140759222DBF24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108387, "uuid": "ed3f7026-07c0-40aa-bca6-7e40074b758f", "value": "6144:QoGJfO8EAp4TwnFGJfNVbeCxM88SXfULYxNwMNEsm+NHc7:QXm8Eaa1beCKTkcnMNEsL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108387, "uuid": "f66190b0-0758-42ce-b2fb-bf03a8b8d5da", "value": 329000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108387, "uuid": "5394d1c7-3bcd-4231-8e14-7dc5f8bb32c9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108387, "uuid": "ab10133c-bbf3-4463-91d9-a7ed41d6bd71", "value": "lod1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2423e449-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1634108382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108382, "uuid": "5f99391b-1756-4aac-acfe-4a40f408e6cf", "comment": "Malware payload (Neshta)", "value": "630d2e74aafd6560475a4cd38813761d", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108382, "uuid": "3f3162f7-f978-44be-ad40-e7f3195f8621", "comment": "Malware payload (Neshta)", "value": "8fc7eb0fe9465b3e9f008e358150fb4cac00b4cd4b4dae6406762d1f0286da68", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108382, "uuid": "6841df52-f4fb-4913-b49f-19c688a341b5", "comment": "Malware payload (Neshta)", "value": "f5bbc7200898e1d8ad4daf761cc58ae71a266568", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108382, "uuid": "02f0ae5b-b6db-490c-9424-ea2edcb38534", "comment": "Malware payload (Neshta)", "value": "4d9f399794a121ef3965cd372521fda4d7dff9a35853bde4c6ace4e84cb488229343f865e0af03dc6b8ed054e47b242a", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108382, "uuid": "8aa51a05-a6e2-49e6-8e36-5395bea6639a", "value": "T10174BFF13669628BFB520D7967F3D3DA14539D5AC175B8CA2702721C8878B920FB0C9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108382, "uuid": "c76cc5a2-957e-4b2f-8c6c-7af10fd06c8e", "value": "6144:35gfbapPks6AFC2FyMS9iPzkYcc0wUVAk53p8Zh7947qwQGCJ2yDI8jQ:4OpPnzCBMS9UANc0w7E3pMh7K7qaCJ3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108382, "uuid": "9e351f65-e800-4e23-ad5a-0c6ff7f6293d", "value": 343464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108382, "uuid": "abd97467-4d13-4929-9153-dcdd1c40b2fd", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108382, "uuid": "666dc38d-05b7-4cb1-a816-6f2f1bf2c9ed", "value": "Draft Shipping documents.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe0aa65-2c07-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634117307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117307, "uuid": "2739a6b2-7d11-4b7a-b775-7a07c1f7a881", "comment": "Malware payload (Loki)", "value": "7c55e395258e9e69d10502500d443ae0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117307, "uuid": "f8ac82bd-68eb-433d-afba-58bd109eaff5", "comment": "Malware payload (Loki)", "value": "90aea5afb79d4a06dd87604c0e77067079fe149ba7d9c6db2308b64d7ad4d641", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117307, "uuid": "b648dca2-1102-4efd-9930-5e784cc928f4", "comment": "Malware payload (Loki)", "value": "e5cec42fec04f09cc8bac8d336063430a3ac023e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117307, "uuid": "67ec0cbe-6789-4bf1-a3ca-ea6dd0c5b46a", "comment": "Malware payload (Loki)", "value": "8cd94c7ffd321162c54c6e1f90f300044b126bf7de69080987365f03f4f54f1724a78facc27d0e80246e3c5799472b4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117307, "uuid": "9e4f12b9-3c4f-43e4-a6c7-5bd51cb24704", "value": "T18634121732D22863D7744CB069BD5B13E7B4629C4672E68FC3B06E33293C2D7AA1754A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117307, "uuid": "998cf85b-9a67-45c8-9cf9-9295d9c24317", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117307, "uuid": "c9fd4dcf-fac5-4286-adfb-c57a27fbe008", "value": "6144:wBlL/coLuNGYmoF45DsR65CGB5zCWONsqRJrjFUcl5+5:CexGYLF4S09UbrKcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117307, "uuid": "e48cc12b-f73a-4b99-a9a9-cfe10a0fbae3", "value": 246973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117307, "uuid": "ebd0e266-949c-4e29-9272-d8f6819dd89a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117307, "uuid": "811c3cf3-6833-4c6b-9a28-31e721017de6", "value": "7c55e395258e9e69d10502500d443ae0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1aa641e-2c05-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634116404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116404, "uuid": "85de954b-c2d0-47f3-ad9b-63e46306dd83", "comment": "Malware payload (Formbook)", "value": "2292debf2685fda1410be586bd7d25b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116404, "uuid": "fda8c7f3-15f0-4491-a653-13336e80bd29", "comment": "Malware payload (Formbook)", "value": "90e1eac40edda005fffadbb1d16c652d16e685f8f4cf7375eb6ac928222c3a1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116404, "uuid": "dca88d3b-62a0-49f3-980c-48ea446ebe6f", "comment": "Malware payload (Formbook)", "value": "1f6f41fae896c4193bac3e58bd34302cbdc2609a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116404, "uuid": "f557364b-7de0-48a9-9f33-a170ee2d7a2a", "comment": "Malware payload (Formbook)", "value": "818be75c7deb0bf3dc375b8937b87c8b7b36b80c267d80a97eeb913e013d8800af71eaa10d233a4be712612585a7ee19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116404, "uuid": "c3d130bb-0148-4741-9497-26c6e6651cc4", "value": "T12A258E13E197A533E4F246789C6F9359AE35BE403D35E94D2BD8AD0CCF20681B839396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116404, "uuid": "c8ede50d-d297-41ed-b126-33c5749d3205", "value": "33ef3fa8cfca6640b4d180caba182c91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116404, "uuid": "ebf81b8b-d6ac-4b78-a8c8-93a00d56720d", "value": "12288:GrHeuodar6Dd3m4aS9FCZXhGiX1d0uVrLGaDOdJ4NUTI94rv4lprmi:GDe0W1m4aVNTc9jOiI2rqpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634116404, "uuid": "aac9e349-4d46-4302-96ae-4ddd4e1eb748", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634116404, "uuid": "c779110c-74b6-4356-94dd-5d9bb918e2ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116404, "uuid": "64ff1b5e-b439-4627-8637-7ff48c50a993", "value": "2292debf2685fda1410be586bd7d25b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66aaef1-2c4c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634146906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146906, "uuid": "8100da5c-3af3-477a-96eb-f749d8485aa3", "comment": "Malware payload (Formbook)", "value": "2fe634ab1348a94f5a2f8712d8b4ee44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146906, "uuid": "3a9cc9c9-8741-48a1-9ef6-738b16046701", "comment": "Malware payload (Formbook)", "value": "9136c283e5029c2f073b706014f6f73b67ead84450267cb5ce0dd26cbcecaa25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146906, "uuid": "c7a88f02-50df-48ec-80f6-16e4ff3a013f", "comment": "Malware payload (Formbook)", "value": "1c6e453bc403da0ae1ea75f96ab90cdf86472665", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146906, "uuid": "d54f4bca-9654-4ea2-b51f-14e35e579384", "comment": "Malware payload (Formbook)", "value": "9496f97561f660d1054c09d98957803dd466bea972021fe484e507feb68ac61bfd79e87f69230cbdf199b5d0188fcd2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146906, "uuid": "e0580831-1d6d-48b1-ba7d-c520bc8300a0", "value": "T194A4CFA47F85DD4EF36A9C781131DF84CB7E654B3A13C625D9FF647A929878028C2283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146906, "uuid": "98cbae66-15a2-474f-aad0-f7aee42fc638", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146906, "uuid": "3c65751e-1457-4c9f-a320-527b3d8937d4", "value": "6144:MidoQHF/H1wPkLCG2V8SlX0CbGLWRj1qqBOzGOoa6lMbvDpXA1Nt3EpMkhBnlYB:MidbH1OjJiMrGYCOawQvDW33ESSBna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634146906, "uuid": "525601eb-6e4c-4ba2-b5d1-d588cbf22e24", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634146906, "uuid": "e7d38f86-34e2-4c94-baf2-894690f9d2e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146906, "uuid": "01dc73ce-fe7f-4467-a267-8c9fad6e9354", "value": "2fe634ab1348a94f5a2f8712d8b4ee44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29cb061-2c4c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634146819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146819, "uuid": "6b0b2c10-1d9e-446e-b261-fc7667c9f238", "comment": "Malware payload (Formbook)", "value": "fda0d823b262ac2b1bd76a2053c29692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146819, "uuid": "d5bf3f20-fb92-43fa-acb6-e7de6b882336", "comment": "Malware payload (Formbook)", "value": "91a166f9a29ad832c9640078210a47e5afa928ab1a79a7b40d3b358e9c8bc5d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146819, "uuid": "4c9b2529-3c6a-43b3-b52c-1db31f951fd5", "comment": "Malware payload (Formbook)", "value": "73f72d7c987d44d1f236c138c5617b527c5ba340", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146819, "uuid": "a33b995e-66bd-47cb-b93b-556e88bc479b", "comment": "Malware payload (Formbook)", "value": "59a5abeb3a54bbafc61202ca267330651f49d0d9f2622b0cda4df335021985182b5fc4ae2335185a31892330235dd96d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146819, "uuid": "1c67dd6b-0ed5-4846-b0a2-1c42e8a1de4d", "value": "T15DA4BF64BF95DD4EE36A8CB85131DF44877D664B3B13C619D9BE507A93A8B803CC2283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146819, "uuid": "40d26c59-d781-4243-8e0f-efa7674175b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146819, "uuid": "a3876204-a14e-4dbb-b6c8-fb5911007ec2", "value": "12288:AsXSBAmUT9BbRsXFkN8xDqT2LWWJOxTa:AsCBAme9Bb2Xq8xk2LWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634146819, "uuid": "f9341c76-16f2-4683-bad0-6a251e4da41c", "value": 477696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634146819, "uuid": "f3d80c63-7c33-4c8f-a805-c34e2b578c0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146819, "uuid": "cc841410-dfeb-4d10-8307-1a754afbbbfe", "value": "fda0d823b262ac2b1bd76a2053c29692.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c51202-2c4e-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1634147603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147603, "uuid": "4aafaee4-f8b7-4400-ba17-cc1ce16c1c7f", "comment": "Malware payload (AsyncRAT)", "value": "18a76877fc1cf3da083694daf8a59c75", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147603, "uuid": "442ea607-b994-4a77-a4fd-e96bfa4715d2", "comment": "Malware payload (AsyncRAT)", "value": "921ab11978687f7b8120f0753f7d500d95512316834f71082a028b08c838109a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147603, "uuid": "2fa3aa50-c78f-44bd-8b84-7d6deeea462b", "comment": "Malware payload (AsyncRAT)", "value": "21014ec5d45f7995b91085c909aa56ad1c31ef8c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147603, "uuid": "8019b218-ceae-4afc-adce-b71409d85cf4", "comment": "Malware payload (AsyncRAT)", "value": "960903a02fac23daa865c497588dec1f3911d04e420a738bc2081b3050e8ea7559520a5c7501ee5d913fb3dfbdfd7fc5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147603, "uuid": "7f937057-5452-409d-aed0-2c7ee929515f", "value": "T11C91890B33B27F1FB5E38296C6915ADC5D163062123252FADB172215CF852F32E753AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147603, "uuid": "82953d18-6a6d-4f20-8519-74d307da7cc4", "value": "48:8pOGeHBjBjBjBjBjBjBjBjBjBjBjBjBjBvBjBjBjBjBjBjBjBjBjBjBjBjBjBjql:BG8YLTRnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634147603, "uuid": "83a5201c-3b5e-43cb-8269-ef74ae176f6a", "value": 4454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634147603, "uuid": "17198dbc-5121-4bff-807a-7acb39916ccb", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147603, "uuid": "0c3bae11-4c09-4487-a54b-1de9c5cdd5ff", "value": "Project.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a0808d-2c4f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634147897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147897, "uuid": "2fde78e1-705b-49a9-bc5f-fdff612ff794", "comment": "Malware payload (AgentTesla)", "value": "fc803b636d37dcbdb5ac142aaa8af20f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147897, "uuid": "ebf5691c-6be6-4c7a-8041-98d35f47e9af", "comment": "Malware payload (AgentTesla)", "value": "928fb7b546c7c4a811df10c1d98da7cf6ca781f8f923accb37f4d5d7af52f10d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147897, "uuid": "c61021d7-75eb-4fcf-ada8-402d22c7a805", "comment": "Malware payload (AgentTesla)", "value": "b7c521bebd1224207a03204b657d42cd949e02ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147897, "uuid": "1e89d990-b1ae-407d-8e55-81699c4aa70e", "comment": "Malware payload (AgentTesla)", "value": "370379327b0a6da2dd84984ea5a0293cdd89b215a8457e0f9f454b7d4fe90157d9ef922c3b842bb3cfe5d064e30f542d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147897, "uuid": "1c43dff2-eba3-4ba7-941f-d84a394c8cdd", "value": "T1E1D4E011338986A2E57F0FB0A023A71947B0FD256D72CB7D69D176DF2F32B909201AD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147897, "uuid": "28f3831a-a840-486e-8086-73917f94e714", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147897, "uuid": "94c4a703-0ef0-49db-9dcc-730ae5f31a46", "value": "12288:+5JEdqMChuZ1IX3phSxQRUnqGwTW/DmS5VSB3QpFvkNgNCc:+5JEdqpHphSOjkmA4B30k6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634147897, "uuid": "3459bcc4-d78c-4f9e-9a71-872ed636a1d6", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634147897, "uuid": "e9be86d3-06f2-4ad5-a4ea-f99512d6e5e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147897, "uuid": "dca0b104-be9c-45f3-bcce-bcc2483cc6f9", "value": "Payment Advice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ccb4819-2bf1-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634107672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107672, "uuid": "5c22c4f9-998e-4d69-b4c8-7cf549efdc30", "comment": "Malware payload (NanoCore)", "value": "d6f040b4d7d217b8525dff843feba635", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107672, "uuid": "fb59facf-d5f0-452d-ac87-d2ccb83cd343", "comment": "Malware payload (NanoCore)", "value": "940ad66c876976f4a05f12710687f5abb76443f693dd3986d1ff7a4c73fc866f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107672, "uuid": "83270721-1b04-4197-9def-928c9e6adde5", "comment": "Malware payload (NanoCore)", "value": "8ed8beaceddf8e8e9ba4b601d1e985e5c7c2d7d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107672, "uuid": "29b6f37a-e3f3-4c0e-963a-be3b6768fc86", "comment": "Malware payload (NanoCore)", "value": "eab475092e622da6eb7d8c817831d5efbbb2248f102da4a70be4eff195c4508ac46b722733fd57ece9d1515e2e1807c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107672, "uuid": "ee69cf61-9af0-4689-b702-32e78f012b9c", "value": "T1E1351203FAD288B2D4731932193977149DBE7E201F29DB1FA3E45D6DEA31590A134BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107672, "uuid": "7ab7927e-ac67-4c9e-8549-0bce5d75c232", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107672, "uuid": "52b383d3-8bec-437e-993f-bd4229495e67", "value": "24576:rAOcZEhIj7BkIMcXzBQuX+a6TPY5I7nT1RMwaz7:t8GI3XXN6c5IzTXM7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634107672, "uuid": "18741d75-0b90-460f-9291-59e53f260627", "value": 1096674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634107672, "uuid": "de28ab15-18e3-45b3-ba2a-63336105831b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107672, "uuid": "3bdbda29-1d31-4929-a92d-9bef0bfd29c8", "value": "KRSEL0000056286.JPG.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89cc7afa-2c56-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634151073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634151073, "uuid": "c57eebd9-c5c3-4a98-87d5-8f6ccb1d4028", "comment": "Malware payload", "value": "f228016e0892ad8965989ea5b92642d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634151073, "uuid": "1bf8bc08-2d39-4e89-84c0-ff6fdd7f62ca", "comment": "Malware payload", "value": "94472492323c8fda6166de5f6d7f6eac209e2154b4d58d48c6fecb2f7be5b873", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634151073, "uuid": "b0e3385d-8f26-40af-9391-a8df73680b7b", "comment": "Malware payload", "value": "ab9cb2f5c6eeca21e2eb9a00b3cd030b09ab9521", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634151073, "uuid": "b2e6dd53-ed97-4245-96af-3d4e0784d226", "comment": "Malware payload", "value": "46d78c33b027ab02029a7f773e99135c387c9f6645651cd638300a24e555bd2ecbae57d745dd3f7acbd4484059036a40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634151073, "uuid": "1febc9d1-eaf5-4a49-8575-bcfb3e8ce3a6", "value": "T1BAC4839D726072DFC857D472DEA82CB8EA5174BB931F4203902716ED9A4D89BDF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634151073, "uuid": "1ce19d19-370e-4409-9790-f7930510500f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634151073, "uuid": "1683140d-ddea-4805-a7b6-b421351e3121", "value": "12288:LWFn+qoTr8uM45nAGBqOxstySC9T8eV1hD+HgDr5OHT3RtFXf0iaVxDZxtysurth:G+qMr8EAACWweV10Hg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634151073, "uuid": "a15fc76a-4343-460c-8253-0696ae8aa5bf", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634151073, "uuid": "bef9ddf5-3225-4f52-9fbf-71690dfe5457", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634151073, "uuid": "201adfe9-e644-4ca3-b777-065f2cc4fe81", "value": "Far Cry 6 crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a28790-2c65-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634157507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157507, "uuid": "ef390b15-5ea5-4ed3-acb7-303d155dd204", "comment": "Malware payload (Mirai)", "value": "144bd8886b69966796efe5f66b760f4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157507, "uuid": "ee1a84c8-f297-498c-938c-ee028d2938df", "comment": "Malware payload (Mirai)", "value": "951fe05fabc2fae3546fb6ca3236f64a3ea585963644dadebb502a8e6e3f37bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157507, "uuid": "4f33ca64-303a-4f8b-acab-584204fef7a4", "comment": "Malware payload (Mirai)", "value": "3c21adef4ec11b0fd2f75fd0cb2d46e6d9d0ae7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157507, "uuid": "8f508640-b14f-417f-80eb-bb8e5d6e79a7", "comment": "Malware payload (Mirai)", "value": "958ed8d0d7a10d8893903fe5ecb9520b8a55e3adda631868ee92e54664410f5d51538e93edc5b642d5991a5ab281ae81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157507, "uuid": "9a02ffbf-26a9-401e-b125-04b425cbcbe5", "value": "T11AE2F1BD15493CB18521793E9D6BC4DB72431BB4C7FFA023A2B5AB1A4A811435FF8253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157507, "uuid": "68fd3b41-b3dc-4491-b1ce-daf60a3c8e0c", "value": "768:DBXGZQFynImlCTr1S2zcc8xPP/38gPJ+uxRhyeOQGNA9q3UELQVu:DWiynFy1S2zcHt7PJ+a3yefGLL4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634157507, "uuid": "d32b4a80-ce9a-4ce9-88e5-d5077100125c", "value": 33588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634157507, "uuid": "75703dec-b5a4-4b3e-9a1a-43d06be37742", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157507, "uuid": "17e28418-348e-4f10-a77b-46d63f55f71f", "value": "144bd8886b69966796efe5f66b760f4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61101e15-2c08-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634117504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117504, "uuid": "c5f25179-8e76-4bec-89a8-feca1f68f174", "comment": "Malware payload (RedLineStealer)", "value": "acdf15a17b8b11a95ba85bfd088f67ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117504, "uuid": "648e725f-d501-462f-968a-0fdd58637472", "comment": "Malware payload (RedLineStealer)", "value": "957818fe99ed9cbbbd5c7a1da5af7fe3db3f7623e19ab47c932076df855eb0c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117504, "uuid": "fe60d379-7d3c-4c38-a437-34991631bdcc", "comment": "Malware payload (RedLineStealer)", "value": "381b52b4ba0b24e201d90a63fc25f9343f6e24c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117504, "uuid": "1c60cbc9-63d9-49c9-a3e3-de707a896865", "comment": "Malware payload (RedLineStealer)", "value": "96ac042d52da5ba72d50ccb86ddce4abae17de0ffceef2b47772e7ae48d95425d9513ba00c5f9ddf4dacc805f83dc4e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117504, "uuid": "12458d77-d508-419a-bdfe-a20af6283e8f", "value": "T186A4CF10A3A0C035F5F356F94DB99368A53EBAA16B2481CF62D51AEE5634AE1FC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117504, "uuid": "d6c94158-ada8-4f87-afc0-2242a8d275a4", "value": "4b52e566ef5b8727d87906b4623fc7d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117504, "uuid": "905c8d8c-428a-4524-b46f-50739e65e2fe", "value": "12288:A/SInaLQNf5mc4yDDwVR/6O3kLM77BRN:S9nc85AyDDMSO3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117504, "uuid": "042ec208-80a2-413c-bee6-6c3799dcf6ea", "value": 458240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117504, "uuid": "6f9df04b-0a30-44d2-8df3-ff2b9cdac593", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117504, "uuid": "0017951b-e4b6-40eb-8eac-84fcdf37e5fb", "value": "acdf15a17b8b11a95ba85bfd088f67ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f8e2c9-2c48-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634144857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144857, "uuid": "b89b6c0b-394b-4e5a-9250-16a187e73e84", "comment": "Malware payload (Loki)", "value": "f3301d2cf11d1d4884f4922ff204042b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144857, "uuid": "95fec331-f968-439b-a688-1bb120b01e8b", "comment": "Malware payload (Loki)", "value": "95e9065c107af5694662b5876912efca5c2f07b578feba2f993d4f98cd2ddf52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144857, "uuid": "c9ba73af-b060-4980-9503-e62ebf69ea2b", "comment": "Malware payload (Loki)", "value": "5e5ad3cac355bfcefa8260f943ffca4e0ec3ed33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144857, "uuid": "c0a5bce8-7d03-4bdd-94e4-a87828955cc6", "comment": "Malware payload (Loki)", "value": "08a0d3214d345b877265301a45ee44dddb974ab2a7e210e1e92d35c85dc36b40af708630bec226a72ce1e470fa5a1fdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144857, "uuid": "d04bd4e8-a9bf-4586-acfd-a182e655f72b", "value": "T142A32A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144857, "uuid": "385d7a30-b841-4658-aba1-182fec6e2074", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144857, "uuid": "67b6e2b7-b347-4b76-b9b8-ebf461800fb0", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634144857, "uuid": "90f2d97a-72c3-4cc4-bce7-d3df495fdce6", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634144857, "uuid": "ecd5b4c5-b83c-47fd-a77d-dacc8ff719c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144857, "uuid": "4844131a-0059-4abc-8709-da4aaa0d567b", "value": "f3301d2cf11d1d4884f4922ff204042b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c341f6c8-2c00-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634114232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634114232, "uuid": "d14a4ba8-5b80-4b41-9021-eb9f7636de03", "comment": "Malware payload (GuLoader)", "value": "328b34adced9ad8128d4079bcffde016", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634114232, "uuid": "a4ccd59a-a5a5-4d09-9a7b-4734c9f59d4b", "comment": "Malware payload (GuLoader)", "value": "95f59bb24f6c23995b22e40d5ba6785f9072da815451c04f61ee42f42a63089e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634114232, "uuid": "9343e3c5-c0c1-48a1-9502-9c8d35440f10", "comment": "Malware payload (GuLoader)", "value": "fa03cb6529d634b2e30d042491c0c13e39fd445e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634114232, "uuid": "4e5524f9-e47c-41aa-bc34-270c46c5cbc3", "comment": "Malware payload (GuLoader)", "value": "c6b9582fa94b31f94e28ae576dd53ec29f992f25b580c80e6e0b263c5da3108030f8e6eb5b3b3fd31c6962bd36947db9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634114232, "uuid": "a0d297f7-b5a1-40b2-a387-cd29f709fac0", "value": "T1BBA34AD2259CA878E80988BD4BBF8C5B071D6C3319619F4B1984379FD4337CBAA9531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634114232, "uuid": "4e7f9c80-1a92-42ac-acd8-4e643a1a0d6d", "value": "669316531b5190f02843878b6ed87394", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634114232, "uuid": "050fac88-004d-482d-94fe-c22e477ba149", "value": "1536:tlDnGkDi0pjX5utKdJxxt2l7izvqpLnD:tlrGkJp9txt2l7ikn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634114232, "uuid": "fc5ff90d-b449-4398-b31e-6706b75ee3ed", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634114232, "uuid": "dd916f31-13f5-44ce-b678-e95a02eea430", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634114232, "uuid": "0984f809-5611-4118-abef-c4a2bcee2be7", "value": "ZAM\u00d3WIENIE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d5b553-2c56-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634150850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634150850, "uuid": "129d6374-71ca-40d4-a44f-493b230c9d63", "comment": "Malware payload", "value": "6429aa83e4bc083b4f0b3f44b0d7950f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634150850, "uuid": "826d425e-f3a4-4af3-8bac-4f25d24f35fc", "comment": "Malware payload", "value": "96c57ae661562e958e01bb0b490c09a0a51bb367931620223174963de88bdfcb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634150850, "uuid": "377f7489-c57f-4fb9-b490-3b2ff849452c", "comment": "Malware payload", "value": "0ead59881f054284f611accb61451ed1ffc818fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634150850, "uuid": "5ab940a4-cea6-4c8f-88bd-fe1ff3c4b15d", "comment": "Malware payload", "value": "5b1a6a6f5b548133154b4c00f1575007e6f996a3f4bffd866070663132bb5da91a7389192123f42c674681c4c0b41634", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634150850, "uuid": "31bb4faa-f950-4da1-a9fe-4bd01321c95e", "value": "T11FA4CFA47FD9D94EF36988B85131DF84C77DA14B3B13C625D9BF507A939CB842882283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634150850, "uuid": "fe1318ff-a2ba-47a6-8667-62f04ba1ce1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634150850, "uuid": "8ac5630c-f758-4929-9180-1f35ef9475b4", "value": "6144:zMkhBsNolyfnZle9UX08PF85KQ4O1LkyUCZ2e12XZ0bp2Qo7lYB:oSBblyfnZlW+08+5KQpyy52nZ0vo7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634150850, "uuid": "715ea195-3cd2-49ad-b74d-2cef5076df0e", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634150850, "uuid": "700027d3-9ca4-4218-8bb0-f6505d64f010", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634150850, "uuid": "3a04231f-077e-4f78-8f86-04d91ade68f7", "value": "6429aa83e4bc083b4f0b3f44b0d7950f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dccb4ef-2c2b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634132584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132584, "uuid": "a5a72a09-5251-4913-8f9f-df5932c72933", "comment": "Malware payload (Dridex)", "value": "30c380426505d0cc6741782bb917671b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132584, "uuid": "a8688d7f-b96c-447b-92b8-d2d72b8a7e1d", "comment": "Malware payload (Dridex)", "value": "97b3e4014ca0d298804be4f599b0601b934f88940137f74c91828c984de30969", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132584, "uuid": "9b74a15f-e803-4c2c-90d7-55b4ee00e25f", "comment": "Malware payload (Dridex)", "value": "e3584ded8526f2d2559e3bb5bbc6cb1e307c5f3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132584, "uuid": "e0cc1577-3c5c-40ad-a44d-44eabd6ef734", "comment": "Malware payload (Dridex)", "value": "0c2b4159e2dc863c112661c1a9eabda668e43db595095c266549c18fd952ead196abb4cc0e93b8521355f804dc658372", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132584, "uuid": "d39197bb-e974-4cb6-9e9f-f468cd579170", "value": "T1C0659E33B2D14837C173263D9D2B6369992ABE112E38588A7BFC1D4C4F3A6417D352A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132584, "uuid": "9c34795b-a544-4e64-9bcc-5a845f9da614", "value": "dcd8b0fda285b3283004e4215a503e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132584, "uuid": "7eaaca42-dabc-4e12-b2d2-e62996a13ad3", "value": "24576:VehqOUx1kdlsk5OPOND4mXHD4tTrSbg86YXFsfS4XVMKG:VQYIEUDVpqYXz4qT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634132584, "uuid": "9918fd09-9413-4457-bd9a-333002dbc950", "value": 1455616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634132584, "uuid": "cdaa0136-05f7-4f34-90e3-833e6173b1e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132584, "uuid": "9be7a460-7999-49d3-8ba2-04b54b8a3ba8", "value": "30c380426505d0cc6741782bb917671b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03743b7-2c4f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634148211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634148211, "uuid": "7ab97119-7b37-40f5-8e84-0fcc978633ea", "comment": "Malware payload (Formbook)", "value": "5c546d999e38e6e51a6c1675b3a646f3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634148211, "uuid": "0104a518-c42b-4c9b-8377-4b1e4c1854c7", "comment": "Malware payload (Formbook)", "value": "980e889b97c92e9a81ff548a481978ad5c2b42829ddb6014d3720c19772e3799", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634148211, "uuid": "50251588-017a-452e-8b2b-39f76a84e232", "comment": "Malware payload (Formbook)", "value": "39ce280bc35b7cc313cbaed2476ee300d7e928c3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634148211, "uuid": "c1add0e4-8647-4381-98d0-c59852e10a37", "comment": "Malware payload (Formbook)", "value": "63be876a80f780faebedab7575f7b3060a9033469b6f197245c43074c0edbb66c517d65850bdbc3009a0aef557508ab8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634148211, "uuid": "7d144441-2951-41b7-acad-65e6d92623c4", "value": "T18874D16659957BABD062DEF814057091E3FD8C78F4727A860800B8257EFB11BCB2F91B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634148211, "uuid": "649941d4-c509-4d73-bb32-3f249d6fd312", "value": "6144:Fr9OhqdApoBlNfbc6LWgAKCSQJePpqu5janAIxTCIEPtUr2TsBPDVvhi8mrO:/2WlNZWrSDBqUjanjPEP+RrVk8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634148211, "uuid": "9787ddc4-6563-4f11-a4dc-52f55216006f", "value": 356184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634148211, "uuid": "9e181b03-464b-402c-9bd4-affec28780ad", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634148211, "uuid": "4c47caf3-6571-4a4f-9262-5d065c56fe23", "value": "OCT 13 2021 - PRINT COPY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6bc0e2-2bd1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634093791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634093791, "uuid": "1eb0884a-f204-4dc9-b363-c789782518c1", "comment": "Malware payload (AgentTesla)", "value": "862e85155619a82623345026226d6597", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634093791, "uuid": "db76ff69-a6f3-4ade-a4db-be11bfa19e8f", "comment": "Malware payload (AgentTesla)", "value": "98316f49e4fbd2189f10bb175c0d2f4ac9e74b7c7f41ae176079cf35366123ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634093791, "uuid": "ffef76bd-11eb-436e-935e-c8fc3b21aa22", "comment": "Malware payload (AgentTesla)", "value": "a45b74cab9b8ddcd1defceca1aad775bf70512dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634093791, "uuid": "d88bc517-9641-441a-a072-b86134946e0b", "comment": "Malware payload (AgentTesla)", "value": "ddc7e6dc4ea921cd0f16ad7b696aa8131d0ca4e2be69575d95c93217db61f5fab1e96908e784f98aa94be41655f37aa3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634093791, "uuid": "c5c4c498-3a4b-4acf-ba18-554d887b8a44", "value": "T1B0E412139FB29A86D56D1DF341B2E6B08771DC80BD92FA5A0CC83DA37333BC6149519A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634093791, "uuid": "0c9fe120-93f3-4109-8284-7487efda620c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634093791, "uuid": "b4a63809-a001-4703-9e47-a538503dd12f", "value": "12288:3/1fPkiSBfpAEEnnUWv7q4GoqJpclqX/YWbCGO0xGesE443:3NfPQBfGhn+dB/c6dWGOgGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634093791, "uuid": "61bfff4b-7d6b-49ab-a31e-81a9b2d7c2d2", "value": 658432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634093791, "uuid": "d9910119-5b1c-4154-96c7-134cb0da18cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634093791, "uuid": "f93467a2-5565-432f-a130-4506c3db5df7", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.7200.7580", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb9c081-2bf1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634107804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107804, "uuid": "43b0075d-c2cb-4ba0-92b7-36438d28979d", "comment": "Malware payload (Mirai)", "value": "db539e6550bef2b858199fb9f3cbaca2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107804, "uuid": "b9d943d7-15fe-4db6-9c60-c7c74e9a19b6", "comment": "Malware payload (Mirai)", "value": "987a1ad48b5bd046d3e099e320c38fe637eeaeccbecb449218e683a002054fd9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107804, "uuid": "aea654f2-3e9e-4d4d-8765-0447041fb0bf", "comment": "Malware payload (Mirai)", "value": "64edd421e00ee6282a24dafff8e1383a03b75db8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107804, "uuid": "613758cc-ba49-4d14-9198-cd6bc5e794dd", "comment": "Malware payload (Mirai)", "value": "accf5ffec1dce6f9b6ae0a3a26f8f69de68a78a6f6fe749692d179c7fd1256df830b0b60a327cae8c39ad70162755a5d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107804, "uuid": "c6745397-8364-428b-9e2f-f68967496574", "value": "T1636302288770A4B2F9277FB4F6F08191742CCDA8C2E970712A24F22E1D94B059FAE546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107804, "uuid": "542a2420-db11-4573-9198-77a035fe9f63", "value": "1536:F5RW1KI8YeMq8oa8cVqyuswDSzL/SEglfx1JXh:F58v8NMRD8cjuswDSzLKE4p1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634107804, "uuid": "f0ee06a6-2819-4dae-b30d-e7f39f35dd32", "value": 70928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634107804, "uuid": "41623b57-f700-4097-bed9-6d18e213872c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107804, "uuid": "8b175fb1-e271-4fae-9977-e3005b1e2cac", "value": "arm7-20211013-0650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e2e323f-2c37-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634137793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137793, "uuid": "339733ca-b4d4-45f6-89f4-93648a31af43", "comment": "Malware payload (Metamorfo)", "value": "bb18932345f67a3144c91d66b685b111", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137793, "uuid": "d6fbdd50-46ec-45e0-a6b1-614006e60284", "comment": "Malware payload (Metamorfo)", "value": "98c4871c4f778b4e1611f0b9f3162701da8c0839ecd1c9851880548d89bc93db", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137793, "uuid": "a5efaabf-86a0-4939-9422-78b489eb174d", "comment": "Malware payload (Metamorfo)", "value": "619d5a1553ef458d18838e4df28858bee02e7f3f", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137793, "uuid": "6b0484c2-dad8-4925-85c5-f01bd97a83f8", "comment": "Malware payload (Metamorfo)", "value": "763c6fbe7eeec7bf49f22a8dc4e29080fa715e214341afd63f22726f34eaeec6c65dabf3a0a37ff9a4a96c19ecab00fb", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137793, "uuid": "5ce4af12-9540-4a09-ae4e-a18c08539929", "value": "T1BE31DD051EEA1329C3B3CF7A107BA2464A76FC51EE934F9D808497DE28A1050EC35E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137793, "uuid": "d7c64b23-7548-4877-ae77-2125e23b1a42", "value": "24:8+JUHRlVo5kcbA+P/+/P+/Mw41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+oB1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137793, "uuid": "38e62315-7f45-4b06-a2e0-fbe7106d15d9", "value": 1538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137793, "uuid": "80f8108f-9a99-4f41-a7fc-05526516777c", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137793, "uuid": "777c279c-3d7a-4d0f-bda8-4aea5f87c4c7", "value": "Foto.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f90930-2bf2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634108192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108192, "uuid": "50c0054f-544e-4cec-b66c-4200ec3fad02", "comment": "Malware payload", "value": "c52b86bb0ed3eb32e9bf465f8e8131cb", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108192, "uuid": "f16db5d3-27ff-4b23-a04e-13f28faa1a46", "comment": "Malware payload", "value": "9a5a3e2fbb5bbd689886e55dbd7cc98aeb0fc4a4f12be492f7e222a7ea37af69", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108192, "uuid": "c0b6da55-f6a6-4d61-a837-5248b3dae20c", "comment": "Malware payload", "value": "239885df5b8443775ffa56de77ec6760252d9150", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108192, "uuid": "7a8bc912-2c3f-48dd-bc6d-c57e8db8fe27", "comment": "Malware payload", "value": "1fc96176f9417f836bb4748ea0f91c1b399d121d836cece2afd7bedd8b5d54f01799fdcc0e43072a762f4f01c38133ef", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108192, "uuid": "4326eeb6-5def-45cb-bbb9-c35bfd5e85cd", "value": "T1EA959E23F2D14937C0732B389D5BA769A93ABE112E38584F2BE42D4C5F3978139252D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108192, "uuid": "1d5e6d0f-edfe-4d81-b60d-e8e771230047", "value": "24576:RxAwAa4WINVi+Rg8W5AFhFEXCUVPL0LDAC7yOId1WxC2YK2EX6UmmBUejaXa4yTE:RxvAZP+VPL0LKuYXG6unTPFOYLHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108192, "uuid": "975ea67c-cd75-4be0-90ba-9d6ac3556aff", "value": 1957888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108192, "uuid": "d73f9805-5097-43d6-8af9-7e77bf88be92", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108192, "uuid": "e7f3eccb-4dcc-4de7-bc11-d9e971073c7a", "value": "deudas ynwoltzofnmucgpkqdrtwdreyr.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e698e83-2c08-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634117446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117446, "uuid": "b9560c53-d735-4d5e-8747-941616af8d7e", "comment": "Malware payload (Smoke Loader)", "value": "ecebcfb4709df4fd437cac2d5f14cb05", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117446, "uuid": "bf25ef27-5840-4c6f-915f-b14520885b0e", "comment": "Malware payload (Smoke Loader)", "value": "9a7f4d4d2c440b8009781e82023e52e122d77c584ff7bef19002a29e3b918efd", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117446, "uuid": "0138cad0-ec83-446e-88e5-9065ecef6a43", "comment": "Malware payload (Smoke Loader)", "value": "3aab7c184d965c66e23ebe9b281a897512a8d4bc", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117446, "uuid": "f1984beb-19aa-40dd-87d6-af75cf5fb722", "comment": "Malware payload (Smoke Loader)", "value": "c06b436f87440bbdf68c42a8e5759f635ade34bd01d1dcd30f292b31068ba86da62157390702c5eb0183a424e0650d4e", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117446, "uuid": "49687c87-1775-4b10-9236-7c0f5fbfd008", "value": "T130648D00B7A0C034F5F326F949BAA36DA53E7AA16B2494CF53D41AED96346E1EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117446, "uuid": "efb1f75e-ae5b-4eac-a7e3-72776282785e", "value": "4b52e566ef5b8727d87906b4623fc7d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117446, "uuid": "ebd425f7-1f7e-49c2-93a5-2d2dab11f06a", "value": "6144:D6HdDo6Ge4/tijD11qOHT/Iw6ZxpRwgZI8e:qdcpe4/Mf11qOHT/YxpRwof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117446, "uuid": "0811e37f-910b-47a5-a539-6a1cfb6be9d6", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117446, "uuid": "03d37fef-e523-4445-8e5d-ed1cd04bcaa9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117446, "uuid": "9aa72501-165a-46ca-b4c0-e24083864971", "value": "ecebcfb4709df4fd437cac2d5f14cb05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72beed3-2c07-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1634117326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117326, "uuid": "41aa2276-552b-4ff8-96af-0641788b2e57", "comment": "Malware payload (ArkeiStealer)", "value": "addc536bf186bf0f1f3c1bfb0dd10fb6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117326, "uuid": "fc694969-d5ed-4ea2-9da1-31b21baee121", "comment": "Malware payload (ArkeiStealer)", "value": "9cffbade290f88c34b8a5e2e551fd9ae035eeda9d49d0eb0fecec8e40ecf2e84", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117326, "uuid": "40631edd-d255-49f6-9e84-85e50211ba0b", "comment": "Malware payload (ArkeiStealer)", "value": "30608904d812a48535427dff89ca28640477fb90", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117326, "uuid": "a6ffb405-1b9f-4818-8477-3ba3e3284bae", "comment": "Malware payload (ArkeiStealer)", "value": "178b858c280d183b14a0a592917c2bbf98cf7a696cd82805d9bc3829669a2e609fd2782fb269443b8e1ea3cc1e287cc7", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117326, "uuid": "c3bb95fb-69d0-4039-86ae-6a62b0958c5a", "value": "T1BDF4F010B390C03AF5F352F85979A27AB63E79A1672894CF12D916EE87356D1EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117326, "uuid": "d6569e19-d7e1-470b-becd-252e2830aaf7", "value": "4b52e566ef5b8727d87906b4623fc7d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117326, "uuid": "cb3544bf-0f34-46a1-bc91-4b17987f8557", "value": "12288:vW3ImVZpEhctCENMfUkTwQpAQJQiCpJHDepBOcZJ70zTWsy:O3fhEh9ENMpkLrJSzOcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117326, "uuid": "9952046c-3ad7-44c0-b79f-4c6780d397d3", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117326, "uuid": "cefb396a-d859-40b9-8561-6a6eab1a537c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117326, "uuid": "fd6728d5-dd76-4bd3-abbe-87e40bbd4785", "value": "addc536bf186bf0f1f3c1bfb0dd10fb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff90e53-2c27-11ec-843c-42010a9c0014", "comment": "Malware payload (Cerberus)", "timestamp": 1634130736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130736, "uuid": "0adeeec1-cd78-4098-b01b-f63a0b4c7519", "comment": "Malware payload (Cerberus)", "value": "ae81f90811749ff7fa5dd524bef3e50a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130736, "uuid": "213577c5-66c5-404c-8651-3307843efd59", "comment": "Malware payload (Cerberus)", "value": "9d8aee08d3e74c40e0c4bae1bfca12b4a3e35c4a44197d6ff0cae3811ed43927", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130736, "uuid": "27c72518-930f-4909-8ae5-78e8cec07995", "comment": "Malware payload (Cerberus)", "value": "fd88462e3c6369ace6eaef53170290fa753ad83f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130736, "uuid": "50165118-0841-4113-b24c-ad95016295d5", "comment": "Malware payload (Cerberus)", "value": "213e39ce43be7ceaa4eac4f85857098cb779b0fb15a1462b933d86ef343266fd324c343d4207bdbaa74c61ad78e341c3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130736, "uuid": "c0c002ae-e7ec-4ea0-ad26-5c1e5b4a9ec4", "value": "T123C522F8C6610CB9D5794831A34B70A275B11B20B6F1F97B047279A57FBBE204189EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130736, "uuid": "931a0cde-ceb4-43e9-b02e-65443a178804", "value": "49152:tdtVtu+1bysjRG2sZnGUTINl96IMsjqR4HmMktOc8lyhfIEA8:jtVM+AsjRGHZDPIWUmMYL8lyfIn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634130736, "uuid": "4804ffc0-73c6-4301-bad9-c35bb90d58e4", "value": 2681519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634130736, "uuid": "4dd8f5e2-a323-4906-980b-30bc7f892b5f", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130736, "uuid": "c5d1b96b-e00f-4c96-8d69-4173a93104f2", "value": "Android build_obf.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59b8837-2c70-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634162313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162313, "uuid": "6a48cecb-66c6-4838-b4ab-9f75b936c117", "comment": "Malware payload (Gafgyt)", "value": "76a6c49638ea73fb10ca1bfb61d5c42f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162313, "uuid": "f6f331a0-4b90-4d7f-8f4e-b4ecbb0adb58", "comment": "Malware payload (Gafgyt)", "value": "9e952a0515f7fa4dae887c33b74c2674ef772e15f9cf67ed208e5c3525ad6f2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162313, "uuid": "82ff0590-4eb7-484d-a681-c3a24ccc0885", "comment": "Malware payload (Gafgyt)", "value": "7bc2239c15854cdfadd4062dc2fc72e276b24e78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162313, "uuid": "bf825eca-22bc-4981-9efe-35838343bee6", "comment": "Malware payload (Gafgyt)", "value": "1cfe10895e1af7d1a5c290471449c4da4899158c4d05c0dd5149f8e5ac500ec0c069ece6de432f9a33a51c21660a9ddd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162313, "uuid": "02ee4275-e2fb-47e1-ae1d-6406c3477e94", "value": "T1DB933B07B71C4F43C1DB59F029BB2BF15769B9E112A36181B91BAEC05B33AB81523F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162313, "uuid": "70e58361-7cec-4fac-a658-749475a80066", "value": "1536:T3oCu/OcwUBvPsTbwHH3P6zMSIHsiO6aRv/lz5H5hLg6wOFO6V6qDjjofSee:T43/qUBvPs6X03IHsi2/D5hL7wOFO6Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634162313, "uuid": "100544dc-8c58-4fde-b930-5e627858957d", "value": 92720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634162313, "uuid": "a8d28632-450c-4b38-b239-a9ffbdd7642e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162313, "uuid": "2ff59510-f8d0-401c-b612-778ba8137d69", "value": "76a6c49638ea73fb10ca1bfb61d5c42f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e594a2-2c2f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634134390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134390, "uuid": "d0c5d885-81fd-44d2-a76b-7bd45e66b10c", "comment": "Malware payload (Formbook)", "value": "ac493c2681477e3b56acbb570b8e41d9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134390, "uuid": "f9ca91df-834f-4028-9d06-d70f0485d899", "comment": "Malware payload (Formbook)", "value": "9efaa722d6e9df7c6628df6d1f49d14d858b60782db11c3f1e9b5037803b290b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134390, "uuid": "bbbcadb0-464b-4c4a-a6eb-7fbd764fee5a", "comment": "Malware payload (Formbook)", "value": "2d9019b6c2f57c6360b155957cb542ae61bbf728", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134390, "uuid": "9ac18fe9-7dc5-4142-a312-f553e583d86b", "comment": "Malware payload (Formbook)", "value": "dea46a3d49bc6977667772d2286e4925611fb0da6b5059907b8aa70f365b44f891e8c479169bc4a3e71f7d7dc9f2608e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134390, "uuid": "8c161228-05da-4d79-ae7d-b35ff31ddecc", "value": "T1DC64D196FEB51556DC4929F28D492CC898FFEE0AAF37E3C0846B751A1D7089F9348384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134390, "uuid": "0e617231-2f5a-45cf-bfba-08d25750414d", "value": "6144:nPUVRB6666666rBkkoL6666664BoW303lddzlBGJOvZT7oz7Dqfd2QCwHPPQRUk2:PqH666666eBkxL6666664BoWE3lPcGZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634134390, "uuid": "0fe455c1-fbee-4c53-a5a4-2cf3a50af9dc", "value": 328616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634134390, "uuid": "49d0f343-576e-42d4-adb3-5f17157ee09d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134390, "uuid": "6f3dbc92-52c6-401e-b4d3-f62c1f5b824b", "value": "Sajeeb09908976745344567.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9fea4a8-2c0d-11ec-843c-42010a9c0014", "comment": "Malware payload (a310Logger)", "timestamp": 1634119908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634119908, "uuid": "491e4d04-3290-4307-b8b2-a0d17d3f54ff", "comment": "Malware payload (a310Logger)", "value": "5b99e078a95f02617911e2403177a8dd", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634119908, "uuid": "c959b0ee-e5a9-4687-8307-6d31c617c22e", "comment": "Malware payload (a310Logger)", "value": "9f42a87633b7a40b8ce90e2d156d2c98fa9ebf7946e3af454fddc82aaf259c91", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634119908, "uuid": "e4f7009b-8bfc-4c4a-ad97-57b6ce5823dd", "comment": "Malware payload (a310Logger)", "value": "d9c1cbbd8d3b49c0af18b754e3a217689cf828fb", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634119908, "uuid": "d63cf8c8-bd80-45f8-9539-f40695ccdab3", "comment": "Malware payload (a310Logger)", "value": "e8f37a65a91c58ea13ecb5f3843d97b6c4900b5aa54c1e34ca4776538cab6d1a871de3b2ed03b4cee488aee956bd2f26", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634119908, "uuid": "d8198370-e15c-48af-9522-e9083c9b4306", "value": "T1D4250915F3929C11E567167364E051E391092CC7E858833DEBB7BAA318EA3805F9CBDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634119908, "uuid": "6083c178-099d-4c3e-8d6b-baa846bed6df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634119908, "uuid": "8fa149a7-6c32-4a0a-8b3a-0e13bc8a8f29", "value": "12288:yAeoSjd75My5rWpiBvy29xzqk5rm97D5BWKjQJj+UXxeLNdU:yhddBqwxJdm97D5rjQJj+cxydU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634119908, "uuid": "63bb9d80-bfa7-44a0-ab6d-a8c1511598ef", "value": 986624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634119908, "uuid": "c9795380-ebec-4ba8-a883-259c3d00ef0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634119908, "uuid": "172d242d-937d-4dc4-b503-083aecb9588c", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee1638b-2c13-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634122439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634122439, "uuid": "741f92bc-e253-4d94-9a6d-20fb0c9dcc23", "comment": "Malware payload (AgentTesla)", "value": "3a864f29c4e358887ecab0c0c5026ed2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634122439, "uuid": "ba14d66d-4901-4c76-9f44-84e70c9ff199", "comment": "Malware payload (AgentTesla)", "value": "9fef5950c5cbed99b2ae8e5cc3de14fa3534352d97b9eb85d05fa9e83731beaa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634122439, "uuid": "0f73a3ce-bb32-41b4-a2e7-f4c65097c8ba", "comment": "Malware payload (AgentTesla)", "value": "5c5269bd9f4a967d0632cb7b15ac3c918b4e4ca2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634122439, "uuid": "89b511c3-6927-46bb-bea8-cc43ef907980", "comment": "Malware payload (AgentTesla)", "value": "7f69f1a1aa7b726c8575d95b0ebc5f855d25f6a1260c46fefee8d1a1f0b97b6c32d27fb951aa07633276fcc30bab27a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634122439, "uuid": "3c9c97cc-ff61-40d6-9970-13668e201a06", "value": "T190D4D0A47F9AD80FE36A88786131EF44CA7C615B3713C625D9FF147A929CB9428C21C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634122439, "uuid": "70101f81-ec2e-4bc4-ae99-9fae5d6f0a05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634122439, "uuid": "78430dd0-f80b-48f7-879f-88fc9d7b9657", "value": "12288:4hwYEfl2HxPR/WhQgblpOTgR+8wHPU7qt9wWXqsmgISPoq3eSBQL1l:+dMbwH8OAW6smrXqzBEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634122439, "uuid": "e9e5bfc7-676d-46f5-8df6-a52d69bb50b7", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634122439, "uuid": "99a62efd-b3e5-492f-b91c-73cce8ca51c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634122439, "uuid": "c3775f2e-f303-49d8-894d-17524b9c5a39", "value": "FAj7shxXukkNrTk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311f3e61-2bed-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1634105827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105827, "uuid": "92c7bbeb-4c53-4270-860d-5df3c57850ba", "comment": "Malware payload (AsyncRAT)", "value": "babe589c3f9cf2208119a52ec96fe9e4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105827, "uuid": "19dbc922-bbce-42ab-9dba-b33f7301a302", "comment": "Malware payload (AsyncRAT)", "value": "a037ad7688921e0a15cfa4d5b6843ca81a17d046c16eab460aa5eb3bfbe26f0a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105827, "uuid": "66de499d-11ac-4052-bd43-5bff5e0514a7", "comment": "Malware payload (AsyncRAT)", "value": "a4426d63ad04cd8c6128c1d24bf3bd2ef97101ce", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105827, "uuid": "42a885ae-fe0f-4c55-9f30-8cf1ae24d659", "comment": "Malware payload (AsyncRAT)", "value": "3acca6f6a50f92d3ce758578d4445dbe703990413be58f54d5490fe2f508f88f5235cc01febe75bc566bd0de378bcdb1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105827, "uuid": "ad322fe6-5df3-49ac-8f70-31ad48bc508e", "value": "T1CDC43105F3939C11E567167364E051E791092CC2E858833DEBB7BAA318EA3805F5CBEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105827, "uuid": "60e90fd7-90c8-4128-a161-03d3f91c9ade", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105827, "uuid": "96efdebe-fdac-49fd-9b39-9551d8499f31", "value": "6144:zvd3o3dgzTXnLYY4lOolT473pun2y9Un+ZpdupIvSazr1krQ+6Uqk:DxoATXnWOoipu5Un+9upLa/ymU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634105827, "uuid": "cd3c84f3-6678-41f3-aeb2-a09932bfa68c", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634105827, "uuid": "abf817b4-c179-43b0-b20b-7a1500e8b6ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105827, "uuid": "3291a22e-b93e-4e7b-8fd6-8971766e9472", "value": "Payment_MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dccf76ae-2bf1-11ec-843c-42010a9c0014", "comment": "Malware payload (Lazarus)", "timestamp": 1634107833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107833, "uuid": "67e96c23-08a3-4f07-bc56-1e75746819b3", "comment": "Malware payload (Lazarus)", "value": "c44d866adf8c6845b7dda742c59c6b59", "object_relation": "md5", "Tag": [ { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107833, "uuid": "803271b7-7314-4f56-bc52-6557d51b13ea", "comment": "Malware payload (Lazarus)", "value": "a042bfeee49345d514c274e5f44da374eb0875da4a5671e8bf67005078c076fd", "object_relation": "sha256", "Tag": [ { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107833, "uuid": "cb2dff83-62f7-498b-9558-fc0be837bfb7", "comment": "Malware payload (Lazarus)", "value": "b19e3b0ea216eea3c3cdfae490b0929b8d0ca40d", "object_relation": "sha1", "Tag": [ { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107833, "uuid": "d4ef7f73-2488-4517-964a-7439e52caa0b", "comment": "Malware payload (Lazarus)", "value": "b382f0962b316a1d2d6e31a15c1234cae35afb50d2edb28f9d886b137fb6bc625f4dea5de911ee9684fde8437c7f7851", "object_relation": "sha3-384", "Tag": [ { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107833, "uuid": "d1ccb009-97ff-4033-a960-6215ff9d4da7", "value": "T13B410F261ADA1315C3728D3B40ABF2418635FA56BD53CBAD028052C858A9619FC36F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107833, "uuid": "16335143-23cb-4eaa-b769-abe0ed8d649a", "value": "24:8doPJ/PbCgQlzASPx+/cfvnZwrMPLj+/QT4I021XQaR3+PwckKVtCGO+/efmzB:8dwBYUSvZlTjfMI7Xv3vOvO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634107833, "uuid": "47ec876d-d8dd-4890-8f03-35cac9c0cbc6", "value": 2324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634107833, "uuid": "9b4a869a-7109-4725-8483-0d1ae1f30445", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107833, "uuid": "1a510e39-afe2-45ad-8b36-397f47d4b1b0", "value": "a042bfeee49345d514c274e5f44da374eb0875da4a5671e8bf67005078c076fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7409f33b-2c53-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634149748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149748, "uuid": "a6aed3ee-c790-4fd8-83de-e539b01d785f", "comment": "Malware payload (Formbook)", "value": "e954c3d029b943b054fceb27e5e24d2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149748, "uuid": "cabfb68b-a5e1-4334-82b6-9b94bfa049ec", "comment": "Malware payload (Formbook)", "value": "a0703367806de16bac9c75c016780c0bf3b1d8c21cf7f51b6a47b6a1aba74999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149748, "uuid": "001476a4-32d2-4514-ae41-0aecb9001100", "comment": "Malware payload (Formbook)", "value": "927f6633500965f008ab556a0c1004c095e004ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149748, "uuid": "37002670-68a1-4922-889b-fe956ec254ef", "comment": "Malware payload (Formbook)", "value": "7cbc85e27d34c173a1e38e54755fe3b9e942e665b405b53469eb77964462306dda3470355546bc409b7541cc8777ea0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149748, "uuid": "b367c988-4b91-49fd-a665-96038758d81a", "value": "T1C005907A9DBC483AD5A54738CC4BB7A5493ABD103A04AB5B3ED16D48DF3D3C63612283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149748, "uuid": "11562690-3143-4d4c-b216-f26539eaafb4", "value": "96a5031294b4d167fbfd58b7a8f0b330", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149748, "uuid": "984cb9f7-f16a-4945-afb4-4a0ae8a4d53e", "value": "12288:oP3Sd0k2b6Yf1ls9oJ2mF6LIosXFHJ1kUH1N+BfZ8fQOwm6V:ofQob6CEoJ2OpXXp7mZ8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634149748, "uuid": "86b03c72-6c82-46aa-a106-be9a02d7432f", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634149748, "uuid": "97ff0039-8eef-4416-844d-da7d4437dedc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149748, "uuid": "2641cd60-fa35-4a4e-8e43-c6525f58290a", "value": "Original Shipment Doc Ref 2853801324189923,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb0b15e-2c27-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634130891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130891, "uuid": "a74e114a-83b8-4bed-82c6-3bd8d3e3d54f", "comment": "Malware payload", "value": "18a942800e19f651c6b2b047fcd96f54", "object_relation": "md5", "Tag": [ { "name": "wbk", "colour": "#09CA42", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130891, "uuid": "707ebfce-3d53-446c-b02d-b678ed8e8f3c", "comment": "Malware payload", "value": "a25c7a104abb85ad689644059b6e6ec5a118eebfd5fb004073a74f3b3b9428da", "object_relation": "sha256", "Tag": [ { "name": "wbk", "colour": "#09CA42", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130891, "uuid": "30446d32-a5e3-40d6-b369-ced15eada893", "comment": "Malware payload", "value": "422c2222fbc390060e4dba67cd6cc6b9058bbdd7", "object_relation": "sha1", "Tag": [ { "name": "wbk", "colour": "#09CA42", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130891, "uuid": "6ab39a56-210a-4223-b3ad-0a04bdaf69d8", "comment": "Malware payload", "value": "c38d4c13a836e84c0306af3052d6b8a3d0baf84b1a0af56ce1014b34fdf88c9ae4d30394a364bf8b4fff69926e1b0efc", "object_relation": "sha3-384", "Tag": [ { "name": "wbk", "colour": "#09CA42", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130891, "uuid": "c04e1989-d017-4dab-94cc-f727a2a36fd4", "value": "T1EA42B6ECF55701A88F496ABC176A27D8024C7A2DB348A273357C9B356B91C3B4627C3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130891, "uuid": "8daa8341-c477-482c-be04-116e4375987e", "value": "192:Uf8ZLfAfRH3NgFPOKiyfItd8NizpancbmJHDO/00kmixJmm62FphsnXzgW:UwzoRH3MNnfIOizpoHSq6tXzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634130891, "uuid": "2c367c56-49fd-4fc6-8b0b-3f8b69c66ba7", "value": 13127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634130891, "uuid": "1f2063ae-758e-40ed-8855-4567aef7d836", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130891, "uuid": "45127e81-ca7f-4e1a-9975-9f1c21613910", "value": "invc_0098008.wbk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6247dd-2c2d-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634133365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133365, "uuid": "7caf4b0a-918a-4f9e-b81f-b8a96b32b5df", "comment": "Malware payload (Dridex)", "value": "04c6e562e2bbd3ccc221f6472f231b7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133365, "uuid": "40ebf50d-5ba0-4285-9cdf-c0724e1d7bca", "comment": "Malware payload (Dridex)", "value": "a2c1142a25a5081b3ead3280a8f4405d5781032e556904a66196f2c7a3d27268", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133365, "uuid": "259ffc71-f8de-4f74-a12a-a6470075e49b", "comment": "Malware payload (Dridex)", "value": "bdd6406d6dab7efab07907033ebd8e3df9af5dd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133365, "uuid": "683a9444-68e8-44d4-90be-b0d490dad6c8", "comment": "Malware payload (Dridex)", "value": "5a493b9f923e9d828ece2e93eb4554d69fd593f8a0be9c1a7714d2eb15a85458184fb2da58e99af8069a5413c121e6c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133365, "uuid": "b3397b08-1fc1-4f3a-ab60-d11cf412a464", "value": "T1B2D4F8013A54E821E7E955B6CF2AC6E85B183D49EFB0A4C778E17F0F2AA94F3D215305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133365, "uuid": "d2e6901c-c181-4579-872b-aeb2fc253a66", "value": "54afd981c141523b8c68b6a5bfed7202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133365, "uuid": "c140e73f-e730-4e98-af69-798d4daebc4b", "value": "12288:ruIBcXwMtjp4CqwqyaXPLAfx38TW9DiWUT2tq017JGoLb+W/:yVb4wqyaDA5sTWiXT2tq07G2z/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634133365, "uuid": "393e0ffe-7d78-4ef1-9c44-048c72b53693", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634133365, "uuid": "9446daeb-17da-4df1-ba56-f2195d3b15e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133365, "uuid": "feda5ce4-c346-455d-93c4-32de3b349834", "value": "04c6e562e2bbd3ccc221f6472f231b7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52143ded-2bf4-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634108889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108889, "uuid": "5b19dc96-5134-49c9-9fbb-99f9c63866b8", "comment": "Malware payload (SnakeKeylogger)", "value": "9934f525e8ea1c8a4b24a3f2e4bc41fe", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108889, "uuid": "d8d2fe3b-8a73-49f2-8b77-296ce11bce13", "comment": "Malware payload (SnakeKeylogger)", "value": "a39fb6c88577cf1433d6c45a30ae8f9cd746431a81a8f0e883ebdeaf3479b220", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108889, "uuid": "bb9bd5d4-82ce-45fa-9538-6df14a6f3fc2", "comment": "Malware payload (SnakeKeylogger)", "value": "579e8c03eac407eb6cc268419d0cc39ea743a14e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108889, "uuid": "75a712b7-2b3a-4663-9d31-f382c2218791", "comment": "Malware payload (SnakeKeylogger)", "value": "f9826e0353afeeb40a77e7dd00e85ad8f26e306e629651bdb8613d4f19ec67d2c9d0fecc62e14e42d75c235a4e3123a8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108889, "uuid": "2caf705d-5e3a-4afa-8ee4-57c04f29bc4c", "value": "T1C8D42393B1D4DFDBE41B6A391CC3D09C7E18EC886E6DD20B3A45BB5B4EB97358102819", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108889, "uuid": "ab254826-3a72-468d-b598-8f49f76d1b90", "value": "12288:zbqTtukI4DLk+N76BI7G+eDYYQgc6gID6ijVAm5vbZ82NHKLtO2:HmukI6Y+N7uDgl6gI9VAm5vzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108889, "uuid": "cfce113a-9a1b-40ec-babe-e7eba9df6ad5", "value": 644096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108889, "uuid": "6e22eef9-e4a7-4b22-92a6-395b42896f5c", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108889, "uuid": "79dd588d-d231-45fb-aef7-931e7a9c66ec", "value": "BTL_01145120_160850IMG.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a46c1c-2c38-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634138362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138362, "uuid": "21097528-cde8-4036-b62b-273121838273", "comment": "Malware payload", "value": "c73fe89eec912db04a4804a843a7a926", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138362, "uuid": "b3d136a6-3c6f-41c3-a22a-4ce2f55f9eb7", "comment": "Malware payload", "value": "a49cfcbba75f88e0b1f631f920332174eb9d1da55a8820dbdee601c78663d76c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138362, "uuid": "02c791d5-150d-4615-bd43-551e651767bf", "comment": "Malware payload", "value": "11e80f57b755767c44ba6065541a81b459f23c37", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138362, "uuid": "0467128e-ef8c-4eaa-ac13-7c9801dcad6b", "comment": "Malware payload", "value": "d7b592a7326c119780f5ffbe3dfd087a247a68d54d1380679b2c3870f7113b312a8afa94dfbc65ec05cdf471765fbfaa", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634138362, "uuid": "b49a545e-5496-4fbb-9b02-cd7c96b1ad11", "value": "T175D42393B1D4DFDBE41B66381CC3D09C7E18EC88AE6DD20B3A55BB5B4EB97358102819", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634138362, "uuid": "94e02317-a75a-404f-aaab-1ed677bdf464", "value": "12288:4bqTtukI4DLk+N76BI7G+eDYYQgc6gID6ijVAm5vbZ82NHKLtO2:omukI6Y+N7uDgl6gI9VAm5vzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634138362, "uuid": "d00041d1-9af5-4308-b743-1d25a5d87bdc", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634138362, "uuid": "5e5ab189-aac9-4e03-974e-5df40d902501", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634138362, "uuid": "94d7b440-e70d-4798-bd28-b4c224e0d0b0", "value": "WU PAYMENT DETAILS.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e73982-2c64-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634156948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634156948, "uuid": "81a71c56-0f36-49a7-a39d-e46e91b393e8", "comment": "Malware payload", "value": "ea5d06ebac99fcea217fecc743c259f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634156948, "uuid": "9e54c02c-42fb-4529-b73b-dfe01cc19ace", "comment": "Malware payload", "value": "a4ea8ccb32a746e3315e35d366246545d6475dc48e8e43cf92da45bf5de0fe7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634156948, "uuid": "225ef79e-dd98-4dee-9fa9-91a7c4a084ef", "comment": "Malware payload", "value": "db9b688cf9941bcbd02364db15ebfa22797eb551", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634156948, "uuid": "ea3b3d84-b6b5-42c8-8b3d-0d6c23be1356", "comment": "Malware payload", "value": "38f75345dbeabf0004618aee237828f6dced4910f775e78e195a6f6c5f25e09ef4226566883b4d5bd479c3ba64a6d2f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634156948, "uuid": "216ab8bb-2016-4dce-8d62-0bcb4b91b9db", "value": "T14F74BF0031E7C876E47314314D78EABA49AEA5354B5F46FFE3D0153A8E713C19633A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634156948, "uuid": "320c2627-23fa-4095-8f2d-fcde4d2bbb8b", "value": "7e6d410cb0ee9d4d9be8ad4e6fd75b64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634156948, "uuid": "b3f6ae44-cd41-4e83-86db-91f4bb4a402c", "value": "6144:6USw3fbq4a6LKXpzdKgneetfFqJTTiabAOPSW7N88e5Qx3ef+D8:65w3fbq4a6Lap7CTR+0OWD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634156948, "uuid": "3ad52f50-e09c-455a-ad07-cddd87a9dbd4", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634156948, "uuid": "85a7f5af-89d0-46cb-8d1e-b64f158635d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634156948, "uuid": "9ea1e61d-eaa2-4ff4-95d6-67fb5ab17719", "value": "ea5d06ebac99fcea217fecc743c259f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23672392-2c34-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634136298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136298, "uuid": "6dfe8308-9561-4342-a442-180b07465191", "comment": "Malware payload (Mirai)", "value": "933923bbd3630ceea916b7a843808379", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136298, "uuid": "3a7aefa9-f4a4-4e2b-81a4-9b2504df16a1", "comment": "Malware payload (Mirai)", "value": "a514f347f33dc8fee923561f1d9b16391598ffe0429c6e08029dc88a4448c4e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136298, "uuid": "96e1e903-d258-4a43-a58d-e3a7fac130a0", "comment": "Malware payload (Mirai)", "value": "d99f181f5cfca2a1d693bdca90c4635305a9e867", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136298, "uuid": "acf47f50-cf93-4f56-a3c6-a644398aa9bf", "comment": "Malware payload (Mirai)", "value": "d4fd0a9bfc51356428cd444f500e0cdf64741d5380ab14051b3e60813dd577cb0016b2ad736362d07f0e0f8fabc936f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136298, "uuid": "65136091-3d61-4d05-978b-aadcb568ae26", "value": "T13953E781BC41A629C7D11777FD9F559E3710A3C9E1E932138C240BA07A8F94B0D5BF9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136298, "uuid": "785e7793-3386-4b3d-8a82-e5ad670e4001", "value": "1536:GogI5uRJ7lshCKotdsVKQNdQy33eZtQqQotK:GogI5uRJCQszmy3w3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634136298, "uuid": "53c8b281-dfdf-43da-ab15-38b00e78050b", "value": 62900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634136298, "uuid": "b5acc33b-c0eb-48ae-a8ee-d38e995fe743", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136298, "uuid": "4d61a409-a6e1-4b7d-9468-83ab807ffc39", "value": "933923bbd3630ceea916b7a843808379", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254006b1-2c4c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634146609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146609, "uuid": "98c2c21a-2b21-44f1-ac6b-65469906bbe9", "comment": "Malware payload (AgentTesla)", "value": "6cfde1b32fbdb5f459e9b5ccd166f84c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146609, "uuid": "0189ad8a-f508-41a6-a218-11929bd57537", "comment": "Malware payload (AgentTesla)", "value": "a60c71563da5339e766d8db264205ae5542b11e38f7bdc91b502fce729858896", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146609, "uuid": "5d90a670-0e66-4c4e-9e89-21b004aafd9d", "comment": "Malware payload (AgentTesla)", "value": "c5691fbc01a63a2cab1f3c9349c0630f979f980e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634146609, "uuid": "d7cf0163-5c00-4075-a0dc-7ae2382659ba", "comment": "Malware payload (AgentTesla)", "value": "e6e24ac27a1a4322796a5062e18071a1cbd569ab0b45ea4315b5ba034221e0bbc9c2d42d7104259f3771510c5cfc1e10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146609, "uuid": "d4097707-2d86-4e4e-9616-bd60f2ad44a1", "value": "T151B4CFA47F99DC4EF36A9C786232DF44C66D614B3A23C615DDBF507A936CB8029C2183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146609, "uuid": "4eb0e1be-4971-42cb-bb8a-782763337768", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146609, "uuid": "7f32f0f8-4848-4b2b-82fc-57031ad3af80", "value": "12288:xEj54mJ+E/HYeq4/wezaheFFr1U7IxkH8SBpa:xEmmpHYk3+hi51ZOHBBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634146609, "uuid": "3f0d980a-af30-407a-857d-04446cb71d75", "value": 510464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634146609, "uuid": "2f2f07c3-0fd8-4e0b-bafe-87f720d8266a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634146609, "uuid": "dc564661-fad9-4412-847c-2486c85ac20a", "value": "copia de pago_pdf___________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73918567-2c2d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634133426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133426, "uuid": "717d22e2-2c0e-4a21-ac34-79a6f2eccb9b", "comment": "Malware payload (AgentTesla)", "value": "1f12c749f19ecabe40cf2e7bf6dd6469", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133426, "uuid": "33fb3168-5930-4882-9e7b-e708be6d7a90", "comment": "Malware payload (AgentTesla)", "value": "a663e8bc86582ab9a3e2798d7bef3b1fbc408f2bf8d1b75af866e778043abea4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133426, "uuid": "ead989d6-76aa-46b6-8c18-a279caa6d672", "comment": "Malware payload (AgentTesla)", "value": "cc5fa19c09c00c68f4cdb0ed6f775634e81a4b16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133426, "uuid": "4dfef378-ab57-43fb-b994-bcbe00250611", "comment": "Malware payload (AgentTesla)", "value": "2309da5baf5b0994c69f31f5a709e31a6008a0420f3a0433153031388322d2dfa6602e5842fd2d853a74204af776dae6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133426, "uuid": "0847f972-6162-4390-82a4-6b35a4ea3eec", "value": "T1FB64D074F175A38EC5665EB628D2372FA029CF7ABB46D6617003F190AC74DC2B43A634", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133426, "uuid": "b30ba9ab-ffd7-43f4-a619-46c8a79b7570", "value": "6144:buBtij+j65+T7jFKR9mG+ACmAtmhZbn6GJBfbSpLKyiVDgjeFV3AcdELi:bu7Hjx/pKR8pMr64Bf8jybELi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634133426, "uuid": "f19ffc3a-7925-4f44-99e6-d4cbaf33405a", "value": 329000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634133426, "uuid": "0ac725b8-ee2b-49b0-9139-81772bcdadbd", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133426, "uuid": "f62c5c17-c743-47a3-aad7-071ce9bd0d05", "value": "DHL consignment number_600595460.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22348056-2c2c-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634132860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132860, "uuid": "0abbfbb4-5610-4101-9628-f647df79eb66", "comment": "Malware payload (Dridex)", "value": "2be3103281a5c5e36ea8caf61ef751e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132860, "uuid": "f27c5dde-4b52-479a-86c7-5cad90bbe2e9", "comment": "Malware payload (Dridex)", "value": "a6c8e854f7c30f6390c39a1cea1393b949331a1b17b455dedd05fd7c92c7ff90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132860, "uuid": "138f69c4-f9a1-4149-a01c-af1eb08c02e4", "comment": "Malware payload (Dridex)", "value": "d652eadb5b4ccbbdbbb0f8b6865493b3b3112b7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132860, "uuid": "ad3304eb-7765-43bb-8fe5-5b20906d5f25", "comment": "Malware payload (Dridex)", "value": "9ddbab7289a5ff75d159bef4b79664ccfa7d3e587c4e68edabe8478152a9f30fa4ada040689c7709b3a565dc65dc0546", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132860, "uuid": "ecfce324-1892-47f2-86d8-4f40a2cb20b0", "value": "T1D4D4F8013A54E821E7E955B6CF2AC6E85B183D48EFB1A4C778E17F0F2AA94F3D215305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132860, "uuid": "51afc07f-eb54-422b-853f-dd49fc0bb93a", "value": "5eb95f99453a8a6fe3d6300e286747db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132860, "uuid": "6a6c5a1a-c482-46bc-a969-497c7525cab4", "value": "12288:vuIBn2wMtjp4CqwqyaXPLAfx38TW9DiWUT2tq017JGoLbjW/:2Fb4wqyaDA5sTWiXT2tq07G2W/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634132860, "uuid": "cd2004b3-a8b3-4cb5-992f-784677479c6c", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634132860, "uuid": "627f4b91-eba8-413e-bbeb-4db47f1aad81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132860, "uuid": "76bfdca1-5c81-4cff-ab3e-8c2b7040d045", "value": "2be3103281a5c5e36ea8caf61ef751e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66fc9472-2bd8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634096898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634096898, "uuid": "fbabb80d-3fac-4080-a8eb-f7426418726f", "comment": "Malware payload (AgentTesla)", "value": "ff37b8b142b95b671a64a93f00178ffd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634096898, "uuid": "b0cb1808-a979-41b2-bbb8-c6f6c9c79e0b", "comment": "Malware payload (AgentTesla)", "value": "a6d9820be6946d1f5456861a455e2e0229943bbbd47f9102d869a424dd64b21a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634096898, "uuid": "134f3626-43dc-4875-b815-36af881814cc", "comment": "Malware payload (AgentTesla)", "value": "3dda6898a368c8754958b3f60a8023d72d4c5379", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634096898, "uuid": "cfff2daa-5038-4585-98cc-c7beeecd1e0d", "comment": "Malware payload (AgentTesla)", "value": "5f1e4841deab80bf6837ff1bb4b619c3d30ed081c87052d39a65fc5d7c073fc1c502e519b3f3d849fee599f05103aef1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634096898, "uuid": "cefd9ee8-cd0c-48a8-89c4-b9fe68e8e232", "value": "T155D412469FA5AA4ADD9E4EB601A2E7B08BF0DD443D62F7195CE53CAB33373D60442063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634096898, "uuid": "bcd803c1-b4de-4f29-bbb8-5edc8604fa79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634096898, "uuid": "7d473e19-5a53-4e8a-a3bf-08b13dd5753e", "value": "12288:5cxPkASBUSnKMe9fl7jCX6JJFGHGnJ1XsjT41ukTuPDfxPo2obxIJ9W:KxPOB6nfiSfGHGJ1X/uC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634096898, "uuid": "61be8f7a-373f-4210-9a55-dd3c4f1001be", "value": 650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634096898, "uuid": "3b359e32-0b55-4249-9bbc-b19be03b0851", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634096898, "uuid": "523dcd38-f83d-4f53-85bb-4ce3be7b9c54", "value": "SecuriteInfo.com.ArtemisFF37B8B142B9.31360.10534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3efb0cda-2c4f-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1634147941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147941, "uuid": "5b3a2aca-cfec-4868-b621-2165ce683273", "comment": "Malware payload (DanaBot)", "value": "43bd9c07d8cbb790982087b309f45a76", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147941, "uuid": "94af60c1-c6e2-4ae0-b5fd-e3633021ba01", "comment": "Malware payload (DanaBot)", "value": "a88222d690c442a6d8af50b2ddf20b770611b0a41be4585b5e9f562a5542953b", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147941, "uuid": "0b5a88c9-b7dd-4b03-825c-ac35bba4aad8", "comment": "Malware payload (DanaBot)", "value": "a95eabdda268bc3e59a60c6b62f2d9759543ba0e", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147941, "uuid": "f97d94b2-3c55-4629-8864-6f218b1364ce", "comment": "Malware payload (DanaBot)", "value": "f34124ee8ea35b3640d24f58cb9fe12da07a508b12eaaecc10427eb074499ee3070cedeecc2bddb5965d4dafe610e80f", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147941, "uuid": "1be1056f-79dc-4ae2-a6e5-988056aceaf5", "value": "T1F0451214A7A1C039F5F316F84AB9926CB93E79F1AB1840CB23D856EE57256E0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147941, "uuid": "3cb6fe5e-9153-486b-81d4-ad0306370b7f", "value": "e9d1f1739ab48fbfe7c7128688524302", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147941, "uuid": "83264c4b-2664-44d0-b712-b20ab7428fca", "value": "24576:E3ye1rzR1OwYV+WOb1ts8wvmdPghJ2G3wXIK:6PFWOBts8wvmBu2G3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634147941, "uuid": "4cb444e1-6332-47da-8f64-edeacc2f59ef", "value": 1233408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634147941, "uuid": "c324d5ec-df97-46fd-8788-af14c4946e91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147941, "uuid": "88268dee-f8ea-42c7-8667-243644a89fc5", "value": "43bd9c07d8cbb790982087b309f45a76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16361ed-2bfa-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634111679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634111679, "uuid": "a0376925-b5f9-4f85-ae85-5e2715e4200d", "comment": "Malware payload (RemcosRAT)", "value": "e53618e98476bd381cf375f10e360e87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634111679, "uuid": "390ef3b9-b546-4c1e-92dd-85951d351138", "comment": "Malware payload (RemcosRAT)", "value": "a97b00620e1e8ef9ef5c5f922f5b40ecf698504402d3e14979701c330bef7b56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634111679, "uuid": "09507026-1bc6-46a7-8ef4-ca23f7029274", "comment": "Malware payload (RemcosRAT)", "value": "19d61a832a0e3494b7c40717ca0e645fb622f13c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634111679, "uuid": "23baecfd-c78b-4855-8c43-d1d0b1e3e90c", "comment": "Malware payload (RemcosRAT)", "value": "8d7c59cc26fd118ab51ba4ab516099d86df406083fffe3b1833b7eac87c80deeddd81f1642e0707ba05eaf271f2d7cc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634111679, "uuid": "3230bc45-d030-4bff-8fe4-3aa736069e11", "value": "T1E9258D13E5F50832C6773B75AC670B256E38FE14AE3035452EF9298DCFA139178262A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634111679, "uuid": "10044c8f-a81b-4ec6-a1d6-a403403c4d2a", "value": "33ef3fa8cfca6640b4d180caba182c91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634111679, "uuid": "9033e11e-3bdb-426e-95a7-6e135c99a379", "value": "24576:GDe0W1m4aVNTc9jOigXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXo:GDe0JVxiY2uM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634111679, "uuid": "4ab0d62f-1153-4385-8c3b-ed2d997affff", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634111679, "uuid": "bed81d17-cca0-408e-bf01-db7b134e6a8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634111679, "uuid": "7e8ac0af-1d13-46f6-b883-55e658fa1e2f", "value": "DHL Lieferschein,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa63a26c-2c04-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1634115909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634115909, "uuid": "7cc52005-dcba-4448-9b6c-cc5350ab32ca", "comment": "Malware payload (ArkeiStealer)", "value": "0050729426253655c88625a8ad93d7a2", "object_relation": "md5", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634115909, "uuid": "a05f61c0-c5df-41c1-9612-2b7e90d12a7c", "comment": "Malware payload (ArkeiStealer)", "value": "a9dea10c6d4d205faab1ac8db69384e9c3dc91fd5a718266957e4e164f76cd4a", "object_relation": "sha256", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634115909, "uuid": "60d099e3-054b-4773-90be-508a607c4e94", "comment": "Malware payload (ArkeiStealer)", "value": "a8ea376bc26eba3ff32e72cb2bf43cccfa1c87d7", "object_relation": "sha1", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634115909, "uuid": "fb567174-e48f-49d3-9323-d7a9969eb5ab", "comment": "Malware payload (ArkeiStealer)", "value": "1dc29e89b9291afc58384526c1caa9a537066ef557109aac5ef6b365a76c2ea6bd0cb130d958b988376d0061c19e926e", "object_relation": "sha3-384", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634115909, "uuid": "529987a5-7eec-41d1-a58d-f94029dd8828", "value": "T1F0648D10B7A0C038F5F712F959BA936DA53E7AA1AB2490CF52C516EE96346E1FC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634115909, "uuid": "81ede00e-5d29-4cdf-bcd5-da5c911e295d", "value": "362b424337999aee119a9c1dea92a737", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634115909, "uuid": "0dd61f7e-c255-4663-8603-94cfbbeb18c1", "value": "6144:GKQxkV++/1iYCoMjg+iYObpfxmjahC6BFCrYH7a:3QxGxC9c+iYObpfJhhBFVba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634115909, "uuid": "1055dd93-ffd4-4002-bc6c-b002cb33d436", "value": 318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634115909, "uuid": "a90823fe-85e0-4156-91d0-f2ea05bde97b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634115909, "uuid": "f18bf433-0d73-4271-8b3d-b7b07cfc4d61", "value": "mixsix_20211013-084409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91b018c-2bdf-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634100042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634100042, "uuid": "fe333773-1e11-44e8-bc17-8258416981f5", "comment": "Malware payload (GuLoader)", "value": "f43a85771ae8a8e4db268a2965fee6ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634100042, "uuid": "12e24195-b297-4c8b-8a6f-090f4791ce8f", "comment": "Malware payload (GuLoader)", "value": "a9e19360b797cd61290d940ffcb474448588c2056a5c283158a7d8a29c328cee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634100042, "uuid": "9e4dd797-183c-45b8-a5cf-1cb76ec11876", "comment": "Malware payload (GuLoader)", "value": "1f20b01c689c732bdf06d827e6a1eea9963fcf51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634100042, "uuid": "e7f62d11-9344-4f4b-b38d-611e642f7bd7", "comment": "Malware payload (GuLoader)", "value": "f5adf86c13721954f5fc48bc9e927294c51056e08a388840c99a6461f8fc25157b70d20d1c4b19c369ac2662c18c4200", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634100042, "uuid": "82051216-030c-481e-8b4f-13763191240f", "value": "T1DCD3B451E1CEDE62CA16817D0D528317BF5A7E425CC3281B3A6E56C83FEE9127381B8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634100042, "uuid": "c3a39565-41a8-4fb5-b28b-baa847dd51c2", "value": "0a8e5f9658f839d07c08aa4f38837bac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634100042, "uuid": "a0ba8da6-a477-4a2b-8c10-7377f9183662", "value": "3072:TFgXlFw3Y6xd3w6gTxL/4zpURrDhOdnXhWZ2QLqw9mh7ObETDuvTuqZccm+Fp/rn:TFEA3u7IURh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634100042, "uuid": "6a70db50-b0b9-4a74-8425-776ee181111a", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634100042, "uuid": "edeaab3f-94dc-4d84-8cce-64d2dbcf2a71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634100042, "uuid": "886db70b-8df7-422f-b471-43bbb8d9881e", "value": "WIRE ADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4949759a-2c6f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634161702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161702, "uuid": "8dc4296c-ed05-4928-8266-5de4bb2f235a", "comment": "Malware payload (Mirai)", "value": "1d7d0b4959044597572bfc061ec8d082", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161702, "uuid": "201f83f1-8223-40b1-8f03-e2ed221b89e8", "comment": "Malware payload (Mirai)", "value": "a9feab595490595367509935d9bfe12ba9597b42fec190149ec8780df0ac0f48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161702, "uuid": "03f6efe9-4dc6-49fd-b484-018082001325", "comment": "Malware payload (Mirai)", "value": "b07f821c6631811f1354cc9c441a23471fcdbde6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161702, "uuid": "383f6ad8-dc67-4857-9cb2-7ddeae926f4b", "comment": "Malware payload (Mirai)", "value": "a1778f51f915f430ac97cb9a27a13f1cf4814c6b23e2d22f22d164bd8c3196adc7b861435447eed56656a8e1be3dd9b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161702, "uuid": "da5d8a6d-cf01-4415-96ea-32fc904e3fb3", "value": "T1FB333BD6B902AD7CF99BE6BE80270E0AB13123541053073777EBFC937E321949956E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161702, "uuid": "e58f2edd-843a-4aa0-ad80-cc6de3c6064d", "value": "768:8CeKEfhe5XdrbentIYfNMQn5MdgFHj0iPuvWeffpqmUJTXr6Lu380Da:dsfIBZeNlJDFj0imvppqmUJP6Lc87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634161702, "uuid": "31eba903-4341-4317-bf09-3dc6a1f0d2fc", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634161702, "uuid": "672a8fcc-6dae-48c9-8152-761d7179ae37", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161702, "uuid": "832e4a95-7bb8-46f0-8eba-9fd80f12eda6", "value": "1d7d0b4959044597572bfc061ec8d082", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e316c9-2c52-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634149301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149301, "uuid": "9d1ba6e2-517b-4228-a620-ae62c49522a6", "comment": "Malware payload (Metamorfo)", "value": "f86f85de3d6f78bfeb8871a390c19ade", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149301, "uuid": "709b4e79-2724-4eaa-a6fe-e8b0a4656f76", "comment": "Malware payload (Metamorfo)", "value": "aa0247bc913c0c91d82e8b972163c23a219800a904c360871bd7de11cf2e0a6b", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149301, "uuid": "07ef23be-b506-4631-b0ba-5f42917c72d3", "comment": "Malware payload (Metamorfo)", "value": "e9d2dd56611711cb3224307d4839079f095932e0", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149301, "uuid": "1483edc6-3494-48e2-a86e-fef52d9c4cd6", "comment": "Malware payload (Metamorfo)", "value": "bc6df901c77cc161003f338bc357a31be7575dc7d0954fc876293f7be2742f04f325085db36b58cdebacdbdcf44ab414", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149301, "uuid": "541fb3bf-ac51-47b4-907d-aa84916f2a2f", "value": "T18F31BB051EEA1729C3B3CE7A107BA2464A76FC51AE934F9D808497DE28A1050EC35E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149301, "uuid": "e55e181e-414d-429c-a7a8-dbc3d7d01c4f", "value": "24:8+JUHRlVo5kcbA+P/+/P+P2kMw41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+o5f1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634149301, "uuid": "e448c6fc-4754-457d-b393-5b17cf56caf1", "value": 1542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634149301, "uuid": "645adca5-63df-47d1-8555-9bf2d23ea30c", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149301, "uuid": "dc5b0b11-8b17-458a-9e5b-358c6dc05acd", "value": "Foto.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23ef098-2c37-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634137853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137853, "uuid": "d85e0c0a-9a8a-45ae-8952-d1b3addaad95", "comment": "Malware payload (Quakbot)", "value": "696ba2d572d39bae76bd91919fad2c61", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137853, "uuid": "ebdee8fc-f3c1-4d66-ba59-c83f694f886e", "comment": "Malware payload (Quakbot)", "value": "ab523acae165286b7dbc6819412eb8ec0ceb3918a279a7beef38a698eb47bbf3", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137853, "uuid": "93cee17c-2eed-4881-84e7-c5531213c961", "comment": "Malware payload (Quakbot)", "value": "0436ac9461734f0c9e843f519185594c517dee02", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137853, "uuid": "3f9c2667-d870-4d17-9cc7-e9c070846797", "comment": "Malware payload (Quakbot)", "value": "c158d95fe478bf6d9a54339a9576d5e78383761cea67d625ecc11d7048466c3f3a9544aade2aeedc20904c8e1cb26de3", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137853, "uuid": "fd95cbe0-1785-4b79-a60b-1bfa068882ef", "value": "T101D38C427797CA4BE54813398EE3CADB3772FC21DE62470336497B0E5E7A6A08C17652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137853, "uuid": "ff9572bd-cc0c-4902-b896-20ee41231222", "value": "3072:vk3hOdsylKlgxopeiBNhZFGzE+cL2kdA6c6YehWfGMtUHKGDbpmsiiFGmZyAqgOb:vk3hOdsylKlgxopeiBNhZF+E+W2kdA6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137853, "uuid": "496471bd-ae00-4df6-b41c-b1baf10fd6d3", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137853, "uuid": "e3369c93-e040-4956-af05-396aec113738", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137853, "uuid": "1b1923ca-fed1-4be1-afb5-41f25b3f9807", "value": "SecuriteInfo.com.Heur.10164.7738", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae6acdf-2c2c-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634133063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133063, "uuid": "d561e917-acc4-40e2-a3c8-1e9480c5c720", "comment": "Malware payload (SnakeKeylogger)", "value": "fd7240f2297ec144836d3319623dc897", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133063, "uuid": "9640f4a1-49d1-4c0f-b1ce-45202ee18ef0", "comment": "Malware payload (SnakeKeylogger)", "value": "ab5c61e8e00e5d487970b39587317dc85efc21123f5500e36467e80d20d85326", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133063, "uuid": "ec8bdce4-0d73-403e-b04b-b34be2d255cf", "comment": "Malware payload (SnakeKeylogger)", "value": "bb1ab045a636b5db94f0eddc41681f75797847e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133063, "uuid": "d2a450d9-f2ff-4329-9ea3-d5f7b35b705a", "comment": "Malware payload (SnakeKeylogger)", "value": "1a295911a4f72eff7b87e0b1060d095ef4eae1c08ca235d0e7c953415159e4970c73798eafc698aae4708e2a7b12aa6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133063, "uuid": "8bb28687-c93c-4fab-bf46-e0a8e38ce78e", "value": "T1B694BEA47F89DC4EF36A9C785131DF84C76DA6473713C629D9FE507A92AC7903882283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133063, "uuid": "39c117d5-3171-488d-a476-3907d21470a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133063, "uuid": "75eb798a-25ed-41ad-b05d-9f0d4cd5acea", "value": "6144:xMkhBZspWjc6x2DD/jr9PMYOHeTrLZJihXIvQL0oexCxG1BaYB:aSBOqXx2DPrFNUMPihj0oeMkBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634133063, "uuid": "d7cc2c35-da12-4073-a725-41ed37004696", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634133063, "uuid": "336c969d-5c61-4243-ad64-adaed8b43e5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133063, "uuid": "7189f0e1-ff9d-470a-9356-3cafc89042f3", "value": "9wybe7f5d3WBbPW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1617865-2c2c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634133073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133073, "uuid": "b480f196-3fe1-42b4-8711-ed4d4e0ff0c6", "comment": "Malware payload", "value": "68a080e7b195209a49002961dd20debf", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133073, "uuid": "c6d5468f-fe87-440d-b662-8b5a11b00fdf", "comment": "Malware payload", "value": "ac7d9c9c9644eb6dbb2bcebe86b010800c385a246a9bbac3c1d12a705521e6c0", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133073, "uuid": "b2acacdb-1e0d-4f39-a68c-155fe7ecadca", "comment": "Malware payload", "value": "2972f4842501e1d86e78bd190cbf2ccc740efe23", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133073, "uuid": "aa203152-60db-4e1c-8d47-e94e405a9d52", "comment": "Malware payload", "value": "c295d6e0a543b4ee499811dbcc3dc513eda89b0243551955a4862de7af5393052916b40258a4eebaa5740056f6104aa1", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133073, "uuid": "547764d9-6b60-4f1c-b6ae-6e7a9abc717f", "value": "T1F0958D23F2D28837D1732B389D5BA3689939BE102E78594B3BE51C4C5F356813D292E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133073, "uuid": "c949ee20-49d1-4c11-8eee-589a7457b4b4", "value": "24576:Kh7SCzvzXW5A3WvlhyZB5Sk0UsClS1lDFtMQFEhwdG4B/d1AGHfTU+IomLe5OY13:KhGMWvOSk0URle/tMsRTP4uOY1EA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634133073, "uuid": "83eab1fc-1d54-4322-810e-6af335857b95", "value": 1904640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634133073, "uuid": "b4f4f0df-23cb-4576-a3cc-4bc766ed44ac", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133073, "uuid": "3b38b29b-c86c-4382-a036-596484cf94cb", "value": "deudas yhohyzidbxpgqwrjjkdmbpizkfuzl.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71cb6ea6-2c38-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634138148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138148, "uuid": "0a32b260-51fc-4d19-a016-32cbf31419ae", "comment": "Malware payload (Metamorfo)", "value": "403563e1bdb34dcc2688ce92a743e84b", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138148, "uuid": "df173d72-14fc-472e-8f57-a06b965cf6aa", "comment": "Malware payload (Metamorfo)", "value": "ad7e48476d899402775ead853a3d8d456dc8273a175f1627a6a109a4b9eac157", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138148, "uuid": "60612a31-b018-40f8-84a9-b3f80c594372", "comment": "Malware payload (Metamorfo)", "value": "ba654716fca91975fab19637bd5ccc0b878c5a24", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138148, "uuid": "bc4de7c6-33c4-496b-8f47-413852728f58", "comment": "Malware payload (Metamorfo)", "value": "19242703a0f5ff63800203f03c13a9b3ac416cbacead248fea8c4908a7f16e29aacb54ab2a905cf1c63baeba9dc38192", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634138148, "uuid": "2cddadcf-bf6d-44fe-979a-d81cca9cef6a", "value": "T13731EE091AEA1329C3B3CF7A407BA2434A3AFC51AE934F5D84C487CE2851010FC34E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634138148, "uuid": "1f48bec0-73e2-484b-a057-967e69d733b3", "value": "24:8+JUHRlVo5kcbA+PSyV1+/P+0Y5xMw41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+JV6xb1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634138148, "uuid": "e7e853fe-1f13-4f65-aebe-e05f9d337e01", "value": 1550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634138148, "uuid": "ea25ad08-fc50-45ac-89c5-ef3833172a63", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634138148, "uuid": "232a855f-9e51-4b19-87e5-34d70ddb8c47", "value": "Anexo - 008131021.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbf61f2-2c37-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634137580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137580, "uuid": "b2917420-6235-4e38-a3b9-3096c4d1d111", "comment": "Malware payload (NanoCore)", "value": "1fc9414612683fa9b525a75355706490", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137580, "uuid": "cc8a5189-f2d9-4544-89cb-ad59c28987e9", "comment": "Malware payload (NanoCore)", "value": "ae095ebb3fffa75296b6db100d55ef0dcf8e8c7eb9a0c616e0adb732dc4ee8c9", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137580, "uuid": "072d2ff1-889d-410f-8805-0542200aea3f", "comment": "Malware payload (NanoCore)", "value": "780cee42ffebc33391e0a814db98e5cf8affed5e", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137580, "uuid": "e2f20edc-1d50-4614-92e8-742a507d2cd5", "comment": "Malware payload (NanoCore)", "value": "09d3dd1e2d6a40f2dd35abaa8ea10094ea9d398defc0bdfd2ff0fdbdb394a8bd00144a4cff975e8ffe272044adb3a69f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137580, "uuid": "f6f3fc94-711a-4af7-804c-4124c7b0266b", "value": "T129D41243EFA99993E24D4EF29192D5708370ED80BEA2F6254EC03DB73777BD088451A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137580, "uuid": "cbb0f832-480b-4f92-bd7b-0ca307b430a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137580, "uuid": "72df4651-4fcd-4ae1-9b25-09aedba8bb48", "value": "12288:o0cPk+EcPRnhUVjfP+Uuf2j613ztwXUoaAE0UErHPsRIY9Zi6g6SB:JcPhEcpw+U02e13ztwXUoaAlrvsxi6aB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137580, "uuid": "714439b0-9b5d-42c0-9382-cd61048ae672", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137580, "uuid": "bfe87405-58c5-4337-8395-9638b118e5df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137580, "uuid": "0c25cc34-3400-49c1-b247-df62212ccb07", "value": "DHL AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5d7269-2c3b-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634139343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139343, "uuid": "8684e9d5-eae0-4bcd-abd0-dd9549c2df23", "comment": "Malware payload (Quakbot)", "value": "82ec0e1df076c986704fe0f919d6a53f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama114", "colour": "#4D111E", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139343, "uuid": "d60be5b5-5cd2-4baf-9956-0f009f01806f", "comment": "Malware payload (Quakbot)", "value": "ae9f663e051bccb9f24f0dd77eb714b2b6baf572993343d7bcd3f74cfcca5248", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama114", "colour": "#4D111E", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139343, "uuid": "d122d1b5-7703-4600-b861-c791b8b9f92a", "comment": "Malware payload (Quakbot)", "value": "c0d6be6324a341c26cc36ccddf663e95104d05fc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama114", "colour": "#4D111E", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634139343, "uuid": "48e8deab-468e-435c-8a4c-f587a91def26", "comment": "Malware payload (Quakbot)", "value": "e23539b38d40f8eeca0bdb888d8e70135c82a61a46c958f00228113274fdb032c2fef10dc687a439132f08bf183ea5d9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama114", "colour": "#4D111E", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139343, "uuid": "8c69512f-e46e-4a1d-9e6e-b1491f28dc03", "value": "T11CC409A5AD0D8C73FDD42A3052836E082E1B7FD2B17C318F316BF6146D6BB94A891E14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139343, "uuid": "f27dd343-d217-40c9-917e-6ad4b8e290c6", "value": "9a30e75c82eff20dfe0e0897d34cb07c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139343, "uuid": "97c56d4c-f62a-434f-a1e1-21a9faff037e", "value": "6144:VJVAfqX+2Rr+nxQDBO03fHEera3bpt5eHd:VvAfLfaEkAz5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634139343, "uuid": "16ec86b1-50b5-483c-a3ab-58f783c36c0c", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634139343, "uuid": "708be598-4296-492d-bde1-2ac7897c3ef6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634139343, "uuid": "14dd4455-68c9-419e-9c42-3a8c616218b3", "value": "Celod.wac1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4238847-2bec-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634105671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105671, "uuid": "8086f68b-e3dd-4076-961d-5d4d80cd1cb4", "comment": "Malware payload (GuLoader)", "value": "926d2eaa0980907087ef3344001377c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105671, "uuid": "18380b1a-f173-4ce8-b6e1-2a253772e27f", "comment": "Malware payload (GuLoader)", "value": "af15e4ae146dffb9a7b611ed94eab12422c0e4474bb8de5adaede8b587949bc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105671, "uuid": "8a86d65d-f35a-4ad0-a758-e1f5d9253ca7", "comment": "Malware payload (GuLoader)", "value": "2c51ab9065ec9cafc62ca1f93d26b3e9b97aac13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105671, "uuid": "eeba32f1-a495-4e5b-be61-de9996aaf51f", "comment": "Malware payload (GuLoader)", "value": "9cd633851048228e5a2728b1281ac7e0ea251ead48d54a3f1142ce43ad45f3bd49e6276c4b87c70a7d99683fadd0d62c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105671, "uuid": "5663e4c3-1a3e-4c06-ae0f-5245a4464a4e", "value": "T120A36EC2569C9CB0E9948DBE03FF5A57173D6C7318158EC721C8274EE8767C62AE138A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105671, "uuid": "b338d16f-662d-4caa-915d-c427822b155e", "value": "669316531b5190f02843878b6ed87394", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105671, "uuid": "e1c28a4b-4585-418b-9683-efa087730eae", "value": "1536:tvD4BsCW04a57G8Xi+uKnrmxSFkX+Xu0SdPIvoO+uD:tvksCx57GWO+mgFg+XuHUoTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634105671, "uuid": "0d07f75f-8c8f-4315-b40c-1a7dec785fcb", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634105671, "uuid": "2f49b76e-3cea-4ef6-b543-1dd4fdf32fd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105671, "uuid": "e5410cf9-6433-4a7f-af43-2b448d693094", "value": "184285013-044310-sanlccjavap0003-7069_pdf (5).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49b70bc-2c2b-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1634132676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132676, "uuid": "7ed0ac08-2d48-4930-8a76-75f8fcf112c2", "comment": "Malware payload (AsyncRAT)", "value": "437f8c67e26fd3bf4f9b21174d65b2a0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132676, "uuid": "5c2f67e4-57c2-4f98-923d-950f91452c8e", "comment": "Malware payload (AsyncRAT)", "value": "af6a983fddf6bcb3a4fdf93ad8ff0fb48e893bd11e4e4c5d2412e68c98f03b54", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132676, "uuid": "50d60f39-86bf-406b-af0c-8ed4c87b097c", "comment": "Malware payload (AsyncRAT)", "value": "88798001c898391298a6f4abd61e0518e633684a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132676, "uuid": "3a595588-a042-4d06-a13a-165dbb265160", "comment": "Malware payload (AsyncRAT)", "value": "e9f22f4287eb25c6e905b54e975c6311a0803d43205ee5d327ee6fdcf32f468b38c13861ff5bbe766667ddb3bef813db", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132676, "uuid": "13ce1240-7dbd-4301-afcd-544118ff9b4b", "value": "T1CE749DA47F99D84EF36A9C785231DF84C63D664B3713C625D9BF507A93AC79028C2283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132676, "uuid": "c59e1efc-39d8-48dc-a115-50d71ccae8a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132676, "uuid": "5fe9e689-2c7e-4314-9c02-7859d745870b", "value": "6144:6Sx1K29ZfZwM9yhDe521t3TsIewcv1Q78EfMkhBM7YB:6SHT9ZV9seAjs3P12ESBMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634132676, "uuid": "4295c717-09ce-4b2f-b058-9924a1c7bd4d", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634132676, "uuid": "3e47db11-5d1e-46c1-80d2-11b356d7db68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132676, "uuid": "1da61ea1-fccf-431f-9f7e-a1bc13e50049", "value": "Price Inq 01.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d8fb30-2c37-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634137564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137564, "uuid": "60a7d18d-d037-41fa-b647-70a299e86b69", "comment": "Malware payload (AgentTesla)", "value": "beed4e13d0e57c6775e2aedb9a4e4bcf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137564, "uuid": "63d20c2c-9db0-4fcd-af8f-7f60a5397cb8", "comment": "Malware payload (AgentTesla)", "value": "af8e6d79ee018b057fbba0f2082c0406541b7f31f7ebe30214d897a74d341425", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137564, "uuid": "80eeb5cd-d471-4179-8e07-2c0402a98222", "comment": "Malware payload (AgentTesla)", "value": "103332c96c1724a3e2c83736710e67512937cd5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137564, "uuid": "617274d2-808b-45df-b21a-d6da81dd7df2", "comment": "Malware payload (AgentTesla)", "value": "66c4c85e6e44050c8052c60dd91a2a465de4b517aaa482308d984232db1c45f06bec87091d9b1661948f7b0ca46b5077", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137564, "uuid": "d885bbe1-e713-4aa9-b54e-e59d8aeff00f", "value": "T1FCD401C1AA06A713E7FA1F3888741F315FE42E1B6733EB2CF86875153A3635E8521652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137564, "uuid": "51f0f3be-903a-4ad1-9b73-dd7abed85714", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137564, "uuid": "4d7a3183-d78b-44ff-b93b-3f0436a225ea", "value": "12288:eM5DbHXnZgCyLGUkwPTSzwXgB2yJRZmxSBehC:eM5P110WzwlyTZm8Bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137564, "uuid": "249e7373-f2ce-4e43-935c-996a22d6d625", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137564, "uuid": "de90b6a2-f764-47db-9ec6-56ed982c1a8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137564, "uuid": "7d4975fe-fa42-4718-832e-8a7af742229c", "value": "DHL.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad61cfe-2c4e-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1634147773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147773, "uuid": "9654416d-eb79-4cac-a1b0-cceadd5da248", "comment": "Malware payload (RaccoonStealer)", "value": "a7590868a85203e4873bc995240bb4b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147773, "uuid": "a18254e6-7ae7-4654-8241-fcdfb81f0608", "comment": "Malware payload (RaccoonStealer)", "value": "afa506dea7e88d3aa2ff4c2f58a21a91cf5d6ae5a00dea2cf482832d1613e37b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147773, "uuid": "6d64c236-99ac-43b4-a1e0-c1938a3fe23f", "comment": "Malware payload (RaccoonStealer)", "value": "4ff373bfff693b45444f0a6273764839540198ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147773, "uuid": "cca90583-0da8-480e-bef1-e9d4e872e72c", "comment": "Malware payload (RaccoonStealer)", "value": "d5d4d6e92ffc150ecad9380686bb3529705f4d49aec19432c1488c741c6c4645824892b1533491b0ba716572288027ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147773, "uuid": "65da8b48-6be6-4908-a63a-8c9744e6d955", "value": "T1D0C4E100A7A0C035F1F726F89A799369A93E7AE16B2594CF63D416ED4734AE1EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147773, "uuid": "dc9492d0-f322-4d2e-8ac0-15fad7c8c240", "value": "e9d1f1739ab48fbfe7c7128688524302", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147773, "uuid": "b4e9704a-c415-4581-90aa-363a1c160285", "value": "12288:ZWpNS6tVElpHeJKSWirbY5nvXhtdFUSlBaKPlIBbLt:Ag6TMeMSJrEvXhtp6KtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634147773, "uuid": "892a41a5-6199-4e4d-b5cd-3fcfdfff7c4b", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634147773, "uuid": "f7b7aec2-c37f-4732-9236-ebfc2e6d8814", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147773, "uuid": "c4e92440-25e3-426f-9786-f21f193b449c", "value": "a7590868a85203e4873bc995240bb4b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd8f1e4-2c39-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634138789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138789, "uuid": "4f8b454e-060e-4008-9ad5-8bfe502b24a6", "comment": "Malware payload (SnakeKeylogger)", "value": "f54178f1e63fbb7770fb2f6325f7d3d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138789, "uuid": "1ee2b948-f3df-47db-b46b-260bd39868f9", "comment": "Malware payload (SnakeKeylogger)", "value": "b0430be9c4cf8e7331d4d111e500725399be2ea892e573d44f77af3a453ac014", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138789, "uuid": "9bd83e32-5ebd-4872-aa20-3d0d447fcb4d", "comment": "Malware payload (SnakeKeylogger)", "value": "9d1f7c6d5339b5c5f4905b5be11d1057bf183310", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634138789, "uuid": "9e3a1931-fdf7-4b7c-ae84-b153fbf0dce1", "comment": "Malware payload (SnakeKeylogger)", "value": "15eac94ec7911fc57e1afbc2fb9620de4def68a1bb34809e1b0e1fc86c8f7bf4ce501015b541beaa52c1f2beba441867", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634138789, "uuid": "33fe584c-d2d2-455f-a016-a95e0cd77fa1", "value": "T1E053D883718254EED8EA59F2A51B982016036C3AF475986D07E9377E09F336351EBF0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634138789, "uuid": "4d1bf55a-1c5d-441b-adb1-72fd4597b84b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634138789, "uuid": "abb4dee2-446a-4540-adc3-7f34b285a32f", "value": "1536:rDjkOM5YwwbkZ/R9hH9BGK2osztFsEzLaURroCoU30+HG58F2g7ELBw44444HbOq:rDjkOM5Yw6kZ/R9hH9BGK2osztFsEzLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634138789, "uuid": "91d3fc05-ab24-452b-83b3-fa2361b78e6f", "value": 62464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634138789, "uuid": "7907b80c-bf73-48a7-99eb-fa380b854401", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634138789, "uuid": "54e9ba4c-3367-4593-841f-fc1a88cc1885", "value": "Qoutation013-10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe3e92f-2c37-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634137849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137849, "uuid": "24bc5022-75ef-4558-a8bd-bb813e6bc762", "comment": "Malware payload (Quakbot)", "value": "e5cc58b3cf7baccc32384d0894b7fa84", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137849, "uuid": "b84b521c-c7df-41c3-af1c-76c4b8c0962e", "comment": "Malware payload (Quakbot)", "value": "b17fcba15d1b9367a3d8d48a646c2688a0e07e936d5e3f0ac69559db3abbc57e", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137849, "uuid": "924a62f8-5683-4a22-a571-2aeaec7303f6", "comment": "Malware payload (Quakbot)", "value": "4c841351f51b318313674a81d5619f57bf9786a3", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137849, "uuid": "d999733b-760e-4ca5-aa17-d9602a1017ee", "comment": "Malware payload (Quakbot)", "value": "4e019a2fb7c2a48287c48fce5aca4ff16866c06af7f316c6edf9e14e4bfb2a15eab65c48b2678d2796994f3e05c773d1", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137849, "uuid": "f832ca09-1143-4dae-a29e-05a3a2d332d0", "value": "T1FDD38C427797CA4BE54813398EE3CADB3772FC21DE62470336497B0E5E7A6A08C17652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137849, "uuid": "aaed27d5-827e-469f-acee-fecdfac83355", "value": "3072:vk3hOdsylKlgxopeiBNhZFGzE+cL2kdA6c6YehWfGMtUHKGDbpmsiinGmZyAqgOb:vk3hOdsylKlgxopeiBNhZF+E+W2kdA6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137849, "uuid": "51dd1ade-683e-441f-b7a6-aed41dac006a", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137849, "uuid": "441c6bc2-cc74-4df8-b3bc-62c5be6599f9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137849, "uuid": "a6991d68-da6b-499a-9d7a-7670106d0c05", "value": "SecuriteInfo.com.Heur.573.3021", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c29d47-2c6c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634160332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634160332, "uuid": "064b3278-d87f-4b19-9029-86cf8ea8e17a", "comment": "Malware payload", "value": "c2c5e578f033301aeb7b6d661123d8af", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Webhook", "colour": "#E32A37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634160332, "uuid": "5dba5eee-d4ea-4f68-8c17-d9470a4250bc", "comment": "Malware payload", "value": "b26d38dd6bc8f04a6d370a7c58b73f2893c1be2a2399b62f4b576dff550648c3", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Webhook", "colour": "#E32A37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634160332, "uuid": "b23959fb-43cb-4cf3-b10e-4d3d0a288ddc", "comment": "Malware payload", "value": "ec8969ca2b9001147739540de43689456b65bb98", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Webhook", "colour": "#E32A37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634160332, "uuid": "8d3a7ac8-348d-468a-b9f9-9788c61448a5", "comment": "Malware payload", "value": "0a1916e68aa3b6e588e6eca2d49207521347d141068ddeb8e9dca8db2dbd77e81cac3cf76889a00840acb46500979f96", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Webhook", "colour": "#E32A37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634160332, "uuid": "2d7e5802-a7a1-4d0a-a6dd-8f19080d01c7", "value": "T1A22633467C154BA2C18515390C6BC12D7B8FFA0DCBB8F8EF3626559B20C2B1C976E54B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634160332, "uuid": "e73f80b7-1baf-4022-9acd-68164956dc0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634160332, "uuid": "e8cc6e58-9650-4d79-af1b-f7f633a179a7", "value": "98304:eJplkQyVo/cM+ExC9V9Ex+qevliMf5iYo76hj1nigdlGTW8J:KaScZExC9V9aiBf5ih70jhigX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634160332, "uuid": "cecab14a-2ffb-4055-9f26-121349fad7ab", "value": 4572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634160332, "uuid": "ef1ca142-1b49-4862-b3c0-661f8ebb1840", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634160332, "uuid": "181548a9-4e2f-4c87-89b3-a8925ceaef7c", "value": "Synapse X Crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6bf9bb0-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634108682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108682, "uuid": "cfd3d267-b711-4801-951e-e316c586a6fc", "comment": "Malware payload", "value": "ba408548665d6bb1e307867ccb9ecf57", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108682, "uuid": "d0087347-9ff6-4d6f-856b-4f0d9fa7060d", "comment": "Malware payload", "value": "b38b6f65ea22d5f5b8c1a3a7073c2743c746e2f24a30290353a86fedc078c5b4", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108682, "uuid": "04353e3f-27fc-4bd2-abff-598e72a86dfe", "comment": "Malware payload", "value": "0c69332bf36ad776ee6286f32fe140c823a77fd8", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108682, "uuid": "158a601c-c315-4c16-8278-6f0dbcfd5d96", "comment": "Malware payload", "value": "d0782d144ebb205c17caa5509e5b1d53291cdacb0ba0e68ae9f6ab18b3afd4cfc2bd48bb9c0a7a910953483133134873", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108682, "uuid": "caa052f5-7340-48b4-a70e-7db5382063bb", "value": "T1B6F402117AD08471D172293445F9A331AA387D205F388AEF93D47B2D4E345D2AF3AB6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108682, "uuid": "e51eed17-4289-4e94-8b75-bf0c83182d8b", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108682, "uuid": "4a12b620-e5bc-4c86-9332-a1c47928e678", "value": "12288:HG/onGprkMB62cAyPacr+DV8zNlpX+t4MYoYWjo0bWvKsJzcBK44kPqCoscm518g:b062cSEk8zNlLyYX0PMzyKUBpRWxbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108682, "uuid": "bf2716e4-e634-4c9b-a80b-b081ca86db86", "value": 769381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108682, "uuid": "5bc3f175-6e89-4171-a206-5cc2b0965014", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108682, "uuid": "98659be6-72ed-48f5-88be-cfe42cc31ac0", "value": "DHL AWB 60073535404.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612a5933-2c35-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634136831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136831, "uuid": "9d6f1480-77d6-49b1-b9f2-75118ad29242", "comment": "Malware payload (Mirai)", "value": "b249c95aecb66fef959be79d333f571b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136831, "uuid": "d27cb85b-d0df-4466-ae31-706204af208e", "comment": "Malware payload (Mirai)", "value": "b40f2065f32d08a258ced9cf74ec591ffcef23d9b282d0dbe889f4e657ed2fc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136831, "uuid": "15ef181c-525a-47bd-b346-8d3b2d0965ca", "comment": "Malware payload (Mirai)", "value": "24ad203adc436d451934ea3eb79656be6cf8234f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136831, "uuid": "5b5405e4-d174-4df3-b349-615d8964d8f7", "comment": "Malware payload (Mirai)", "value": "fccecbda25a09a956dffd6dc65833608b84004a94b90939a8a43220e8ea2c1639fba8d87c76bbba31ec33acbed85b5f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136831, "uuid": "a95ef1d9-e7aa-4c9d-b96a-b9e57e961472", "value": "T13A73AD33D1686DA8D0664B75B9988E309B23A28416937EF6D794CB784013EECF509FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136831, "uuid": "b91ead25-0220-4513-ab59-d4cff9fe99b3", "value": "1536:9aD/MEGvbwt+i7EhHGWn8C/0rrnmFllrKkNGIkFgCJl2c:9OkdzeEhme0rjElOkQFgLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634136831, "uuid": "34983094-d975-4ec0-84b8-6181d754f04a", "value": 75888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634136831, "uuid": "98ea29df-109a-440e-bc2e-824216cc61cf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136831, "uuid": "55d68bb0-f367-4d98-aad9-184ab0594861", "value": "b249c95aecb66fef959be79d333f571b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0b0596-2c52-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634149387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149387, "uuid": "e0994e10-4dfa-4d4b-a52b-e3bad2c17a5d", "comment": "Malware payload", "value": "d95e9bb2fa064a984c391b5bfc1d01e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149387, "uuid": "c2eabec5-05a4-4cf9-9ea3-eb79228e712d", "comment": "Malware payload", "value": "b499be4b6955eebcf4228039f67a65a38b322f0ca1d58d8071de9a428ced8720", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149387, "uuid": "4e0de662-85c7-4f93-83a4-6c88b35f8f9c", "comment": "Malware payload", "value": "6b045974084794b785110909351e2a25950c5ed6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149387, "uuid": "8fa99b6b-14e0-4fca-bed7-3669847dc0ac", "comment": "Malware payload", "value": "a04b9558b08a82fe4454a2af17de3303a66819e131c9ee7e356b2a209e0aa004a129a0ba40aa09e2961f628c0a16f95e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149387, "uuid": "607b7342-a081-4545-a4de-293a3946d00e", "value": "T111C4DF5133458263E17B0FB4A023A76887B4FD296972DB7D69C176CF2F32B909211AD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149387, "uuid": "c128341d-93c2-4bd5-97e5-721362d6bd02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149387, "uuid": "c275770c-14ab-4018-b250-1ff8b16549b5", "value": "6144:t1DEMkhBBcKqMkXKQEa2F7A4quO15IWwPGQscHLHXQpCIOZBxPFPgN21c1:nD/SBBcErSqqflwPGQQpFINPgNP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634149387, "uuid": "8548c3c6-af23-4303-bb97-3441031b87c7", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634149387, "uuid": "3f4b1743-8ce7-4766-bde2-a7f2e90a11ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149387, "uuid": "8f4d1613-aa7f-4496-8b4a-3ef6c5abdf47", "value": "56460021473877.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb2910c-2c4e-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634147808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147808, "uuid": "dcf4ba2c-948f-46e5-8d9e-fdbe94ceea40", "comment": "Malware payload (Dridex)", "value": "bea4379c47f02f88e77a690879a0d323", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147808, "uuid": "c883041a-6916-4878-aa45-33cc59026b88", "comment": "Malware payload (Dridex)", "value": "b585a54184f3c933f4e0e38cadec4ada8950278bbdf69970b6f1539865772e36", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147808, "uuid": "9ca5bb8d-b729-4a5a-a2d2-2a6e7e6abc20", "comment": "Malware payload (Dridex)", "value": "d82c912a86a5ebedede1015cf0b814b2711e75a7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147808, "uuid": "825212bb-d131-4a15-b794-096086476782", "comment": "Malware payload (Dridex)", "value": "eff58457d5863e959edb1f1c0cf42272b75af8be568acecd5c3f7254b3aeadf251069eebb676e2ffaac6042bb89fca23", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147808, "uuid": "3971f77c-b0d9-4202-b60e-3906d78949d8", "value": "T1C5D4F7013A04E821E7E55575DE2AC6E85B183D49EFB1A4CB78E17F0F2ABA9F3D215301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147808, "uuid": "ee327a05-1d26-4d5a-8dcb-706ca443695f", "value": "77aefec4cdbad9a00d9143503be0ce97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147808, "uuid": "58876f4d-5854-40ea-891a-cb2a5a939e92", "value": "12288:4E6rSiY4Gbs3j09TMmonCh5atbz9+eoQoUZpDd7Da1nX9y1RO/zFZx:ee6z3j0dMZnCutz4zI5xDwXU3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634147808, "uuid": "a93a3c2c-4d02-413b-be18-7c020648691a", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634147808, "uuid": "957e9e7f-6238-4395-966d-8ba5e63e7d43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147808, "uuid": "df127877-ecde-4992-8f21-c6c0afbbfadb", "value": "bea4379c47f02f88e77a690879a0d323.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed8871f-2c07-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634117070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117070, "uuid": "7de72ecd-f2cf-4a68-9631-ddbc232cd97c", "comment": "Malware payload (Mirai)", "value": "c958f8dc1bc3c12ac9caa0e59e4888c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117070, "uuid": "797ad107-1ba1-43f1-acf9-8d575823e602", "comment": "Malware payload (Mirai)", "value": "b5e133c34c73d9050dd89deb3c43e71208191245a38df79367c8b63aaca5cd0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117070, "uuid": "2684b303-ba07-47c0-a6b2-1ce7f4b8a07c", "comment": "Malware payload (Mirai)", "value": "6ba09890f69f5992711382e6e111ef8c5a73dd33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117070, "uuid": "9fcf72ec-9284-4ba1-b153-765837c1ebbb", "comment": "Malware payload (Mirai)", "value": "d88340d17e065a0b9f0828455ac5a6efb3cbd204f52614962d1a1687b412194dda542b67192772a4a7b300725b65a355", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117070, "uuid": "70dfbc10-92f4-4cf7-9769-8233d8a1f4fc", "value": "T1AF03E1382707F0F3D6B04436FDD7935191980FF981BB6A1A01285F689AAFC496F729B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117070, "uuid": "b000fef6-aa80-4cf4-b968-889ad7037004", "value": "768:cPEYw5HRhXrTCwRBMQh/kOrI08fr5GxKWM8gCy/jFSiyn7WTPSbLzoH+r8A9q3UY:cM1/HRmspxSXr/vz0LzoH1LL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117070, "uuid": "bfb1ed2b-7c1f-4a89-b4d9-2e1c95c880ab", "value": 38012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117070, "uuid": "cb40a8ab-d992-44df-9793-8f9de5e491f9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117070, "uuid": "ae0a02e4-8445-4066-85ef-8b38a3fe495c", "value": "c958f8dc1bc3c12ac9caa0e59e4888c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09fb471-2c47-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634144669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144669, "uuid": "5b3971ca-31ef-410b-a84a-62e5513d4ae5", "comment": "Malware payload", "value": "027caa87ab822ccd0beea65a99be2e1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144669, "uuid": "ef366b21-488a-408b-9d15-d493f590e2fc", "comment": "Malware payload", "value": "b643d5ee1be492fcbfbfb4c9b9bf3da8460b74ab2097b96e6545318c92f2ee26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144669, "uuid": "62246e72-6293-4355-b8f0-997d72862664", "comment": "Malware payload", "value": "9fa2e9ec6334a4432add4cf589089fdf5d777a9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144669, "uuid": "0a79857e-7af3-4d84-bd39-b87f8cb0da32", "comment": "Malware payload", "value": "34c6d9af36c8b6d479f4ddfa77a6ab92a308edf9917e29a091ed17e457f29a17c582a67a6ac93ce64534fa1d3b08fe5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144669, "uuid": "31c1023c-26cc-4ca4-b671-1425105fc32a", "value": "T190D4235AB6A1CD97E2292A714873EA670FF4DE44D2A4015B47C83F1EFC61721133E9CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144669, "uuid": "6340148a-b331-4b7b-a131-7f7192b31475", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144669, "uuid": "28c49a29-0019-41b6-87fb-40cb8bf0e5a1", "value": "12288:eq3Wo0AhTTzbLJeZRqmxdFqbQgK4Ivdel5MF454NDrO:eqkAFLJeZRq6tgK4gdy5MFjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634144669, "uuid": "80039bd5-ec4c-4219-99e2-af2a45a5b9b7", "value": 622330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634144669, "uuid": "a92dc452-fd0a-47ba-bdfb-e203bf2c4e01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144669, "uuid": "fa1a3b43-13f0-41c6-a98e-ade036004fc1", "value": "027caa87ab822ccd0beea65a99be2e1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91aefa6-2c06-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634116792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116792, "uuid": "eeb7d582-5c59-4a78-a757-bda036bcd7a7", "comment": "Malware payload (RemcosRAT)", "value": "aade455507f667318c83c42a95b3fc3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116792, "uuid": "f20b55f3-2ef0-4568-a525-4242ea23bb5a", "comment": "Malware payload (RemcosRAT)", "value": "b774d45c6788cc48716eee3e81002e5b74996a3c2610967f3d19115646ca4d6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116792, "uuid": "42cee9f3-478c-4f2d-8e7b-4acf8c4621b2", "comment": "Malware payload (RemcosRAT)", "value": "92efbfe4546ddee6a5807a5794adea2f440cf107", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116792, "uuid": "bed15a4e-54df-4fdd-b51c-82a65492184b", "comment": "Malware payload (RemcosRAT)", "value": "73cc5e1981f48c40dc52b3cf2b15d80f8050ec378dbe63b594e2e22bf5c53c2c83cebdfaa5a61bc0af9b7d81f2151be8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116792, "uuid": "bc9c0e12-450e-4ce8-96b1-730ff84de751", "value": "T1748501A0B701BC25DF976DF7ED51C98119253F9C4BA0163B3482BF2F76A90228B51E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116792, "uuid": "3d90c6f2-adfd-4ce4-a673-ef22846bdf93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116792, "uuid": "532a6166-dd56-447c-830a-137ba4e81d3d", "value": "49152:Xe8CI/Zr5B6t4JP24kCvC/J3iSI3AvYwnuSg:O8CI/V6ta+9CmZJvYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634116792, "uuid": "b639c4e1-27a6-4d9e-bf78-f85053115618", "value": 1761280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634116792, "uuid": "c93a01c5-fd89-4dfe-939b-d43a80b9fa0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116792, "uuid": "c73a6ee2-644f-4e59-b6ec-dfe01dda48ec", "value": "aade455507f667318c83c42a95b3fc3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59c7534-2bf5-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634109566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109566, "uuid": "f48af80f-155f-4a1f-bb68-dd493300a46d", "comment": "Malware payload", "value": "e2f2d2832da0facbd716d6ad298073ca", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-40449", "colour": "#1F5DF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysterySnail", "colour": "#1B78D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109566, "uuid": "89fcc99d-1716-4745-a2f8-bb14741d4093", "comment": "Malware payload", "value": "b7fb3623e31fb36fc3d3a4d99829e42910cad4da4fa7429a2d99a838e004366e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-40449", "colour": "#1F5DF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysterySnail", "colour": "#1B78D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109566, "uuid": "8c704cad-c990-4ca9-9dd4-2747f6b19e9d", "comment": "Malware payload", "value": "ecdec44d3ce31532d9831b139ea04bf48cde9090", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-40449", "colour": "#1F5DF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysterySnail", "colour": "#1B78D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109566, "uuid": "debf7b5e-7c44-4934-a30a-03e2ba607626", "comment": "Malware payload", "value": "efdc53a0314150e848ce9c64be80b7ed72c9e007da6e39d29df64b6b957c03cf2957403138e81b15e24f8576f6f748b9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-40449", "colour": "#1F5DF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysterySnail", "colour": "#1B78D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109566, "uuid": "2b705523-f619-4453-8d13-2ce31e0e1f16", "value": "T1819631A9DB7B53E4E5521BBECD222120E2907BB8F670C02557F9D39B16805B00EF97E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109566, "uuid": "4a46c7a4-a60b-4c56-b123-9554a493f691", "value": "de0c9e6aec27d278ccdb6718b3e96e32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109566, "uuid": "caeae5bb-9dde-45b0-855e-e505515b1515", "value": "49152:F6VwASOwGtlqOhIU6i5H7teZtsDFc9HSgm7inT9p53PPhk+y94faa57HarYhu+nF:mW+k3E7iZXbteQDm9yOuLns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634109566, "uuid": "7c4ebb0b-1758-4119-a259-d7918936f983", "value": 8701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634109566, "uuid": "e50e38f2-c574-4f1d-9baf-3a8ccd241787", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109566, "uuid": "d4cb8493-470a-4016-bbe6-c7a37a73c571", "value": "b7fb3623e31fb36fc3d3a4d99829e42910cad4da4fa7429a2d99a838e004366e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d333d5-2c2f-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1634134475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134475, "uuid": "6038be1c-b02d-492a-9b26-6e2dc5d71966", "comment": "Malware payload (AsyncRAT)", "value": "eeb0c557c2a47647816b3dd96bfb9aed", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134475, "uuid": "4a83551d-f391-44e8-9f15-36bdf1677579", "comment": "Malware payload (AsyncRAT)", "value": "b80ae947b3d17cfbea8e868e2ff1026d0cc27e939be778fe339f635a86ea8a0f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134475, "uuid": "00eb29ca-13cf-4134-b3e0-715782dee22b", "comment": "Malware payload (AsyncRAT)", "value": "0fba76b1ffe103583276f6766147a8a0e80941f6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134475, "uuid": "0aa5ce2d-2787-43fa-982a-975bcac1af2d", "comment": "Malware payload (AsyncRAT)", "value": "3618a4c22f4f5b343e785ecd0e09976b49a22082d359e6ae1f310396444ec9e996a71c81fbd455aea9e65f28a102524d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134475, "uuid": "21e5175b-8584-4afa-89cd-53f65314add7", "value": "T1E8611B74993C3883D75974A7DA717EA646E3F290CAC28CC4742DF94103290346B66F58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134475, "uuid": "889a348a-52cf-4677-a06d-818f34ca4ed4", "value": "48:G65V43x63pnCaw2gjMEcKUF+Pxz3RKBGz4OB6rfIKCgL333RVRXTCnt2TkaRZ:dVEyno2gD1zF8brggL3nRPTYP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634134475, "uuid": "3a15270d-7356-43b7-a768-a2a232df360a", "value": 3343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634134475, "uuid": "45078111-e925-452a-a2d7-cbcb7cfcbd3b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134475, "uuid": "0c8b0d07-e503-47d1-a709-90f08f5d0e71", "value": "Inquiry 001382021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa63b91-2c51-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634149123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149123, "uuid": "16391919-74dc-4056-be7e-c1d4216ab88b", "comment": "Malware payload (Dridex)", "value": "13607671c64e6859be1f83fb324344f9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149123, "uuid": "9d81429a-256d-4a57-801d-6d577f1a05a1", "comment": "Malware payload (Dridex)", "value": "b8e4c68f8843fe8f2f12d5cc636c824a338ddaa24feee9e9e5e380169b07b231", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149123, "uuid": "10a9e2dd-1a21-4636-b4d4-b68c8dd39995", "comment": "Malware payload (Dridex)", "value": "6ef50dbb7dff8dd9e860fd1c5b36a4f3df1c2863", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149123, "uuid": "07970aea-1f1d-4b58-ad25-3680921b2f71", "comment": "Malware payload (Dridex)", "value": "8642c9a101f0fbb3b5d9ffe60939e071db42b8b5fa7ce26d9abfd642f10a1fbae33742c52824edc656c6b470cf02d028", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149123, "uuid": "d79c30fe-b26d-44cd-94a1-92d3e0929a3c", "value": "T14104DF34D6BB27D1F8DB0878B047F07BF21A6E59B12CC545D29AC05FA4EDA12B8B1913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149123, "uuid": "7d43f6b3-4c74-4434-91c5-cb8df1adb8f7", "value": "4ae655604782e94c4041a6069971edd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149123, "uuid": "15b0f755-7d03-4c8e-b290-88df4fb57f32", "value": "3072:/qdhtjVkooePHOHX9s/4R1ltAeSKt84r5AMUpbSPS:CgopPu3q/4FCur5AMC2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634149123, "uuid": "e8071b87-72f1-44d3-8ebf-db7d70d38ee9", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634149123, "uuid": "8523cd2d-6c6e-4eeb-b459-1bd93c4e84de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149123, "uuid": "a88bbf2e-c8d1-40fe-927c-caa1e2608877", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.2499.31515", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c4e94c-2c2c-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634132869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132869, "uuid": "4c0fc334-e428-4bd3-bc5e-8157cbd6004d", "comment": "Malware payload (Dridex)", "value": "e63deaea51f7cc2064ff808e11e1ad55", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132869, "uuid": "62a2416f-6eff-44f6-b8f7-46d7eb1e693a", "comment": "Malware payload (Dridex)", "value": "b8ef959a9176aef07fdca8705254a163b50b49a17217a4ff0107487f59d4a35d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132869, "uuid": "fdefb348-d30f-441a-b23d-9840a1436bea", "comment": "Malware payload (Dridex)", "value": "4d58ec4c978988f16468cda2323103ae62b2baea", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132869, "uuid": "72ee9c69-6a8c-4c2a-9874-0053b9ba7254", "comment": "Malware payload (Dridex)", "value": "353bbefd55bc4c0f08736fd2e6a2f39f319a1d92ffd2aed003cc483a3f823c2315efa9364653bb048d573deadc2f06af", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132869, "uuid": "e89fa932-b4e6-4c37-8ef1-10d2342af406", "value": "T184835BA6F682E909D95917754CE683E26727FC115F53C38B7288F72F0F727808A03656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132869, "uuid": "d33858b5-69cb-46af-ae65-c7a4564d3669", "value": "1536:LFk3hbdlylKsgqopeJBWhZFGkE+cL2NdAA5eSUPIbjB59ZYiosYvvXvTWbxgXTPE:LFk3hbdlylKsgqopeJBWhZFGkE+cL2Nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634132869, "uuid": "b517b408-6899-4c04-8f9f-df20dc0bff51", "value": 84480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634132869, "uuid": "7297f790-8c5b-436c-ba17-7b4a7abd9c82", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132869, "uuid": "6de6c6c6-0796-4e6f-b2dc-3f3a6b66a26a", "value": "Purchase_Order 2412.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad28bada-2c3d-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1634140395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634140395, "uuid": "37e3f01e-416b-4e50-96f5-3a0f34db8559", "comment": "Malware payload (Vjw0rm)", "value": "e39be287d5161038ddeaa6ebbca80151", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634140395, "uuid": "3d695994-de08-4231-aa81-8f3b4782a4ca", "comment": "Malware payload (Vjw0rm)", "value": "b91e92bc3dd5d7eddb8c10f8aee1429f262b4cd033e4d1847c7eaf180a0120eb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634140395, "uuid": "b659e308-1f12-4427-932a-cd150f2510d3", "comment": "Malware payload (Vjw0rm)", "value": "0ab208083961f5054b4042eb86eb1d195701d89d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634140395, "uuid": "0bed50f2-9db9-415c-ad54-43de44a9546c", "comment": "Malware payload (Vjw0rm)", "value": "e8d0d0c6a716f4cbfdaef644a209893b7c05f03e74a5a98701d968627fbe54f22baaf8bb5ded19f1dc414006cd920994", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634140395, "uuid": "3bd6c317-4b11-44cc-9665-dc9916a029c7", "value": "T1BD42B088764BA8A6D75FE9390B5F55C8B12D59212A0FF14DE08CD19E00383A764FCDE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634140395, "uuid": "28b10333-e6ba-4652-8fe1-6c107ec060d4", "value": "192:fYmQfHbdlbNiTGh0a3VhWNGKXy0w1G75fERC5DfBABEgFLYogETfciuD9JKSzTe3:YdlAq0aDWNGSy0w0Sk9AigFLKKPuvza3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634140395, "uuid": "b2f37d01-ff39-44a6-9fbc-e2a61625317c", "value": 12177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634140395, "uuid": "87e1c186-bc34-4e7d-85a3-52a9289fac22", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634140395, "uuid": "1878bf13-af3b-4a02-85ed-631d3345268c", "value": "V00JM_Invoice_Copy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac227c52-2c3d-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634140393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634140393, "uuid": "a4b01017-855e-4acd-ac21-443ae37567bd", "comment": "Malware payload (GuLoader)", "value": "4805bfc9145d8aa3ac43d1cc29c451ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634140393, "uuid": "d43bc447-ace0-4a0f-b243-3a6d3d3802b0", "comment": "Malware payload (GuLoader)", "value": "bac5da263610272c5c5be4ecb5a16626c653a757abaffc8402d210227ec04bb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634140393, "uuid": "8040afcf-7abf-461b-9d8e-ce9999835684", "comment": "Malware payload (GuLoader)", "value": "7787fa250b35d1a67142d230cbedbc357eb8cb9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634140393, "uuid": "6d188a80-ad6e-41a0-9d91-e07ee294ce1a", "comment": "Malware payload (GuLoader)", "value": "6d3c48d8f26d9844ac106565ab8bdfaca38e72add933e6478d794b07d23ba92401eef2ab79fd8371ed041d33209f7e60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634140393, "uuid": "a3a650a8-3836-4484-a456-7d0a2b68b6ae", "value": "T1B5A38DD3655E9CB2DE404AFC47FF049B072EAC735A066B0B0184A75FD83B795A82036E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634140393, "uuid": "66be09f7-0780-4be7-b8b7-c7f36878920f", "value": "3d3cd1bd8dcc611a5734bf41f4e1a6a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634140393, "uuid": "b5633d5a-0b9c-4925-8f01-378707e845d1", "value": "1536:tlDO6+ecV15gr1zsaZMkKfsw1yNbmPsQTz5It5W3gVARkD:tlRwVLgr1zsa4qSkAI/WwVARk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634140393, "uuid": "91bf27dc-6b48-4467-98a5-b58377a7ad7c", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634140393, "uuid": "b8e50749-fe90-42e7-9915-015aadfd053a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634140393, "uuid": "e4e6426a-545d-49e6-b19d-76bdfa244046", "value": "ZAM\u00d3WIENIE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68dbac93-2c6d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634160896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634160896, "uuid": "3160391d-6950-415c-8b46-1d10d2213db5", "comment": "Malware payload (RedLineStealer)", "value": "953fcf7b3ffbc73f4b33786d0f113664", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634160896, "uuid": "270d07bf-86a3-469b-9e54-ebc96c34dde0", "comment": "Malware payload (RedLineStealer)", "value": "bafabb4721aa53307b5339d148014334d98976134a6896471577878bc5732dda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634160896, "uuid": "5a6bddc1-9a1f-4749-9472-a90215df0c9b", "comment": "Malware payload (RedLineStealer)", "value": "09cbe64ec6a5dec39e6d1c743d8e619d06c77c05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634160896, "uuid": "ee6ebaf9-f144-4d12-b394-308fb1269489", "comment": "Malware payload (RedLineStealer)", "value": "7f115e317dcc979e88b7aa5d689ef8b7c88266f55df8345caa198e053f357ff2ba1b948e5225c515a3b2d9fe9b299894", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634160896, "uuid": "9de237ab-ac7a-46a8-9d39-ece5f3fee7bc", "value": "T18AF3AE20F2D1C4BEC4A716709C658BF25AFBB821567492CB77A8377E1F603C05A7A316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634160896, "uuid": "0b3ea4dc-e490-4696-b708-ad245b556f87", "value": "2122adc88eb6e103fbc7dbe6426ed12d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634160896, "uuid": "11a13146-8e71-4e9c-a399-0c84f7ca9cfa", "value": "3072:PVJryuQJJMQvCBehTu3EPoS9D98aShyuyjh34Oz:jryzkGCEPVx98aCAh34O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634160896, "uuid": "1769a220-6d78-432a-a3a5-a10a6496de92", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634160896, "uuid": "4a0bcb6f-237a-4ad1-a085-b7371d708914", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634160896, "uuid": "6407b9b9-1d18-4b68-a4a1-6ba2ad90b352", "value": "953fcf7b3ffbc73f4b33786d0f113664", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52600c4-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1634108625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108625, "uuid": "c429982e-95e6-415a-9204-d041530cbbd2", "comment": "Malware payload (STRRAT)", "value": "75e918d14ee69bffc062d7186ed5fd17", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108625, "uuid": "f17d9dfc-db87-41b5-8e88-a0687f8b64e9", "comment": "Malware payload (STRRAT)", "value": "bb710e82db6839b248b100277be6f681b36831755f2768ab849139822f79c02c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108625, "uuid": "c8011c42-baa9-47ef-992b-69ebc0c83b11", "comment": "Malware payload (STRRAT)", "value": "130f31c53a7a5cd6e14675077c98f66cd94c9efb", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108625, "uuid": "f51e73de-9a6e-42ba-a7cf-8ddb9bc81bd1", "comment": "Malware payload (STRRAT)", "value": "5aa1cb4b771574f5534b018e8fa14a0a513f0690399361340dd898133f13dbdfaef43153d0ee194fd47ed3888ad34fda", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108625, "uuid": "1fbc1662-a90f-482b-ab7f-1918b2094c3e", "value": "T1FFC3125547A5A804A02C651BDD25DECA2FCFE103C8CAF039BA3FD83D316C5D979BA424", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108625, "uuid": "5a0a91c5-c3ea-4058-ac20-c57cbae2d4e8", "value": "3072:j95sb6ztQ1UYL8DHDgLogMJfg4FT0Gjpb3aD:kGZQfSVbJ44d04W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108625, "uuid": "56631993-baca-4dd6-b1b7-fb6eb6731f7b", "value": 122960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108625, "uuid": "ef2eca88-68e1-4968-a696-e27a4ca10a10", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108625, "uuid": "04546da2-99f7-4e7d-bbe8-a867e177136a", "value": "ORDERS_536252526.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000442a4-2c37-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634137527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137527, "uuid": "9de44346-f599-4dbc-9184-3a41a794b127", "comment": "Malware payload (Loki)", "value": "5057cc691005a448954a59faf019c6a4", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137527, "uuid": "704f4d7f-bab7-4f7a-964f-86958773f1f2", "comment": "Malware payload (Loki)", "value": "bb727e3ccf2cad49fa431905c08dd6c9f52e880a8d290b8f0c4842f1ac50ce1e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137527, "uuid": "4fd79be4-a287-4a9c-8095-1962616a77a9", "comment": "Malware payload (Loki)", "value": "15547242c0a6e054e3b2a7f47edbe8c0ad062f69", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137527, "uuid": "d68cdf0b-279d-4b9d-be9a-afdc9adf2b59", "comment": "Malware payload (Loki)", "value": "4b3363ec7c86c3452cdc078811284cb7f3c1288191d9521ef56a3db013c183ec3e8f280dbf7b96a1ae8b22ddbeb4f200", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137527, "uuid": "3f9ba089-76f4-4a6c-b820-1a9251bc4242", "value": "T167B40212DF71EA87D1B81EF29162EA70ABB0CD807D62FA8A4CD13C673B333D14585566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137527, "uuid": "8f6d3703-c8ad-4a72-b5e5-7817e06c9802", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137527, "uuid": "9a73618a-9de4-4885-ba83-f051d8f3e648", "value": "12288:CxoPkgSBJKtOMtCP2YQMasabaHNbETPIxK2:KoPGBk2wjsaCEIw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137527, "uuid": "fe456718-f9d9-49ee-8a73-fcc10b8106c0", "value": 535552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137527, "uuid": "802d7b7a-9760-4f76-bc82-2904d03fd048", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137527, "uuid": "b1329566-a5b2-4db5-90ca-9de4725f7030", "value": "DHL VN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2346cfd-2c52-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634149530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149530, "uuid": "a63314ca-b1fe-4743-88dd-d854fc1515b9", "comment": "Malware payload (Metamorfo)", "value": "edadc5bad5c854dfe6b0a63b55309a28", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149530, "uuid": "451095e6-31e0-4932-b268-2001e21c718e", "comment": "Malware payload (Metamorfo)", "value": "bc66b12c8b9dce2d58fe3e899b97f51ac009f26c21ea1b88fcf117214b1f13f2", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149530, "uuid": "e609ea47-4dea-4138-801d-8a9bc123ef32", "comment": "Malware payload (Metamorfo)", "value": "dc1f193168a8022ada8b9c5771a19586f94bab97", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149530, "uuid": "a5c678c4-47f2-42f8-9a11-b42a1b08aa78", "comment": "Malware payload (Metamorfo)", "value": "7a0787a4d4e8899fe030039ad2cfe7be44a97db5a56656a60c9b85613d7d150e3ac6a8a4802a8a5176df0c85e988a802", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149530, "uuid": "45849869-54fd-4614-addc-d20a4adf79ef", "value": "T1CF31EE051EEA0729C3B3CE7A107BA2424A76FC52AE934F9D808487DA2861050EC34E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149530, "uuid": "d3018e2a-967d-45a0-b33e-7a95f25734de", "value": "24:8+JUHRlVo5kcbA+P4d+/P+P2kMw41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+15f1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634149530, "uuid": "ad555541-21ba-42d6-b8b7-1a529f37312d", "value": 1552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634149530, "uuid": "0e3ec54c-7432-40a0-b167-e2577e5a184d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149530, "uuid": "0b13c711-8da9-43d3-b72d-f793dbcaf017", "value": "Curriculo.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895d106f-2bec-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634105545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105545, "uuid": "32b6f137-290a-42c9-938b-be0cb03a0dca", "comment": "Malware payload (AgentTesla)", "value": "c9fa29e6e303450e5c9890518d27ebfa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105545, "uuid": "b4cf110c-9b15-4947-84d2-b6fee0235d27", "comment": "Malware payload (AgentTesla)", "value": "be91eb148b36528adb2b49362c50a099cf0cfbf5f1d5bd18ce88751b3c779ae6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105545, "uuid": "86027d25-cc96-4d25-bb7f-01b2167d1687", "comment": "Malware payload (AgentTesla)", "value": "314d358046143e4d4dd88e3d7dc0db9e9b999947", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105545, "uuid": "24bc3ae3-0f41-4c86-98b8-5bbccc7924ce", "comment": "Malware payload (AgentTesla)", "value": "e149de5d707d874dc74ad08adeec1bf25f4aef6d2f57df57b8c51b3b71269e8a57a21da9ed479d5bc8e0a7ecf41eeff3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105545, "uuid": "8f24d066-21aa-459b-b1e3-5613785cf1b6", "value": "T12AC412A1A2E46B03FA32BFB469557D505770AE263421F74D0C92B0EF97A3B508371B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105545, "uuid": "1621e083-2209-4f88-9ea5-1ea99314d980", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105545, "uuid": "0810db27-19bb-401b-a59d-14cc61f370b3", "value": "12288:z1P4rnksslb9WqPs08Eeo+3zKUO/+8c7eRgSB:xPAraIqknEmD8/+81tB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634105545, "uuid": "b01de798-f832-43d4-a1a9-7215e3cef9d3", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634105545, "uuid": "c62ef077-0f96-4efd-91ab-9e0f79aec30d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105545, "uuid": "4b90c7a1-3c6e-4324-9232-5f6bd8d6699c", "value": "Doc-CS3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7a0a75-2c20-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634127990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127990, "uuid": "1b109276-f274-4894-8c32-89fc1051feb7", "comment": "Malware payload (SnakeKeylogger)", "value": "b5812b7111f4e31941bb8761f5664cff", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127990, "uuid": "6f7d5fe7-a300-44fe-aeda-a990bf906d86", "comment": "Malware payload (SnakeKeylogger)", "value": "bec60463781f744d7b84ce0e154c2d7063838df50bda53ef990bf42c9512bc77", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127990, "uuid": "5cf647be-874a-4573-ae12-86a319b73e54", "comment": "Malware payload (SnakeKeylogger)", "value": "ee2d0ba8a4d293d14af7e39578ba8db422f069a8", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127990, "uuid": "1e53730d-7e8d-4ca6-9f66-353957f97f04", "comment": "Malware payload (SnakeKeylogger)", "value": "b971978b76b3f421e65816737fc031bffd1a5c13af64602896a0041fcefb845136ad8469198ee6593bfe988275c40dc0", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127990, "uuid": "3c74a103-7af2-43c2-ae42-80337d4a6177", "value": "T1F29423FF2A4696683B649AEDD479F15E403E71BE851ECBD73D4B518A107BEC8C422208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127990, "uuid": "1cc5aa63-15a0-4551-ad3f-f5b5a61fb655", "value": "12288:0/Xk85KdZ6kvjwpqDOsuQ05XMaVR4HJCIJEqw9W:GU8YdZ6kvjwOOjcgR4TJEqw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634127990, "uuid": "b4e8c2d5-aa86-48b9-abab-c7aa73e666ad", "value": 443024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634127990, "uuid": "8d86f540-15f0-4b41-9f21-00c60f7ae08c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127990, "uuid": "72a86e9b-46f0-46ef-8c01-c806ad09ce76", "value": "SHIPPING DOCUMENT and PL.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26c93e8-2c2f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634134417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134417, "uuid": "4016814d-4f95-42ca-b5ea-fb353fee365d", "comment": "Malware payload (AgentTesla)", "value": "18d37add870067a7590f15b317eebe6a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134417, "uuid": "a6fc59c0-1cb6-4231-90ad-7d5c6b8b1449", "comment": "Malware payload (AgentTesla)", "value": "befb6cbb69f448a0082f1744852c28ac804097671626926b5c324ec96911c318", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134417, "uuid": "504cae7e-2d87-4b12-82e7-6a59ef3758a5", "comment": "Malware payload (AgentTesla)", "value": "6c94d812876a813f4b0c554df7bef385546560ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134417, "uuid": "2874e9a4-3f3b-4321-821e-6585eecd166a", "comment": "Malware payload (AgentTesla)", "value": "500652ad5c2b79ef5661f6f71df1a320ac7d020a71d8d142716b63a55c8fdbfd5660e68ca730c79a9619193f9df11a8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134417, "uuid": "9cdbf660-560d-4023-978e-874fbd0a61ce", "value": "T10664C084F55F711BCEF7613560803AA06AB9FE620E490BD74016BAE0983E54FEB70977", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134417, "uuid": "2d51a7bd-64f0-4a8c-98bc-9e564141661f", "value": "6144:ENrOlkMazWNw4GmZHQG04jQzljZ0eKbWFlvssgCcR4I40iZKbt25rSDtYBQNFgFy:orhJzT4GwHx0zzlNTQWFl/pICaPCBCg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634134417, "uuid": "70d7b2da-69e1-412d-8993-7860f70d80cf", "value": 328888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634134417, "uuid": "2e1ab83a-a57a-41f2-9748-1d24ea244c8e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134417, "uuid": "93054b82-53b2-4356-805f-d911601600ad", "value": "PURCHASE ORDER2543.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7e5676-2c28-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634131377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131377, "uuid": "ece92efd-4ff4-4fc9-b1f8-feb6e935753e", "comment": "Malware payload (Mirai)", "value": "a9d1ccecf99ef64fd5fe6acf0616e750", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131377, "uuid": "31bf208d-982d-4652-b009-f17c09a6889b", "comment": "Malware payload (Mirai)", "value": "bf272ad2fe8581c549b3cc5f358d6e4115d4c6450787f0833e91c65577ccd76e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131377, "uuid": "753d5596-f71a-4961-aed5-0900f893c7f4", "comment": "Malware payload (Mirai)", "value": "d071bc470a60703ae64319dc8d2774db8454ba7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131377, "uuid": "26e5e6a1-9096-48a6-8048-2d601aee24d6", "comment": "Malware payload (Mirai)", "value": "9dcc47180632c0e15100ab0b73d43a4806aa30e2c2e7e7cb4935166a5fe2caf435294fd09f3bdd108114cb05dd93e688", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131377, "uuid": "0f3f07b2-078f-4957-9f39-9b85b6ea2ee9", "value": "T131F3953A7E21AF7FE168827107F69F70CF9529D326A0A341E2ACF6185E7114D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131377, "uuid": "e9190315-377c-42e1-b7d0-0d480e3ec0db", "value": "3072:MGXtUjtg1aRGllLrMHLIS9YmrThPaLEnvPrNb:9XiAnaIdmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634131377, "uuid": "ea551dbe-ae96-4dcc-b822-a4e1b1b04754", "value": 159492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634131377, "uuid": "315ed381-eca2-403e-b2f4-da710df96d6e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131377, "uuid": "0b8330d7-7490-40cc-81e1-35f530febfca", "value": "a9d1ccecf99ef64fd5fe6acf0616e750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fd9672-2c47-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634144738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144738, "uuid": "4995f10c-6eb9-4f74-b02a-1129982d52e3", "comment": "Malware payload", "value": "145d4aa5e184405b34d5c173027c9f39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144738, "uuid": "0941e709-171e-49d8-8e8b-13db7eed57d3", "comment": "Malware payload", "value": "bf33486037c297c3e6d4ee754315ffff1be61b5d55f253b5f23b6f037a37335d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144738, "uuid": "56012e57-f452-462d-8f7b-9720542b5739", "comment": "Malware payload", "value": "f8b4fc661a54d49b7756c28faab2b0768944ded2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144738, "uuid": "114ce7da-1bad-4e95-8042-fb1843b49c81", "comment": "Malware payload", "value": "5e7ecfb8c065c2f696806c7b0ba3180c70891d7584fb1380f61e90bdcb952bd4b86e6ed9f273e69e892ffa8700b19607", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144738, "uuid": "443ebf91-f361-4579-b499-ee6fee396406", "value": "T10DD5238B2FB0DC17E728CA70BD6450E4A8D21D77E15C8341E394B70EB37BA99792994C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144738, "uuid": "acd59ef6-ddd3-4104-8445-9c91078dc5ad", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144738, "uuid": "34cdc6a4-a6a5-4315-ad1e-86df7238ed7e", "value": "49152:Wg3mEwprI6Uv4B4tpzvXoJkM1P5dlFN7JNlr1SR3eDawS8Nd:HWEwppS4B4tBT6PrzN7Jf1OW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634144738, "uuid": "fb5106e7-d9c7-4dc7-8492-3aa3187aee99", "value": 2843562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634144738, "uuid": "9293fc97-9b50-46ad-b8ed-ee5fc8da6e8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144738, "uuid": "0b4e84cb-1e3a-4d8e-8d11-abe5cef2254b", "value": "145d4aa5e184405b34d5c173027c9f39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f8346c-2c48-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1634144912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144912, "uuid": "7c061f42-3529-4ae0-b1a7-74b65fa75344", "comment": "Malware payload (ArkeiStealer)", "value": "69056288771b40a05572c690bfda2518", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144912, "uuid": "31d0b5d5-c0d6-46b0-ad09-e8ec91457dd6", "comment": "Malware payload (ArkeiStealer)", "value": "bf4d1dcd4b9129f47ec4239fa5a33e00c981e5fac5b8be880b76d2a1f5753c34", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144912, "uuid": "0192a482-b5dd-4d87-ace8-daf5b19e05d6", "comment": "Malware payload (ArkeiStealer)", "value": "5accd01f4e9863a28fec911ca6a169a8e3ff741d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144912, "uuid": "59ec82ec-4306-40e9-84c6-1cbc8666e2b9", "comment": "Malware payload (ArkeiStealer)", "value": "a92d9b4aa4b6fd1a228c5c597b93d06ef365835666963dbba0f4ca80d49663ff9f859ad2e7f4f6497faf2bb4e4251ed1", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144912, "uuid": "2f0afcf3-32a5-4bb1-95d7-5d0c45766a94", "value": "T191F4F110A7A1C03AF1B312F989B99269A53F79A15B2494CFA3C107ED8774AE1FC70357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144912, "uuid": "5a0738ac-3db8-47b6-9e60-e6018e9b7e89", "value": "e97201e7ef5f430ebcbaea94835aaebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144912, "uuid": "be22c19c-1edf-452d-9b06-6a94c7d06d0d", "value": "12288:+JsrBVsv7FhQry1CB1XMvj6Uoz/hKeW9wOmJcY/tbgfDfy9iHxwFf:+J627FCrHBMvj6Uoz7W9wfJcYyfW9io", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634144912, "uuid": "e4cdfd2f-31cd-4968-94cf-e0afa1dbc487", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634144912, "uuid": "50089b79-3f0c-4c80-8182-9fe3a86fabda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144912, "uuid": "b14cf212-b3f0-48d5-ae88-014eda185ec2", "value": "SecuriteInfo.com.Ransom.Stop.Z5.27157.7517", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda958ba-2c09-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1634118088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118088, "uuid": "4eca0625-9ed6-4a48-b014-a9180d6d48a6", "comment": "Malware payload (BazaLoader)", "value": "730ca73a23dd70b2edf3712e4d03db1c", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarISO", "colour": "#EBCFBA", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118088, "uuid": "9dd15b84-1457-4af5-a42f-763e4b2f30f2", "comment": "Malware payload (BazaLoader)", "value": "bf58ef24dd79c02522163be7d8e523cecb2be8daf30e98fd6673d583cbc9e74b", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarISO", "colour": "#EBCFBA", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118088, "uuid": "1e78cb38-9d49-41e3-a7cb-77c67f87145f", "comment": "Malware payload (BazaLoader)", "value": "48d8ff863d43bde2614ae387841135d1b33e66da", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarISO", "colour": "#EBCFBA", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118088, "uuid": "7c5e1047-30c5-40e9-93c6-1f1c12939151", "comment": "Malware payload (BazaLoader)", "value": "dc58336de91555b84224d7ad4bcaa0f881bee688627a45affec0b6f421304ba59b84a243ef94aa666056c4482dcdf967", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarISO", "colour": "#EBCFBA", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118088, "uuid": "375798ab-af4f-4060-885f-5d3ca1678ab0", "value": "T18345D7E5EE2291D0F4BBE070C5917617B8603C6953398BC74240672B2B63BD4DA7E78B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118088, "uuid": "a6727c7e-2bc2-4d7c-95b3-ddf9b4b63f73", "value": "f1f156271da624d9896a0e778797f0dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118088, "uuid": "a34c2052-ee50-45eb-b371-4b578faee494", "value": "24576:4Am1pTsWeU8tV+VwKYs1tRS+7SPFL3EOGTWqG5QVEzAJ24GOy2ipi8z71aaDpZBG:4AmbTsWeU8tV+VwKYs1tRX7SPFL3EOGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634118088, "uuid": "feec356a-20da-47d0-9b63-8d9551650d60", "value": 1191424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634118088, "uuid": "b6d3a939-23d3-4c12-bf7d-fbf72dbc68c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118088, "uuid": "3f706576-506e-4ff1-8994-c078539bd686", "value": "1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6890eec5-2bf2-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1634108067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108067, "uuid": "a9f02f3f-6894-43bf-a726-2068de124e57", "comment": "Malware payload (AsyncRAT)", "value": "a5b0bf93788aa86babebcd07bbf89515", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108067, "uuid": "8cf2acb6-846a-419d-a689-523ac3b65047", "comment": "Malware payload (AsyncRAT)", "value": "bf6c15afdc77d81518ec529242a307457e412ed390f556bc04f66e3c809620c9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108067, "uuid": "30ba1ee8-1062-43ed-9b62-86785189eed0", "comment": "Malware payload (AsyncRAT)", "value": "b14ce32ba23566c298370b2fda6b9b4f875bccd6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108067, "uuid": "df08d4ff-8ab7-4214-a686-ef8d8540e64d", "comment": "Malware payload (AsyncRAT)", "value": "097e951f90f6d98cd9df5571a65574fefec21657d4177280cffe788338c9a33a5b64136f3cbf7f20c5305acad7db0b49", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108067, "uuid": "567d43e5-d15e-4748-8cd2-60ddb9cbc5f1", "value": "T18AD41F15F3529C11E567167364E091E391092CC6E858C339EBB7FAA318AA380DF5CBDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108067, "uuid": "5d965f67-162e-46df-84c8-7dfb3323e3d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108067, "uuid": "3f8fc21a-066e-49d4-b8a4-acaa005ee1fa", "value": "6144:2UL3o390zRCmmZspUPrNtJjHNre0sNg666Uqi:DzoYRCmmUUPrNtHt6nU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108067, "uuid": "8f3fec20-415c-49e0-b961-5e0a2c6e8499", "value": 623104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108067, "uuid": "ebfc9891-8efc-43e5-8d16-1aa1e78a6c93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108067, "uuid": "a2c6134d-8c7a-40ec-b5a9-889429f4f7c2", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.14947.21169", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2124c7bb-2c0a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634118255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118255, "uuid": "2f5a9fb3-e7e2-4238-804d-91f1a3d4cc27", "comment": "Malware payload (Formbook)", "value": "31ce7d8522a4ee3ba72ed934e7ffd70b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118255, "uuid": "0964e9ad-ae5c-459c-bd03-f1e1fa65c45f", "comment": "Malware payload (Formbook)", "value": "c04a6522c272316586333bdd0e1c78427b3dd04976d77e45d937fe763bea101f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118255, "uuid": "079e9b58-31b5-480f-ad7e-eccd2769dfb5", "comment": "Malware payload (Formbook)", "value": "47f2c35db86890a4b155562fa0622f10518f3df3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118255, "uuid": "2287506b-0fd8-4cae-b00e-bb0d5c7673b5", "comment": "Malware payload (Formbook)", "value": "719798733d40bdd41c3742e312c56d5645de64619be62d70567ec0aa5364b53366f1b5964a640ac3c6e436da632ee21a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118255, "uuid": "a27cd870-a8c9-4e66-9e69-c8166ba21b77", "value": "T10F44122F70D384B7D1838EB04BBAA778D3F7E60D5495228F6BA06F363C612CB5915096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118255, "uuid": "79c119d3-d2e3-4ed1-9fcf-cfc6c9122c82", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118255, "uuid": "0fa6b367-e30c-4616-bfcb-33810aa49b4f", "value": "6144:wBlL/cImhOSmCgu1lf7zDQ5kwNJ7wdsVZrXe9ajPjIRNz+U5OO:CeIcQA5UbrXeYsRcU5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634118255, "uuid": "3d8cb458-fd84-41c1-90b2-d980144a43b4", "value": 253381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634118255, "uuid": "01f4adcf-b393-474d-b73d-f8d4ead70df2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118255, "uuid": "64cb78a7-05f2-4ca7-92c5-5c4f26ad1bfc", "value": "31ce7d8522a4ee3ba72ed934e7ffd70b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "458ffc8c-2c6f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634161696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161696, "uuid": "5d88e22e-d152-4905-88fb-0d5d1a7de420", "comment": "Malware payload (Mirai)", "value": "06b45704082a5af856473bb725f62487", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161696, "uuid": "d9ff6a71-20a4-4e85-b0e3-1e27e7fabf08", "comment": "Malware payload (Mirai)", "value": "c0ada7d920df46763311a32eb24a0b8ca141df574cc36f08f5f1a12a134854bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161696, "uuid": "564d80d6-00f8-4aa3-970a-f4abeeae3d4a", "comment": "Malware payload (Mirai)", "value": "5d1b6b6e5d0e3c996af59dbfb382b177c400a4a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161696, "uuid": "738e4e7b-c798-488c-9846-9fe8e08207c4", "comment": "Malware payload (Mirai)", "value": "79b5b99ddf70fb72591a12ef51cc7e362912cdc65f7abd6aa3c28c8d55bb1c31dc7d2689af2f3fb53d8cffa9953bd413", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161696, "uuid": "c8e626d5-f4d1-4dc3-a0f5-8936b2ba51d6", "value": "T1D9B2F1C9D6FF2BC3C2918336D0BC9A4DE6721AC10746841A6109764FA3D760E47FB3A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161696, "uuid": "7899b29a-95c9-4083-8e75-94f646c72fe0", "value": "384:MCDKKQOcRpmYLdn6RBOFRFt5rUFX1DiSIlCo3AnupCFNqnrrd1NEZgO8UXWozPLd:P/QOC0Yhn6ROHWFlAcwNEFCnNBxcqc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634161696, "uuid": "9808a693-0787-4750-894d-a5d29299f88d", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634161696, "uuid": "551c42d7-07bb-4906-bbdb-86aafc30db9e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161696, "uuid": "9a5ed945-290e-4d8b-8092-976a214b4416", "value": "06b45704082a5af856473bb725f62487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4729cc7-2bf4-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634109027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109027, "uuid": "214eb8f9-9eed-4d85-ba3a-5eb40f112082", "comment": "Malware payload (RemcosRAT)", "value": "61cad3efd5f03b11b513cf54c6b2122b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109027, "uuid": "d9cd1ee4-ceb5-4b3d-ab05-2ef138800f0c", "comment": "Malware payload (RemcosRAT)", "value": "c0c93f169cabc35bbaac637c0dd6c21112752398c42b3c828d78d9cc4de2eaed", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109027, "uuid": "84d326da-5930-4590-b1e9-f485daf5c0da", "comment": "Malware payload (RemcosRAT)", "value": "5b5584f7798f33d6bab0c37755f3fe62672b48f7", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109027, "uuid": "2e9ea88e-3feb-42c3-aa26-fac0c6934066", "comment": "Malware payload (RemcosRAT)", "value": "a33ee0110526f5f1812a1ba16824b91eb1dbb7a1ff44f288c006044aa44e4db2d9eb5dd38406d6468681641aa72aa4cc", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109027, "uuid": "db6f5bb2-5467-4d2c-a901-0b6512eeff16", "value": "T10B737CA6F6C1DC06CE69077A48F782E66626FC555F63828F324CF75E0F71AC0891261B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109027, "uuid": "0d54a6da-28ea-4dee-b815-1fbf4b3d2a0e", "value": "1536:qJk3hOdsylKlgxopeiBNhZFGzE+cL2kdAO1zI0ScDNzmVQyrnHRBoESK4nceC7rZ:qJk3hOdsylKlgxopeiBNhZFGzE+cL2k4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634109027, "uuid": "2f194e2a-abc1-4cc8-bccd-daded4c7b13a", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634109027, "uuid": "d0c46a81-8b81-46e9-815c-9af82fc60e88", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109027, "uuid": "1b5b93d9-7edf-47dd-aa19-dabea62923a5", "value": "ACH-01068034.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20fbbfac-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634108377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108377, "uuid": "f2f9d6bb-b8cf-422c-aa86-618b9ed79b2f", "comment": "Malware payload (Formbook)", "value": "efdb3073607b0e44e67b7436fdb70f5b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108377, "uuid": "4c20ede1-2410-4616-a45f-205549f869d6", "comment": "Malware payload (Formbook)", "value": "c13a3022f2212e4e16fb2147f6fd0c09ed4439a49b4313603a5e48b7b3174167", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108377, "uuid": "7f03a0d2-a2ad-42db-b744-926dc2884d25", "comment": "Malware payload (Formbook)", "value": "bac5f9c3aa6e6fae7034d6a1fc9197b1090b4f0e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108377, "uuid": "93e0145e-82eb-4bea-9c58-8da457aecc88", "comment": "Malware payload (Formbook)", "value": "cff28c51fb25e547f9711916401c4ce7985a04e03b7f5b7c21e68b6a0edb77f38d2815b781a571a84cbf488d7b4298ec", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108377, "uuid": "12c282a5-97c1-43ac-895f-ed099c82d52b", "value": "T12744B0FC67AC3E31F48A78B127B5413522684E1C7521C3C779BA39DA54398DF6EC8628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108377, "uuid": "d4f25333-c021-4b25-95f9-3e98e33aa27f", "value": "6144:I0BbR9Lobr7+cGDP3tlISSbuIoYn0WDlbmN7Lk:tBbZfD/fIP3vpbGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108377, "uuid": "9cf153b5-55b3-4557-8707-a29ce9d8d927", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108377, "uuid": "04b5e054-5fb4-4fb0-8e25-a34009690f8b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108377, "uuid": "e54113fd-83f0-4d7b-9741-66691e39e779", "value": "090900 Quotation - Urgent.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a167c7dd-2c1f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634127490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127490, "uuid": "89ee150c-4ae4-492b-8ee0-580007e7457f", "comment": "Malware payload (Formbook)", "value": "1823dce627d29f5d4985501267f7ad9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127490, "uuid": "6e776d58-5bb1-40fa-b1bc-180aa0612d92", "comment": "Malware payload (Formbook)", "value": "c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127490, "uuid": "4a46235c-05a2-467c-be2d-d341006e85f2", "comment": "Malware payload (Formbook)", "value": "1ce10042fccf2c8fcb2b0a93723f24b6c3b4ffb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634127490, "uuid": "0eaf3c61-89aa-4408-9dbe-b804441df91c", "comment": "Malware payload (Formbook)", "value": "3844db379d8dee6fae8bce9262aeb83bedffcc2b050f4b8d850b8c77e42fce9ddef4fb32d167069e3af71aa77c941fd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127490, "uuid": "79464358-a447-4aab-99c0-c03f1a228f6d", "value": "T181C412207B5FDE26C5AB57FD008656F387B87932A1C6DE0A3ED036FBE9213460E85941", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127490, "uuid": "6d117571-e501-4f24-a019-27b7a3382727", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127490, "uuid": "ef411ff2-cc8e-4d88-81bb-9ce67f2d939f", "value": "12288:DMSSBQvlKxIhc8+PzqBpzZCRtDSybgO5Kdw06aDSBaEK:D0ByMstCvDS4h0dbDSB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634127490, "uuid": "94dbb682-83ae-4a0e-9a17-c1ef0db6d3f2", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634127490, "uuid": "1712ba89-e2ac-450f-944d-ac07370efad0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634127490, "uuid": "28a09ea7-893e-4352-9585-cb3d104e1854", "value": "document de commande.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2354159a-2c0a-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634118259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118259, "uuid": "95c17b04-6050-45f5-8cbf-dfea4bd8dd9c", "comment": "Malware payload (Loki)", "value": "559db8de6e321a3af47772f5d349514a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118259, "uuid": "fc052c70-a9c0-43a3-be1c-590fcf064c50", "comment": "Malware payload (Loki)", "value": "c1d2c68c54f57ca6bbb2ecc96f25ec3c0808c3e0194c31e6cafea5900ccbc762", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118259, "uuid": "b6cbf6b2-ffb1-4e52-943a-03d9bf4e06bb", "comment": "Malware payload (Loki)", "value": "c66245883499ece42302e19f0f655d44c8edc60d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118259, "uuid": "f06af0ac-5d67-4356-b785-581728d30c35", "comment": "Malware payload (Loki)", "value": "8ad36bb4ff92d2686a4823924f6d365a15e1edfe79cf467f3bad3d4c489e861905071a4c87ee87afcbc02a055794d3c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118259, "uuid": "c6019166-62f4-468f-880f-bdd8cac409ae", "value": "T1FBB401039FA0A69BD1A92EB285A3E970C771CD81BE67F7498DE07DAB37333C11491146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118259, "uuid": "72788a70-5fe4-43cc-9078-91f832e3d732", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118259, "uuid": "53b578f2-79d7-47d3-993f-2c46ad10ed9a", "value": "6144:idMoo2/R7ITcrNxVQg+jS8g5NddJog/DEIszUxZk2tGYo8nMkhB:idvPkTcrfVQeddJJwDzyZkmrMSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634118259, "uuid": "8a380b34-81bf-4513-8a7a-fde99222097c", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634118259, "uuid": "9ab31467-2ad5-4136-add8-cb3f683f6753", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118259, "uuid": "a8790231-fe27-4c41-889e-536dc1ded5aa", "value": "559db8de6e321a3af47772f5d349514a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ca1e8d-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634108385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108385, "uuid": "f9353c93-cb5d-41b0-99ee-e4a5a4f98296", "comment": "Malware payload (Loki)", "value": "2779c5ec85106463b44339138bbc5218", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108385, "uuid": "d8978f09-1316-44ee-bb96-6d1b6834a41c", "comment": "Malware payload (Loki)", "value": "c1f1638b9cc92fcf80d52a33da1e5f71adb193616358bb9b3349f69d203c8bed", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108385, "uuid": "674de55c-0cda-4b6a-8150-984e2aee53e8", "comment": "Malware payload (Loki)", "value": "27db3aafa190df278ec3fe540eade776adbc99df", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108385, "uuid": "06e9545a-51c6-41b8-97dc-d8d29fda33fa", "comment": "Malware payload (Loki)", "value": "3a50099f0109238e8ee64f44f97a57478d617bb9752a4fcfca85d4e508438c7060bb6c13565e2884ae5325fc3e887922", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108385, "uuid": "f8378dcb-c1f1-4dcb-be60-df17a07a2ecb", "value": "T13964B0C590B07412F5ACD373FFB931144C996EF451F5229E0912FAAFDE7A793A42082A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108385, "uuid": "ca4e050b-ca81-418d-8f01-43d52754e0a8", "value": "6144:6Py7UCsT7i59jFrzBg1NULtP0jFe7VzhzpI/8fvqyeuFCq1JmSKmMyAkEBNl:U2UCsT7M/arWPEe7VM0fvqyeuFDJYkEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108385, "uuid": "7b6ea7c6-6552-4484-86ea-c367a12de535", "value": 317592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108385, "uuid": "0f666d50-0119-4a6d-a6db-1332a4b8a2e6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108385, "uuid": "f79cc664-99ae-4b2c-b723-6d64ef6813e7", "value": "SwiftRefINV0899211.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948b93d7-2c35-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634136917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136917, "uuid": "9d75afa9-86d7-4075-9700-fb2cbe0d327b", "comment": "Malware payload", "value": "a54ef0a7a31d0e3fbc56f05c610bb694", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136917, "uuid": "95dea3c8-9e41-493f-9832-620b12b66d14", "comment": "Malware payload", "value": "c2b051d4be9deed56d51a3579868f76022d91d14511fc84eb51749fc225d8121", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136917, "uuid": "7d929bff-acf8-4c8f-bc55-9328fba2238c", "comment": "Malware payload", "value": "02ad7187ddec47f720d9cd380040ffc48b74f6d9", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634136917, "uuid": "85605a9d-e442-45ba-9a67-a18a4d591852", "comment": "Malware payload", "value": "e49b50c1d94d9f7f5e182b5946e0a9590bdf35ed658f4320be75ae249e8da0fabddaf7531a00fe6d522c02b037294164", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136917, "uuid": "e7ff2579-86fc-4593-80fa-5f081be3d04b", "value": "T192D26C81C26810CAE973D9B9C699D7A7FE30F545A72102DF03A1D8485F53FE2A739750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136917, "uuid": "a39ab315-1acf-409a-9497-1f046bb31af9", "value": "26657703ef97fd050161aae9690705dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136917, "uuid": "cf5db335-a3b9-4442-adcf-1fd5fbff4273", "value": "384:rpI+aIZlcE8jzl0cp0/gY6C1sVxFhm6sCXY0HEBjzDskFEXRZuLh3RF4qslGsETb:r6slc1jx0cpR1LIEYCCV2St3RNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634136917, "uuid": "eaf11c69-2f44-4e15-a799-0044236d9f45", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634136917, "uuid": "52721d92-6356-4f3f-854a-453e5f215ee1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634136917, "uuid": "8a7b23cc-e0ba-4b92-b1de-6c4935d08cea", "value": "1.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a8a7f1-2c09-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634117833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117833, "uuid": "f107866c-5c6a-4069-8c11-308763c6ce1b", "comment": "Malware payload (Smoke Loader)", "value": "4c5870829f2be67e77e9831e25893c1d", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117833, "uuid": "25d82685-29e3-49d1-a222-93b7a55c34cf", "comment": "Malware payload (Smoke Loader)", "value": "c3134451e6ef2212f832ceb0757d14a4d078771ec045bf195a66d40275542a1b", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117833, "uuid": "2a6d978f-c25e-4b6a-b651-d5ec8ab2f1ad", "comment": "Malware payload (Smoke Loader)", "value": "951d4f8b4723381256e8584f6ef80b5649754dde", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117833, "uuid": "dc61695d-bd4d-4733-bfd7-857376876a77", "comment": "Malware payload (Smoke Loader)", "value": "d2f6b60c019659875f46f218574a8e3d7279cae6329c218145c1db0f5e276b0b5e20e48651557a2fdd4654633fe1a40b", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117833, "uuid": "61127616-54c5-4e7a-885e-2ea41bb6b324", "value": "T1F804BFD07390D472C5A716B3C868CFA25EBBFD211A7091CB77A8366E2E303D05A7535A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117833, "uuid": "3214774d-c397-483b-ae96-a4710e2b54d7", "value": "c8c17e47eb07afabbfe8e635fca5ad02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117833, "uuid": "167fac78-6f9b-4508-bacb-b18692d1a739", "value": "3072:L12oiRvrfhG8H44Eeh9yyhHqgEoS9D98aShyuymqhtig0e3E:woiRTfhFH4g9yynEVx98aCOtig7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117833, "uuid": "97c89f8b-4d9a-40e8-a786-9f26b7a3c643", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117833, "uuid": "e822dc88-97ae-4006-904b-a4a1bae70d3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117833, "uuid": "055ded07-2610-492c-a9d1-3c35bf1160dc", "value": "4c5870829f2be67e77e9831e25893c1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4ba1ba-2c0d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634119915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634119915, "uuid": "7edcb406-b26f-46d2-a448-4d470b75c673", "comment": "Malware payload (AgentTesla)", "value": "1c83d78c1969a7ebc3deaa1990c9dc9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634119915, "uuid": "c96935bf-4232-42d0-84b5-30009f667f72", "comment": "Malware payload (AgentTesla)", "value": "c39785b91858501d961c57f85b4c28fc6e674fc68f40244ecbc649870fa749ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634119915, "uuid": "ff508dbc-6bf3-4f89-b5ea-05f69c8b8182", "comment": "Malware payload (AgentTesla)", "value": "2918dc3b764c8c60d0fb64f8bc54bf4f92ba1f0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634119915, "uuid": "f6c09339-9a91-4b92-b336-12d73910e7e7", "comment": "Malware payload (AgentTesla)", "value": "5c95f1d336b82824c8e7bb4ffbe89b89aab3548847590f8c2f46970789dcd74975d00da5c3e6d894888a92cb154fb40c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634119915, "uuid": "86b1f3f6-f27a-43c5-9e32-28d9c04370ef", "value": "T1B8F4A615F3929C11E567567364E051E391092CC3E858833DEBB7BAA318EA3805F5CBEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634119915, "uuid": "35398417-9c25-429e-b406-f872bbaa37e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634119915, "uuid": "5ec206da-e297-4007-b53d-3511d6b6abf3", "value": "12288:QoQEWqEtJPwMSrmNeJgfV3jPzt9eZaxFrPUuN+JQVU:FhEtJPFSr32fV3dAcx1PUuNfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634119915, "uuid": "c4e7c5d9-86b3-4981-8b2e-90ac06555854", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634119915, "uuid": "79a086b9-5d93-40e5-a30d-28c903b04390", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634119915, "uuid": "efc4e077-5b66-4328-ac80-2ef1b6a40713", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ec15c4-2bdd-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634099144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099144, "uuid": "2609d2a3-cba1-4034-b2a5-cf619311e4f8", "comment": "Malware payload (Mirai)", "value": "a29e1648a0de1904adee366f1f7bbe52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099144, "uuid": "a0238c02-0c16-4074-920e-0934e712787e", "comment": "Malware payload (Mirai)", "value": "c460e17eb8d394b4ceb2e598161833de5591fc4bbb20ea8a99188f2b688fb6d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099144, "uuid": "86126fce-d849-4ca2-bebf-db6932a885de", "comment": "Malware payload (Mirai)", "value": "70c851d358e331da1e85d3af662f3d4ce63ea767", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099144, "uuid": "8b5bfb50-52ee-4018-a782-0cd84a45ca99", "comment": "Malware payload (Mirai)", "value": "40557faee980306704577238cbbcee1df473f2d7b3921a5429482a3821568077a5045da9a69a4fe95d9c70242488016d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099144, "uuid": "8941fcca-20ce-43da-822d-7c9c33810148", "value": "T14F339E76C42EADD8C6458734B82A4A740FA3E10491E76EFA5B8586A54043FFCF61C3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099144, "uuid": "3b1d3c8a-cbe4-4faf-8746-fe6d1854c4ad", "value": "768:Er9Q6eGyC75erUUeOiwwtNp40ZdiWFyGoMuJLk3XCmlolN9aXCxR:EcdC753UlwtNFFyGoMD3X3qlGXCxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634099144, "uuid": "67e8f452-0f76-4341-8c96-14b590612bf2", "value": 51924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634099144, "uuid": "add3571a-e11b-4017-be48-0eae5f4615bf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099144, "uuid": "7412cec2-5f19-4003-a5fd-33e4ad183581", "value": "a29e1648a0de1904adee366f1f7bbe52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9d9bf5-2c07-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634117312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117312, "uuid": "8ae8b015-6bf3-43b5-9a55-dbc73476f79e", "comment": "Malware payload (Smoke Loader)", "value": "7c3cb980063fc0ccf876dce8dc72d209", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117312, "uuid": "22d8a146-41f4-4597-af27-0af72cad79e1", "comment": "Malware payload (Smoke Loader)", "value": "c5e6a4a2d7ac5cdac2143d9021bea6bd82976804f6ffb3385e6962691b8c5f20", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117312, "uuid": "1d7c45b0-17c8-41a5-a869-4429fe64f740", "comment": "Malware payload (Smoke Loader)", "value": "1cdce7a77f0589ae2839acccc7438252807978fe", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117312, "uuid": "3c9a6ea4-4358-49a4-b6df-3f925098b4dd", "comment": "Malware payload (Smoke Loader)", "value": "84ef7e45499d9f9a94159edf48fec2b488acd6ebc4aa4479763289697226536ca7fc8094b1f6f72cefe7ce9b60920a7d", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117312, "uuid": "1233b0e8-37f3-4924-b35b-7f6f1e587016", "value": "T175648D00B7A0C034F5F312F949BAA3A9B53E7AA16B2490CF53D51AEE56356E1EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117312, "uuid": "45b9d470-b6a4-4936-84e0-a6b39a9a55be", "value": "4b52e566ef5b8727d87906b4623fc7d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117312, "uuid": "14046362-54b4-45ad-8638-e3e41261f0fb", "value": "3072:7ERrEKQLLyD6DnSPSo05e/izOoednc9qtjj1lkAk5OrMky/48s0R5WZxpR8GQvM4:rLDSvK54MMjj1l6Ozy/4l3ZxpR8Gebh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117312, "uuid": "6b7ea448-fe6f-486d-8841-8ca61e9a7e9e", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117312, "uuid": "c496782e-0e63-4019-a2e9-5a1c592ac756", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117312, "uuid": "e0978317-4c61-499e-9797-7f304520adfb", "value": "7c3cb980063fc0ccf876dce8dc72d209.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a823191d-2c2a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634132226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132226, "uuid": "a53e884a-7212-400b-a276-a3ab83474a0f", "comment": "Malware payload (Dridex)", "value": "4ef7ea6eb6f007e8f0ad9cd6243a21c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132226, "uuid": "68a3c48a-b512-4284-87e7-d668134acae0", "comment": "Malware payload (Dridex)", "value": "c72fa2296308b8500ddb8c345035befee0711451d1272df8b6762c608e0cfb82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132226, "uuid": "06a33f80-eb16-4a82-84f1-ec0ada76a417", "comment": "Malware payload (Dridex)", "value": "b33219154cc6a9db3bb471693542c7982dc5be1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132226, "uuid": "c98210e8-7c67-41a4-905a-f78d497c2e44", "comment": "Malware payload (Dridex)", "value": "477176658a6699c1fd8313e2ed1dead2130a27daa02c61d07c2d950028e8308091ee8ce455028cc871e61df25e95bafb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132226, "uuid": "453a293c-cc7f-4170-92f5-77196ea2a325", "value": "T129D4F8013A54E821E7E955B6CF2AC6E85B183D48EFB1A4C778E17F0F2AA94F3D215305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132226, "uuid": "292ecf87-2e21-455a-acc1-093d65cbc15c", "value": "0bdeed4a70b8b1fd5924130bfe75d8bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132226, "uuid": "7da2763a-d6f4-456f-8bde-0b968110c149", "value": "12288:/uIBebwMtjp4CqwqyaXPLAfx38TW9DiWUT2tq017JGoLbiW/:mHb4wqyaDA5sTWiXT2tq07G23/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634132226, "uuid": "3ff51b3f-4788-4173-8cc5-199787ac866c", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634132226, "uuid": "be2ac0ac-df82-4de8-a303-04815d65e5f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132226, "uuid": "3dd66277-5611-41fc-920c-1a3a1d7b890d", "value": "4ef7ea6eb6f007e8f0ad9cd6243a21c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60c2082-2c05-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634116411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116411, "uuid": "ccc95018-4d83-4398-b2e8-e2d8fdc999db", "comment": "Malware payload (Mirai)", "value": "06c91a8348b1c0db419388fedfe8fd40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116411, "uuid": "e9497ec6-5590-48e8-a5a2-83e1ef6e3e2a", "comment": "Malware payload (Mirai)", "value": "ca26691d3b7d6f323c72c9585de121d4cbd9b703bc3c333d4034d81e98e28b92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116411, "uuid": "cfac88db-5f1a-4434-aee9-a081af25565b", "comment": "Malware payload (Mirai)", "value": "f88f8deae042035fba5f1d5ae9a0266cff57e806", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116411, "uuid": "75404d0c-e11b-4382-a298-fd73cee91335", "comment": "Malware payload (Mirai)", "value": "9fc23e3a6b88208746be6c6b47306d3358b873517361bbdb1a815da3f631f957854561fda8979a602f9519e1bbf4a33b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116411, "uuid": "7a373008-c1a9-4b09-a26a-21f50c83bc61", "value": "T15EF33B46AA808E03C4D62776BBAF414A33239754E3EB73068D28AFB43F8775D4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116411, "uuid": "e991ea4d-f573-4dad-b209-eec651092613", "value": "3072:wVY5zC82GsiAyVF0CZmD45aDPuPO5D7j5M2vgBsHFrohTBM/9N4uJT:wVY5zC82Jg0C15aDPuPO5Pj5M9QFrohs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634116411, "uuid": "09943be0-1c57-4f93-9494-f94cb090ff9a", "value": 169924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634116411, "uuid": "2e39e5b0-1c58-4477-afe2-55f8a5f1faf9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116411, "uuid": "d9edf83d-299e-40d2-bab8-e4f75e766452", "value": "06c91a8348b1c0db419388fedfe8fd40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e04d9f-2c58-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634151705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634151705, "uuid": "2117a5f8-082b-4da5-bfea-00a019a4508e", "comment": "Malware payload", "value": "77d033a3f1fd583cf6836b2d05f196ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634151705, "uuid": "70472225-0900-4af7-9a30-8f42ade204f8", "comment": "Malware payload", "value": "ca30cae9fee835a2a12b111864d52a15f92a5a8b0e6fa7ae189833654bff712e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634151705, "uuid": "af1c7822-d3ab-431a-ab3b-481464521e95", "comment": "Malware payload", "value": "36b6f134a07ae17375d8de3f20a895ee708c5db5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634151705, "uuid": "e66cb87f-e0a8-452d-95e1-d961576506f2", "comment": "Malware payload", "value": "c24080234e755f4eebc09bb25ee4ec771c3181633289eb1e52da353fa752da62a086defc539e0db4649fc191e3e689a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634151705, "uuid": "09f6aa22-95fb-4fb2-9694-530170254fde", "value": "T143C4E110B7A1C035F5F752F8597AA2A9B53F7AA16B2490CF63C51AED4630AE1EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634151705, "uuid": "ead550ea-3835-4a7e-8b9c-fe4a856535c4", "value": "362b424337999aee119a9c1dea92a737", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634151705, "uuid": "ed9c88b2-4766-4a0e-93aa-ddb64592d0bb", "value": "12288:0igYWbWcIadIbTC1aE9/Yz0EH5FULcVvNMOICvzFyZgIIhi:07bNI8GxE9/Yz0CFULOaOI6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634151705, "uuid": "05e90026-0d00-4353-bf1a-2d81c0d49574", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634151705, "uuid": "fe75a64a-8265-42ff-a5ec-893cefce9de6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634151705, "uuid": "d7c57434-ab81-4c5c-a99d-3a31d431eab0", "value": "AutoInstallYTB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100d18b2-2c1b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634125528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634125528, "uuid": "9b118ee9-71c4-40ce-9349-24e0039ea170", "comment": "Malware payload", "value": "316b74ffcbb8793761a1370cf2de906d", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634125528, "uuid": "247f6ef6-70b9-46b4-963e-419011e90175", "comment": "Malware payload", "value": "ca6b1385bf173bf62aae9e4d7c138bf97cc54387380b4bbf988783b1e07e47b4", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634125528, "uuid": "dc3a8bd3-7782-4204-b4a3-a309275f0bcd", "comment": "Malware payload", "value": "fb94580f787ba237400717c52adb416d2576adae", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634125528, "uuid": "fa735200-e155-47ad-811f-5252ff888f7b", "comment": "Malware payload", "value": "d97f4a903732588f942dac27707260f573d8b47a20040f4bebcf021e38576d335e7829201e66f383d4f2cf7f0222b1a9", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634125528, "uuid": "d08dc3ce-1f5d-435b-9851-087c6b9fdde7", "value": "T1EDD4230AB630CB84CA0946BE0FFF5EF157D3A239D4525F84846B659CE726CE774082E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634125528, "uuid": "961b5f5b-e996-4ee3-8fc4-2ff10723c77a", "value": "12288:5ldyB2t1WmLflas6GbQejEUmpXOSTgMwO6hA2t5PHfOS0bZaFBS0GC0mn:5ldykTWuNKGsewtpeSTgMQhnHvfOVn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634125528, "uuid": "d2a6e4f8-465f-453c-bf7d-36a75b7fd4eb", "value": 615040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634125528, "uuid": "2bb17ac4-ab5b-433c-8bd6-fb548f659b0e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634125528, "uuid": "0cf8520a-1563-4376-8326-fdc7a2c6ce75", "value": "Invoice-472573_20211011.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430a11ab-2c47-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634144512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144512, "uuid": "3f19e742-b9b0-44ab-858a-595d89d9e9eb", "comment": "Malware payload (RedLineStealer)", "value": "73eee22caa82703b83d723e7d7d39b58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144512, "uuid": "9f1d7bd3-27e1-4e13-8af4-7c07f126050b", "comment": "Malware payload (RedLineStealer)", "value": "caa7a6a68440a7f3420edd91744375464ccf8ef890fc93ce6e21ac7cf336fc27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144512, "uuid": "6a30955e-24ed-48e2-82c6-64c547b8b10b", "comment": "Malware payload (RedLineStealer)", "value": "f9d77a8d282f7b778d5400ab7d61cac7ffa22cc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144512, "uuid": "e015dc21-7103-4a8a-ac56-591ad4ec3e43", "comment": "Malware payload (RedLineStealer)", "value": "1a9eddbe74dfa9c4d8dc72564a458d3b0e12df45ff2d411a4edc355d0feb578a7a5f953b5f78d617e665bf564da69ae6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144512, "uuid": "cf436328-59d8-4229-b60c-0e0fbef8d094", "value": "T1C984AE10A7A0C034F5F356F44AB9A278A93E7EA1AB2494CF53D516EE5734AD1EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144512, "uuid": "3f6d668c-940c-4b49-a6f3-f3eedc47d870", "value": "e97201e7ef5f430ebcbaea94835aaebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144512, "uuid": "6bafcda1-eb0b-4ce7-84c6-109ce2d2fb86", "value": "6144:GL5+jX1LXJSBqf+6rfZkxzyvzJkNnydSAJFfrZOhY8cv7uQ9T:M5+jX1bJSBojZ6zyb6nyPFflBjqOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634144512, "uuid": "e7bb97d7-c041-4cc8-9315-f1a1aa650381", "value": 393728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634144512, "uuid": "6ff70950-59fb-4f67-9e58-efdb89bc5f4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144512, "uuid": "389adbfb-d361-43ea-b29c-7a7e8897088c", "value": "73eee22caa82703b83d723e7d7d39b58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12bb1fbf-2bc6-11ec-843c-42010a9c0014", "comment": "Malware payload (Cerberus)", "timestamp": 1634089025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089025, "uuid": "d3414d3a-05f8-49ae-8047-18d71ddddf22", "comment": "Malware payload (Cerberus)", "value": "6f13f461fe2814056f907341fa16ec58", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089025, "uuid": "f58d047c-ae60-48aa-88f2-931ebc080c8f", "comment": "Malware payload (Cerberus)", "value": "cb6a1451efb23dd95bfbe11da3019ad34105ef34572cc0e734dfe1b5ef05c07b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089025, "uuid": "1701c1fa-acee-4de1-9092-fc860f6ca5ba", "comment": "Malware payload (Cerberus)", "value": "53c176d8c7571c79c9fa3b828d75e6876ba9a7cb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089025, "uuid": "e5d77590-5e83-4a0f-a9af-0d0f43324f99", "comment": "Malware payload (Cerberus)", "value": "7ea9497aed7a5e20dd35fc4769b65037d19da7754636b1ade21172e686dfc193c9bd1cdea79e33a147cfa47c69db67a9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634089025, "uuid": "f838e06a-dc16-478d-87ae-e6d382020819", "value": "T10FC522D906C29CF9D175AD31934374B2B9311A2066F2E56B1A7378B0BFB3A34850DEB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634089025, "uuid": "9e0cefe2-a219-4164-8d70-641996a7acb1", "value": "49152:7jfKzEXM5kU4xKMc0ewjoZlAG6udDW0kOgcG1Rp8FgvO8t5w526z+GmgJFB:7jS0MyU4xHcjRlAG3kOgcubyOxw526Ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634089025, "uuid": "1a4793f0-85a0-438c-baa4-765a1633dec9", "value": 2710981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634089025, "uuid": "83917504-3a90-40bc-bb51-3eece506e390", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634089025, "uuid": "871a670c-800a-444f-8025-25acc77d65e6", "value": "Android_G\u00fcncelleme.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716171ca-2c47-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634144589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144589, "uuid": "5f467d8c-11a2-49a9-82b2-2a4c4f5a7053", "comment": "Malware payload", "value": "c56a968b07d7d5d1434469830fddc34b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144589, "uuid": "1b377c0d-371d-45b6-87e2-e62093731629", "comment": "Malware payload", "value": "cb92c0fb6ce7b6b801d66ffae90230268d57b81cd2a67faa7b7d9e787367a236", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144589, "uuid": "496a5747-018f-441b-a0a3-3e0a566ed913", "comment": "Malware payload", "value": "2b459af8d40ca0147c4317e2f8b9fdda8fbc83b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144589, "uuid": "5ca021e7-923f-4df6-80cd-b63b3c46626a", "comment": "Malware payload", "value": "804f8460b04962b898d8a7a62a2354f44a7ab690723e62420b4bb4b99c81bc1a71807320f47d4d6438200c5e9671a22a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144589, "uuid": "be0720aa-ff83-4102-a00e-ad81bc15b405", "value": "T12A6533385930A826FD7DED730FDA0F1B99E625039DAF8FBCB13614487A52A24E538C45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144589, "uuid": "6b8ae603-1af1-4c24-aa8c-5852afd13917", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144589, "uuid": "8e88e72c-ad8b-413c-a7d9-65360fc3e8fb", "value": "24576:WvDwpdQoTHd1D6Ry4KMrIe6I+6658uTEchZ/6huXspOJlQJ6Gf+CpqFeDRARGo:6MISHAxrWI+6M8yPZ8ucVzmbkcGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634144589, "uuid": "2b6d2419-1895-4e31-b6a4-507c97f01d24", "value": 1504162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634144589, "uuid": "e5db3ee9-32c5-401e-ac86-f65dfa4f3afe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144589, "uuid": "829f669b-9361-44fc-bb56-11c4432f5ff5", "value": "c56a968b07d7d5d1434469830fddc34b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93806e8a-2c11-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634121454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121454, "uuid": "80c96544-87cd-4b2e-b38b-d3a559a67ee0", "comment": "Malware payload (GuLoader)", "value": "18b804e21a3c1c80c195e7d20dc38477", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121454, "uuid": "4ca32001-6747-4a80-9bb9-902c92da8b20", "comment": "Malware payload (GuLoader)", "value": "cbc14388711803d5a3f90396d4d33c9b3da952c37a5d919daed329cbd487c1b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121454, "uuid": "cfb39f20-31a5-4a42-be51-48ba7845bd0b", "comment": "Malware payload (GuLoader)", "value": "9622e70cd6db56de3488e99cd18c5f51e54afb64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121454, "uuid": "dd0cd1aa-59e6-407f-b742-aa14d40f6edf", "comment": "Malware payload (GuLoader)", "value": "866bd163353c8331830b84d31942bbd9da6ddd637691bb89a60806c9c10bccb4f648ba192b70d226770aa59af3790588", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634121454, "uuid": "6e958b0e-9e86-4bfc-b42b-200db5d6b40f", "value": "T124A35AC2A6AC9C70E4415EFD23FF999B0B1D7C7358898E0B7285674AD4727C67AA1303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634121454, "uuid": "39ff7f7d-218e-4037-98ac-1ad81453cd1d", "value": "669316531b5190f02843878b6ed87394", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634121454, "uuid": "e1d32138-4311-486d-94fd-941f4027d9dc", "value": "1536:tfD8AJkfjAx20HgXeyTftunugia21jbnD:tfeUxxAZnn/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634121454, "uuid": "a608d821-d05c-407f-b9b6-56f7aea37978", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634121454, "uuid": "db9f4507-ea32-4cf0-81b6-e5dcce2477d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634121454, "uuid": "b4a41cb4-a682-40b7-bc52-ca341e5fa87b", "value": "Fra FAC-ES101-2107-03806.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f335fb4-2c22-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634128560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634128560, "uuid": "372e33e1-b0fa-494e-8c49-47d905a832e4", "comment": "Malware payload (RemcosRAT)", "value": "9a4a9d682fddc146aa06e1cdd219e327", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634128560, "uuid": "cf22fa46-a509-4ffe-b881-0bfc93f3fa08", "comment": "Malware payload (RemcosRAT)", "value": "ccb0fe176ccf912558df42da5bb35828110c18c00c4181d063a2b8c942c7504c", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634128560, "uuid": "8040cbaa-fe05-4508-96fc-e3163857a3f5", "comment": "Malware payload (RemcosRAT)", "value": "448812b5f944f4d77fe985bc2cc7fc7acca2f2ee", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634128560, "uuid": "2a2e97e9-e7f3-478b-b749-6429aa2ea419", "comment": "Malware payload (RemcosRAT)", "value": "a33351832e1899d27c16ad347a4d3e9667abe230e9bdd1563f0385060514f3366cb5d24510fda0cc43bb6e049af68d46", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634128560, "uuid": "25eaaa07-008b-49e8-a85c-49be6797553c", "value": "T1D8758D65AAF60C33D17226347D9B8AA8593AFF002D74B5817AF51C0CFF79711392A4E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634128560, "uuid": "8de12b29-ab91-4377-9d62-cb906ff70e47", "value": "12288:vp+vmyY9beSkj77NADGFvGq+EOvLkOUvIVPJvC+0yRK2urqoXkmsdr64lprmi:vMO3g13Wih+kOzPJp/FolKrRpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634128560, "uuid": "1468197a-341f-4656-8915-0857a7b34573", "value": 1572864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634128560, "uuid": "77ad8a8a-06fe-4288-8d4a-8b8ae12372cd", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634128560, "uuid": "65e547cc-4996-456b-9d08-1b0ca320412f", "value": "Attachment.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af79ba27-2bf2-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634108186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108186, "uuid": "e318eaa0-eb9a-4779-bba1-6b6275b1f7a0", "comment": "Malware payload (SnakeKeylogger)", "value": "d7a7133373f9654cc99466bc9fc7d252", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108186, "uuid": "af109265-2ed7-4d48-befe-638f1d7b9982", "comment": "Malware payload (SnakeKeylogger)", "value": "ccbb5d2bd28fcbccadef533444c991c63d28d9934dc4263b330c4517a47b1248", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108186, "uuid": "ea2be8ed-f9a8-4083-9dfc-8c655fa02d22", "comment": "Malware payload (SnakeKeylogger)", "value": "78eeb531e9988822166cae6955f029525d49ca1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108186, "uuid": "ddd0a150-2dd1-4e8a-9569-e31190241e46", "comment": "Malware payload (SnakeKeylogger)", "value": "8a258aa85d2b6d52994f5c4598fff9c92af4327bfa2941c429febc2a3236eed39215a5ae3945fff980df501cf3cec4fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108186, "uuid": "89c4da83-3358-48bd-8025-4a3185efb7d4", "value": "T18DE4D72C3B414A72ED1D8AB04F29DE04FB661F83624C6D92F7EB25CA872F0576D45CA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108186, "uuid": "3e293f21-6d2c-4a4f-ad47-f61a2c1ccd63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108186, "uuid": "fd736ada-c3a5-4e5f-8173-8a8e7169f512", "value": "12288:vNJCHsfSCPhqBCBlvADb+taluBd3X3uIIIkIxV0DT:FSCJuCrYDCtJBd3X3B+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108186, "uuid": "a92a7e86-e346-46f0-b511-0358ce02a18d", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108186, "uuid": "f474ee98-e4d4-4d24-bd99-cdea9c09bdb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108186, "uuid": "f039366e-b833-41db-8bda-206370aab8ce", "value": "BTL_01145120_160850IMG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86725d4a-2c41-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634142048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142048, "uuid": "7d82eabc-a2f1-48fe-8a41-5750ba27b47f", "comment": "Malware payload (Dridex)", "value": "fddd5965364792568919cdf03a75f6e0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142048, "uuid": "f2cdcb0f-6123-4ba9-aef0-48c46ee9dc2a", "comment": "Malware payload (Dridex)", "value": "ccc3dbe6e59089f3f31ceca66125cf024ae13c583275474e50af07788eafd89d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142048, "uuid": "b23270c3-95a4-4743-9a63-83c2468db305", "comment": "Malware payload (Dridex)", "value": "682337c26641044580584720f3cc82cb8deae2c4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634142048, "uuid": "5dfc51c1-f99f-47b2-92bf-b83309f8ce37", "comment": "Malware payload (Dridex)", "value": "c67e37633d25fa656b31bb24edeb563e635417925b62222d6f01a05e296961a32670818f689e33710e993ee0a90f45a1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142048, "uuid": "dc693cb7-00c8-4ae4-ba57-de7af51205c2", "value": "T13BD4F8013A54E821E7E955B6CF2AC6E85B183D49EFB0A4C778E17F0F2AA94F3D215305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142048, "uuid": "e9d85f49-dc0c-4cf8-bfd4-d7b1cd2e11d9", "value": "0bdeed4a70b8b1fd5924130bfe75d8bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142048, "uuid": "d3747c81-e267-449e-9bb2-73325cdf9c92", "value": "12288:kuIBuwwMtjp4CqwqyaXPLAfx38TW9DiWUT2tq017JGoLbVW/:72b4wqyaDA5sTWiXT2tq07G2s/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634142048, "uuid": "6d754b5e-a5a0-41a1-9690-e4a9a93a9eba", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634142048, "uuid": "76d375ac-be13-4f00-a97c-29e410d5a6a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634142048, "uuid": "38f6b89f-9d74-420f-89ba-e25fbfc7f059", "value": "SecuriteInfo.com.ML.PE-A.4403.17165", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba524bf-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634108744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108744, "uuid": "6385c289-e0cc-4aab-b4ae-77373737a9f6", "comment": "Malware payload (AgentTesla)", "value": "141c83addbfb33e4869c7f7a384ac0d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108744, "uuid": "563dd551-d841-485f-a359-903133fa9869", "comment": "Malware payload (AgentTesla)", "value": "cd3bb572b0caf1a700c8c68c6d2638680345ec0f87fbe8024b60d3e405d6561d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108744, "uuid": "28a1a792-7191-4e70-a438-3b37d481dbb4", "comment": "Malware payload (AgentTesla)", "value": "1c413434a2d683dd6ab06c2b0b95eea58639731c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108744, "uuid": "b3aa5124-542d-4362-b978-a4286484fb50", "comment": "Malware payload (AgentTesla)", "value": "47fc853804fe0c18e697dc7026aa7abb110089bb4cf58e9e253eb6a5b694fa41bf41fdf5d7e3132a0d51ee45e2720540", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108744, "uuid": "2abca3bb-1acf-4375-bef6-5da48b6bb694", "value": "T1E3255DF5A13AA98AC7FDBE75BE200D90DD8B2A3745651188CFE23FCA101B1944F5B19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108744, "uuid": "9e3dd9f9-26e4-4ca8-8bce-184b41f1aab0", "value": "12288:KoUOHKWg5pj3lnY0hES5k79BA95e0Mp6IFsgJinHI0:Kovqj60hqDAK0rImgJino0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108744, "uuid": "f2a8a9e0-dba0-4726-a30e-d6882231ee1e", "value": 986311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108744, "uuid": "f9436cc5-c058-4850-9782-27ad08e7e88e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108744, "uuid": "6f5fb21e-67cc-4425-9b2f-b8887eb42727", "value": "ORDER.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5ee2cd-2c64-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634157036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157036, "uuid": "f9c0339e-d56c-4372-abdd-044fcef01c62", "comment": "Malware payload (AgentTesla)", "value": "60d8531f38c9598f5b3a2565c8936f79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157036, "uuid": "2bd99138-6c0a-436c-bc2d-72271e9de64f", "comment": "Malware payload (AgentTesla)", "value": "cd51276527ead66df8ac554cc4706bcb5defcaa66b75832f4fb40090c141b1ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157036, "uuid": "a66ba660-af63-437c-9c00-9cbf730f3514", "comment": "Malware payload (AgentTesla)", "value": "0895a4a1dfe1b130b12ac21002c5929b10df0238", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157036, "uuid": "8ef652cd-a618-4fe9-a140-ba21b39794ef", "comment": "Malware payload (AgentTesla)", "value": "6c7b1fed7e8e272f36b34a3d9c68541009f653d762809d45f6ec00cabb427897e99f20b5290d96465ffc71e06b34289b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157036, "uuid": "3deeb643-9983-4419-b94f-ab344733712c", "value": "T1A245CF647F89D84AF36A98785271DF44C73E664B3713C625E9BF507A93A8B803CC2187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157036, "uuid": "4d3c3ae8-74b4-43e5-b5aa-07b95c5cdec7", "value": "12288:Vt7WyuqDnhdETTtplYjEELNxMd9/rFf8OqAtPkSBY6:/qeTEFplYgKNSrFfWgP5BY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634157036, "uuid": "f4411173-90c5-43f8-9f33-318b3ba98bc5", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634157036, "uuid": "fb2506d1-af16-4a24-9e23-dc76a877c649", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157036, "uuid": "81dd8d6b-2e5c-43ed-86ef-c50aa86d2d76", "value": "Payment swift Copy.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "644a91ae-2bf4-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634108919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108919, "uuid": "07a0a207-9ccd-4c74-bd52-cc74fa99e75d", "comment": "Malware payload (SnakeKeylogger)", "value": "0b39d52ca205c00f34fed4d203f7bfdc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108919, "uuid": "e4e3f657-c69f-4303-a36e-73a87f7d0a83", "comment": "Malware payload (SnakeKeylogger)", "value": "ce60b3120e2869e59414abee55e658fde0f214ed18a8f29dfe09e855d59cc0fd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108919, "uuid": "a2270f6e-89e3-470d-974d-5ee3b53167fa", "comment": "Malware payload (SnakeKeylogger)", "value": "caa72e9c4efc7647f14b9b69510f59a22d93a40e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108919, "uuid": "4b23b2d9-f787-4e2f-b8da-e008c5742114", "comment": "Malware payload (SnakeKeylogger)", "value": "d198786b4b259f69adebd537fea5575f01346a83ab027afc918e2d5285fb98167e9857a88c6c02621b3d84dbbc7e1334", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108919, "uuid": "11054b92-04aa-43d6-b656-ff7fb9a2081b", "value": "T1CAD42393B1D4DF9BE41B6A391CC3D09C7E18FC886E5DD20B3A55BB4B4EB97368102819", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108919, "uuid": "f1b4cfb1-26c9-4d2b-aaa7-0a1d5bb5f19b", "value": "12288:8bqTtukI4DLk+N76BI7G+eDYYQgc6gID6ijVAm5vbZ82NHKLtO2:MmukI6Y+N7uDgl6gI9VAm5vzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108919, "uuid": "80d4a050-a979-4896-b1ad-03d4989afdbd", "value": 644096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108919, "uuid": "40f3bd91-03c6-4b47-a7a5-d13be968280e", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108919, "uuid": "554e1c11-d644-4324-b177-c11927628a34", "value": "company-profile.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754d1616-2c64-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634157051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157051, "uuid": "1b3e99fe-ff0d-4d29-947b-bac7e386c79f", "comment": "Malware payload (AgentTesla)", "value": "04fbd3307b19c80a10503643a249aab9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157051, "uuid": "b1545872-1049-4f5c-bdbc-a75d211f8d91", "comment": "Malware payload (AgentTesla)", "value": "ced91b0b65e08e9ace9d074af2abce84acafc42f69ce1e9905f08a6d85cb6b8b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157051, "uuid": "b6355936-a96b-450f-b9af-a350802633bb", "comment": "Malware payload (AgentTesla)", "value": "87975712b67d94cffd538c577db637e033d54223", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157051, "uuid": "c8b12458-da29-4b2a-bfb3-31ba76678a44", "comment": "Malware payload (AgentTesla)", "value": "12e5f4b128b70b94643373ba83e77f4f47e4bca3d638fc01a9990bae5c10684518f0bb5a239bed4e6c64c997b2b42ff9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157051, "uuid": "1fb267c8-ffce-414b-a7ad-0abd8ca1344b", "value": "T109B4CF647F89D84EF36A98785271DF44C73E664B3713C629D9BF507A92A8B803CC2187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157051, "uuid": "bd236bdc-2ff6-466c-bc13-00e072e2995f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157051, "uuid": "5912b4b2-87ba-400d-9da4-4ae0b5d2c854", "value": "12288:kt7WyuqDnhdETTtplYjEELNxMd9/rFf8OqAtPkSBY6:iqeTEFplYgKNSrFfWgP5BY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634157051, "uuid": "240ae6c8-f6b4-49cc-b4e6-7ce53fe4df5e", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634157051, "uuid": "4b3c4b4a-5c71-48eb-af6a-41947ca0dee5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157051, "uuid": "9bd54801-9a52-46fe-96a9-55f6ce546db2", "value": "PAYMENT_.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33274c46-2bec-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634105401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105401, "uuid": "d94d08fa-0a9c-4d04-9678-4ee063ce4bdb", "comment": "Malware payload (AgentTesla)", "value": "a5abf03e9e99a3055969d8488ca0a613", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105401, "uuid": "519b5c26-fc7f-479d-b3c4-516e288a5ddd", "comment": "Malware payload (AgentTesla)", "value": "cefe91603b281c1225e6b91f0b5c142734a8a5c961ce2d890ed5d724a21fefd6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105401, "uuid": "2ebcd649-8336-4ec6-a0f3-cd8dfd2ea82b", "comment": "Malware payload (AgentTesla)", "value": "d63f25ade0ca19af2c61b4bab284600148ca32ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105401, "uuid": "9642b1f8-1e76-49a4-ad90-5156f0308d56", "comment": "Malware payload (AgentTesla)", "value": "b2cdfd8eaa389dc94cde5c7ffc80c348deb9bd1840b4f468ce61ba0cc4074aa6cb5ce8edd74d2e7ad49efe8e1fd104da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105401, "uuid": "4087338d-98b0-4a45-88d8-2137f9f0884e", "value": "T1F3C4126623B49B21EEF7BFF119A21A209B70BF775602F7085D9820E61927F20F514747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105401, "uuid": "6226c0b7-b461-4a25-bfa9-f6750ecc810b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105401, "uuid": "11a61acd-0874-43c4-90b0-b7e3815a5104", "value": "12288:1WkciN5mYXx3y/LCipNPJQnNOwNk+uET8RIv9DHtAZvzFKUYSB:MvVYX1y2WPSNOwNk+5SIhaZvBKOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634105401, "uuid": "8a9e9246-2fd3-4448-b82d-ce67203be44d", "value": 584192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634105401, "uuid": "e6d833a2-1497-493a-b4ab-6ff8b6d4f136", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105401, "uuid": "e67acdb9-1320-4294-8058-0e407b0f0a5d", "value": "AWB 94000302-2391.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0d3c7e-2c28-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634131404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131404, "uuid": "b8a3e628-5521-4b93-9bfc-9b545c1c9300", "comment": "Malware payload (Mirai)", "value": "57975f880eb67f9e92c44e16cd5db01e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131404, "uuid": "ca249b53-364a-4998-a812-f11d9e281e1a", "comment": "Malware payload (Mirai)", "value": "cf35485e6034ddfc4fa6080be70bb456ef485bc5437c1e2708ce625605f65778", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131404, "uuid": "19c63fd2-d758-44cb-a659-72809b019408", "comment": "Malware payload (Mirai)", "value": "b40ff9dbff79ee1a9ef3f9bb22900b9717379c82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131404, "uuid": "d0768cda-471c-4f31-9fff-016bf1c171c9", "comment": "Malware payload (Mirai)", "value": "fdec3f983d94c130c9b10508435a58fc26c2e0998dbc0c78201edbcab275b99053f5105c06c2e2d2dc4968ff82a75ba0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131404, "uuid": "0e0e3924-3638-4461-afd3-ee22405d430e", "value": "T1D5C3E631F904471BC2C223FAE25E829E3F321EAB57DB33116A3879B45FE27891E65514", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131404, "uuid": "82b25a27-c3ab-433e-beb1-161732461b3e", "value": "3072:JjZ6xke53ppbPOpAlbahRviCXm7/L7QsvmGfIiNb:f4n3p1KAlbaNm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634131404, "uuid": "5cee8aaf-bce6-4862-be8c-0aae78113a72", "value": 125848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634131404, "uuid": "e982caf4-a60e-477f-9411-5fe87d44bd7a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131404, "uuid": "bc704e12-eee4-401f-8d63-f524d4361085", "value": "57975f880eb67f9e92c44e16cd5db01e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290a3411-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634108390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108390, "uuid": "d792721a-4b8a-48af-8dc2-6f0a5d261d6b", "comment": "Malware payload (Loki)", "value": "ceaf13a6a1bb9912acf2116258d8a82d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108390, "uuid": "0eaafbd8-c4f2-485b-8c8c-60f5b9927d52", "comment": "Malware payload (Loki)", "value": "cf5ad7f0cf2c90201ad374d43e9b7f3f28d3c12e56cc1cadae242ee3452ddbc6", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108390, "uuid": "e40f80ee-64bf-4719-b29a-6a95c18b20c2", "comment": "Malware payload (Loki)", "value": "20374c094dcd633dda324ad46c2488ec59532051", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108390, "uuid": "79c3ab73-f058-4bd6-aa42-99a701173f21", "comment": "Malware payload (Loki)", "value": "0ed7619842712cbea892da213d3148668dd8ae065eebc1d81a065978240f68a788d21a5bedd356f7fdd631b055b7ee36", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108390, "uuid": "5ea2bda4-759c-49e8-8d2d-693403c0c7ea", "value": "T1B0C4F23F33F7AB2EC21B01F4E634BDD5010A8EA20D64A945D88AB2F92DF566C5C950F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108390, "uuid": "0d5584a5-4c1e-419c-8dec-78822e4d56a7", "value": "12288:kmI0Da5WU1UVjjo22v+jYYYYYYUezYYYYY0yu2SX3SVAs14KTg4K2uRW5i2J:kz0Da5WUwjo22vD6h2T14KTgfv2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108390, "uuid": "eb19fd69-b68d-491b-a5aa-5fe50a372e65", "value": 586504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108390, "uuid": "2c93374f-01ac-464b-8d3b-3e7cba993d11", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108390, "uuid": "84002e91-87b1-4633-9d42-9d20906c4209", "value": "Invoice Charge.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47330f0c-2c47-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1634144519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144519, "uuid": "bcc475c3-17c2-4449-bf23-27943efc10a6", "comment": "Malware payload (TrickBot)", "value": "3f9d3887c264de95fd0382767efdb56a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144519, "uuid": "0ef841cd-54a5-4265-ae94-800bf48b69bf", "comment": "Malware payload (TrickBot)", "value": "d1461a019fd382d8790a0ff43d259b631ceaa0d2c9e314a450302c53c2b842c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144519, "uuid": "42a7990a-f4de-46e7-b3d0-0bc80cafee50", "comment": "Malware payload (TrickBot)", "value": "b3ff13e06692a326bf9ea52b834db81845883fa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144519, "uuid": "34f72c06-b72a-4119-bfa3-6cc79cb6d2cc", "comment": "Malware payload (TrickBot)", "value": "3ccd8deed57eed138568af9714b80bc6f5f2b6e72f30332c74edee580870c0fc2b3c5fcc8e3e8825db76ebe94dd933ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144519, "uuid": "17e1bc87-9c8a-463f-9014-aea85d06f5f6", "value": "T1DAC4BF273850DCF2D1012576C9A2A3F5AFAC76185FD3511BB3901B9ED9318A39E305EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144519, "uuid": "33670aed-a0bb-4538-8ee2-bbb9a35a32ad", "value": "ffc20f0bbd3f72a6061b1c2845bbf7b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144519, "uuid": "3b96a312-dc3b-43a1-be8e-4641a67431c2", "value": "6144:lJsQ8zcWR976/wrs+zmrY6v9w25rcv4hUhYjSUkPp5DIbT6oweUis:bvOR976Ea5lZAv6hjA/cMVis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634144519, "uuid": "92779028-e3db-4f17-93ef-df1874bd263f", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634144519, "uuid": "be003ecf-1b6d-4973-9103-166e6e765453", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144519, "uuid": "fc4e5da0-790b-42d7-b6ad-0d3af9c1fc40", "value": "3f9d3887c264de95fd0382767efdb56a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564e514a-2c47-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634144544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144544, "uuid": "85482998-c0b9-45ae-afe1-fa7bd168f9ec", "comment": "Malware payload (Smoke Loader)", "value": "21fbb712aab6d4e991d123a1e9c0cedf", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144544, "uuid": "0d4a6b1b-5174-43a8-b355-2c4dbafe3fd2", "comment": "Malware payload (Smoke Loader)", "value": "d3184ceae376a789ccd61e767da3f21cacd72dfc7162a5e1a9569c7244d0bf9a", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144544, "uuid": "e5f19297-0009-49b8-968f-783b76544de4", "comment": "Malware payload (Smoke Loader)", "value": "127cba0dbc74422e00f431f42a2713cf108b9cb4", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144544, "uuid": "deb6d95d-f576-4655-aaa6-0cfaca757a78", "comment": "Malware payload (Smoke Loader)", "value": "95fb503e0f8bea4028b6d4692793617455fef4eeee07187c64e2bdfdbb0d6b6b11486472bdbf18c4a018436c30ca8434", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144544, "uuid": "5305bb2e-17af-40f1-8211-df7628a05308", "value": "T198647D10A7E0C039F5F356F949BA936CA93E79A1AB2491CF52C516EE4734AD1EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144544, "uuid": "eda1e287-42c3-4dd4-8b7a-be3de400c836", "value": "e97201e7ef5f430ebcbaea94835aaebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144544, "uuid": "6f482f83-826e-475e-b56f-fb760c95a899", "value": "6144:zdQzaOOFHl77D3MB97YdnmnO+TvR46BvYUfHyZAdeJwxiVpvowz9eIWjXqqkarN/:zdQzlOF7F2TxcpAn5ada", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634144544, "uuid": "acfc8152-a966-42c7-869a-0d9244e90a1a", "value": 318464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634144544, "uuid": "1f4623dd-a307-4656-82ee-ba234a08fdcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144544, "uuid": "633b09b1-5e90-42ae-9447-109fb356aafe", "value": "21fbb712aab6d4e991d123a1e9c0cedf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be828837-2c70-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634162328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162328, "uuid": "0537db21-9bbd-4de9-8fac-c24dad65a48e", "comment": "Malware payload (Gafgyt)", "value": "19c652797b9ab861d57790c37550c21a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162328, "uuid": "e2b26065-cd09-41e8-afd4-7e6d2c4ef1d1", "comment": "Malware payload (Gafgyt)", "value": "d32f9e5c6d70f6a0dfa92f5e4ebe2d28afcb79e336f37215adae62770324310d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162328, "uuid": "cd4e116d-dda2-4b14-a95d-07177d07bb51", "comment": "Malware payload (Gafgyt)", "value": "272deb3b27bf5ef63cecb74a55f4e328399df66c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162328, "uuid": "a5027c5b-33b0-44df-89b2-862b28be61da", "comment": "Malware payload (Gafgyt)", "value": "b2606e80816059046dafb3106d74ff9f8c561993c2da935137c8d82fac82cd63d108ad9c713a131605325b700bd0cc4b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162328, "uuid": "19905d15-5964-4617-9466-4d9db2603ed4", "value": "T148934A17B653C6BAC0874BF41BDB9A314923B8BD0B227206B3D4BCE67F165A61D19F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162328, "uuid": "946596c3-739a-426c-aea8-31c973b92dd1", "value": "1536:p7rHXokXsWFVSzkfLEkZAT5ipG5v3SphauH/SPNlDDUg6I9um2Xj5YZb0e:pcCPOkfQfNipGdSphaE/AVog99um2XFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634162328, "uuid": "09a6b68d-412a-4ef2-882e-659b17ef5039", "value": 94012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634162328, "uuid": "4cff3758-3bbf-4601-852e-42f3f5ec0d1a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162328, "uuid": "00451a4e-e53a-4f5f-82ce-c20d3d49f9e2", "value": "19c652797b9ab861d57790c37550c21a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02452c99-2c70-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634162012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162012, "uuid": "e44028f0-39de-410b-90a6-ecdb0d21a0e6", "comment": "Malware payload (Mirai)", "value": "17adf00b0be6847887074f099fc88ab8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162012, "uuid": "db07705f-452b-4592-92cc-0e2c5187140f", "comment": "Malware payload (Mirai)", "value": "d3332e5362886d6f0dc5c01994597ebb977dc62fba2d2843409c258d847d1e2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162012, "uuid": "52d116b8-3974-4763-99e9-a80d3ef171c8", "comment": "Malware payload (Mirai)", "value": "de31168fad40c6cb14ac31efb2546bd9011bdd72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162012, "uuid": "43450526-c917-448e-9894-e9af7bdc3df9", "comment": "Malware payload (Mirai)", "value": "5405b3e2b4f7c60a6c1f0cba9004cf8967c757672ffc6a57f7cf7270303d5ec97187ac72deb0bbeec54d3b77c9363ce7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162012, "uuid": "b521085a-ce26-4215-b89c-64f9658cd58c", "value": "T1E9C2E0DFB49639C5CD1D5CBC618C56D115A9A2C7234BDF0837202DCDA9B644EB8AC8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162012, "uuid": "43504deb-ef3f-4bfe-a0cd-75f7f8a5fa63", "value": "768:MuCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdB6Wr:5CrJgHiOJrfwmQrctb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634162012, "uuid": "d322ebc4-bb2b-4cee-b9ae-de51fb264a0a", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634162012, "uuid": "a3846fcf-151e-45d7-879f-f0e54f1dc26c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162012, "uuid": "b7bf8f7d-1e99-4b28-a442-c6b7ea0af967", "value": "17adf00b0be6847887074f099fc88ab8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c3c1f1-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634108378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108378, "uuid": "91e74eaa-6aeb-4d47-95e1-19c605a69dcf", "comment": "Malware payload (AgentTesla)", "value": "b24cc76098fd1ecd0b8d4ec34123084e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108378, "uuid": "ad730e56-8944-46d2-8486-6683985f5fce", "comment": "Malware payload (AgentTesla)", "value": "d4eee88b95366d3b6f77ba4da420024e82d970e182572a685e1524c538839cf2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108378, "uuid": "e07adcf1-adb8-455c-9910-10a30387138f", "comment": "Malware payload (AgentTesla)", "value": "3de9c3d03e5e1e4a4522d38b56313553734001bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108378, "uuid": "d94d37a6-30d5-4f7b-9954-c5463495fc4e", "comment": "Malware payload (AgentTesla)", "value": "53ca708d72c1292cd0ffe9af950d7614ca7adab084af3ba50fb6c37bc6044563130b9174bf95de4deadd56b9198f2aa1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108378, "uuid": "915a2371-1ab1-454a-ae9c-d49d1302406a", "value": "T1B764C01EF4A38465C154A03155C8060472FB4FF98E9D3A2677F77AD8A43CB1CE2AA39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108378, "uuid": "7ee4d22b-7742-42f6-b9fc-8ab32577d8fd", "value": "6144:5B+3svUPkoDq90PLT/WajcdPK/2W4skCnzloowS6NpVjIWvMrEetTtLrzn9I:583s2koi0PLT/WTUZ4sZnzlodSeVj+z4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108378, "uuid": "93027dd7-2799-4781-a96c-84d97411e91c", "value": 328776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108378, "uuid": "d0e83a06-b9ae-416e-b1f9-ea017f6cfaf2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108378, "uuid": "c4a3ae30-71d6-443c-8c2c-17c7a2629d99", "value": "Order EQE0905.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be26f4b5-2c37-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634137846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137846, "uuid": "7c53f3fd-0621-4477-966b-1d61423e9754", "comment": "Malware payload (Quakbot)", "value": "f9e42e72adbbf0cafe2a8aa4bb3e5d77", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137846, "uuid": "261c1b19-7c9a-4ac4-bfa1-61070f9d114d", "comment": "Malware payload (Quakbot)", "value": "d544ee2366301fff7e81d09bc105f2cc92f2127d479900ff2b8d46262f8c13e4", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137846, "uuid": "3972fa15-a69f-4d80-929a-ea1601cb66f4", "comment": "Malware payload (Quakbot)", "value": "e68b0db061179479e6d671519aec579bceb326be", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137846, "uuid": "df8e744e-985f-402c-a772-bf7e7d7d45e8", "comment": "Malware payload (Quakbot)", "value": "59355519b0059b96556214b5236bc3946c325184e70395d1f10dcae6d356626f8572248b2fb4f7bd515eaa1482009806", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137846, "uuid": "dd8e0052-b1a3-41df-a2cb-e514e81763ef", "value": "T1A8D38C427797CA4BE54813398EE3CADB3772FC21DE62470336497B0E5E7A6A08C17652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137846, "uuid": "7371ca91-7b8a-49aa-9af6-dd244111bf89", "value": "3072:vk3hOdsylKlgxopeiBNhZFGzE+cL2kdA6c6YehWfGMtUHKGDbpmsii1GmZyAqgOb:vk3hOdsylKlgxopeiBNhZF+E+W2kdA6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137846, "uuid": "c19d04af-b820-467f-b060-4b342362d08a", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137846, "uuid": "f10698e4-3edc-4147-84da-2c57dd3389a4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137846, "uuid": "36eef2f8-2467-4577-9be4-478d54937daf", "value": "SecuriteInfo.com.Heur.17985.24014", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc364ed-2bda-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634097607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634097607, "uuid": "6a500638-02dd-4c57-8114-9310cede8097", "comment": "Malware payload (Mirai)", "value": "f213499e785773a32c4bee890718d625", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634097607, "uuid": "21245c0a-fa75-4370-a550-dc664b45b4bb", "comment": "Malware payload (Mirai)", "value": "d601462a78a24763ce0dd133cd7c2171f24e65d071632b086fd8a84c23abfa63", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634097607, "uuid": "54bfe58d-1a26-4135-8f46-bc8c8cb394b5", "comment": "Malware payload (Mirai)", "value": "ca26b350d6c69e90dd6f3422565e5af7c4523d47", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634097607, "uuid": "22541ae6-9060-4538-ba31-4834396f2892", "comment": "Malware payload (Mirai)", "value": "d0e3775fc41aa9d2815a65db6540d496a08a7f4671d3a4a7862a8af58d7e459bbe886e818b2d59aadd69557573355cf7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634097607, "uuid": "cb59d3ad-3446-4f22-b598-4d64fa0f74b0", "value": "T19733D795B8D25A2AC6E4237AF9AE40CE332073E8D1CF3217CD151B147AD592F0DA7B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634097607, "uuid": "db0a5ad4-8eb5-4fcb-bb44-360c2cd93e22", "value": "1536:S5Z4fJ6tL/yXFeL5zvL5nrHwcA7WhKpQY:S5ZIs5LL5nEcAihWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634097607, "uuid": "f6c9c87a-d6e4-4a82-a3e2-4077b8f5deac", "value": 51168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634097607, "uuid": "43cbe36c-b813-4f77-ab15-283ed08f059d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634097607, "uuid": "058d1b6a-0dd2-48d7-8456-6cf4bba235a0", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ee0e2f-2c51-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1634149103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149103, "uuid": "01c70a82-1adc-4267-87e7-1743e291df2d", "comment": "Malware payload (Vjw0rm)", "value": "ed1957ce99539019ee515eacc3fc2660", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149103, "uuid": "c5fae707-7502-4161-858a-89f89b2b5593", "comment": "Malware payload (Vjw0rm)", "value": "d6194c1048c3662b838132f3c112c13f01f83ade44f64bda3bfefb1e9297df5f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149103, "uuid": "e800aa29-043a-4dff-864e-34e3847e59ab", "comment": "Malware payload (Vjw0rm)", "value": "b5be73e11582d601693bd9c10225649e6797cf3a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149103, "uuid": "4ccbde75-a03c-4696-9a0d-fda1c974361b", "comment": "Malware payload (Vjw0rm)", "value": "2bf960cfd9218e57a70a38617779c229b03f161d8950405a3b94f750ff0ae51d06a779439e5660951cb980b1a6942a0b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149103, "uuid": "a0579d0a-928d-4c7c-965c-061254c80760", "value": "T196B24A9C3810B29AD174F224647EAED8ABF8131B941157CD3C2EB6408F32B50D6EEE5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149103, "uuid": "d6397635-c42c-49b0-a927-059f4ea36593", "value": "768:h+lwW99JDfU0KIgr20On+FibSiVOYsWfL2EHbaBfaXD:4ldzDf+S17bXVPsWfL2EYSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634149103, "uuid": "e5020684-7945-4b1e-9f17-6be5980b5a38", "value": 25414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634149103, "uuid": "747dcff9-5393-4e0f-9499-1b63bdc5aa73", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149103, "uuid": "ea9454ca-7878-430f-83f5-b85d5b91c0be", "value": "eReceipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "949ae7ec-2c64-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634157104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157104, "uuid": "c713ca6c-4879-44a2-b193-ef623101ff6e", "comment": "Malware payload (AgentTesla)", "value": "27d28a040b7c8f5a38fd8f00374e5e8a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157104, "uuid": "897eb19a-d3b5-4ee5-ae37-e5c70b642431", "comment": "Malware payload (AgentTesla)", "value": "d6ed5434acc201f9df6edb585fae1f9d2e01a5014da593ccdfdfbcd41981c9ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157104, "uuid": "6925a49d-9864-4867-8756-89dc7c7e6c43", "comment": "Malware payload (AgentTesla)", "value": "d3ef4bbaae7a43f0fbaac1a9078dd3a106c73962", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157104, "uuid": "39b87cef-20a5-45b0-a41d-1c98b2c45187", "comment": "Malware payload (AgentTesla)", "value": "f9f94633f4c318d455f0f24135917de9657bbba848d33fc6bedb2e555e8be99367e359511acf61d1d54255da738e10ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157104, "uuid": "1dd94997-9916-43f5-b049-bb13b892c582", "value": "T18145CF647F89D84AF36A98785271DF44C73E664B3713C625E9BF507A93A8B803CC2187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157104, "uuid": "aa9512ea-dba0-4452-b670-6995257a339d", "value": "12288:vt7WyuqDnhdETTtplYjEELNxMd9/rFf8OqAtPkSBY6:1qeTEFplYgKNSrFfWgP5BY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634157104, "uuid": "6314b1cd-88f3-4c78-9b3e-05abc8770402", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634157104, "uuid": "89d458c5-7ba3-4816-a91b-c1801d353f2f", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157104, "uuid": "3b345c57-ce04-42f6-8af0-e9f57529cbc7", "value": "Payment swift Copy.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d910770-2c5f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634154918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154918, "uuid": "537eb41f-d2dc-4412-a527-8e75cb809e11", "comment": "Malware payload", "value": "70f36562f58abbdf83212960f304d528", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154918, "uuid": "67bdcba5-96fc-44fb-b7cb-1e0bd5f69326", "comment": "Malware payload", "value": "d7480b9bc123f459d8bd1045f2e1d3b26867c39970290f3007d0b8b79cc1908d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154918, "uuid": "47532562-356b-465d-9983-63a03f5aaa22", "comment": "Malware payload", "value": "8448de6901e3aa62d9e6b2d59bfc7c2c9c4664b5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154918, "uuid": "57b2c63b-f662-437b-b047-8eb9315e7a37", "comment": "Malware payload", "value": "74ac12b15496317e0dfa2893a206cb9f460412e5c597c4c14b7a3368b43be3d03f25de014d909a510344000f3f649a10", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634154918, "uuid": "a17e3102-cc92-4a19-a80b-665b5115c341", "value": "T147C523E446819DBAD57D5D30638721A2FB702A21B7E6E56B0672B530BFB3B205109FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634154918, "uuid": "fb694fc6-b5ff-4d18-838c-777e6839db7e", "value": "49152:gcNuUEfxWM9GxhjSIQEAOCYMsSsb9wf8UkPW50SHVo/P77RBz/mE3tvf:gcEUDM0hjzQ6CkiGy0Oor7jP9vf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634154918, "uuid": "46aa8f9d-05f9-4490-9adf-53cdb1fad4d3", "value": 2727731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634154918, "uuid": "d8ee4783-627b-4382-99f3-77d861a70c1d", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634154918, "uuid": "83b52184-7cd4-4359-adbd-90da224bebe0", "value": "Android build_obf.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da67134-2c4d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634147214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147214, "uuid": "83d8b34f-7d8d-46b6-af23-36c0dda80a1a", "comment": "Malware payload (RedLineStealer)", "value": "ecb694bb378c4841b2ab63d3e96506d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147214, "uuid": "ef96dd9f-082a-4aa1-8e78-f47fd173b35c", "comment": "Malware payload (RedLineStealer)", "value": "d7b4b6a43396314d34f68e01bb1dd58a673c97519318f6dd67ee46acace6191e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147214, "uuid": "ea85f7ce-9f90-4ae7-919d-a5e62d9d6468", "comment": "Malware payload (RedLineStealer)", "value": "751a02f1e3d3267ea65e86482b9af535709f626f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147214, "uuid": "13fddedb-9399-4af1-8233-06c12c823f20", "comment": "Malware payload (RedLineStealer)", "value": "b5abe7288aa003e5f11a9fa978b0bdf4a2a9258d56a8df2e28dec25dfeb7275d9fb5723dcbaa7b865bbdea724cbb9146", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147214, "uuid": "104e6896-803b-4893-8f40-a0ad41434d30", "value": "T1C0F58B632588C92CE427693BE3AE42F6651F5D08CAB5463B5A8C3D87F7B744909C370E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147214, "uuid": "b1f81806-c939-4a8e-a80e-af65fa072d79", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147214, "uuid": "704c5844-c2ce-4863-9706-f40a2e410d2e", "value": "49152:cbLuaZUaBv0TkJ5OiaO7TH2kZ1NapeiVjt+omKUlGl8Nmlxa:4LFyw/OiHjLgeqh+oDD8Nmlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634147214, "uuid": "1d105b5f-590b-446c-b6c0-89b379354e89", "value": 3567616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634147214, "uuid": "345344dc-2809-4761-a622-289eed9e7b3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147214, "uuid": "ab40629e-9a15-4b30-897a-fab004e7b6b3", "value": "ecb694bb378c4841b2ab63d3e96506d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88715035-2bde-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634099531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099531, "uuid": "6308efa0-04c5-4817-95c5-fa6d55b12774", "comment": "Malware payload (Mirai)", "value": "bc980b8c15b503868384e55fcc81c1f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099531, "uuid": "457fefc4-bf6b-4f0f-88ce-4d2128c67b6c", "comment": "Malware payload (Mirai)", "value": "d7e367ea6f80adf671f6a3181f4ba640c8ae3cb89c74f9a05b48428322056df8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099531, "uuid": "7a232abc-660a-443d-bd38-9da7c89a234d", "comment": "Malware payload (Mirai)", "value": "0968a40af5e0a618158279734dd466f3c4b513f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099531, "uuid": "090ab83e-a677-400a-a805-bb689e8d902e", "comment": "Malware payload (Mirai)", "value": "a08d27b353feadf6bfdb8f5cbe71cd070fb1e91901c9c92798456554fcd58623c67d576b673f5fd6f01e1aadd3110d86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099531, "uuid": "557e12da-224e-4565-abb5-25bb573bc2df", "value": "T1CF73A70E6E259FBCFB9C823587B78F21965833D626E1C644D15CEA011EB034E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099531, "uuid": "3f801436-cc5b-451a-b70f-c5fefc9f1cab", "value": "1536:zoVvPLWTs7ys6XcniEyNMin3sDmTRdVSabdza3TTLbwXmP5W:zo5WTm6XouMk3sDmTvVSabQ3TTLbwXmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634099531, "uuid": "acdfddf4-5abe-43a4-9ae9-e1ced238199f", "value": 75976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634099531, "uuid": "38950959-7bee-4887-8437-9c4fa57ad29e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099531, "uuid": "90279d75-3aba-445f-a875-9b91a7e2d6c6", "value": "bc980b8c15b503868384e55fcc81c1f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f31cab5-2c66-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634157793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157793, "uuid": "59846174-939d-42db-85de-ab28ff4511b3", "comment": "Malware payload (Mirai)", "value": "70a29d71dac7eaf795c4d1cdec09006b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157793, "uuid": "5bc440a6-6e2b-4823-8a03-ebb0dca196c2", "comment": "Malware payload (Mirai)", "value": "d8b210b3f9f9afdf0661e2df487f0db3f1412de20d19c26a3250cd98d13d179e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157793, "uuid": "cfeab0b7-2bfa-40a0-819d-c122c9b2931d", "comment": "Malware payload (Mirai)", "value": "35841f4fa7f30935cba4ff52cf1047b4e942b82c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157793, "uuid": "c7f9e98a-c4be-4684-a9de-bed5856929be", "comment": "Malware payload (Mirai)", "value": "18986feee7736b1cafe68ac5b78b7d2145664a6fe8e4e014f63dcca543058d33b7df1298bf2d7c3c599d72f39233e715", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157793, "uuid": "025cda08-3ba0-4395-9cf7-4f1944364369", "value": "T1D1C2D1A0C21922EADEDFDD351C76EBD477B91F992B1AC9C162C1EB01030B6292714DEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157793, "uuid": "a1ebd92c-0dfb-4679-b712-a3736932c326", "value": "768:iq5kPIHL5JQN9kzDwhKc1qHYAhOtyjfIH4uVcqgw09O:UP6LHe9kgKTYSoyjwH4u+qgw09O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634157793, "uuid": "6b933eac-bd78-4929-b601-2392eb97f141", "value": 28120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634157793, "uuid": "b4409474-5246-4661-a1bf-02f341800d73", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157793, "uuid": "0ebc8144-63c8-44fd-884a-5cfefb7d93fe", "value": "70a29d71dac7eaf795c4d1cdec09006b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3bb7e94-2bf2-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634108193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108193, "uuid": "15069efd-531e-49ef-83ab-3b20aaa55aa2", "comment": "Malware payload (SnakeKeylogger)", "value": "ad8e64ec7e02965b3487caa1424e253e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108193, "uuid": "bce3c388-22b3-463f-a156-e29cfd9887e8", "comment": "Malware payload (SnakeKeylogger)", "value": "d8b2b725cb39a2286fe1f22afaf4968ae1a8f837dad52c48edd70ab83c1f345e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108193, "uuid": "0a36b7c2-ec23-4477-8cb4-25a3d291af3a", "comment": "Malware payload (SnakeKeylogger)", "value": "f8c6aaa2a36f3e539bc076b2d8c66ac23f735fba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108193, "uuid": "fadc0737-ebd5-4215-8b02-cf035c1fcfc2", "comment": "Malware payload (SnakeKeylogger)", "value": "9fcdf2e984cb1ec74f2f2936b8af148db533a26b70255e8c4812c90fc18f350cab7a462a073074b65e62a147ce3d8976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108193, "uuid": "8489b816-ef29-4f6a-94dc-a056369d06a5", "value": "T158E4C52C3B414E72ED1D8AB04729DE28FB561FC3224C5D91F7EB29C8971E1B72D448A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108193, "uuid": "552fdccc-75c3-4e09-b848-8f98fdee1f85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108193, "uuid": "29f0b312-37b3-45ec-bd49-21b618d045ba", "value": "12288:CmkIvSuxojv2F4a8xyRDfTDmuBd3X3uIIIkIxV0DT:hkfj2dRDf1Bd3X3B+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108193, "uuid": "8227e5db-fa8e-4ddb-a796-01bd8b385301", "value": 681472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108193, "uuid": "06be206e-ad27-46b4-9654-ad09723ceed1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108193, "uuid": "16387888-880c-42bf-99d5-dcbb97670670", "value": "RQL_0506111780.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ce5585-2bc9-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634090566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634090566, "uuid": "fce719d5-2171-45a0-ae5e-ca2d5379348e", "comment": "Malware payload (RedLineStealer)", "value": "32ad2713313dcf30a66402b405278167", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634090566, "uuid": "c2cf0fd8-8e73-4279-886f-f4035b2a23aa", "comment": "Malware payload (RedLineStealer)", "value": "d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634090566, "uuid": "aa26a266-4da6-4505-b113-4bd13a048543", "comment": "Malware payload (RedLineStealer)", "value": "108f4a1cef7ab49cddb8872b945692b34afe4fcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634090566, "uuid": "d8eb6030-973c-4ff7-a36b-191c55df0e4f", "comment": "Malware payload (RedLineStealer)", "value": "4b9b9bb8f3bf95ca587791e316351d2d1afe5647de8d4cbcbbc9dbcb03ea14b5dfebbb460e1ec32f42812116d7ce0d6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634090566, "uuid": "0edee555-799c-45c6-bb10-7d5a0d16d799", "value": "T109A41328687FD01991E3EEA12DDCA8BAD99E55E3240C743711B4733B8B52B80DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634090566, "uuid": "07e3c23d-2191-4107-b99f-8885332b7a3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634090566, "uuid": "edb52cc9-4af2-4118-b195-905deade63d0", "value": "12288:pklT97igt6Ko1Zjhq/4VlRKdmauFCuypdgroSUaf889t3hib3tiaj6PDY+XZGbm:cmjhzsgroSUR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634090566, "uuid": "39c69a2d-6c7a-405e-b009-37b6f9a4d5da", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634090566, "uuid": "8ace49be-ad4c-4c6e-9fce-c6831af81f9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634090566, "uuid": "e2c9fde5-365f-4357-8991-b8fa35ffd6df", "value": "32ad2713313dcf30a66402b405278167", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24591c8b-2c19-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634124703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124703, "uuid": "53d43a4f-4407-4589-96b0-4b3597f0fb28", "comment": "Malware payload (Quakbot)", "value": "eb4b931726a4f6fe23e3efc4c2209f43", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124703, "uuid": "649a69cd-5474-437a-b756-0194ac0d7c35", "comment": "Malware payload (Quakbot)", "value": "d99b5090f1ef9ddc4d1116761dc85c5f658c5d28b80f129f9b3501ffbf665552", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124703, "uuid": "6b650d8c-1b11-4f5e-9aa3-cc84918d2f4f", "comment": "Malware payload (Quakbot)", "value": "d857fe8a0b9b26e1eafd2fbe37ad7f1751866b65", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124703, "uuid": "ef7278c3-6f77-4b16-973c-fde83bbe6c81", "comment": "Malware payload (Quakbot)", "value": "5ddafc346328bd4bcb00ecf7e8d065dabf6e9f8194b7987b048a4e5329f3a3ff43d0cdbc38ff73a7f55e675ccce7ae08", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124703, "uuid": "b9029adb-5728-42d2-a4ea-0ef5bcda2c33", "value": "T18BD38C427797CA4BE54813398EE3CADB3772FC21DE62470336497B0E5E7A6A08C17652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124703, "uuid": "b3f73348-2734-4890-9c56-3ebbd64d6667", "value": "3072:vk3hOdsylKlgxopeiBNhZFGzE+cL2kdA6c6YehWfGMtUHKGDbpmsiiHGmZyAqgOb:vk3hOdsylKlgxopeiBNhZF+E+W2kdA6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634124703, "uuid": "ed79fb3e-283e-498e-8cb2-4fd611577081", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634124703, "uuid": "c729c011-f341-4542-b097-979d30df59e0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124703, "uuid": "2b0f4c39-ec05-4bfb-b14f-8444e45263d6", "value": "Outstand_1112926396.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd8c03d-2c48-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1634144848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144848, "uuid": "7fb7da26-77ca-44b6-94a7-ece4a1efd2d3", "comment": "Malware payload (ArkeiStealer)", "value": "9ce7a85ba3d9b83cfe600c41859b1bd1", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144848, "uuid": "c517b0b8-5fff-4f99-af05-eaf03ef4e025", "comment": "Malware payload (ArkeiStealer)", "value": "d9b6823ca8e13b78c269c5d21e948dbab625ea87d3370d163eeabeb3822aef56", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144848, "uuid": "aed58f5b-d3fb-417c-a26e-73d9b4470245", "comment": "Malware payload (ArkeiStealer)", "value": "bd1be91996a50af60298dbdb424f608e4f80a8d7", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144848, "uuid": "f68b058a-48ff-4422-8dd7-1c2711322a32", "comment": "Malware payload (ArkeiStealer)", "value": "bd392e7bf9a5e84c08392b9333cff3e6d9b4c7d10591c2259c21706915d14431f092768ecfabd5a9e58999ab35677c27", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144848, "uuid": "c55edc94-1261-4127-8c2c-76672594a3f9", "value": "T131F4F110A7A0C036F5F312F489799379A53F7AE15B28A4CF52D806EA4739AD1EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144848, "uuid": "c9db4fad-1be7-4f9c-8310-80841ea8d365", "value": "6914b510638d71b110829c8d3f3435fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144848, "uuid": "f511c8bb-f492-4cbe-a1fe-48e519309aa5", "value": "12288:aaVz0j8qmpg05Jgon2K4+TU8HoamNrDCTVUEqeRaoKnZEV+NgRmrlIPzVbG:a6drCggx+o8IaqDqUeCnZEV/maP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634144848, "uuid": "53d2fe1b-b738-476b-9881-5655ab5be353", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634144848, "uuid": "8b594660-ba4e-4e98-92b4-8f372493b8b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144848, "uuid": "daaee803-2b9c-4ec8-a72f-24da014c67b4", "value": "9ce7a85ba3d9b83cfe600c41859b1bd1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1995852-2c37-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634137852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137852, "uuid": "26a84af6-9cda-43e7-8475-cc605a550678", "comment": "Malware payload (Quakbot)", "value": "28bfc6c034e7d4a95c6d6c24ff9115a9", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137852, "uuid": "507db521-f46c-44df-bd1c-b3e5330be8e1", "comment": "Malware payload (Quakbot)", "value": "d9f63db8dc54b130b088b21c4c6733dbe9c44bb82211627834972be16e63449a", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137852, "uuid": "efcf006f-c529-4dcb-8354-601e38f19311", "comment": "Malware payload (Quakbot)", "value": "75f9c0feebdc903489f961e8e688a4678ca474ed", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137852, "uuid": "cb090e0e-5134-4997-b72d-de98da7a5655", "comment": "Malware payload (Quakbot)", "value": "464a0e8a1859108cba719bdf7c6fe60364c050ef200bce14753dcf3d57a47bb8308c52d44730d6a36a44b50cadd878c9", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137852, "uuid": "cf0e143d-36b1-49ce-8cd9-6b315efbf85a", "value": "T135D38C427797CA4BE54813398EE3CADB3772FC21DE62470336497B0E5E7A6A08C17652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137852, "uuid": "8f7f782f-82ed-489d-b536-87a3d8c3393a", "value": "3072:vk3hOdsylKlgxopeiBNhZFGzE+cL2kdA6c6YehWfGMtUHKGDbpmsiifGmZyAqgOb:vk3hOdsylKlgxopeiBNhZF+E+W2kdA64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137852, "uuid": "28abefad-59f6-4431-90df-ab7f46784e17", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137852, "uuid": "51b05a12-8fc4-4066-a47d-0ab4bfcc1e54", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137852, "uuid": "f95cf2dd-6642-41c8-9ce0-7dc188e9cfdd", "value": "SecuriteInfo.com.Heur.18564.23193", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9671b5fe-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634108574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108574, "uuid": "d8587f82-b56e-4776-95fe-310241dea0f6", "comment": "Malware payload (GuLoader)", "value": "a5195696c0c755e88d0718f3153082dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108574, "uuid": "7aa9de4f-8b92-466c-9ba1-b7ea585aac1b", "comment": "Malware payload (GuLoader)", "value": "da05e4caff9b006b4e47d51cad57e756e330f66fec712cb325d24e3b777aa8a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108574, "uuid": "32ca5228-7c1e-4c8c-873f-a86411a5317a", "comment": "Malware payload (GuLoader)", "value": "4efb35e97e38863298ea06912829a6cd1c0ada6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108574, "uuid": "4b3ff32b-dab5-4568-bc2f-d4d13f67c2ab", "comment": "Malware payload (GuLoader)", "value": "32998a5eec4774960120857eaffef983daebcc974b5131fe63d1371336064bf6217926c008a74b937f9a5826a3e1c595", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108574, "uuid": "0f248318-9ac7-450c-b92c-024c1556f4cf", "value": "T173C37C227DE46DFBD294C03144AECF8D8292AC515B064C1731BCBA6F59FAA6D6C33346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108574, "uuid": "d7610458-4a32-42f8-bf99-2d6526b92227", "value": "1aba8d044d8f6dcb721b92e7112420a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108574, "uuid": "8ec7f51b-cef5-442a-9c56-6fe33b58286d", "value": "1536:B0DtnwFL9N5Qz6XW+NY3gk+upE4Vd0yTPClpD3:iDtn8BK6pCC4T/PEpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108574, "uuid": "18e4dc63-ecde-4789-a289-b2aee9114cb4", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108574, "uuid": "01d04f06-bca7-43aa-89c3-7f2cbadc44d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108574, "uuid": "35eaf104-c711-40f8-9b23-c162aea7a1e0", "value": "Booking_Confirmation_Maersk_Notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa6060d-2c53-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634149786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149786, "uuid": "b445aff5-9145-4185-ba33-993224b866c8", "comment": "Malware payload", "value": "d4a4093dcc7dabb6e9d9b57aaa159ac9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149786, "uuid": "e5f054b0-9ffa-4297-a492-bcd222cde558", "comment": "Malware payload", "value": "dc050b963c642e86bf74da5e85fbfcb0b3c12bd692808bf8ae12a36f4bcf3c84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149786, "uuid": "3e1dd4dc-dc27-4219-9525-7257c0e30016", "comment": "Malware payload", "value": "157f7306ff5b4ff9332570d631f7d5ce27df78cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149786, "uuid": "a9fb8fce-961a-4587-a489-aaedfb4b0045", "comment": "Malware payload", "value": "4698b4a91aafd6f40b45ab5c4ad9e177577a7114248be1c9fce90534be97d34d88694912327136bb4dbe18a80e36f4a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149786, "uuid": "554d2131-72d2-4f37-96a6-1bd06a973440", "value": "T13745331D03FE2700D2AA2970BE2EDDD84D642D5DD761899F182FD854EDE4489EE0BF18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149786, "uuid": "d7956afc-40de-490c-b712-791af201ddbd", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149786, "uuid": "69440b46-d483-433d-9cbd-b7a9dfa468f3", "value": "24576:FFofQDykb6wCihobn3IZCIPrU+k1MeKn1v2nuktSTm:Hykb3CT0ZbPRk1/K1eptE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634149786, "uuid": "62ce697c-80c6-45ef-9920-f91d89e2f99f", "value": 1168384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634149786, "uuid": "0a3b5229-701b-4325-a8b2-9a5cb0148213", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149786, "uuid": "0e22372d-d976-45e1-aaf9-2827d58dabac", "value": "farcry6_repack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db27617-2c48-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634144905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144905, "uuid": "f317e131-fc41-491b-8efd-9c385fab3626", "comment": "Malware payload (AgentTesla)", "value": "a665b705b9381b33aaa9e307fe340af7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144905, "uuid": "cb3d5a5f-1dec-4252-a841-cf6a707787be", "comment": "Malware payload (AgentTesla)", "value": "dc07322ef1652695b5e85bfd5d6da8c5b6c311d26ff13eb18a390cd4b7232203", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144905, "uuid": "33351cb3-9595-4c22-af75-10b9cd65ff32", "comment": "Malware payload (AgentTesla)", "value": "a6fba4f009921b1de9d524047bcb7fa0e571a116", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144905, "uuid": "dbda87e0-eb5d-4f52-8482-bc8af4c30940", "comment": "Malware payload (AgentTesla)", "value": "08ff82f16bc3765dcb0bb5748754cf6b3bfbfae2eb81e3b3e777c732b21b6b2a9293bc6474d238b3c1c67392ec28fc48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144905, "uuid": "7c99b781-ade9-4c6f-abcb-2bdc3eab5a09", "value": "T107C4C064BF89D84FF3A69C785131DF44977D614B3723C625DABF107AC2A8B903982287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144905, "uuid": "b6df4b4d-b4ed-4c5c-9b5d-1cb866c5f626", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144905, "uuid": "97e1c686-c28a-4380-aac1-1f3344ffcc73", "value": "6144:0MkhBXuLbabNr+o6RxQbACvuj8qLhT7uu5ziEjPY2hL1Vkebv0duOjwYB:vSBXuLbalbMebAr9LNu3KY8L1u+0j1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634144905, "uuid": "657db62d-eabe-472d-a855-316c8e538a15", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634144905, "uuid": "648f17cb-2727-4741-aa4e-5450391e0074", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144905, "uuid": "b6139724-3fa7-42ba-9f42-a176bd6c87b4", "value": "SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.27244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4abab702-2c09-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634117896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117896, "uuid": "f2a49921-3d8e-462d-9cf8-fcda6ea731c4", "comment": "Malware payload (RedLineStealer)", "value": "156f188eb44c465c3d56cc5b5265b5a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117896, "uuid": "7c3729c1-9e1d-43b9-be05-a7c860e07ea9", "comment": "Malware payload (RedLineStealer)", "value": "dc0a6070aa94dcdeb01ddc73b7d368d4be7956e9edb3b193a409bb3bdb3094fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117896, "uuid": "b19c6dcd-e0a3-4a1e-9b11-cb9fdb24b3e7", "comment": "Malware payload (RedLineStealer)", "value": "72015c5a5b42b556566426317e8f1fd038d2da5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117896, "uuid": "683abb65-96eb-483b-a079-7b08415fefdf", "comment": "Malware payload (RedLineStealer)", "value": "2efaaf1a87bf0a273080bb07479d495ac9d4ce9af4e487506dc9474190847b0e218e76123fd80170ab21c5c7f5fab34e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117896, "uuid": "628895e4-8511-4fd2-9440-77f754c9fb66", "value": "T1DE54E120B3F0C435C59616758DB8C7A61FBFB5222A7550CF3B643A6D1EA03D06FA631A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117896, "uuid": "3a554bb9-fa58-4e98-94ef-b51f02f53e00", "value": "c8c17e47eb07afabbfe8e635fca5ad02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117896, "uuid": "3985a521-0b60-42ba-baf0-9d66b268d8fe", "value": "6144:BAJ34wlc51Fil0Xdk7RswCCmbq8RWS/vmdRcgVx98aCmVs4E:6J34iOmawRmbqAWLH8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117896, "uuid": "8a6d1199-4ada-48b3-be5a-c7ca0e437014", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117896, "uuid": "b3620440-3d79-4d5d-850c-53d984b505b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117896, "uuid": "6bbf5522-b2ac-4bdb-a6c3-7ba650c45915", "value": "156f188eb44c465c3d56cc5b5265b5a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11359c4-2c09-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634118121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118121, "uuid": "ff684475-8802-45f3-86f1-e7cbf9b96210", "comment": "Malware payload (Formbook)", "value": "cd082d86c8243824b21969ef80ebd2e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118121, "uuid": "e866f946-dc7e-4173-b54c-e362512cff0f", "comment": "Malware payload (Formbook)", "value": "dc79715b1603acf022ff683ea5042eda16428d8d383d3779b292e8ea8c72f81a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118121, "uuid": "74a04829-38fb-4740-9eef-74ec4213ad63", "comment": "Malware payload (Formbook)", "value": "dae3abb03aaab4bed3733d8756b8ddca512c9806", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118121, "uuid": "b96d109d-094f-4866-a0f8-01d2ac3b2069", "comment": "Malware payload (Formbook)", "value": "630bdfb2880c56bbc23f6c542f0fe91f8750931acf21b8d562ae0c6fa38dc1ecc19ba15ecc6dd4c453cbd3d15b002230", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118121, "uuid": "7185df72-7860-4175-b054-e62e2c6b0e68", "value": "T18244123322E5A9CFC4CBC5719DBAE97AD362930221347B0F97A06F9639721C3441FA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118121, "uuid": "bb8bd478-fe0f-4185-83f1-8fa5bf79d090", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118121, "uuid": "9d8f4c85-5981-428f-97d3-bf111ed847d9", "value": "6144:wBlL/cyM+BhiUgI4kUV5+bwntgBVJm8QEAfwJYWAYisnAxRZ:Cei60bwtiJm8ZSw7AYissRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634118121, "uuid": "32e00494-557a-4c18-940d-37abf4059e8b", "value": 254113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634118121, "uuid": "07c85b44-fc12-4d5e-9d72-7a9e9f25cddd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118121, "uuid": "58fb175f-a16f-4f92-8847-2cd28d988e49", "value": "cd082d86c8243824b21969ef80ebd2e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a8716b-2c07-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634117060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117060, "uuid": "0fc8edcc-e633-439d-91bc-009b7a6a9133", "comment": "Malware payload (Mirai)", "value": "bc16a7a78f3b0a642a11f396bb6cd46e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117060, "uuid": "b3a34f6d-c720-4c6f-8a78-af660b5b90f1", "comment": "Malware payload (Mirai)", "value": "dd64c5c85af4df0e4c70ffffe63d8859d7d479093bf6a70363d7d2a966183b58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117060, "uuid": "2ed172e4-3104-48a1-ac6b-d31e33e79cc1", "comment": "Malware payload (Mirai)", "value": "b17a57af25e887d6834610dfea1bfac3629df398", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117060, "uuid": "6bd19010-0997-4d97-b282-a2adf15ab621", "comment": "Malware payload (Mirai)", "value": "12a7ffabbecac450c5c6c30889febb2ade249da0bf2533e94e281d04c1a869a15ce91f9818ab1d5296575c7d653fdb93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117060, "uuid": "4c304c45-9b8c-4239-8d3a-aa414a8e6bcf", "value": "T156F2E14FEC997007D9FE5E38938F92528957B1D021AF9FCE42055C6DAC168137A642F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117060, "uuid": "279108f9-bd5f-467e-97fe-5f396a015000", "value": "768:EFcJGZpuhBwymL/sFoCqZO70rgp6da9WT:ectW0Fy470kpdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117060, "uuid": "87ab6663-63b3-43f6-8e5e-a291d02f4c8b", "value": 35992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117060, "uuid": "6c077a5b-ebf4-4c32-a71b-282d8093de63", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117060, "uuid": "f0b8f322-56e6-42df-ac9c-557f46d21794", "value": "bc16a7a78f3b0a642a11f396bb6cd46e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f418d4b-2c2c-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634132882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132882, "uuid": "29931a43-14e1-4819-8ea4-eac8f7df7f6f", "comment": "Malware payload (GuLoader)", "value": "ae27dccff11f1c8e17661269d90148b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132882, "uuid": "28b8756b-8366-4d79-81a4-6416b729d552", "comment": "Malware payload (GuLoader)", "value": "dd739f42791b213769f242efac95b60d0026825d5c882d576533cd8ae57514b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132882, "uuid": "920ab673-3938-4e84-8509-e9c470c5c160", "comment": "Malware payload (GuLoader)", "value": "365138784e65ad92bc8f05653374348aa4e00788", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132882, "uuid": "1bf57ba6-43cd-45ae-bfc0-826feca8a189", "comment": "Malware payload (GuLoader)", "value": "7260533d607c58cd7929f7ab8cbbc46e244514382f0032a37521cf3b7b8ab6e2dadf8319e938c4d119a06e9ff2040de9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132882, "uuid": "3ba05153-1b0c-48b1-9cdd-94ad2d71f96a", "value": "T1D6A35CC22D9C79E2E9450DBE473F05D7072C6C730993AA0711956B1FD83EBA25CA272E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132882, "uuid": "29ea3813-9867-46eb-9eb4-b6f59d7573f8", "value": "3d3cd1bd8dcc611a5734bf41f4e1a6a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132882, "uuid": "5b222f95-84cd-4f2a-8e79-1bdb0dbfb4f2", "value": "1536:t+DTwpq/hDgCLBytxYxAK1zjzAk1Knpps45QJcs1VlkOO0tFVVOWHZRGD:t+Ypq/hcAytIBfz/1KnppsxJJ1VlkWnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634132882, "uuid": "83dcead8-6bf1-42ad-a2db-5f2a07796c0e", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634132882, "uuid": "96d95158-fb12-4c71-bb12-7a528e8b3bac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132882, "uuid": "90b7b771-7842-42cd-a7b7-deaec07ade39", "value": "Delivery note_241493.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a089db27-2c19-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634124912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124912, "uuid": "d7d4b0ac-6812-46f2-8cb0-11198db1cd8e", "comment": "Malware payload (Loki)", "value": "404fdb1ce192f8274a78ceec928256f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124912, "uuid": "e5e25dc1-a995-461e-8026-87f2bbbd8bc3", "comment": "Malware payload (Loki)", "value": "ddedd1eb01aa4a575922cf3ffb033cc8f5829db70dd713d33cc1ebf4a6347d29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124912, "uuid": "249db35a-5944-4f70-b573-dc07f79135d5", "comment": "Malware payload (Loki)", "value": "a2e9e1c42e2d83e5ebcc37d68895deebd648b57a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124912, "uuid": "326abb30-f235-4f08-bf7b-e2b4ab79514a", "comment": "Malware payload (Loki)", "value": "d02989bbb2bd2eff0e4cf137027e9731a250d7342a280c286ad768bb4e6111aa81c35ff81d51e93d5ab3c2d3d9f01c4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124912, "uuid": "67946844-341f-448d-9b5d-422426f25eb4", "value": "T15AE4B4EC3BC24672ED1ECAB38D195E28FB561F036240AF92378B25CA871F1771D65984", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124912, "uuid": "80350bf0-2d13-4e60-9b52-6a2620ae2a87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124912, "uuid": "55ad3c48-0185-45a9-a3fd-8da44b8df4a2", "value": "6144:y4XhteQBOpJPRwjQkuaRBMyJp3RaQLqsffbvlIOvKGgBdUhcX7elbKTumLnyuIIO:frBZztMOp33LrRUBd3X3uIIIkIxV0DT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634124912, "uuid": "052546db-e4ae-40f5-83b8-9191c274b945", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634124912, "uuid": "67b83d14-9151-4027-a3e9-698729afd009", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124912, "uuid": "cc4ee92c-ef7e-4b00-bcb6-b45a59019013", "value": "404fdb1ce192f8274a78ceec928256f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9f346c-2c36-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634137443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137443, "uuid": "b0bd9814-edfd-48ab-bafe-649b88262dcf", "comment": "Malware payload", "value": "aea36aa7d349da819af73b45544e6f9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137443, "uuid": "699e9cb6-c6b8-4e52-a42a-1fa63b4f83f3", "comment": "Malware payload", "value": "df1ab32361636452004a65c04001114c4e0d06c469a69a9743bb748d678e5275", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137443, "uuid": "e5bff7ea-2e36-4791-bff4-3dcc24e2c4f4", "comment": "Malware payload", "value": "761285ab726b7086de2398c9554e5e724aaebc82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137443, "uuid": "72e5bfe3-52a6-441c-a2af-7dcb6e84c56d", "comment": "Malware payload", "value": "1750b268ee934d386a2743d529715ed67a32e1e7dbcffd460e6c3060096454e31c77c3a30b72289208bed1ca7e63e4a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137443, "uuid": "857c747f-6b38-48bd-9600-6b809b879815", "value": "T17FB6332339CD0536E38BBA3E1BF75F1E4FB27D220726944A1265FC1B98719A191B13E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137443, "uuid": "02570585-b71c-415e-abe1-361c0be097d9", "value": "0f7d0ed8477bf9ca9b4b2ce07e02a90e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137443, "uuid": "a7bb7bd0-7a6b-4818-9f67-7ad87d1308ce", "value": "196608:LBJ+4mMFNly0AYFnLDDiqA5CRFq4G6mbA4FNdr:FQwFDy7YFnfYITG6+tFNdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137443, "uuid": "f08c52f2-8c16-4960-b751-216c3d23641a", "value": 10477772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137443, "uuid": "949e6b09-94fb-48cb-8494-27ea0d4b2d1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137443, "uuid": "9fbb541f-02b8-4a77-a8e5-1a9f496bf04b", "value": "aea36aa7d349da819af73b45544e6f9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad09cbf1-2c70-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634162299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162299, "uuid": "8506c41f-abdb-4b28-aab1-ab49f32e3a81", "comment": "Malware payload (Mirai)", "value": "4839f55f8f077a080ff714d020f2d635", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162299, "uuid": "0bcfdf42-27d6-4766-b813-ec11307eb04c", "comment": "Malware payload (Mirai)", "value": "e0ecc69e22e3aed37e93162c20c33704a83aaf91f03ccc12a688a2aaf8b868da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162299, "uuid": "13e7c087-f4be-48f2-830b-20dd990d7942", "comment": "Malware payload (Mirai)", "value": "c141b14932e74efd08b21d1afa88362266996af9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162299, "uuid": "21677120-2f41-4e81-8407-9ab31b971fcf", "comment": "Malware payload (Mirai)", "value": "f60aa75ce79c4f6a7eceeca73307a9007ce139f53a25aab4d72e00e5b4f3521ad589d93c9b63d4424a2530efc247873a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162299, "uuid": "5be70c5b-88d8-4986-97e2-559aa9ece2e9", "value": "T103C2E18817492DE9C2F5C17947B81B6C1CA40BA6F809DC8578F8F762CD8A4753027ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162299, "uuid": "eb967ec2-2089-4204-a242-76bbd918b56a", "value": "768:12G214DFyosXqgvV9o1ndB08PJgGlzDpbuR1Jh:12GdDgosaaO1ndrVJuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634162299, "uuid": "7b9223b5-47ac-4202-ac2d-532e660965da", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634162299, "uuid": "ef9b6bf2-3067-4bd0-902a-8ca84ebcbe3c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162299, "uuid": "7a021c38-ad60-48e6-8f21-e847e9f7e051", "value": "4839f55f8f077a080ff714d020f2d635", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42cbe734-2c09-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1634117882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117882, "uuid": "2a16fd58-8ebe-45b2-9920-ba95f4e9c5e9", "comment": "Malware payload (DanaBot)", "value": "44baf71c2210174d6a9de973f5f02c9f", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117882, "uuid": "ae382622-bc38-4f41-ba18-073cbd348293", "comment": "Malware payload (DanaBot)", "value": "e12472ea051ad0b73a8166ca2cb539168f89bfb1e12130a916df605a88423b31", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117882, "uuid": "2875fa64-76bf-48c0-8cf5-609a7f5ae805", "comment": "Malware payload (DanaBot)", "value": "6e10f407dc8faa4879bf2ab0f28fbeeada5d4033", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117882, "uuid": "2cc4f7fb-16da-4c6f-baac-a6925dd31323", "comment": "Malware payload (DanaBot)", "value": "6956c47a02beffc05439441ed5fcfd843b732fedb6b3b76a2eaf37d2233975e2f54bff4decfa0f187bd100d902baa9ec", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117882, "uuid": "0d02a76a-4f3e-445e-82a0-2274dfbff229", "value": "T1823523547291C0BAC2C711BC4A35CBA45FBBB8A0967595CB371C393F2EE07C1A6A6335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117882, "uuid": "2b609f76-2277-4f77-88db-99bd75d45a1f", "value": "c8c17e47eb07afabbfe8e635fca5ad02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117882, "uuid": "9c0d8598-cb32-4071-8ffe-8c4975d754e7", "value": "24576:/bxjt/UTmNUew84fUfA+yo8T/6L0REVLCiH062cchSZH8f:7BN3FyYZCijIm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117882, "uuid": "eed2f9ef-9fa0-4cb3-83fa-0376dcad1c07", "value": 1117184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117882, "uuid": "eb5a9ac5-b9dd-4436-a226-90c6a0e7bdca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117882, "uuid": "cb76b298-0028-4621-92ee-8f0bb40b5b12", "value": "44baf71c2210174d6a9de973f5f02c9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07a95f7-2c28-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634131408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131408, "uuid": "9ecd01e2-b4ce-42d6-a160-ab2599313b12", "comment": "Malware payload (AgentTesla)", "value": "2bdf9487adb8a6f4d86f0c8cf3c5c5a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131408, "uuid": "886ae750-f1f9-4468-bddd-5d85b809c29a", "comment": "Malware payload (AgentTesla)", "value": "e13afdd0fd1fb07099a8caa32bdba8c0d15ab2b5ad40f9bee89d88556e60bf34", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131408, "uuid": "42ceb41a-c4d2-4763-9a99-e078decc3386", "comment": "Malware payload (AgentTesla)", "value": "75d93cb1b86e0a0d53fc08446eb46de4939b5d30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131408, "uuid": "cc597bf0-153c-4c80-99b6-9db65e017da3", "comment": "Malware payload (AgentTesla)", "value": "cd0a4258c7ebfe132c135d2cd1304fdff451c48b68db88deca6a88695433f0df175e7592885f2a042a88e5f24071a0eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131408, "uuid": "4a9a56b7-4426-4820-afcf-2d8325f98104", "value": "T12784233F5F924F1BA6CBDE7B16E43A0250E4068F877FE8718B110EFB2115B52A1859C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131408, "uuid": "3ced1846-1756-4d07-bca2-263ae14bc03f", "value": "6144:kC8RXHAdGX0/mpvmDocHoW9aEsoawAMNAxlIxNff6/QO4p1Vzcza:N8e4nmaNwlNAg/6/QO4Rzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634131408, "uuid": "8a52659a-4ce1-4db8-85e7-29050cf34241", "value": 403727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634131408, "uuid": "def9382b-b3fc-46d0-8787-7ec0d29ee7ca", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131408, "uuid": "8c7ed8ab-a116-477f-b91c-741d4b9d12c1", "value": "Swift copy.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b18380f-2c30-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634134700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134700, "uuid": "d427fbcc-ac09-4bb0-81ef-7ba777290799", "comment": "Malware payload (GuLoader)", "value": "31851bac3685c5641fc16e256c94c4a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134700, "uuid": "4aa676fa-f85a-4a72-a28d-6ed57e9d3e17", "comment": "Malware payload (GuLoader)", "value": "e1940206b5e3300e88b817953a62d90a2e69b738df549dc5da993409a6487ae1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134700, "uuid": "71c7a502-9797-4199-8d91-0c4254e07a96", "comment": "Malware payload (GuLoader)", "value": "31fea2ceaeb535863d46ec5260385649c34c0fa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134700, "uuid": "92878559-d84a-4c1e-bb66-5c0c89208384", "comment": "Malware payload (GuLoader)", "value": "28beb694b3d536d11e196a554537326b513873fa1dd4438e7ff2274f26f32f168204e17dc0f03ff00dab87c0d6af19d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134700, "uuid": "20796cec-dca4-4ea8-a760-dc7d61468d57", "value": "T1E7D381A162B08FD4E4A78A7F67E5476431327E340912AD47F68DBE0E4E761E0D69032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134700, "uuid": "00e4c168-c95f-4976-a099-ca4c2037045f", "value": "c727a98e677fb7bd25bb06d2a2d956f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134700, "uuid": "3c394d98-b648-4183-9c3e-66417b745a16", "value": "3072:8BtA0di9VPKLRp6d1KBRk2e82wzbC8DmE:0tU9kLRpw1KTket+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634134700, "uuid": "73dab3ff-0194-4137-91a7-2971beb466ce", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634134700, "uuid": "73f3e16a-e905-496b-85d4-f01cb3925458", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134700, "uuid": "32251a26-0861-403a-9949-69326648bc00", "value": "DOC 13102021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa7b1a7-2c3f-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634141249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634141249, "uuid": "38ab9393-83a4-4689-a438-63acb9be81d3", "comment": "Malware payload (Dridex)", "value": "a289f26f09690ec48b1970204f8757c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634141249, "uuid": "b6a7a3e7-3b73-46e6-91c3-c1422b87c1a3", "comment": "Malware payload (Dridex)", "value": "e19ffa56150021f69ad88bf6c2650f66b6bf4350f3163275abbf98ca94acd157", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634141249, "uuid": "68529c2e-0467-453b-a4d2-6c29e55d7ffb", "comment": "Malware payload (Dridex)", "value": "a006f6707ac1208d3d93e12e866dadabc6e2ef92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634141249, "uuid": "456362da-6502-4492-bd12-85212a42e708", "comment": "Malware payload (Dridex)", "value": "32a988cc32bc2dcc749596e4bec1c1e380ed5025942c5bda19b341a37ab58cba079649d51990224885dea688b8a76dff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634141249, "uuid": "c0c56a45-d221-4e1c-ac52-7ed779b7f7bc", "value": "T1FFD4F7013A04E821E7E55575DE2AC6E85B183D49EFB1A4CB78E17F0F2ABA9F3D215301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634141249, "uuid": "275b3b68-1c97-4a0c-a7c0-375be2f70f2f", "value": "77aefec4cdbad9a00d9143503be0ce97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634141249, "uuid": "46369879-1f43-4a07-996a-f072cfb285e7", "value": "12288:GE6rSiy4Gbs3j09TMmonCh5atbz9+eoQoUZpDd7Da1nX9y1pO/zFZx:8eoz3j0dMZnCutz4zI5xDwXUXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634141249, "uuid": "2b39a486-f0e3-482c-9710-ab94e19f1e78", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634141249, "uuid": "8ae6bb37-6e5c-47fe-96a4-372fd449ddd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634141249, "uuid": "b2632b10-0984-4589-938f-69ebba015d4b", "value": "a289f26f09690ec48b1970204f8757c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78984ae-2c28-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634131393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131393, "uuid": "53c9ff6a-58f8-46ac-9b7d-f60d5943e80b", "comment": "Malware payload (Mirai)", "value": "3af9b4ae1c0a9fa855dacc591990e821", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131393, "uuid": "2adb85a1-868a-4913-ba81-e015e5f9899d", "comment": "Malware payload (Mirai)", "value": "e1f4d0560530e7d6456adfcd6fd68d7d39516f19936f76c4d30c8bcbebc4be7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131393, "uuid": "1994ded1-a5c9-494b-af4d-81635139db26", "comment": "Malware payload (Mirai)", "value": "353dcfeb9cd1a081275d16ecfbf749e410ecd9ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131393, "uuid": "e98d8325-708b-416f-b5aa-46b6889853ab", "comment": "Malware payload (Mirai)", "value": "841d3cacb3de4338a8cb1db72d882c87d70b4cbbfc0c857d30f9fc404d34f74b16148cb11fa3c73a58017e46fd5c8535", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131393, "uuid": "069cc48b-1048-4808-899f-0fadcab1cb4b", "value": "T10CB31833A9658E73C04555F065BB99310F226D930F5F2694367DB6E48A3B0CEA88EF1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131393, "uuid": "4bf47025-3a26-4892-9733-5f67ae5434d8", "value": "3072:hDBfSZRIN1hXXNF5eOvneWmH1cuEgvniuN/:hDB6ZRI3ZTnvneWmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634131393, "uuid": "b218ecff-32cb-44ab-b915-690a89a23d5a", "value": 113649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634131393, "uuid": "b65e8dfb-a202-475d-9745-7957194a46ea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131393, "uuid": "e9a39d6a-3ccc-444b-b76b-066d9d51c1bb", "value": "3af9b4ae1c0a9fa855dacc591990e821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7063a40-2c08-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634117648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117648, "uuid": "07a0c4a1-2fe4-4692-bad7-809e0b565765", "comment": "Malware payload (RemcosRAT)", "value": "e40726b44abd64042271651ca1caac11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117648, "uuid": "626e7f7c-6106-422c-b6c8-f7f16be7d627", "comment": "Malware payload (RemcosRAT)", "value": "e21e8c522a9966a51d1059cac3735a68a08803182e7ce78e857d28c0d3424f1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117648, "uuid": "ffee1e5a-d7e3-43d1-b35b-7df486105211", "comment": "Malware payload (RemcosRAT)", "value": "d094ce35595c668e5349a20ad6150a349cf537f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117648, "uuid": "d80dfe59-17f1-42ae-8fb1-e7aefc948d26", "comment": "Malware payload (RemcosRAT)", "value": "4ac860c31716530fad90ee914e6269d41e2551250ad25bc7bf0c851c62adf0edac10b4139f0cc9510de441f0d587274a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117648, "uuid": "67ec3fff-6e36-413c-9b2e-fb16b00f8166", "value": "T1ACA4231AB7C0B8A7C5A660F35CBD3B6A7932D908401E971A0324BD37E9365D7FC1C692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117648, "uuid": "ab8d2d8b-a6e6-49e2-a4c0-ed0ad371a237", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117648, "uuid": "3f5c1e99-2a1b-4d54-b3ad-8d4b9116cf60", "value": "12288:Ce+ZNqq/S2usLuZ4ozt7ANZ6bT/jDK6Kl8ENuVjkc:JQNqqKsaZVCPWT7+cEN1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117648, "uuid": "3f4db34d-8d18-4034-854b-e9a9c4dc1f5d", "value": 451311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117648, "uuid": "3cde9424-6453-490b-abc1-348c92663716", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117648, "uuid": "6e1dcee5-64bf-4a56-8431-8c367099d1d8", "value": "e40726b44abd64042271651ca1caac11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "071d56d2-2c04-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634115635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634115635, "uuid": "43cca88f-9a63-433b-82bd-375513fcba2b", "comment": "Malware payload (Mirai)", "value": "97d39f8ef5ba4007e7b635a9149bc1cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634115635, "uuid": "51842e6d-003b-402c-9526-835f4d3f70e2", "comment": "Malware payload (Mirai)", "value": "e26f70e2d92c31893980d281d7ab1f4eda486dc74d05eed35af86ea9149471b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634115635, "uuid": "4a0bd429-a94c-4cd5-babf-58bc07e517c9", "comment": "Malware payload (Mirai)", "value": "660c86d69abc464ace3700b5a1e84829897067cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634115635, "uuid": "8afcb7ff-04e5-43a6-965b-700a0f3453a8", "comment": "Malware payload (Mirai)", "value": "b84d5dc20fdba2605f9e84648d9d550bab95945598b47e51073690c90bc650d9b60fd2f5b325cf15ad8965fd96bd04be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634115635, "uuid": "8269beda-90f2-4627-a9c0-3e2c09677ef4", "value": "T16B835CCAB801CD7CF84BDABE44230E0AB530635156930F3B669BFD937D721A89D52E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634115635, "uuid": "9a88bf29-281a-484a-ba38-db789bf1190d", "value": "1536:dRT3uKYukWicGFIWMGfSn8Ihw9ZEFOzBHUgI8HGFjEK:dRT3bYWiKWrfSh3O1HRuEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634115635, "uuid": "d606c70b-c802-4859-9022-d6ce65dead21", "value": 85712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634115635, "uuid": "434b2a7d-056a-4915-a3c0-66d81517715f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634115635, "uuid": "16ab9802-57e5-4e93-b5b4-774832e907d8", "value": "97d39f8ef5ba4007e7b635a9149bc1cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b932947a-2c70-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634162319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162319, "uuid": "59f0ee5f-745b-4bcf-ae5c-e6ac3d7481d8", "comment": "Malware payload (Gafgyt)", "value": "25a771210917ec404329bb1e811f8c87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162319, "uuid": "f894b776-cd21-4154-8e27-4ae8ba03d2b9", "comment": "Malware payload (Gafgyt)", "value": "e29e277debf74a415958ca1c540e02b9f36d35ee0f3fa2012fb8fe6ac3373ca1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162319, "uuid": "baf288c0-fa9b-44b5-91f6-5166183c8efd", "comment": "Malware payload (Gafgyt)", "value": "555411cd3bd18b0177d2da5dabeca0c04404fe1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162319, "uuid": "862854ae-bae9-485f-b2ae-a173d0e26c77", "comment": "Malware payload (Gafgyt)", "value": "107007ffff6a6821d8169153ff9cdb71656af0490f296589cfa703633ce1b684acab4a5a70fe3f9e21044f83d3a0d46c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162319, "uuid": "5792d78e-05fc-4a4a-92f6-13cccaad46be", "value": "T124A32A05F9118757C1C327B6F78F47493B3167B997DB33026A34BEB02BC27991A2AA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162319, "uuid": "6705606d-8ba4-4cbb-8dc3-69218eac924a", "value": "3072:7e9h9oZs5hvFfKufS2faYj0+rQ0Knm4XATe:y9wZs5hNfKfpYj0+rQ0Knm4XATe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634162319, "uuid": "e442c4f2-5051-4472-80df-b3a8e446667a", "value": 103862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634162319, "uuid": "8806edd6-cb22-4274-b616-8c60f16719fc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162319, "uuid": "3146535d-3d17-46de-9a6d-df805382eda8", "value": "25a771210917ec404329bb1e811f8c87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317fbac2-2c0a-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1634118283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118283, "uuid": "8ef0802f-59c8-40eb-8745-62518c2d1745", "comment": "Malware payload (BazaLoader)", "value": "9a1725b1db1d41e3718526e265a8c6fb", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118283, "uuid": "01c201cd-77fb-41d9-a0ec-5dffcf4ff2b4", "comment": "Malware payload (BazaLoader)", "value": "e31898f207733cf33a6f951d8337d6cd303334a9df95956686657e3f13436ae8", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118283, "uuid": "e01ae41b-fcac-4606-9ac2-76caf6a54858", "comment": "Malware payload (BazaLoader)", "value": "3f38ead3e0ce0d8ae516465e2bcad43cf1dd8970", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118283, "uuid": "680d8425-eb3f-48a3-bea8-16cb285ab247", "comment": "Malware payload (BazaLoader)", "value": "33454cffd9eb91b2839809e42d3450f10e32d1e9b0909c85f4ea8f243edc13ee01a24aa1c74fa2f839912174d4371e40", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118283, "uuid": "1d9c1a62-ac63-44da-8c65-e348b50657dd", "value": "T19874B6F46C10D1D5F8B6A5BAD8D1784660113CA8766A8F860114BB3B39A76C0DF6CBCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118283, "uuid": "32be2971-c6d6-4ece-92c8-94d0ee0c4edb", "value": "79d9be238e49f034d4a76e5debdb4868", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118283, "uuid": "44573cd8-30d0-4701-89c9-8fa797580cd3", "value": "6144:BeiSscyk7I05DgnncrqB4MKqeuR9pO0iS2TBBQxKMedx2isuXuKnJtyK5iHI:zl12TAisuX/Jtd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634118283, "uuid": "6863050e-1542-4216-adae-dd6e6e36dce6", "value": 363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634118283, "uuid": "c48748da-3b4e-46fe-8ed1-e35648c76a85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118283, "uuid": "68095473-064c-4c91-9acd-78e8f2a6f621", "value": "1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb26aa6a-2c2c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634133117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133117, "uuid": "e4173de6-38c0-4001-91b8-aaf76c394bec", "comment": "Malware payload (Mirai)", "value": "52c30297ab9f68c15665b8e2eec0d906", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133117, "uuid": "7cd094ff-0779-4673-99b3-1f0177155bae", "comment": "Malware payload (Mirai)", "value": "e31d031026cc853610ec5365d2459ab2f056a96fa6cf3bf142dc4b6d992d74ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133117, "uuid": "7b6ed48d-6e9b-4db8-8f51-812ade0699cf", "comment": "Malware payload (Mirai)", "value": "923f37d46177950d1360d39ced11845c3062aa7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634133117, "uuid": "e7720b87-bda4-456f-8aed-81c0b8d0b7d7", "comment": "Malware payload (Mirai)", "value": "ade3b31c619ef7ee9f1918fc302cb4e20f2fbc8cd30e84f6ec817a300a16f1e68d06ef8a251005fc461ca6c82fb7bb3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133117, "uuid": "b8f53977-a4f7-4610-923a-702e1a3ef335", "value": "T114B3C40ABF610FF7E8ABEC3745A92B05249D510B21A97B75B930D828F61B60F19D3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133117, "uuid": "9f9882c4-6610-49f7-bbf0-757b41d2250a", "value": "1536:g9DYWFx+xx+AaEPiGMR2jk2EkZ+BzYojKoOvDBgplbngVZ14hvG:gqWFx+xUA0LR2hEkZ+BlpZK1+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634133117, "uuid": "fddf9c5d-8ca3-42b3-8540-f0838ff02afb", "value": 108960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634133117, "uuid": "bbb4849c-00ef-4cd7-8f04-66e26732a9e5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634133117, "uuid": "40d31a75-56bd-4c54-af5c-d5db97f7f520", "value": "52c30297ab9f68c15665b8e2eec0d906", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e996b0c9-2c0d-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634119880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634119880, "uuid": "92b435b1-d988-447a-a7eb-d894b39b2b31", "comment": "Malware payload (RemcosRAT)", "value": "7b5c5724b840539d1723ff789494231d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634119880, "uuid": "5665bb6c-0255-4c70-a295-18d1361bfb74", "comment": "Malware payload (RemcosRAT)", "value": "e326ab12f1406eb893a57846391c41f2be83340537a40fc6e525d311846adb52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634119880, "uuid": "3232539f-b7e4-4272-862d-22516fa4f464", "comment": "Malware payload (RemcosRAT)", "value": "40380df3ee558fbbb158aba55e6646f94ce8aeb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634119880, "uuid": "d5c2c657-0c1d-4fd7-b5ac-7826ab1093ff", "comment": "Malware payload (RemcosRAT)", "value": "a9a40ab14b1998a8ddc0ae023d38fc12f6278a1564fe09b381ee91f1d78a7a67c574e327e50f5d1ef7d0bc339dc20d4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634119880, "uuid": "739013d2-9be9-46be-8730-e49e60afc7e1", "value": "T1CCE40240B0F8DCD7C8DF1AB59B92E52DA0248C716858CCD376BA7F7E38B530A28585D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634119880, "uuid": "1f37c369-9eac-42b9-af44-763e32b2ce0b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634119880, "uuid": "2e7e51d2-43db-4070-bfcb-7789deb03432", "value": "12288:VJd+vGvcT6NOvWXVV682FB00XnIcQ17eGmfKiDuKMVrCGkN:/dAGv26NOvWXVEFu03D87kuK4CG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634119880, "uuid": "f4393a62-6f5a-42e4-a625-e2d9a8d430d7", "value": 696128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634119880, "uuid": "ff57e20c-783a-4839-af5b-57fcb3cc8428", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634119880, "uuid": "68af60e7-8297-483c-8839-c75d75b7e482", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83cf7c61-2bde-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634099523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099523, "uuid": "6b6947e4-eff5-426c-a137-b2307b024898", "comment": "Malware payload (Mirai)", "value": "f52899c56a3693f364db35c84ead5b8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099523, "uuid": "a6fd9353-b5bd-4af7-89c6-7cfb1e063937", "comment": "Malware payload (Mirai)", "value": "e391b08f5b8af2d838434494f986cb4f1f68b3c01ecbdd1f5554199f448b48da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099523, "uuid": "d14238e1-de30-420b-a807-06bf5625d6a5", "comment": "Malware payload (Mirai)", "value": "3c6433889932c6e9c10249528ad8b52376883c2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099523, "uuid": "88d41a5f-1978-4c03-a3d0-e113f8d61dfb", "comment": "Malware payload (Mirai)", "value": "8ac322a6026f6bd28222b8cfee55357af49432b186f1576173625a87bf0328a16f4907ceceafcb6cac4426fe2ba3721d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099523, "uuid": "72cc5ae2-0f9e-4542-b9e5-56f5d4d59579", "value": "T159435D43321C0E47D1A25EB0253F17E093BFE95124F4B689265F9B5A8B36E3B1486F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099523, "uuid": "26dbd729-d7a4-4c7e-8972-0993de38bba9", "value": "768:lgbf8RQzh1r3FgzRaN7+faVt7Ymuiygu1HoGczEppVuz2GipH6TnSgGABs:ybUg1Jgzz4Cqu1HFsi6nSgG8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634099523, "uuid": "73865dbe-4385-40c9-b05c-053beee008f5", "value": 55472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634099523, "uuid": "24bb256c-9a68-45c6-b726-2857f6ed3776", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099523, "uuid": "b5bdfad6-f2d4-4aad-a788-be0028e131d8", "value": "f52899c56a3693f364db35c84ead5b8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a890419-2bdd-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634099132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099132, "uuid": "8e2cfe32-cbb0-4f86-9bc1-6ec9110a0d98", "comment": "Malware payload (Mirai)", "value": "49809173d2231a951bf26736856ebd71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099132, "uuid": "be5f17c8-e979-4c06-a36a-9955a6989a57", "comment": "Malware payload (Mirai)", "value": "e4147e4358f1a234c37ef0d3d273dc27975833be7805c7b2b41d1a61245bf694", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099132, "uuid": "66c52085-8ab8-4f82-9af1-ed7617b09608", "comment": "Malware payload (Mirai)", "value": "8a043b44eeccccf2a285a713e8c24cec5f1ee515", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099132, "uuid": "0f45de0c-31fc-49a1-bf36-0227d1c69386", "comment": "Malware payload (Mirai)", "value": "54d2b55fd06f871a2ceea6f0806f7352e18ae3998898fadb76eb7d9d40803f8182aea3aac5e57b8bd2f1c75e36580812", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099132, "uuid": "eb4cf328-c06b-4866-86fe-5ccd42a560ec", "value": "T16B630852B8818E15C5D813BBFA2E018D33126778E3DFB2129D106F147BCA92F0E77A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099132, "uuid": "a67b276d-8707-4a74-9091-801b1c5bc37c", "value": "1536:StnwsWjjS5+8hEWZc+mQM4fJL4Okw/RqO1do3YpPz9I5iY5UJ/k:MWjA+QEWZbbZx4OjcO3o3H5UJ/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634099132, "uuid": "38ecf2b4-fe89-406d-a928-e5a2104be3e8", "value": 70960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634099132, "uuid": "95b491ea-f185-400e-94df-32533d439ebe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099132, "uuid": "5a9b379a-0613-459a-87f8-e2caa4c8a834", "value": "49809173d2231a951bf26736856ebd71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e50e70-2bf4-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634108929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108929, "uuid": "692ffbe5-646c-471e-880f-5663940a6b0b", "comment": "Malware payload (SnakeKeylogger)", "value": "99d4e6823ca77891ffbdf29922bd1272", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108929, "uuid": "70bdef47-1c52-4546-83bf-8a6528afbdcc", "comment": "Malware payload (SnakeKeylogger)", "value": "e469a3442dbede6e908755799fb367c6f7d729e46b3bc7cf67bca3fa28238ab4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108929, "uuid": "4a7ffdea-0947-48cc-8f98-7f296c6b7162", "comment": "Malware payload (SnakeKeylogger)", "value": "1427cf992d01da50eb250b33303d3f8873b989a8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108929, "uuid": "0037594c-99d2-4130-94c0-5bbe68279521", "comment": "Malware payload (SnakeKeylogger)", "value": "d2d0662f85f712c63b90b80b88c350c534cb1c6dc60d3ed865a126cb4503563d1d9acdb3e187ab8f264ca6dfbb14e525", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108929, "uuid": "31bba64a-9b81-434c-8a2b-f31f0a630b01", "value": "T19DD42393B1D4DF9BE41B66391CC3D09C7E0CEC88AE6DD20B3A55BB5B4EB97358102819", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108929, "uuid": "85911b18-6881-4171-914f-f33d1614b74d", "value": "12288:ebqTtukI4DLk+N76BI7G+eDYYQgc6gID6ijVAm5vbZ82NHKLtO2:OmukI6Y+N7uDgl6gI9VAm5vzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108929, "uuid": "d9821a41-e8d3-41d1-bdab-a2ccb3c3df30", "value": 644096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108929, "uuid": "10c68646-0f85-4ca3-9fb4-cf0dcbcee0ec", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108929, "uuid": "e24fe092-47d2-4db2-9cde-8aa4d25e4987", "value": "MV VTC GLORY.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "570f449e-2bc2-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634087422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634087422, "uuid": "1e800610-c0b6-4a4d-803c-32071138ac0e", "comment": "Malware payload (RedLineStealer)", "value": "28b377e617248ae77daf5513d905f212", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634087422, "uuid": "9b9825fb-73de-4404-b85f-8db35f3d2c35", "comment": "Malware payload (RedLineStealer)", "value": "e473281b837d007701592a65023981d76aa489368849b0778bd6af20748295bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634087422, "uuid": "415a8358-e5b9-4309-bcf6-ad3753a70708", "comment": "Malware payload (RedLineStealer)", "value": "2e4b40a884ec3d4c81f6d0f7e4310bd4f28e378f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634087422, "uuid": "27e1d3f4-2592-450e-b1fa-00627dd01d40", "comment": "Malware payload (RedLineStealer)", "value": "c0836aeebf1131e0b201146a4bb59856c35076734b729a8c2045fbb6859403299aba6888dcfc2a7460a13f4ecba8dada", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634087422, "uuid": "470166c1-3b03-4701-a6c5-246764211830", "value": "T177E569632594C92CE416AA3BD3AE42F6752F5D08CAB5463B9A8C3D87F7B744904C370E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634087422, "uuid": "2f69868a-6752-4cec-8050-968ca32108e5", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634087422, "uuid": "84ee1876-880f-4676-9b25-c1ce6237a54b", "value": "24576:yz794AhA9W9lZ5UPHvHCGfMypvwP5QFrwL4dndSVgEj3OoJ/+H2Bsdz/H1+JsPxp:yz749S5UPHT/5VdSdCoJWmsd/Vea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634087422, "uuid": "80a779ec-b76a-45dc-acd9-964406f2945e", "value": 3152896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634087422, "uuid": "b0c987a9-5638-4144-88ac-353447bdab7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634087422, "uuid": "0e39a8f6-8809-4925-91ba-c142116c9587", "value": "28b377e617248ae77daf5513d905f212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3699d56-2c08-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1634117615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117615, "uuid": "1072d4ea-a6e4-4d0a-8078-bee997150327", "comment": "Malware payload (DanaBot)", "value": "a9f827f1dccee7e68b359b509aa31430", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117615, "uuid": "2a7cf580-e84d-407a-a554-52ede794a7c0", "comment": "Malware payload (DanaBot)", "value": "e4d8322aab287b539f0b5e44931faf582e46537d980df05fdaef9e1da49f5e8a", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117615, "uuid": "04a3a93a-39cf-4952-bf08-d9ad774ae7ca", "comment": "Malware payload (DanaBot)", "value": "15b36acb3ed85a73601a39d3cd6b599b3fe309f3", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117615, "uuid": "c99c1d41-7427-4209-ae1d-4370c267a384", "comment": "Malware payload (DanaBot)", "value": "e2b976c6cbfa159e2b9493e04779452671febc0ed3a63180ef328c2ee1a2c68aeccf5b0bc9b278062d69c18102f77843", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117615, "uuid": "239ff274-1151-4e53-b80a-e20b4f540f17", "value": "T1EC4523F13294FBBAE4938931C869C6E15DBBBD012564C1DB71CF3A2FACB4BB04569241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117615, "uuid": "930a5aea-bfc4-4361-9a46-da997d0540b1", "value": "1c763ac38c11e291bf3530d542ce2870", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117615, "uuid": "90a9f3db-7ca9-4047-8983-d62901909b0e", "value": "24576:Efc0AhufUWmker1Ef6Ei2WiKYbzrZ+m9zvj5M+UH8mkA:Hhdbker1E1i2WiK6z1dR9UH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117615, "uuid": "88e3416b-71b8-4f61-b4f5-0b205bb2e14c", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117615, "uuid": "17f0620d-c5fe-4925-9a1d-a9eb382d22f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117615, "uuid": "70e48262-9977-4864-8f69-7aa787460b6e", "value": "a9f827f1dccee7e68b359b509aa31430.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c249b4dc-2c28-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634131411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131411, "uuid": "967ae53c-e086-477e-b062-bbb9a0807d42", "comment": "Malware payload (Mirai)", "value": "052c3d1e7b2367158625a9c6ba973e73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131411, "uuid": "5ccdcae0-91b7-477e-93f5-5e8e580ec43d", "comment": "Malware payload (Mirai)", "value": "e618e8e253c5b2ea634940de5defbf63059a5d151d6ec834bdd714939cf9babe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131411, "uuid": "ddea8ebc-caad-45bb-8ba3-c097ec544c3e", "comment": "Malware payload (Mirai)", "value": "7a4dedabafc9213e857d5bb67bb01edcbc0d34d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131411, "uuid": "cd168447-672e-4165-8b5d-49822b2d549b", "comment": "Malware payload (Mirai)", "value": "c59f387f4ae1f828f565727151bf056ddf24ae26dfc0bcc903c35f1bb3ad3a33209cb4832636ba688163a70a2023d016", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131411, "uuid": "d7153d0d-396c-421b-98de-09a58c7fecbe", "value": "T145C30933671C0B43C09B55F028BB67F28F29AEF316EA21C0664ABEC08B775B16551F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131411, "uuid": "454487e3-99e2-4012-ae55-1b331f9030c7", "value": "3072:0Zo0Zt8fjRIsZipwdIAUzUmm/QcuLmHniPNb:0ZzZafjSsZip8IAHmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634131411, "uuid": "7b4df34c-0280-4356-9fe1-501a37d358c3", "value": 120594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634131411, "uuid": "6d9cd4ea-0659-4cb7-a36f-e9ca7b5afb62", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131411, "uuid": "a5ac2ea7-ce9f-4fa4-977e-dc1cf1acde22", "value": "052c3d1e7b2367158625a9c6ba973e73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269991c3-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634108386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108386, "uuid": "c6f03a32-21ad-481f-b577-c706c6bb904e", "comment": "Malware payload (Formbook)", "value": "e00b4b8a71f868c715d44e4f0f58fea5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108386, "uuid": "65dc76ff-8cf9-4c98-bd88-c958b78ed389", "comment": "Malware payload (Formbook)", "value": "e72a2bb9b7598e235721d247a50479c6cada2a9fa5b84255558259b1a7fdbee8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108386, "uuid": "c514a369-617c-4d6e-bcf6-7cad30f92155", "comment": "Malware payload (Formbook)", "value": "f2459cd0dbfef688330a1686ffc7df13956cb82d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108386, "uuid": "6a8db76d-b61e-405c-87c2-5a0c41faa313", "comment": "Malware payload (Formbook)", "value": "446b12a7c46d6bc609744ddb3274118c0cedf8b0ac2cb30d819ff81bbeb9efc602c02eba3f3335c5f4ab83e01a5e59a5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108386, "uuid": "efabe59b-59f3-4eb5-9d54-cefd36546125", "value": "T1FC64C01BEA4A159DC9CF8C33058979F09097CEFA0D1294975F26B18E6D3CA15C323AF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108386, "uuid": "cedd695d-4f2d-4071-badc-b9afaf4656b0", "value": "6144:tgfUukVvZBVzDC8N7j1pP6c8FN8Unj/gd5+s6ALwB91SZcAUYlumK:tgBkjBVzTNNO/BjYdsALwdSZ6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108386, "uuid": "8a68c367-5a5b-4312-b102-3bb311488893", "value": 317208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108386, "uuid": "8eed63ae-8f08-4741-8428-b219c75d3100", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108386, "uuid": "0e5c139e-7a4c-475a-b179-454e47bb3a1d", "value": "New Order For Chile.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927dd33f-2c6e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634161395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161395, "uuid": "04f1b7fd-06b0-4ea0-a635-6efc5d703455", "comment": "Malware payload", "value": "70bc0a4f0257fa6603b8088372f74a29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161395, "uuid": "26e1d13c-2659-4bbc-ba8c-2494da1ad6f1", "comment": "Malware payload", "value": "e7e82f61f2a37e4123c770f980336d6be54baa91db6b57e7d8ee5103525a6433", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161395, "uuid": "9b241f02-4c7d-4a7d-8f50-277d3f1aa8a8", "comment": "Malware payload", "value": "b4e88ab9d74a05becb0ab02f9325f0bc1bbc49fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161395, "uuid": "c18702ed-8142-414a-9cf7-a2590c2d2fdb", "comment": "Malware payload", "value": "3e04c8aa51892460a144726640fc864cfd30ab96a2134a3588dc52b98964c6f0206c94c8238d2f9be389086f4b091cf0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161395, "uuid": "02897314-9982-4364-a69b-1abf6c895e00", "value": "T156D39209AF601FABD82ACD37459D078574FC075621BE2B56FE38D614F7DA68B00E38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161395, "uuid": "b5e2bb27-248d-4a96-b338-55c6bd22c281", "value": "1536:e4wMyR8bs7KP3FRv2NE6ERpduhBcrcZARNvvh3Avv6:eLMyR8b1FRixhBcwAky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634161395, "uuid": "c64e3622-8c6a-45fe-b64b-292c513afbd4", "value": 134108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634161395, "uuid": "931862d8-0a6f-4d42-88d6-550fadde6ae0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161395, "uuid": "54354bf0-f14a-4cc8-9cb5-226b24f3cc3d", "value": "70bc0a4f0257fa6603b8088372f74a29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a3ba2f-2c09-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634118159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118159, "uuid": "82e60bd3-fee2-4ee8-9d35-6449a37d8e4d", "comment": "Malware payload (NanoCore)", "value": "664d73b23eddfcd0227786b9d0f5d022", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118159, "uuid": "0630c3a8-d578-423a-bc2d-3f8a0db90e52", "comment": "Malware payload (NanoCore)", "value": "e88b591e50dc770c48156d2c86655923a090ee619753a6028ed857697d21f9db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118159, "uuid": "07bca0de-ef1b-4575-8b12-37a5b5b07979", "comment": "Malware payload (NanoCore)", "value": "36fa060dbc146777f54c958e7457096af267e15c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118159, "uuid": "13868259-d1b2-403e-8966-66b778eda265", "comment": "Malware payload (NanoCore)", "value": "67986696556d70bbd43bd034034ae1302d93a58f8477e0a2b7bbf3c3b7604c65764723158f2c87fb7f163a86cbeabeda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118159, "uuid": "68f60cc3-9038-40a5-9c28-1cfc6b731c4e", "value": "T116351203B6D68C72D5B328315A3967159E7E7D312F649F2FA7D04E6CAB345C0A120BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118159, "uuid": "7132d006-d9da-4aa4-b936-0c80153f5d25", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118159, "uuid": "d8e9abf2-6d42-47ad-8579-fb5e6d08c3a8", "value": "24576:rAOcZEh9dnCceJd8E0S8/ya6TPY5I7nT1RMwazXV:tLd+JdvqJ6c5IzTXM75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634118159, "uuid": "44d992f5-2a31-46cf-98ef-7ba4f1e9b82b", "value": 1103092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634118159, "uuid": "276355ba-e4cb-4ca9-8686-0bfacd34bcd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118159, "uuid": "75995992-0a3e-4d34-b0ce-946e1425f181", "value": "664d73b23eddfcd0227786b9d0f5d022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895eb565-2c6f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634161809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161809, "uuid": "99dc5804-6721-46ed-9ec1-239555b26638", "comment": "Malware payload (Mirai)", "value": "7fa29995e43d7f4c534528950b4904f2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161809, "uuid": "c7b6b30f-9408-4bac-a54b-c0becbf1ff2a", "comment": "Malware payload (Mirai)", "value": "e96a08a1f8fbc5c6aea35c6d344cfa9e2e00c7070de831fa8986e600ac2b230a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161809, "uuid": "b1de1969-a00b-4de2-8f36-bfe78b8d67af", "comment": "Malware payload (Mirai)", "value": "964413479b6d6e0cd0de05d9629c8994f38c5cef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161809, "uuid": "342fd607-a667-490a-a6ab-6d7096f1fbbc", "comment": "Malware payload (Mirai)", "value": "d51f1cd126a4c3634ab2224689333c014130af338e196cdface76b94eceb390616a9ce0ba75cd447944ba0b031c6c805", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161809, "uuid": "1f31084e-cc48-424c-8ccd-df78ca5a1a41", "value": "T148B2D0717015B8B2C7E100779DEDDE43BB800EFCD0E8B3291469099DEAD5946AAF0547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161809, "uuid": "d57fcff8-e633-469e-a52b-a25e0733a2a8", "value": "768:aX9nxn8o9wnBoWzEQf2EjKb3pts3UozsE:atn+o9wjfBAZwzsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634161809, "uuid": "21cc8233-c9de-4aab-afd0-09b7eeca52cf", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634161809, "uuid": "165df3cc-0e94-4222-a97d-757d801d8421", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161809, "uuid": "e034885b-7dce-4a9a-acc6-969bc342ffdd", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f248022c-2c21-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634128485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634128485, "uuid": "b6c108cb-ba96-4832-94ec-9233f0b1d786", "comment": "Malware payload (AgentTesla)", "value": "8248d8d87802e72e927bf56c72c8ac9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634128485, "uuid": "46aa6849-1c9a-41b7-9282-e99ba465d0c7", "comment": "Malware payload (AgentTesla)", "value": "e9e184c58ab5d849ec0bfc1258fc2f004eb6cb364430caa3005e2c441ff70ed8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634128485, "uuid": "8ec7a272-b113-4c81-afa1-b2f3cc101ee8", "comment": "Malware payload (AgentTesla)", "value": "e0b1973df14596229e36a41e6d06151acf4b9aec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634128485, "uuid": "b1a24fd3-6f0e-4fc7-b632-ed3f3161646f", "comment": "Malware payload (AgentTesla)", "value": "e08b37d49a0745c3cd2183e4c6ad692233728d08b659319cd1d9cc16d878c3bc7aa3c8378a4d5ec1efeca8c87f0bb116", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634128485, "uuid": "b6cdcb73-2ca9-4fd8-9a62-8fbae8f32226", "value": "T135B423B2A851B67DB1034F379286EF78AF64775CB33406715A4F40A17870A9B99332F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634128485, "uuid": "1886d637-0a08-45a7-ad9c-f2f71614ab9e", "value": "12288:LNMi2eAMy4NnlvYRYmXPnqdnRaAW5zJY7V8e6pVpUT8:W3anlwmmOnwgVgUT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634128485, "uuid": "ebf3d686-aee8-4ae2-8aed-cde9b067463f", "value": 530076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634128485, "uuid": "fcf0c29c-dc99-437b-8ead-ad010bb1efea", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634128485, "uuid": "699d49d9-3fa4-44ae-afbb-3cab593dad3f", "value": "SURRENDED HBL CNSBIF0825FT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac90ef0c-2c28-11ec-843c-42010a9c0014", "comment": "Malware payload (Hydra)", "timestamp": 1634131374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131374, "uuid": "c1a8ea41-4306-487d-a16a-cc0c6a386fa3", "comment": "Malware payload (Hydra)", "value": "4d1d88ed96379c4b6b72b7f3f1727a97", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131374, "uuid": "d0e8dce2-7f1a-426f-b3ac-8d367e2db8dc", "comment": "Malware payload (Hydra)", "value": "ea6058517e957895fbd3c26cac63013df3442ceea289123c7afd4bd0b24bea82", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131374, "uuid": "01d8d5b9-9f5e-41f2-bc87-83616a8671d4", "comment": "Malware payload (Hydra)", "value": "691e2571c920f2dd184ff96c4ca05e89e2da2efc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131374, "uuid": "5a99b525-be3e-484a-922d-3385dca2836e", "comment": "Malware payload (Hydra)", "value": "0d165b19a3fa1382751206d9cc4f2d92b6d11101730ba227b0928e53e1151af0fb1fc0768471a1cc9363cb95b44ccea5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131374, "uuid": "29f9c8a2-4e25-4479-8769-6ef07ffdfc97", "value": "T18A9633D5D2801986E72EBEF908D49645B35087A514B2987F03881F609B71FCF1F8E9AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131374, "uuid": "ece478ff-bd1e-43f3-b014-d9d4afd1ef6d", "value": "196608:c6ltXnj5qP0vzIjQK2n8aPH1yN2iQDWx0RiQdyjynFAL92:c6Tnj5p0QpXN22icWabyj402", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634131374, "uuid": "3fb97af1-6bd4-4188-bbad-c01caf1a70c9", "value": 8826149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634131374, "uuid": "344a5069-e6c8-42e6-abcc-1d6f33b4d140", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131374, "uuid": "70cd6aa2-2812-49de-8e3f-f57b2d1eb795", "value": "76032_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f60720b-2c79-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634166007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634166007, "uuid": "adbf220a-e84c-4a48-a4e8-8f0eff8de1ca", "comment": "Malware payload (Mirai)", "value": "a8ca9e76eeb0635e9e812b0e33639dfe", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634166007, "uuid": "677dbcc2-8337-4a44-aec0-336880ae73dc", "comment": "Malware payload (Mirai)", "value": "ea9d6a29662115b1eff8b788e8ac71a8e39e1961f2c86ec3f207c05c0b766ece", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634166007, "uuid": "7938abfb-a0ed-4466-af2b-c0fd277aab7e", "comment": "Malware payload (Mirai)", "value": "7b7c6a2bb890d3c59b79c1715835934ff6b11f03", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634166007, "uuid": "3cfd850d-d2fb-4eeb-a2d0-a4a0a713e833", "comment": "Malware payload (Mirai)", "value": "4ea1271c3fb49e2a2e859dfc00ceb3cdf2c5fc3a37c87d996633ecadf6297745af8ede9b17dca56efc4d8584554e5537", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634166007, "uuid": "adce7f89-3741-4973-85cd-20e1fa92b81a", "value": "T1B2331A91B8829A12C5D4537BFA6E41CC331563A8D1EF32079D266F507BCA82F0EBB651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634166007, "uuid": "00c0d703-affe-4384-9880-a3cdb0a70dbe", "value": "768:w7Mc+v+wcWDEKmxmmEBa4OmdiC8saEbwzRgBCEVeHmYMvYPfjA/hcl3D8NRRZPNG:lcBnWDFx8sHeHbMIfU5tGlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634166007, "uuid": "b5d76851-fde7-4a52-bb09-549a2d677983", "value": 50316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634166007, "uuid": "598bdf86-6d13-43e3-aa2b-d79f0c775a2f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634166007, "uuid": "64eb75a0-6bd3-427a-a2df-e6fd00f9677f", "value": "hoho.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1dc3234-2c31-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634135249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634135249, "uuid": "6b6e3f38-c51c-4620-a32b-c112d3d4f83f", "comment": "Malware payload (Formbook)", "value": "f841c72b1c4cadc4c98903ad26a96a16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634135249, "uuid": "c8bd2af5-9b3d-4d62-81c9-1292e33c2f41", "comment": "Malware payload (Formbook)", "value": "eaa038a0020fee7ddfe2919203f20f15ca1d7eb19d90b168cade93b5cf8d7f43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634135249, "uuid": "31273067-30c2-4051-9853-dbb456bd7a40", "comment": "Malware payload (Formbook)", "value": "06359aaf42a5ce60889ab7a93d8af7702b34630a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634135249, "uuid": "44f69019-e840-4423-b156-07414dbe1957", "comment": "Malware payload (Formbook)", "value": "80f71b7570ea7e60d1608b748c4f7e10732bab856ae0d8bbc7c4b2ff3190aa13b16c1b414eed9567d51c0ce82a7388f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634135249, "uuid": "11f67c5f-13b9-4cb0-8dae-23f14ea71202", "value": "T14B54124933D48A9FC4875A709FB3CB74CA77CA04211AD48707528E3B6D616D7786F0AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634135249, "uuid": "c4b7f80a-d562-4c79-ae2f-8a9c3fc45ddc", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634135249, "uuid": "c6dc5c79-7d93-4338-b701-0a9a2482e7eb", "value": "6144:wBlL/cQMpuMEI8xf6S6s4SOTJoR6qMdayJ5rSFb1e7uuUI0vVLM:CeQMzEDxf6I8J3dTXuuUbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634135249, "uuid": "4f0a63b8-1b48-4ec9-a3a1-8a23ab7d109f", "value": 288183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634135249, "uuid": "10b9fae7-8291-4134-a395-0c1fac42eb70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634135249, "uuid": "0751a44e-9f3f-4769-89ff-ba951f6efd60", "value": "pago atrasado.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d7f614-2c2f-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634134426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134426, "uuid": "ab33d582-fe92-41f2-840c-9e20d7967998", "comment": "Malware payload (Loki)", "value": "d5f7f3ec1ee0683554f135d9ffc9c7b9", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134426, "uuid": "098c0ec7-f463-4905-b6c1-8cc375166f51", "comment": "Malware payload (Loki)", "value": "eafb06c29b8894d02be209fc0b4192785f999041a42036e2b2463a5d09576ed9", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134426, "uuid": "308c3666-6844-4009-9c68-ce2018784251", "comment": "Malware payload (Loki)", "value": "3de06efa678e5d238b0e851a928b3f6df20a78ee", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134426, "uuid": "f4ae5a2c-0bdf-4b71-8992-8f6b05929bcc", "comment": "Malware payload (Loki)", "value": "88daf2201945bb68577a302e50a8cae234f365203e19b4989fd87d40a057b541b056b47af2e4670e6689230dc6c5a02c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134426, "uuid": "c3c32a68-1050-4316-b930-3b32661ab936", "value": "T1E664CFEEEDBBD981D126CDB18FADA166C90BDCC1C04527F3D0607D44B9F198A63285A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134426, "uuid": "b57e1b36-5cce-46bb-ae37-253f2ac57b20", "value": "6144:LZNCmPRh3BXESYtSA5GGbSSNzc+9qVgWiYH6/R+CT35j72prCsta:LZVZ4tR0GGsB9eiJ/R+FrCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634134426, "uuid": "b9dfbf4a-e78b-4974-872e-62e6d61cda54", "value": 329192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634134426, "uuid": "85640548-7f5d-492e-aaed-f4adf73383fb", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134426, "uuid": "6a9a083d-78b4-41d5-b9d5-07a38bfb322d", "value": "Ref 0180066743.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df01b532-2c2b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634132747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132747, "uuid": "d72790fb-814b-4d47-8b4c-5612cf97e6b3", "comment": "Malware payload (AgentTesla)", "value": "b6bbe2c95f7c6ab382809fa413665a9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132747, "uuid": "fa27da04-1bac-45ae-8a14-ce7be82f9623", "comment": "Malware payload (AgentTesla)", "value": "eb0e13f3d9647c00ee236d97db0eb3bd58c18be36c29362be4c5aae952fdf6df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132747, "uuid": "7013731c-d421-4608-886d-4bc2f1ec4ef6", "comment": "Malware payload (AgentTesla)", "value": "49b0b9c96ec636b65b723157e6498f9023c6e662", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634132747, "uuid": "cfbc1756-3e2c-4243-bc88-838fb40cfc81", "comment": "Malware payload (AgentTesla)", "value": "978350d90f4d742fa5cf7f9a109e5c6ed14ad989fd462fcdf0edde76e82c84cc190a07ebdbc21b5ef591e995e1408689", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132747, "uuid": "0e48e3b9-8cd9-4d0d-8048-937ec9ea01f8", "value": "T1DCF49415F3929C11E567167364E051E391092CC7E858833DEBB7BAA318EA3805F5CBEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132747, "uuid": "fb68ecdb-a178-410f-9c84-df595d341157", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132747, "uuid": "1b60e1bc-c6c0-402d-9133-7ebc366d96e5", "value": "12288:OJ/o+nZkT+pnXFkB0ZGf5cmI0UVZ9nK1QPi63U:OJPkT21kB0HxXnK1y3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634132747, "uuid": "edc47a9a-721f-4dd3-bf8a-1a86eab641cc", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634132747, "uuid": "bb01dbc1-8de8-46c4-802a-7401399a4c08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634132747, "uuid": "5fe59a03-390f-487e-adc5-8d395ef264ad", "value": "Kd29Pu4e8yObdUv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2c2f8c-2c09-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634117846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117846, "uuid": "6bb2fc8e-2bd9-4e9a-a762-177096211123", "comment": "Malware payload (AgentTesla)", "value": "95698e9de3a04c9778b32695505115d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117846, "uuid": "a3ed7dac-0bf4-4475-bba5-7aeb729cdbfd", "comment": "Malware payload (AgentTesla)", "value": "eb113d83adcc796bfe1a06c28abe922e57d6673c7a0e07843d71002fac1ac800", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117846, "uuid": "adba824a-8cff-4fed-ba3c-9d55fcc1cb50", "comment": "Malware payload (AgentTesla)", "value": "8d072347da4448b7b7342eaf0d85c46fe6d7b634", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117846, "uuid": "f9f67d64-257e-49f4-bbf4-25129e59ff69", "comment": "Malware payload (AgentTesla)", "value": "723a301fa84b1fd1f0cfeb705a2434291da1bcecde0d5efc00581a8ea596f8f745ee29e6d402cd9056bd4cf4e310d816", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117846, "uuid": "da6884e0-ddd5-4823-8875-6afdfe86749f", "value": "T102A4AE3223E85750D57E937A143094A413F2BDA6F722C71E3DA872DE4D31B805763BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117846, "uuid": "a6b5ab09-ab2d-4c85-af46-410e885a7c8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117846, "uuid": "a05a20d2-4bf8-42d0-a96b-eb416683b000", "value": "6144:aseZOU4071p/IUiYm3EkVgwZvUkkBVbeRz+TxiTSFmwl33mBUqV8:aseID0H/zCEkOkh62Qxn/He8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117846, "uuid": "1411c7c6-ef07-429a-9d0e-34abafa17ce8", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117846, "uuid": "0c35ba0d-8a83-40dd-a30f-009aa7d84d54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117846, "uuid": "b726cdef-5a1e-475c-96b9-f5874be33906", "value": "95698e9de3a04c9778b32695505115d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34ad9df-2be0-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634100489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634100489, "uuid": "6ff7c282-b935-4070-8c2a-66c8dbb62ee2", "comment": "Malware payload (SnakeKeylogger)", "value": "7fc3d3787cc9efd18c01c11599c013b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634100489, "uuid": "9e0adc92-95ab-4977-ad5f-323d6a753c41", "comment": "Malware payload (SnakeKeylogger)", "value": "eb93c418892bb15265770d6b560e7a196a9897b65acd093a926578c64dbf7fe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634100489, "uuid": "bfbdfeeb-4b88-488e-a891-01f9881b5549", "comment": "Malware payload (SnakeKeylogger)", "value": "58179b71319dc2bc790c0f58d4818b33ed74eb99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634100489, "uuid": "9f802d76-b908-460f-a4f4-1c9743b5fb89", "comment": "Malware payload (SnakeKeylogger)", "value": "d3e5cb3889e8eafa9e41103e9f4d39206e40509719493d598d6ba90ac6bdaa8f2ba75a33202fcc9b17f2ab65c0d833e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634100489, "uuid": "1fce8321-aaf2-46b4-84b7-d829c5fa335d", "value": "T191B41203AFB1996BE5684EF20062D970D7B1DC81BE62F62A4EDA7CA737733D14052253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634100489, "uuid": "7f9e5cf1-8918-4fe3-9663-6d36157857f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634100489, "uuid": "7b17c301-f6b9-4b2b-8bec-4bbd35740fbf", "value": "12288:+nQBPkAx6NROqDJBilQe26XPtOL9Hl7RoYLievwvISB:+QBPpx6POqDrKpXPtY9HxRoY2evwvFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634100489, "uuid": "285e9d42-7d05-43b5-b16b-de011baa2950", "value": 541184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634100489, "uuid": "d57a1922-4690-4776-88f1-2360535bd259", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634100489, "uuid": "3798cb99-5640-4c1b-b8b7-05dd4082325f", "value": "SecuriteInfo.com.Artemis7FC3D3787CC9.2543.26072", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c821962b-2c28-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634131420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131420, "uuid": "c621453c-3aed-4280-805f-d340d19891f8", "comment": "Malware payload (Mirai)", "value": "7e547539a760523ff148817f96017737", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131420, "uuid": "acabb636-93bf-4e15-81f3-9d45701e77da", "comment": "Malware payload (Mirai)", "value": "ebd52dcf2a6b594887bb3894d7f9ad4254472aab1c2552509c9b9a1222d1f90a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131420, "uuid": "5aee383b-0138-44c4-a8a6-394a7371cc4b", "comment": "Malware payload (Mirai)", "value": "edc6f22caa74e8eb2dd61a8648b079987012dcae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131420, "uuid": "86a18e10-b52b-443a-88bd-23575c98308f", "comment": "Malware payload (Mirai)", "value": "94fd1d7e9b468f49347613d109f43aabb1aa4853bea474b41075b6989040a0a54f467a6fe403984e7a42b96ff03f8391", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131420, "uuid": "a98251ba-b60f-41e9-ad7c-f5746fd58e54", "value": "T1DBD3B53B3B270E23C0C910B111E74232AE75DF9B34B962936AD5399CAF365843956BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131420, "uuid": "96748b01-737c-4a56-9188-4cf80afbc99b", "value": "3072:U4uvTXgNPkhox7P2LlPmm/QMurB1nKGNb:/yElgo2pmm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634131420, "uuid": "6c2c3480-de36-4e07-8474-47d7744620be", "value": 132368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634131420, "uuid": "89b39888-930b-42a8-a9da-acc19951f019", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131420, "uuid": "22644ecf-bfbb-4038-8b39-0322013fd6cd", "value": "7e547539a760523ff148817f96017737", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6c17fa-2bde-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634099541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099541, "uuid": "1101d694-59d4-4b46-a06b-13726adefaa8", "comment": "Malware payload (Mirai)", "value": "745f46a6e14026c898e489e9f0c4441d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099541, "uuid": "f341771e-9c02-49a9-bc3b-a5947c9454f3", "comment": "Malware payload (Mirai)", "value": "ebdf46f0c0628b00285762468e85387b965263f6ad820ec90e51627efa8ada60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099541, "uuid": "9b9f3f0e-3900-4114-943b-d6ed732edf7a", "comment": "Malware payload (Mirai)", "value": "15ec6e23177482053f0a88131174f39b11e28b3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099541, "uuid": "122f3009-15ae-4b2e-a313-810b7c4aff90", "comment": "Malware payload (Mirai)", "value": "6b544513f9f626204ceec8d56237a501c592b98ed245d1020e926ba2b2779a7dc8c0bf7092de3176d7e8a96ef2cdf880", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099541, "uuid": "5f0276a2-2613-4c1a-ac51-cf38964474e3", "value": "T17973B309BFA50FB7EC9BCC374AA92712288D651A35A93F35BD34D418F25B21F15E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099541, "uuid": "4571b113-f90f-4abd-bc2a-540bfc0fb22c", "value": "1536:aHJtIFGq1QDT+uDEQhKvt191Yi8ZNFDGE:aHJtIMZT+UEQPi8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634099541, "uuid": "943d739c-ca0f-4b3b-ba8d-044cde76baa2", "value": 76904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634099541, "uuid": "54e0b0d8-092e-4c5b-9c3e-720628f22017", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099541, "uuid": "e4a4a11f-afcd-4beb-ad91-37132a38425a", "value": "745f46a6e14026c898e489e9f0c4441d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc6cc92-2c0a-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634118275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118275, "uuid": "92d571d2-6bd9-4e9e-9669-4efee78ef87a", "comment": "Malware payload (NanoCore)", "value": "b866823e1f8f4a52376bd108c457dd78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118275, "uuid": "47192571-e72a-4b44-a263-cb46a2e57dbb", "comment": "Malware payload (NanoCore)", "value": "ebe1bb18a77cf0b34d3ad06919a9adfff2aa69cfafa5b96b670534b890e3e2a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118275, "uuid": "bf262d5a-0ae0-4260-ba64-9e5f5fceac7e", "comment": "Malware payload (NanoCore)", "value": "fe99849ec27630463080445337798eeba8000a02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634118275, "uuid": "9543969d-8fdc-470d-adf0-d9d140f2a5f1", "comment": "Malware payload (NanoCore)", "value": "62edce8a5ece797cda27c62c06f544bc53c41558923c8c723bee800eb5fa0778b1cb6384d91adf85c4921c587a01eb69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118275, "uuid": "7930b866-198d-47c1-a58c-63e090b59088", "value": "T1B5351202B6C58872E4B359364A396B255E7D78300F39DB1FA3E0587DDF366806234BB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118275, "uuid": "031e9058-fb57-4426-9e14-7a73fc8297d7", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118275, "uuid": "17355672-ee05-4231-b036-8fda3a0e53ea", "value": "24576:rAOcZEhU3Pv6cxzVQ5WP1TKyENXWPI1sDx52gWbh9dlfQ:tEicRPwZ1sDxIrtG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634118275, "uuid": "ad18696b-8c86-4a49-bee3-bb0ffc9c2e19", "value": 1073384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634118275, "uuid": "2f397d76-7d0a-40ad-a62d-260b1643a92a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634118275, "uuid": "211300ef-3bd1-477c-afa5-7e894345035c", "value": "b866823e1f8f4a52376bd108c457dd78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9bc5e6f-2c17-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634124149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124149, "uuid": "ed66b0f6-f79c-4d08-8152-3b511fb7af01", "comment": "Malware payload (Formbook)", "value": "b670879d45e75eb7f88fe047f9e88e5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124149, "uuid": "caeb6a22-54ee-4ee8-9005-b2f7c5df4bdb", "comment": "Malware payload (Formbook)", "value": "ec427d5a521cdc4f2690ac7ffa883c982c4e3008991127998b0cfdf32f240f30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124149, "uuid": "4f62af29-4069-4a39-9fc2-4e6fba114a55", "comment": "Malware payload (Formbook)", "value": "7497d669a327aebf33ec9dd1c554444d4ee826cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634124149, "uuid": "007d08d0-445a-4908-bee0-18abcad7b6c3", "comment": "Malware payload (Formbook)", "value": "5af85624d960cd294bfc5acfe371a793c4f7a198c96b5cfff0bb6e730d3b441d1aef4690ae14cf1cf813c0e5f274cb42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124149, "uuid": "1ce986d9-0b15-4d75-bbb9-74b943c34271", "value": "T1D3D41243AFA695A6D11D5DB380A6EAB087B1EE40FD92F75A1DD83C773B373C004415A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124149, "uuid": "b7ac0748-80a8-4b4d-ab19-d14c8294f9d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124149, "uuid": "d106b0ae-77f2-4c68-8e93-5c8f0d0c0e8d", "value": "12288:LQjPkrSB8R8NmZHakSp3dB8ls0eOKsRJBOBnylN2:MjPpB+8AVaXr0JZ/KnKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634124149, "uuid": "7004a0bc-a37a-4ea4-b688-c1ee83130a0b", "value": 601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634124149, "uuid": "f8c80fc4-bbc4-440a-b299-624552d0a451", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634124149, "uuid": "7cc81843-d7cc-44e5-9cc0-806aba9ea8c2", "value": "010013.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72371a6-2c26-11ec-843c-42010a9c0014", "comment": "Malware payload (MirrorBlast)", "timestamp": 1634130587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130587, "uuid": "2b1009f2-d682-4b64-acc0-abc9474f251a", "comment": "Malware payload (MirrorBlast)", "value": "dffb3d323708f624dc3469e99c3adcb3", "object_relation": "md5", "Tag": [ { "name": "MirrorBlast", "colour": "#08A768", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "REBOL", "colour": "#9BCF68", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130587, "uuid": "af410aa0-dd64-43ea-9004-43d70a1ad4ba", "comment": "Malware payload (MirrorBlast)", "value": "eceb164a69e8f79bb08099fcdf2b75071c527b0107daebc0e7a88e246b4c7f13", "object_relation": "sha256", "Tag": [ { "name": "MirrorBlast", "colour": "#08A768", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "REBOL", "colour": "#9BCF68", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130587, "uuid": "5da07b6c-49f4-46b6-a742-bd7fe2a9a913", "comment": "Malware payload (MirrorBlast)", "value": "043620bdea4fd9d48673db8081ffbd9f25d1d8ac", "object_relation": "sha1", "Tag": [ { "name": "MirrorBlast", "colour": "#08A768", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "REBOL", "colour": "#9BCF68", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634130587, "uuid": "6a6d5945-3416-488d-8a4e-a61cdaba82ce", "comment": "Malware payload (MirrorBlast)", "value": "dbc5036a7ddecb36f5f1afdf7aee1cfe96b626d6d682c1dd7f137bf487c5a598545621d2320c8a010cba869a28d69298", "object_relation": "sha3-384", "Tag": [ { "name": "MirrorBlast", "colour": "#08A768", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "REBOL", "colour": "#9BCF68", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130587, "uuid": "70e1fa37-e131-4cfe-984d-2589f07091c1", "value": "T1F4C42347730A2335CE66437286EB87D28B343C416E988A166A53765E9F332C4F6773C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130587, "uuid": "e78d7f16-7de2-4025-ae54-766ff10a4184", "value": "12288:8j3LUk7ftIXeWc5ie52YOqhPS+KP/w1pZGGgCs5xu8Z:88aFAeWceYHPS3PIoA4xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634130587, "uuid": "8d84c83d-f1e6-487b-bea8-147f83972b3d", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634130587, "uuid": "bf79014a-8fcb-412d-8206-72a541dfea5d", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634130587, "uuid": "131d4a12-b07a-430f-95ed-cca4b371a21f", "value": "load.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323ebcc7-2c66-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634157798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157798, "uuid": "0a173e73-4f7b-44f1-94de-ed7eb34e8a99", "comment": "Malware payload (Mirai)", "value": "bd8589a129ab8679b4142294586d952f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157798, "uuid": "c5ab16a8-295e-4e05-b9a8-94724dbb5b63", "comment": "Malware payload (Mirai)", "value": "ecff18f697a136546c9c35e059b77d6c11773ab71a5b61ec32dcd592b7389e9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157798, "uuid": "df6e47d2-6c64-495c-a141-8a97db92ad2e", "comment": "Malware payload (Mirai)", "value": "a27b9da8aa6ac2d679d7653d4bd575058c59c253", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634157798, "uuid": "312829aa-27df-41b0-a122-9e7c2432bae4", "comment": "Malware payload (Mirai)", "value": "0b6cffbcd8fc75db0b4d52fbab1c7db5354c0e7f185d969424a028b3f866ca10bc13262d96939daac7bcdcacaa394819", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157798, "uuid": "c2a876e3-3884-4e50-863b-ad521ac7ea32", "value": "T1F6635BE5B801DFBCF84BD6B685270909B522A2454B930F27E367FCD76EF20949A47C42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157798, "uuid": "f439a188-9c4d-417b-a94d-5cc9e7b3b35b", "value": "1536:rsX5uU4vIS2OwAWdl1iFJnJLjGnDKCNYU7ob4D0k81AYp:rG0wX1iF1JLjGWMc44x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634157798, "uuid": "af4b4150-577f-4644-beb0-e6c8c9e90ae5", "value": 72376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634157798, "uuid": "09475606-be09-4bf5-ab56-297ee14682ae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634157798, "uuid": "9a59a365-90f1-4e0c-9681-6b1867eadc0e", "value": "bd8589a129ab8679b4142294586d952f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0788a270-2c50-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1634148277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634148277, "uuid": "b7408dd6-874e-4b3a-81cc-84332d138e90", "comment": "Malware payload (BazaLoader)", "value": "ba40d5aa9ba2419c25e7a0d8dfbb4600", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634148277, "uuid": "f99dc703-c6db-42e2-8e95-b8a68a4bcb0a", "comment": "Malware payload (BazaLoader)", "value": "ed0c061e3de7a017b87fab71f5b1d9e9fe8b8ac416e7d9840fd59d198b4869cb", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634148277, "uuid": "645224e1-aa41-4dce-8e56-96f96a3f4a8e", "comment": "Malware payload (BazaLoader)", "value": "e3bfaaf32386553768022a086d95e83fa571741a", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634148277, "uuid": "e4531c9f-62b9-4789-b65d-f38904a7926d", "comment": "Malware payload (BazaLoader)", "value": "3c80560461d2a09db729e672e67e66c900b86c00c994223907273358fb60ae131a8d75794c7577e54a946bc77fb20a92", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634148277, "uuid": "168b1858-8988-45d4-83ea-b1c8e3dd5793", "value": "T11DC49D05A6604473E81B923989A28E4BE2E17E597731D30FC3E1AF6E6F3B3535418F19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634148277, "uuid": "ee518c5f-41d5-4513-8d3f-422f0fc1d2ad", "value": "d6bb10bc6ca8af288c82745738f7c1db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634148277, "uuid": "7d6e21ef-b0df-4a6b-a36b-755673b870c7", "value": "6144:umUCbQC4Kd+yp5+H/OfQ1ezKfzEJ60vPeuG7T3VoOkcnwP1t6O/eVbnn6Y6726xV:bQC4KUkgH/Ofzy70vPfEQY675f2hIaYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634148277, "uuid": "2399239a-d5aa-4b37-95ce-6879f329cca2", "value": 585748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634148277, "uuid": "9390e4f8-fb6e-48a5-8f8c-16685c38a00c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634148277, "uuid": "6a53cdb1-8a19-4401-89ca-db009bac9828", "value": "Gsdqz.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07812f7-2c31-11ec-843c-42010a9c0014", "comment": "Malware payload (Cerberus)", "timestamp": 1634135327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634135327, "uuid": "0997bfa9-2799-4f43-af06-20dd6a1996e8", "comment": "Malware payload (Cerberus)", "value": "4fa14f8459004366b6dcb15dbb60a4ee", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634135327, "uuid": "2c7ec3f7-0206-41bc-819c-e0f42f757900", "comment": "Malware payload (Cerberus)", "value": "ee26a8ae29a4e353b10c787838638a4233f9adacf315b69fcfc6d8e6c3a0371e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634135327, "uuid": "bbc4cbe1-8185-49e3-9cf6-4b56d4117ca0", "comment": "Malware payload (Cerberus)", "value": "7c8b7b5866f5dba9a9ac858f5b627d96c69852e8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634135327, "uuid": "b8e0e9af-83ea-41d4-8a30-83af9e0ad043", "comment": "Malware payload (Cerberus)", "value": "5a08cf564e8a329cb0e96152a1836d9e52ae58f6032068ee0b4746bcfca51dedb4a8b4f62f918d9a7df43abfe32e9c5f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634135327, "uuid": "fcffdb9d-349b-4789-83ca-e0a025f22808", "value": "T19414128B6F14701AE4AFF878A7A593784BB4939C73C315A6193B9438EC261F00F5DD19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634135327, "uuid": "f1b9e089-9708-4018-b5a3-9f254cc7e3d2", "value": "6144:QykS1f4iZzI7iVLu07HU8tRJtF0b8qRJthR0R:QyB1ftz3Vp7zJtgJt3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634135327, "uuid": "ba112883-6720-4037-9794-0527b327190e", "value": 205226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634135327, "uuid": "920cedf6-f4a2-4bba-8f74-cd7e8ea1abe3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634135327, "uuid": "d46d14c6-0ce4-47ee-8343-e04d60251922", "value": "Android_Update_build_flow.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8498a054-2c13-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634122288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634122288, "uuid": "e5842bad-a2f9-4f12-946d-018ac6aa8211", "comment": "Malware payload (AgentTesla)", "value": "246b78329cdef1989c4f27b411312162", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634122288, "uuid": "3711b668-4674-4f28-9d28-e9975782fda1", "comment": "Malware payload (AgentTesla)", "value": "eeb14fae34a305b9bf24954715705b38bdb20f50d785383c0ab7d3ec4a28c1cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634122288, "uuid": "39eb8bef-6c76-4856-baf3-b23466401747", "comment": "Malware payload (AgentTesla)", "value": "b6ac11752aa87dbda5095f4906216dec11ec49ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634122288, "uuid": "b0159f99-1f7a-4412-b932-945742ffea90", "comment": "Malware payload (AgentTesla)", "value": "eb2545e39a78f828eef1c91ff1842edab382fd39ed2231f55a95897b14dc9147c4af03655e36132fe18be57efa72a3f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634122288, "uuid": "041d781a-d499-4e77-bd10-0cacc4bd62a3", "value": "T1D4F49415F3929C11E567567364E051E391092CC7E858833DEBB3BAA318EA3805F5CBEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634122288, "uuid": "ca2ad875-7903-4a65-9c5c-9eb534e8d56d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634122288, "uuid": "ec12c734-40db-41f6-a4c2-2287b6de6502", "value": "6144:Wyo3eVzVExarcrPrAKcrIzlakgN6w0lPvyN4EllRQi4thwrjoKfbcAG8l0qPmZOM:Wyo8LrCcIz/gN6L9vL66iGhiJJPI7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634122288, "uuid": "613c7daf-ab90-448d-b68e-cf937dc8abec", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634122288, "uuid": "b6b91d8a-2f4f-4824-81f0-fa7ce11a431f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634122288, "uuid": "ae41ce12-171d-475f-b36d-fd7e9273ad68", "value": "0000000588.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78cbf158-2c52-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634149326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149326, "uuid": "5b5bd07e-0dca-46b0-a736-597354cc7c02", "comment": "Malware payload (Metamorfo)", "value": "f5e4a2787690f32214c57da3ff412e34", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149326, "uuid": "b863cb48-1246-4015-8acb-a6454bd0a9cf", "comment": "Malware payload (Metamorfo)", "value": "ef69f934ac1a9a8f95504f9c13455ef0a5be0657ed1265b3df19559468796a8d", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149326, "uuid": "fdbc40fb-e559-4936-b98b-185dfda3c374", "comment": "Malware payload (Metamorfo)", "value": "25fc337c2c8f008b2af43f011bef5c551150b55c", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149326, "uuid": "deb9b0d9-5e3b-4f47-a8b9-ea09e18127e0", "comment": "Malware payload (Metamorfo)", "value": "708613e95615c2ae14d97dab499e550e3408bd0971f7462bac7eb95a967b140a3cd2e65dc644ea767f78f08f882fbe2d", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149326, "uuid": "70474fca-dd41-410e-ba6b-a94391feeb09", "value": "T1AD31CC051EEA0329C3B3CE7A10BBA2034A76BC51AE934F9E808487DA2851050EC34E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149326, "uuid": "b3e663fe-70bb-4e5a-8849-2f3fcfff7920", "value": "24:8+JUHRlVo5kcbA+Pucu+/P+P2kMw41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+mK5f1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634149326, "uuid": "25541fca-2ed1-4b86-843f-de579184e6c4", "value": 1562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634149326, "uuid": "e0348684-da7d-4a37-9f46-54deaa7480a4", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149326, "uuid": "df9c07e2-e06d-437c-ac64-d14a79dde92f", "value": "Anexo - 008131021.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c9dbed-2c1b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634125690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634125690, "uuid": "021aa469-a419-47f3-a68b-e7012d5dd5a8", "comment": "Malware payload (AgentTesla)", "value": "1dae68e30d02e6a06edd4daa95735f0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634125690, "uuid": "4b9b995b-0e59-4f61-889f-7b2b15ed48c3", "comment": "Malware payload (AgentTesla)", "value": "efbd6abe40e680c9fded2f8170a6d0e0bd9db8c81311cc6b6f9c4d89d56967be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634125690, "uuid": "087c8847-3634-4f8e-a08b-f4a1852f9ea9", "comment": "Malware payload (AgentTesla)", "value": "c44a482e9c9144f949e727dd2802bd3461b8bceb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634125690, "uuid": "f1a4ffbe-58fc-4d4c-a1c8-87218ea7c1b8", "comment": "Malware payload (AgentTesla)", "value": "98fd242d9e5912eacb459566765a0bcc1b0b55eb6efc969400743f783a98eb0d89dc60f2075960c4de82a27c472ad7b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634125690, "uuid": "05af02e9-569e-45ae-82bc-b2e19bed8b81", "value": "T1E445230227F08763D9AA27F9EAF05700A7706B47B909D74E3C4D31FE2B653914A507AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634125690, "uuid": "07278c55-cfda-492b-8688-c8cea62ff4aa", "value": "12288:zwyV1lzekhtihXIQi+5S046lrRp5W7IF+90RHXYpJSB:0yV/eoK/5DNH5W7IFqAVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634125690, "uuid": "df6de627-88ac-49ad-b1bc-7443272486af", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634125690, "uuid": "d62dc518-9670-42e5-86e0-ab32b43b20e8", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634125690, "uuid": "8b9d1e7b-b67b-42c4-9c95-ec21679cb6fe", "value": "SWIFT COPY.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34e7bfb-2c37-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634137855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137855, "uuid": "8694041a-20b2-45ec-b0ba-83090902d0ed", "comment": "Malware payload (Quakbot)", "value": "05b9dd05e497bf7a8935370954ef1e8b", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137855, "uuid": "7f4f78e0-db9a-42b1-a97c-61dddf7ae912", "comment": "Malware payload (Quakbot)", "value": "efebf5d864b6840e519d1a02d4fa84fe97f2a4e576d03442b9fdb0c57afa19b8", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137855, "uuid": "1bf08f3b-0a1c-4661-b65e-dedef5044b77", "comment": "Malware payload (Quakbot)", "value": "6dfb9d589d521b51bcaeeccdcf46d5070e6872b9", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137855, "uuid": "8b302f3c-136b-48e4-b98f-85fba5c26d68", "comment": "Malware payload (Quakbot)", "value": "1296b034e5d71c83f1fd23952a68ed674a0d3c91447efe9e9c2cf18586fb310bb7a070a4c35099deb819b14af47806b3", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137855, "uuid": "8e73bd72-a474-49b5-a4dd-1b86ab19c5e1", "value": "T152D38C427797CA4BE54813398EE3CADB3772FC21DE62470336497B0E5E7A6A08C17652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137855, "uuid": "9a4fe99f-e3b2-4ae8-b6aa-76749c98be29", "value": "3072:vk3hOdsylKlgxopeiBNhZFGzE+cL2kdA6c6YehWfGMtUHKGDbpmsii9GmZyAqgOb:vk3hOdsylKlgxopeiBNhZF+E+W2kdA6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137855, "uuid": "f5bd13dc-0d07-45d2-9b93-0d27885db9cf", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137855, "uuid": "cc689c14-84a8-4f82-94fa-7bdfe86d14c8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137855, "uuid": "3f761f17-4afd-4456-9c9a-e318db14e086", "value": "SecuriteInfo.com.Heur.19388.13782", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b65db65-2c48-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634144901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144901, "uuid": "6f31e417-e527-4181-963f-8d8849435a0d", "comment": "Malware payload (Smoke Loader)", "value": "78375b849e08715aa936026378f5144f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144901, "uuid": "b7ae2e4f-b4b5-406e-b9e2-1650416b831a", "comment": "Malware payload (Smoke Loader)", "value": "f0232cb85baaa1c6a56dbdad622acf2288dfa667e2506975289de339291b0962", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144901, "uuid": "ca443ac5-b5dd-4cd2-ac94-8cda464a61ee", "comment": "Malware payload (Smoke Loader)", "value": "93486ee3e98897bcf8bc0707797ee2ad3a027690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144901, "uuid": "f1345094-dcf2-432d-9657-a6bc4a914c52", "comment": "Malware payload (Smoke Loader)", "value": "dfe2efd6d42563f3c3880a9c844e7c187567d265536e6d73d1aca811786755596609c17ec9109580d39e12cb8f12f56c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144901, "uuid": "6d5f1b77-38bd-47d9-986b-9f5108de8e21", "value": "T1B0648D10B7A0C039F5F716F95AB9936CA93E7AA0AB2490CF52C516ED4735AE1EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144901, "uuid": "e7195133-7c2a-4641-bef3-3d569332b9e0", "value": "e9d1f1739ab48fbfe7c7128688524302", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144901, "uuid": "c70ce8f1-094a-42c5-9f13-008c14b2a4bc", "value": "6144:cmyjjewKCvCl2Qvh9Yypl/cTab6Gh+Nt8T:byjj+C22Qpxpl9b6GM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634144901, "uuid": "fb027846-e22e-41bf-b5fb-8c0c90cb1a33", "value": 318464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634144901, "uuid": "c1709eca-7fc9-4edd-b52f-1381961eeff0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144901, "uuid": "74e7b857-f69d-414d-acae-32014c1621da", "value": "SecuriteInfo.com.W32.AIDetect.malware1.10225.29162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ae3539-2c29-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634131678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131678, "uuid": "c0cc2805-d9a9-4def-ad7d-e6a34aafceb5", "comment": "Malware payload (Mirai)", "value": "4cbb6e09360bcae245a940181fea254c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131678, "uuid": "81be4224-f1d8-4084-9b87-0b6c28fcf5b7", "comment": "Malware payload (Mirai)", "value": "f0363196705d02410cb5791dda694ba2b6e212bc5486b89b0c785d60705c860b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131678, "uuid": "cd132894-d494-4065-ab66-f85c5ead936e", "comment": "Malware payload (Mirai)", "value": "9a876e39b62f55948fb87842a908cf5e2b8a56f3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131678, "uuid": "784307b4-e58a-4c8a-a0f7-9b8fbf199dfb", "comment": "Malware payload (Mirai)", "value": "c54ec8e36149b39ceee77c3f5253f98e2c88cfd163c8624bff010e29c92ffd08c447283f64e4a3d182dae928dd9e22f4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131678, "uuid": "cf5f9fe8-f6e1-4eac-b22a-0ea5e9d81b94", "value": "T135C327336651C926C04755F426EFC5729D23BDBF0B7A305A33D87DA4AE368C64E98B08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131678, "uuid": "c8777364-82c3-416e-a217-b717cbb1ee1b", "value": "3072:Hir38nE4o42Jf5rml0qbM+pCjPRPTA6rdfgm7FnVqfJXFWbNb:tE4o35pqIhugqm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634131678, "uuid": "0acaea16-576f-4753-bab8-8b190c81ad0d", "value": 119287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634131678, "uuid": "0050e287-047d-4fe9-803d-4d6938a8a045", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131678, "uuid": "e5f17046-56e7-40f6-8406-04987ecce414", "value": "4cbb6e09360bcae245a940181fea254c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d30ebfb-2c6f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634161708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161708, "uuid": "3c2ce7b2-5240-4004-8a64-8eae57c24345", "comment": "Malware payload", "value": "2fd3f28293a968ce7c70399c4d2f581e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161708, "uuid": "9ea1d293-c615-48d2-9f7e-251825634620", "comment": "Malware payload", "value": "f054686e52755d85a927f507d96db50220036c379ee03507bfac39370e45a56f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161708, "uuid": "90e8fd23-1384-478b-80d8-f2bb9c44eeb5", "comment": "Malware payload", "value": "4530e1659a696734646ea8553a3c260680120b7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634161708, "uuid": "faf32ba6-6721-49a7-ad36-1188589e047e", "comment": "Malware payload", "value": "2270c33a0d556770be742727151e3feb25b41be0d14c5d42fc7db486da31b44054222a78aef3f426fa74d64b4ae20419", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161708, "uuid": "449436af-72a8-41dc-a625-107d647dbbcc", "value": "T1FFD3953EAD314F6EFAAD8334A7B39EB19665229A3395C34CC06DF9103DD0689544F3A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161708, "uuid": "4543bf6b-6c22-46ea-9877-cbba80ec756a", "value": "1536:cBnd7cdacdedsdVcdc4bgsBqHHCj9+MJd8uFD7zbjk+oGTrM4TreehZrvEb3y:Igsgn48Xq7zbw+HTrM4nFrsry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634161708, "uuid": "c2e2c775-846e-44c3-a880-ef8578a60ea1", "value": 130700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634161708, "uuid": "2993ba5b-7ac5-4161-910e-0145de003df9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634161708, "uuid": "bb12ec4a-91a7-4ec7-8145-11d491c6c3a5", "value": "2fd3f28293a968ce7c70399c4d2f581e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec85f06-2c37-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634137847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137847, "uuid": "207a34dc-c0ae-4c1f-a729-5dbdfe971929", "comment": "Malware payload (Quakbot)", "value": "dbbf65a70841fc5df66b31bcca42fc3d", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137847, "uuid": "ad66e58a-1f59-48cb-b434-704d7ccb10a0", "comment": "Malware payload (Quakbot)", "value": "f0c66d605df8bf0f91c36f968dac5f9b825ef98128f4133ceab5508a89b60d56", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137847, "uuid": "50dd4e19-b952-48f9-8dc7-12607e17ab50", "comment": "Malware payload (Quakbot)", "value": "1a43e6665bc3be0d262fbcfdc847a3f4c6aeabb6", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137847, "uuid": "44faa7c8-1256-4fb4-b180-40199c17071a", "comment": "Malware payload (Quakbot)", "value": "36cf05049c556a0532f5c97a84e286838fcd216435d331bad54f0dcaa2b1be0c9f2b564dbc87fe48b8c5ce5a355d2c68", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137847, "uuid": "20045421-2c9f-4861-a389-993ef7d2b142", "value": "T1F2D38C427797CA4BE54813398EE3CADB3772FC21DE62470336497B0E5E7A6A08C17652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137847, "uuid": "ad49e7ab-d5fa-4dd1-96b8-2c8ab134b84a", "value": "3072:vk3hOdsylKlgxopeiBNhZFGzE+cL2kdA6c6YehWfGMtUHKGDbpmsiivGmZyAqgOb:vk3hOdsylKlgxopeiBNhZF+E+W2kdA6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137847, "uuid": "096b58ad-cee7-4378-8a1d-ac32a2c76eab", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137847, "uuid": "86ed205e-a447-4b9a-a445-3da479e1e423", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137847, "uuid": "ae92ecbb-d689-4f98-973d-03f85ca5226e", "value": "SecuriteInfo.com.Heur.21879.6497", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c63518c-2c11-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634121308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121308, "uuid": "1d68ac89-9098-4771-81e2-419b8f02c68d", "comment": "Malware payload (Mirai)", "value": "38da16e0c937a81be82d4631a0a1776d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121308, "uuid": "9a18f33a-982c-4701-8ad2-c4a5aab7e029", "comment": "Malware payload (Mirai)", "value": "f0f215d26e5aa6cd749db53e3f96ad8d24c9a2f0692e6c804adf1602f6ec3147", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121308, "uuid": "dca70ccc-c234-49e4-889d-4020c129b533", "comment": "Malware payload (Mirai)", "value": "5561f6b14a641f60d54d7fd7d3924d3f8f46c64f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634121308, "uuid": "a33a61fb-b39f-402d-8e04-a2f29f62ca8c", "comment": "Malware payload (Mirai)", "value": "7e56cc17acd2821a6e268d2d084cfa116e262577c0b2818d291e465ea2658b947f586dec03907414e42a980efd3da6f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634121308, "uuid": "c93b4e4e-b5ad-4c9a-9788-6bd9bff3b5f4", "value": "T1C8833A81FD809A12C6D4127BFB2F518D371613D8E2EB72039D259F6437DA92B0E7B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634121308, "uuid": "406f99c6-6269-4ae5-bf42-a2dad56f2d0a", "value": "1536:oViklC4E684h+8D0jH+VFVDbKnK1f9Qdgmm7Eu8cjwFB1b0utvEjQ:oVimDSUAQyCm2Eu8cjqlfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634121308, "uuid": "6b7838c3-f0cd-4323-8136-46108d053079", "value": 87396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634121308, "uuid": "c71d0b8f-8afd-4046-9f6e-910606586e47", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634121308, "uuid": "3a910b01-992b-4834-b6c0-3c32e394033f", "value": "38da16e0c937a81be82d4631a0a1776d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a5f195-2be7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634103417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634103417, "uuid": "8fdffa53-772f-45c1-af37-56803a007c99", "comment": "Malware payload", "value": "c0191f7905947b8ac0ab62ac70c2118d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634103417, "uuid": "0530d8af-05be-4e40-906e-abb865947db6", "comment": "Malware payload", "value": "f12f4f8064e33f458acd1cb2c6c0aed335987385cf8541e71c096fe22a7b7e9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634103417, "uuid": "c4fb15b6-019e-4456-a960-ee562ec78793", "comment": "Malware payload", "value": "9b237f521b1cf648366486dab35493154b01f00f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634103417, "uuid": "8b518629-8650-4001-a03c-942f48f463a8", "comment": "Malware payload", "value": "abdf7047a11f176dce72b0e132bfed13714302225bcea67e52e713de481a13435f5980f0ffbcc3b09bfcd6284845b5bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634103417, "uuid": "d79f030d-04b6-4107-9920-ce36707a49cb", "value": "T13DB5336FEF00B836F6440A7278E8766552468D1BE68B397E32D117F01B492728D12E7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634103417, "uuid": "6e20e6c3-dfb4-4ee5-8613-44965ba114da", "value": "08ce2bb5c289c22487015109b09aeba3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634103417, "uuid": "02b180a9-9139-453e-a609-fd351a2be6b0", "value": "49152:BeVq3A99F62ZyjzWH9AasGFlnwMs5bGLLWRKXFKKc6HOP8qtP1MVh68UfGrMnAh0:YV79Ou2+nwMsgLLWYXgK4t2VI8U+rMnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634103417, "uuid": "442374a9-0b70-4ae8-b1dd-40e72b6beb94", "value": 2467840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634103417, "uuid": "0edea02d-d2ef-41fc-aaee-12a3dfd71a7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634103417, "uuid": "36e617d1-5706-4275-962c-0b03e0023c19", "value": "c0191f7905947b8ac0ab62ac70c2118d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25cec016-2bec-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634105378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105378, "uuid": "c22e5b51-5e8e-4257-8bb4-aabbae65ca5c", "comment": "Malware payload (AgentTesla)", "value": "b086230efe465f1935f5faccce4c77a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105378, "uuid": "df145050-1840-434a-a149-63ca50bece92", "comment": "Malware payload (AgentTesla)", "value": "f13a089e15b22e094bf83593716bf4450b8ea5e682f01af0b6620ced6cddf628", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105378, "uuid": "922c37bf-7b45-4821-a749-719d2eebc437", "comment": "Malware payload (AgentTesla)", "value": "ceba8e0c2f007ed3fd2d8e7597870c64a80bc513", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634105378, "uuid": "02809ddd-83d5-458a-b3c6-aa7aa2a42e8a", "comment": "Malware payload (AgentTesla)", "value": "dbb9c9fe02c6eb1a2bc529de4f8e64428bfb2d890aa314b75d95ee7d3f995a57242691370b93d2f5e1b8196337db295e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105378, "uuid": "57bf8d61-57e7-49e3-a389-a12f51629867", "value": "T106D41263AF709C97D5A94EF700A2E53083B1ED91BD12FA2A9CD43EA33B337D50850566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105378, "uuid": "f7a9d61f-5283-47ca-8bcf-4212b68a5161", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105378, "uuid": "87cdaf87-1334-4f90-aee3-93698dd5b280", "value": "12288:/qmfPkISBspLqsEESarSrgozHz+PkJkhjSo8BXOv4ojl9hrKE:xfPGBspus33r4zT/ijSMTbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634105378, "uuid": "7adc4b6f-938b-41c2-b508-1c0fda8d5a2c", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634105378, "uuid": "0b38748e-710c-4355-bb5c-f9be0a7d8f99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634105378, "uuid": "f4c09b31-07f1-4120-bf2c-5cdd876b8fea", "value": "Wellis Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41249683-2c09-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1634117880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117880, "uuid": "7c14c0cb-181d-4d87-bcf6-17036982335a", "comment": "Malware payload (TrickBot)", "value": "c7cd2b6f69821366c5d9e235971a1268", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117880, "uuid": "9ef1d1ee-b0d9-4a69-94c9-70eacd4e5bae", "comment": "Malware payload (TrickBot)", "value": "f14c7926c27a7ea9fd096db1c9a13a6ddf04a3179240efa1945babf98cc3388c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117880, "uuid": "87e7e888-d375-4a0d-9d5f-777565f69db3", "comment": "Malware payload (TrickBot)", "value": "7cd6d5b4fb7d0aa37289d2a5207f3f879da3c024", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117880, "uuid": "bcb2e5f4-b099-4446-b4fc-2a6b9594a9f1", "comment": "Malware payload (TrickBot)", "value": "0100e771635e03a0e7efe8c99670e9da6f9ec54f6230408ab30a1c657f5f10481c536aeb775b873b74d15e4efe7ef923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117880, "uuid": "06029a0d-b0a2-47ab-a21b-19c22de05857", "value": "T156C4BF273850DCF2D1012576C9A2A3F5AFAC7A185FD3511BB3901B9ED9318A39E305EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117880, "uuid": "62cd8713-a4cd-412b-a41a-5e8f5df3a7db", "value": "ffc20f0bbd3f72a6061b1c2845bbf7b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117880, "uuid": "27193af3-634b-46cd-be98-6651b9daee28", "value": "6144:lJsQ8zcWR976/Urs+zmrY6v9w25rcv4hUhYjSUkPp5DIbT6oweUis:bvOR976wa5lZAv6hjA/cMVis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117880, "uuid": "40a6b1bd-d847-406c-bedd-b0d8925fbb5c", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117880, "uuid": "848af2a2-7604-4c64-a83f-966f032a7b3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117880, "uuid": "b040cec6-c37b-4d0c-a59b-5d7c2e15a63e", "value": "c7cd2b6f69821366c5d9e235971a1268.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23a9a2d-2c5e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634154603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154603, "uuid": "2fe021b3-cd33-4128-a036-edc7d0b5cb96", "comment": "Malware payload (Mirai)", "value": "b674a4e7c2e755c5af73025a6649707e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154603, "uuid": "acc168c5-9508-46eb-a59f-0abad85b3a6e", "comment": "Malware payload (Mirai)", "value": "f19270eb2efd46bfd1dedae21cb8769d880ce0cb455b5d92261bd0bccedb76b1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154603, "uuid": "2c1f7794-53c5-4a5a-9e4a-111ad9d18662", "comment": "Malware payload (Mirai)", "value": "2d2d4a163e8a34bccda077ce1df718367d4dfca2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154603, "uuid": "47e47667-e611-41c8-8d75-7260908b2fd3", "comment": "Malware payload (Mirai)", "value": "96ba49045831d6ff0590a327f8393f5d852ffcc78755b2fcaa75aaf97194035b921fa71d95676675f428235f8f28d41f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634154603, "uuid": "f94362a3-4a90-44ac-ac5b-c53429d40954", "value": "T1C6D2E00AA00B594BE918737732CB6DCF98D87C00130FD720E93956DAA2D3566BD35B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634154603, "uuid": "9be31e53-789e-4914-bbc2-09615b1c3b48", "value": "768:tq5xjULWe8WVvISrD9n76UDEqZpQeJEerhmg8:tq5xjAh8WySf9emZpnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634154603, "uuid": "8d72d81f-1f11-43fc-b4a9-c1939341326a", "value": 28916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634154603, "uuid": "4a744445-ba56-49a3-9d0e-a36acf43cb81", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634154603, "uuid": "99921d3d-5e6a-4ba2-909b-cad5607a3bff", "value": "Tsunami.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1531e2-2c48-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634144931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144931, "uuid": "60be8495-722b-4005-be20-3504a35c9db9", "comment": "Malware payload (AgentTesla)", "value": "3a6effcf998b47d5fd0e6109edb56c31", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144931, "uuid": "bcf2badb-e89e-4307-970b-e101d3edc2c8", "comment": "Malware payload (AgentTesla)", "value": "f2154cf4be2684ec34cab38bacff70beeec9a82f1f016624a365cef6f34b167a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144931, "uuid": "dde3732e-5aa0-4754-85c8-be6794a2f71d", "comment": "Malware payload (AgentTesla)", "value": "aab36926d8c10e3f1750c199e62901e379348d8a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144931, "uuid": "239ebbe3-fe8d-4b90-96ea-0c0766b8f9bd", "comment": "Malware payload (AgentTesla)", "value": "81df71e44ad78f287449ed49c7edbe75318f075093480459ae48aaa5ee034ff1f8ee4deb091cc116d5ad82b206690ac7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144931, "uuid": "ef1b887d-c53f-4f3c-9184-d78d3831a075", "value": "T1AA641397F2E82877EE431E3195BFDB41D7BBB6041020A35F8354AF372A6CBC65616881", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144931, "uuid": "ac5adcf0-10e8-42c3-af8c-2486fbabfb55", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144931, "uuid": "efa1b239-7c6f-4efe-bb7d-bc01d28cdd64", "value": "6144:wBlL/c8mj7cXTc1ocgFBTiygJXhgQRXFssGwS6NWimzccVr0MPLWz1Ww:Ce8AcDcH0tiygJXhgQR1bBgpPpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634144931, "uuid": "4a34337a-3b3b-43a4-836a-b87451bcc35f", "value": 316440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634144931, "uuid": "18171ca3-6c3a-4ab8-b78e-c02a85689b0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144931, "uuid": "8dea2fc5-1b7e-4e49-a93d-363b00cf7828", "value": "3a6effcf998b47d5fd0e6109edb56c31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b8e0d0-2c70-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634162307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162307, "uuid": "af6a5b65-933d-4a94-b82b-2e1d1ebd09df", "comment": "Malware payload (Gafgyt)", "value": "61070772be86ae51222bbf84082dd489", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162307, "uuid": "02b96672-9762-4e71-8777-ee9c5261a3fd", "comment": "Malware payload (Gafgyt)", "value": "f343a459647f37581940261e12deb3a098eed230514a00ea6b19102f9be8c6e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162307, "uuid": "cccf62de-d1ea-4548-a1c5-9059285a6d6c", "comment": "Malware payload (Gafgyt)", "value": "359319d13a5eecb9f5bc56144a9788a6afc9d842", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634162307, "uuid": "7688b16e-e2fb-4776-b1fc-34eee970782d", "comment": "Malware payload (Gafgyt)", "value": "65981437465a7b56ba2ae7fb8c261f011bf753de325ce6b53145abf5ccc6ca447a25804bb24d5c96c65f85f5b5027975", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162307, "uuid": "99b9dc40-47e2-44da-9fde-6e7e97cbf609", "value": "T1FE934C06F8419753C1C327B6B7CF47093B3667B957EB330266386FB02BC67991A25A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162307, "uuid": "1e544d38-eece-411e-a508-25f1fc2acd6d", "value": "1536:ZvgGLI1gX3JGQxPuwjxtOZyO5hXNKV6T/Fo2kjvVqQEqn/lJXCPe:tIHQjjS5hXNKV6T/cjvVqQEqn9JXCPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634162307, "uuid": "d2d2a3f0-ca9b-4c7a-a31b-3fe80aa8803b", "value": 96620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634162307, "uuid": "301c54e1-507b-4515-a53f-a1a426f75046", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634162307, "uuid": "7b5b838a-b64d-4a61-84b3-4c50385be4f4", "value": "61070772be86ae51222bbf84082dd489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b559797-2bda-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634097603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634097603, "uuid": "90dcf4e2-384e-4517-88b0-e8160c112f2e", "comment": "Malware payload (Mirai)", "value": "3e9bedda95a380f762f7fadbc8d9371a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634097603, "uuid": "d0bfb201-7f61-4b4d-9e6e-23f343a92623", "comment": "Malware payload (Mirai)", "value": "f396d08eccb3ea094a89b38514bb483b06cdb7acaa518b8a16cf97f5ca568414", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634097603, "uuid": "8d06f4fd-ba6e-4ad4-af46-3202ac414f56", "comment": "Malware payload (Mirai)", "value": "78cad3fcd540a9d0e4a859aaee90dcd93c1b0f55", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634097603, "uuid": "740bc8d1-b198-4496-a4b6-d59f78554341", "comment": "Malware payload (Mirai)", "value": "1e1ad8081e603db3cd2b6f7b7ca05e5e0b90d787b127fdece05612e28864e250ec5d20778a8123abe6ec8ac1f9919e92", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634097603, "uuid": "032ced8a-a0a4-4666-8d2c-f016e027c207", "value": "T130D34B46EA808E13C4D5177ABAEF41493322E754E3DB730699185FB43F867AF0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634097603, "uuid": "fe34c22d-0cc4-460f-a37f-63874afbde43", "value": "3072:uw9Lg2RRhpRM54yaRF230tuiC/gH5CEuqTH3l2M/9CIkYj:d9LgaRhpRMqzG+uiC/gZCcH3kM/9iYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634097603, "uuid": "477037b9-6356-435c-a5b3-1346f6ec43de", "value": 131898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634097603, "uuid": "af43eded-ec06-4300-affb-2ca0c5ff5135", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634097603, "uuid": "568d6e59-d5c0-4743-97b5-f1019e3f5d74", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd734c51-2bf1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634107807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107807, "uuid": "968d0c36-b1c9-4d2d-9ca5-17aad72a1542", "comment": "Malware payload (Mirai)", "value": "8293668c3ecfb0a4f9110e49f4847044", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107807, "uuid": "30be3dce-bc2e-42fe-b018-d04da90e114e", "comment": "Malware payload (Mirai)", "value": "f43b5ec86eaf5c87ccb3a202a15b6d7a7ddf4f367956913a3a4185f4605fa391", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107807, "uuid": "5e0fbd2c-457d-4ce3-be6e-adfb8793cd87", "comment": "Malware payload (Mirai)", "value": "6aa99cb5e7cab6a74803cb958e753c2e175a3aa8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107807, "uuid": "70c4983e-12e1-4dc4-9504-ac19c481e491", "comment": "Malware payload (Mirai)", "value": "444ac4965202778cf621a81619536279f1d430192e277e040a6ef84af4f93b4d67f34d2af0730e3191a1d1a900da838c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107807, "uuid": "b4eafac2-0f83-4d92-ad51-11fdc6b27402", "value": "T14913E1E7396221235E90B97CFD5F88E236474DF8C1EB61172528E8F42E0772A1678683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107807, "uuid": "b0265c4c-8ce9-4578-b38a-e5e33e6d8bd7", "value": "768:BxnVnfKQvyMaVMu+im6SK0+pKSRm820vh2Ci98JWCrMm0QIs3Uozv:RnyUQ9oZ+hS0vh2t8mmt9zv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634107807, "uuid": "0632eaaa-6fc9-44f9-acb8-fef14e1cdf87", "value": 44060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634107807, "uuid": "0998d3ae-10a7-4e02-a5c8-40b6cc54d1a8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107807, "uuid": "29c36c37-0cf1-462f-b6c0-139336dbbf19", "value": "arm-20211013-0650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4f1815-2c2f-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1634134461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134461, "uuid": "ca28c098-390d-4f49-ab69-0c75d22898fd", "comment": "Malware payload (AsyncRAT)", "value": "81328cb4752e4a26c4a0f9f28ef2644b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134461, "uuid": "4b82348b-7852-4b80-b278-7a7747c35f27", "comment": "Malware payload (AsyncRAT)", "value": "f54229e39a2b3b55eca168f9c0bb6afc072db8f482b047d7236c9f4d282e965e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134461, "uuid": "b2b4cef5-57a1-43a3-8d14-11efb7e454d3", "comment": "Malware payload (AsyncRAT)", "value": "b32baa01d3d0b9d740f14af4ee4944cad4e16380", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134461, "uuid": "de3d5640-c7b8-4ced-b1af-8a4e53eab021", "comment": "Malware payload (AsyncRAT)", "value": "20a422dfae6df1b85db40b72bcc68a169c4d344f87b028fea2327f56290d4651d0ec43495f653cb6f8cf41e500c03570", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134461, "uuid": "350dca70-11c4-47ab-8859-9c44e3996f10", "value": "T1AA71F829F24C7853E78720E594483E2E01AFB14666C7E8B5F09DE9D50B6799C6C3B828", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134461, "uuid": "616ea7c9-2ed5-4f12-b317-5bcab48d7982", "value": "96:f2sd6smFL0mtsTkwYCiyRBfTlCkHSb2EuJJWNnNmfgqwi:f2se0bkBFyXf5NHSb2QNzqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634134461, "uuid": "d3b8db77-0811-4849-81d8-7c3a5101c1d9", "value": 3740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634134461, "uuid": "326b2c34-d9f8-4690-9f90-8afa35d2db91", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134461, "uuid": "f0c98d68-1432-4e02-997a-06451f9fc340", "value": "Building Inquiry 13.10.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c59efb-2be5-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634102429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634102429, "uuid": "d2f3ea08-46f9-4434-ace0-e091f6dba3a2", "comment": "Malware payload (AgentTesla)", "value": "b772387208e2bc581bd9758fcf1399ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634102429, "uuid": "8c7757d4-d67d-4465-a965-7d5e2ed836cf", "comment": "Malware payload (AgentTesla)", "value": "f5975138fbd005ad1399f0f2623cff56d494f138a207156e272c85e6e3e77445", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634102429, "uuid": "cc406b88-c2d2-4bad-9eb7-7fcd8ee56514", "comment": "Malware payload (AgentTesla)", "value": "a3159e22c2c3e447f9f025d4cb34afd54cb4bc5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634102429, "uuid": "98e123fa-67dd-447a-bd76-a426d12d285f", "comment": "Malware payload (AgentTesla)", "value": "74b97d230dbb071ee1a6b142755de2623b44a61762a4f220fd6cb0c4f69e1a9d2b4240b87a29b16d3159ce27f446323b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634102429, "uuid": "b26af511-fb96-41e3-b367-db482277f609", "value": "T186D41292DFA1D99BC2A88EB661A6E870C6B0ED417E66F3146CD17C6B33337D00885357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634102429, "uuid": "9b6d87d5-7ea4-4cd0-b367-f4619fdde96c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634102429, "uuid": "a9b66570-05c4-4faf-baa4-6a1ce1b19527", "value": "12288:EmlPkiiX8Wbq8ue0L/5ziICS55k9LJl8OSB:zlPVGhFUL/dRk9Fl8TB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634102429, "uuid": "ecee13fd-5365-47fa-8586-8165bdb53e77", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634102429, "uuid": "b8e19c7f-19bb-460b-9732-319c4bb124c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634102429, "uuid": "5e750efa-800f-4caf-8212-70314f061a71", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86815a1-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634108658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108658, "uuid": "68d51929-605c-4073-84dc-c787f32041b8", "comment": "Malware payload", "value": "30c4bc282511f58533ba590cfa87904f", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108658, "uuid": "2e2b006c-d9eb-43ba-a495-3a85fa94d7e4", "comment": "Malware payload", "value": "f8143a530dc56fd0493a1ea8dccd99c2b4f0b2e43cdc2596a22f3f3a1a19dc35", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108658, "uuid": "f188806d-7cb9-41a2-a29e-44d2cf6095a4", "comment": "Malware payload", "value": "4e62dc4c9dada802a26d6a9efc0f20890124020f", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108658, "uuid": "cb1d3f82-b880-431f-a987-f33c904a06c4", "comment": "Malware payload", "value": "a30850a8447dd1a8d9557eaa931a6589cc28efef7671bd3185f442424314fb97fb35c5509a6b48e4a866667347d7f840", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108658, "uuid": "78cebb6a-5107-4a13-95cd-1765e8ea294c", "value": "T16782DA3015F55882A13B4B496278A85B73F41CFEB58474482C37E8C71AF7F8D1EA8D68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108658, "uuid": "a8b4e6a4-2a28-465b-9274-21998503c538", "value": "384:p0PCy5pvjSNN0ZtghL05Q1Vtg0o9WddzVCrTh7gSL8KPhTCWvX:p2SSgt9P+cLIOWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108658, "uuid": "678efce4-8161-4bfd-9da2-23258c2b5db1", "value": 17804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108658, "uuid": "04c8ac7b-2267-4613-a1c1-ef6f99d68154", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108658, "uuid": "49c9697f-7ed6-4218-8f2c-d3c2bdf3e0de", "value": "FedEx_00000216219.doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e061c83-2bdd-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634099138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099138, "uuid": "2d7254bf-6d53-4273-a328-8aafad809cbd", "comment": "Malware payload (Mirai)", "value": "60f939dc0be1f760bbedceeca842f116", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099138, "uuid": "f1fe9c90-899a-4904-b5a3-932858b80a6d", "comment": "Malware payload (Mirai)", "value": "f82715b58ac1cb1bd6d82518af2eaec7993dbe539fd5b43936f9f017e1b5c715", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099138, "uuid": "b8e3ea12-a209-43d3-882a-f09f7c8d65f1", "comment": "Malware payload (Mirai)", "value": "eb662aa573c03b727afc249281f53835b258d21e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099138, "uuid": "de0877c5-eba5-4334-87ee-25aecbaa43b9", "comment": "Malware payload (Mirai)", "value": "91d25a6b2334b42e1bd6d412d3f3f4d9b23131804e78a40be29fe11cdf799fad5cdf2f446249489f0d2a3719a9c52c9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099138, "uuid": "2fcea577-79df-4561-b537-3fa0feeeac40", "value": "T1EE43199178D19A16C6E423BBFA6E40CD332563E8D1DF32179D212F1177CA82F0DA7A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099138, "uuid": "b57dfe1e-c4d0-4b46-bfbc-0fb1ec7bf16d", "value": "1536:EaDIpuRZhJRAAMA+xVZtWaWhK3+y6MdD:EaIe6ZtWhhQ1dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634099138, "uuid": "e82cfc75-2873-4470-a42a-cdfb3799c01b", "value": 59988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634099138, "uuid": "42561b3b-166b-4779-97d8-87b2ccd3714a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099138, "uuid": "8683b62e-cc7e-463e-ab05-ba7b7dc31691", "value": "60f939dc0be1f760bbedceeca842f116", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3c3793-2c36-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634137497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137497, "uuid": "e66b0a7d-d6ff-4d52-a381-25a31b8d5187", "comment": "Malware payload", "value": "238c81fea0510868dd3d8764a1650dda", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137497, "uuid": "9f8605e1-8d45-47e5-a8cf-49952c73e758", "comment": "Malware payload", "value": "f8487e1142badd3f7ce0a58ce77c17938083b9b57f805f48723bd73b077f53f4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137497, "uuid": "d88f2212-101f-439b-88dd-ccf510f421c2", "comment": "Malware payload", "value": "0c72e0ec782a4e5fe80b0def4c3a7590f268ec48", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634137497, "uuid": "e2d3df65-acf1-485e-8399-695f80cfb455", "comment": "Malware payload", "value": "d992fbd26767d7899a2a61800df29ce7ae84785c8c82f69c2cd364aebd01ba59a269e271f4e51e787dff51e4017b54a2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137497, "uuid": "7358eaf5-60de-421d-9d87-069fa778ca1c", "value": "T10F84B0B4B1FCB15E5E93CAA49B3648CEE9FDD272F374DB91B1229410E1D9C3285648B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137497, "uuid": "e16677b7-976e-447a-bb15-e4d7ea33f0f5", "value": "1536:r7IpJD/OEx/aFaTdY4T0xZZWfrjzBRUP+7sjE+/xt3XhlATxaH4b9xcw21j/pLo3:r7/Qwlj/xosWddZhNVbqg4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634137497, "uuid": "8b0756d7-9849-4c09-906a-1850760f0ca9", "value": 398075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634137497, "uuid": "4895358c-4c41-4c59-85d2-98112ed7f94f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634137497, "uuid": "60b86304-320f-418d-bced-911cb3d78493", "value": "STATUS_ENQUIRY_M0813100411650_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d868f8-2bf3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634108392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108392, "uuid": "3a605188-a446-4edb-b3ba-5a7193a78b12", "comment": "Malware payload (Formbook)", "value": "b21b088d12787311f331eac08a45cfa0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108392, "uuid": "92417509-627f-44a3-abba-005230828527", "comment": "Malware payload (Formbook)", "value": "f8e5931926034fb027649ebd98867c41315b44bd05c7bb56f5f506a170162010", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108392, "uuid": "6b4f09fa-e7c8-4cd4-81e3-554d8c39500b", "comment": "Malware payload (Formbook)", "value": "0b4c9590dab94b7c84d788d27d8f4522395b961f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634108392, "uuid": "9e161548-b1d2-47e1-819e-830cfcaf02b2", "comment": "Malware payload (Formbook)", "value": "4463a000c7bf67642c444ead50e5e3d41e91901d1230849bcda1e5e931cb3abc38599d4f6a148916f1936c3767ce83a9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108392, "uuid": "801a936c-977a-4208-9f57-df412d6315a0", "value": "T1D174CF1AA483E045EA33457B94154D461AC9BCF1816A13CF7DF8FA7CBE709FA222B744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108392, "uuid": "8048f750-4417-4399-8424-f9df24a51678", "value": "6144:4JL8lLclpTXLbYbDocW5Udkflv6rFRIyUIoitRweaQJZXIeIR:4p8l4lVXQb3yLtSrFRUcKeaHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634108392, "uuid": "d92b1083-091b-40bc-8a12-8f88e1ce65b1", "value": 343000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634108392, "uuid": "24cd4edf-a13e-4e35-99f2-524c9e737512", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634108392, "uuid": "df11ec64-3fb3-49d3-aad4-1d57bd51f305", "value": "TransportLabel_1189160070.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f011457-2c09-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634117903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117903, "uuid": "59278e16-a50d-40c7-9c40-9387ae719c13", "comment": "Malware payload (Smoke Loader)", "value": "741f960ae2f91ba7b632f472e1995d63", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117903, "uuid": "b1793269-d203-43fc-8e0a-6fdbccb6a1c7", "comment": "Malware payload (Smoke Loader)", "value": "f901f95b307d303778cafcb4b3158b8e4afd6b001c55461165fb55bd0c1fc29e", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117903, "uuid": "beeed72e-0184-4dc6-a7a8-bb64fa3fac89", "comment": "Malware payload (Smoke Loader)", "value": "afbd300aa5566ca3fa5ea56a5a236f5ec91cd5c3", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634117903, "uuid": "fad74960-54f0-46c6-9366-8b23cbb8c242", "comment": "Malware payload (Smoke Loader)", "value": "74eae10c87595c6340abf794ad2c7c6f0f6eae90fe654809e28d5f373be5a0635f6107ee9e3469b9391d910435ce5869", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117903, "uuid": "5b0a34b0-b74b-4a70-a29f-224926f9bbcd", "value": "T1B104BF1073D1C472DCAB06708979CFB61ABBB821963581CB77BC7A7E2E603D08A75356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117903, "uuid": "6698cf73-0ba4-40f3-8c94-b169e4125187", "value": "c8c17e47eb07afabbfe8e635fca5ad02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117903, "uuid": "299e1a3f-44b8-4794-96cc-2564d473c77f", "value": "3072:A12oiRvrFUXeixCGGO4J5Mu3ifWh0EoS9D98aShyuyYolw43E:roiRTOXrYGT65Mu3i5EVx98aCoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634117903, "uuid": "49ce70df-7f03-4ee1-931a-7eb50ad910b5", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634117903, "uuid": "171f3135-9445-45f8-af17-03c973277ae8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634117903, "uuid": "70af9b36-f90d-41a9-a84c-fba3e6363e9c", "value": "741f960ae2f91ba7b632f472e1995d63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4e9c64-2c30-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634134758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134758, "uuid": "e412f64a-9b6d-4c66-b9c5-c7c1ac0306ea", "comment": "Malware payload (Dridex)", "value": "4f14d43871e9762c37b375300ab96290", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134758, "uuid": "d7972a22-24a0-42b9-a550-4e86a4fcdd78", "comment": "Malware payload (Dridex)", "value": "f97357d8db0ae59cafa51ca6bbae3356dd92311607e0b3192404969f4ff3f860", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134758, "uuid": "96d5de88-aab7-40d7-a1d8-aa7603f2499e", "comment": "Malware payload (Dridex)", "value": "5e3e97d8c8526537aabfce2b5a5ef76340ce0e0a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634134758, "uuid": "f2b79b6b-8295-42d9-b6a8-b5421c64b897", "comment": "Malware payload (Dridex)", "value": "c97032290839d7d70f7e694aed53969c84d20e7b10f820b6079c2ecf6f395a8b005e348e0def43613ac0be86149883ea", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134758, "uuid": "10ff8a68-5986-4b9e-a222-8da7f7f4d8d7", "value": "T1BAD4F8013A54E821E7E955B6CF2AC6E85B183D49EFB0A4C778E17F0F2AA94F3D215305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134758, "uuid": "6f6c290c-207d-4894-8f96-5289cc53938c", "value": "54afd981c141523b8c68b6a5bfed7202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134758, "uuid": "d05f013e-91eb-4221-ad9e-7f4e1d054f5b", "value": "12288:RuIB6NwMtjp4CqwqyaXPLAfx38TW9DiWUT2tq017JGoLbEW/:MBb4wqyaDA5sTWiXT2tq07G2d/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634134758, "uuid": "faacaa98-2cff-4a80-ab3d-ccda180211f6", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634134758, "uuid": "7c87e979-b63c-49c8-a00c-50bf8cc38868", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634134758, "uuid": "fba3687a-5481-4c76-b68f-86a563520fc4", "value": "4f14d43871e9762c37b375300ab96290.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cdc6a2a-2c29-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634131670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131670, "uuid": "e39f71a5-f0d3-4257-9e76-74885454debe", "comment": "Malware payload (Mirai)", "value": "e92515fb6264ddc863fa600701ac63f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131670, "uuid": "1596c960-6339-4a80-bff3-55bd87cfc921", "comment": "Malware payload (Mirai)", "value": "f9dcbb91979be0275c5c208b77c8f4a5b89bd4e5a5e4fdfb54b0d9a0360b57d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131670, "uuid": "36f5fc95-f906-4da6-b292-a8203ddd2c0d", "comment": "Malware payload (Mirai)", "value": "443f0d69a3d6e32200c2dda99e13226a5e7f4053", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634131670, "uuid": "654636fa-7d13-440b-836b-9af7dff9e6c9", "comment": "Malware payload (Mirai)", "value": "ebd1cf85e029380122f269d58811a37221f6b242182013fa29d13a59cc25ddda296e002f28acf8af8383a7247238dba0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131670, "uuid": "ac675e07-5399-49f8-ba18-97e96720e484", "value": "T19FA32932E602CA73C40606F111AF9A675D21BEBB096E6A84F35D3CB4DE334C5B691B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131670, "uuid": "fd61986d-8503-4e9b-81c8-7814c96e91ba", "value": "3072:hW3gFEmSAfzYvJXA6bJ+4fGWmmFVcqq0GnDZT:hlFfa5A6bJ+4fGWmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634131670, "uuid": "d05db307-5092-4af0-a780-250a22a3a354", "value": 104202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634131670, "uuid": "9b1e557d-42cb-4f21-8c1a-27aef28fc394", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634131670, "uuid": "11734815-01f8-452f-a3a9-74d314bd23b8", "value": "e92515fb6264ddc863fa600701ac63f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe99f09-2bde-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634099463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099463, "uuid": "e671711a-88e2-438e-963f-155872392ced", "comment": "Malware payload (AgentTesla)", "value": "afee8762eb2c3b682a3d12391d88dbb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099463, "uuid": "1030a3be-b737-4685-9450-c60ea55509b4", "comment": "Malware payload (AgentTesla)", "value": "fa5b04c80dfbb8dc5d31da04dae39d8af9cb5737be087977a1849d75dc7f9ff4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099463, "uuid": "674aea37-eb5c-435d-bc42-45666c072387", "comment": "Malware payload (AgentTesla)", "value": "41cdaa1e9f65ae2bf461c81c1256d181e86c5e86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634099463, "uuid": "44b3ab8b-3976-4695-b4d7-71f6900aa0fb", "comment": "Malware payload (AgentTesla)", "value": "f77f52b36d05884cc6d780f173271cbdfd4278c149f01e7080a0057b6c2555a5eb4266efe0d88d76fe297d413f092920", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099463, "uuid": "9285c77d-7ddd-4f89-bee9-d5df6bb0cf41", "value": "T14D94E5D7A3EE6B61CD267D30F62259B0E3993D310F185822255C3E5E3FA41ADD522F28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099463, "uuid": "2c7ab3de-f4a6-4d71-813f-3d001e28d4c9", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099463, "uuid": "6df41e2f-5e48-4cf6-ad09-991b633e180f", "value": "6144:VBlL/gjxvrOCSjlzCZrmPzHeOJO5e4MwxRyucn0Q6JEmWzfAKmmCZzcGfOrc:DmjcC0lP34NxBcnzkEFfHmmCYGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634099463, "uuid": "fdbf281e-947a-4b82-a5b3-c24e1c8b89a0", "value": 448801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634099463, "uuid": "991e0fec-204e-4f2b-bb7b-191675d9fdfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634099463, "uuid": "883ed607-00c1-405e-8caa-94a2d321657a", "value": "PO#1135 - \u88d5\u5049.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20631b2-2bc7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634089803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089803, "uuid": "b06c6b67-dc4d-4275-be95-236e2106647c", "comment": "Malware payload (Mirai)", "value": "305815cd4793f0991d83f8987aaac52e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089803, "uuid": "0b405d5c-48f7-43c8-8394-ef6169609733", "comment": "Malware payload (Mirai)", "value": "faa2c993c56015d79f79e5a621b23563ee4577cb3d912d094a170c330be8fd16", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089803, "uuid": "90a25744-fc0c-42b1-9cff-80997ccd558a", "comment": "Malware payload (Mirai)", "value": "5f24589d2e3778864ac81a6fe92c0c4fa73459c5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634089803, "uuid": "6aa28033-e082-4a43-9c16-ccb7b22a78b4", "comment": "Malware payload (Mirai)", "value": "cd92d04dd2317fe4d205f0608f58aacf9b347f9534034882c9cf568e0aa27fd48dba4cf5173a99b1cd6d0a6bf316025d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634089803, "uuid": "c0509fcf-2e9d-4f80-a9dd-93a76c7523ba", "value": "T174A33AC5A6C3D9F9DC152A797077EB314A77E9BF2125E9DBE7E82923794400080072EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634089803, "uuid": "858a4fc1-54a4-4beb-80f9-7c69a5ccd8c5", "value": "3072:2ndG28MBneyZghkmIqzrCH5Y7xxTOHHe:2ndG2BBnOkmIqwMoHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634089803, "uuid": "a755370c-5de4-4f53-867f-3d91f82cb083", "value": 99424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634089803, "uuid": "6c8aff5f-408e-47ef-9fcf-166b77559aa4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634089803, "uuid": "d962cec4-8fe3-48f5-afdf-cbaeb0660db4", "value": "notabotnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bac9a1-2bcc-11ec-843c-42010a9c0014", "comment": "Malware payload (Hydra)", "timestamp": 1634091960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634091960, "uuid": "45eed5e1-d0eb-4372-9bad-5e4375ea1744", "comment": "Malware payload (Hydra)", "value": "edc5eeb1f0ff10f5e2506d9d032a8d67", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634091960, "uuid": "6ecee001-9795-48b4-a879-233b2bddc089", "comment": "Malware payload (Hydra)", "value": "faaf963fd84d0e7c86f8750115f5291f0692d0aca0f97e151cf4cc870a65d88e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634091960, "uuid": "47b27aed-4b38-44aa-a107-76b7d0d83cbf", "comment": "Malware payload (Hydra)", "value": "d0bdb0b5d99286cef289d87e6fdf281493f34898", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634091960, "uuid": "f7e909c0-58a1-4283-99c7-32d4970fe038", "comment": "Malware payload (Hydra)", "value": "061940c71cc9c24f8ea94d82ef5efbc059a1df032d510ee0c2666c856312fa3639d929f3ed14a11ca36d69ca808c6801", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634091960, "uuid": "85faba58-54ce-4560-96c7-6655f7c17053", "value": "T151963386F2C41781FB17A9F84890AB897520896720E2553F87401BE19AF7FDD2F46B1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634091960, "uuid": "a226c254-fb46-411d-b89c-efe6f0149724", "value": "196608:w64mXiT5+b3XRnkyNsikDWx0RiQdyjynFAL9h:w6rXiT5+b3hk2siQWabyj40h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634091960, "uuid": "5d44fd8c-9d72-416f-99fe-6a3959aafc13", "value": 8826149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634091960, "uuid": "3e1730f8-ab9f-451f-8b72-0dc56fe5f455", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634091960, "uuid": "ec2c2de6-d1f1-4264-a5f8-e219f7097815", "value": "84563_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e27bfc-2c47-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634144672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144672, "uuid": "5331e9c1-c665-4776-925b-cfc3752b22cf", "comment": "Malware payload", "value": "55fe248d64630753d644e6cce8075364", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144672, "uuid": "d3ed2f0f-ca65-4272-a57d-a81ec80dafe1", "comment": "Malware payload", "value": "fab7787c4091df4416960dd16b043e78c1e63e70db42841094a073912a7c39f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144672, "uuid": "884f5128-8779-4575-9dad-adf86b812bac", "comment": "Malware payload", "value": "5a481e8dba3df6b5a16dc3f22da038afa439f2f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634144672, "uuid": "8640921f-b9f5-436d-bc56-5b6df28f53d4", "comment": "Malware payload", "value": "242aa3a1a0b36ef47352a3d0657642390a0786f596db95223757cd432fad76f85dd5428329056ec12fe5c6e23b887a1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144672, "uuid": "4d6dad0d-1672-425a-a097-841d7af7351c", "value": "T154E5339B2FB4DC17E324C970BD6090E8A4D20C77E15C8345E780B71EB37B9997929A9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144672, "uuid": "a754be01-7a36-4869-aa53-23b6c2d3b526", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144672, "uuid": "b89cb29f-e5f6-4219-a22a-1d0c98576a2f", "value": "49152:Wg3mEwprI6Uv4B4tpzvXoJkM1P5dlFN7JNlr1SR3eDawS8N+1RzxrooU:HWEwppS4B4tBT6PrzN7Jf1OpH0oU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634144672, "uuid": "763f5aed-4750-4531-8bc1-e979fff54e03", "value": 3273618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634144672, "uuid": "7cb74fb6-d7b1-46e4-9216-2697636e0e80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634144672, "uuid": "984245a1-6df3-473b-b042-9c57fbe33cdc", "value": "55fe248d64630753d644e6cce8075364.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f98363e-2c0d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634119595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634119595, "uuid": "4cf9872c-77bc-4c46-bfcd-3724635629dc", "comment": "Malware payload (AgentTesla)", "value": "b7cdee38fa09523c282d85827bd0b6b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634119595, "uuid": "a9c24aad-6fa9-4304-a4f9-d82a427749b1", "comment": "Malware payload (AgentTesla)", "value": "facf29c75df34f019c99bef01ff65084708d8764a6783c9b1926027eb00ccfd2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634119595, "uuid": "44c0f0a5-64df-47fd-85d8-5ee2c97272a0", "comment": "Malware payload (AgentTesla)", "value": "bddfa33b46def77313e6017a7a7bc707bbb11c40", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634119595, "uuid": "e3f0d18a-43df-46a2-b9e1-1c23d697e856", "comment": "Malware payload (AgentTesla)", "value": "4f6d7ea2f881c71666abcaa78a61231119d4a1948dc021a18fa69223e3493bdfbebe82e466d9811194a79cd57c4950a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634119595, "uuid": "4b8539f2-aaef-4fd3-bc53-778fc0adec55", "value": "T184E4E0647F89D84FE36A88B81171DF84C67D655B3713D626D8BF603AA39CBC029821C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634119595, "uuid": "e3e0be81-702d-4659-aa4c-bdc4def85937", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634119595, "uuid": "4e411749-3bb2-4ee2-8f76-12edb329563b", "value": "12288:lRSFJLp2GaazY6bOwgDLroodjyW+BZOdF44P/wirJhIzD9ACWSB+17:XSzLW+5bOt73dX+nOH4w1rJhQDLLB+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634119595, "uuid": "48445e4c-7ca3-4896-8e70-13b4888ae0bd", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634119595, "uuid": "e67c30b3-fcd3-4dfd-be1c-fba8c27468b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634119595, "uuid": "837e1cd8-c355-4708-885b-42b240467fad", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.AHX.genEldorado.12071.14370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ef7ad6-2c7b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634166983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634166983, "uuid": "2771ad6a-847d-4533-913a-700dba4ab8c6", "comment": "Malware payload", "value": "5f60376ae066166c8385bd292a9986ef", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634166983, "uuid": "f3daa7bd-c1e8-46b1-9f3e-8ff7be683a2e", "comment": "Malware payload", "value": "fb34414b386d0d12c24d11bce56f087730afc3fbab1ee397182f5dd64183b53b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634166983, "uuid": "5a145bd5-447c-4f72-ae19-b3b2cfd97bc5", "comment": "Malware payload", "value": "02ee0294a56c0ea1d644bd46d1afde8732f8ea48", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634166983, "uuid": "4c847cfc-a77c-4d7c-bf07-87dbab012e70", "comment": "Malware payload", "value": "6595956e6bde3d064b4f11e03d69ff44c520b4eebaadc684e30a7f8a4fc016c52f93ffdcda40d2b7bf3b2b114f353c97", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634166983, "uuid": "2b049258-c4a0-49b8-9196-d457f12f6d52", "value": "T1419633E1E3801704FB1FA9B615845806B680D69E99B2C83B41441B50EDBDFFD6BCBA37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634166983, "uuid": "2e9044ac-b64b-496f-b593-a4d88dd1c8ce", "value": "196608:czNyHL/kdBsGd+NAy5HqU4x6yNQZvtjUDWx0RiQdyjynFAL9/w:csr/kdBsQ+BN462QZvdgWabyj40/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634166983, "uuid": "c8f3d53c-3310-4655-801e-4876b7eeb471", "value": 8826149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634166983, "uuid": "de70ceba-5c9b-418a-89dd-0d8f65b30792", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634166983, "uuid": "8cb0ea13-1444-4657-b86b-9c8282b739e3", "value": "73265_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779eb535-2c4d-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1634147177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147177, "uuid": "dfb8e038-62ed-4359-a219-f10939ebed8a", "comment": "Malware payload (BazaLoader)", "value": "afb7e73c9d9a99b395074a1e39728b36", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147177, "uuid": "31a7a201-ecaf-44ce-ac90-8ba6a828a9c5", "comment": "Malware payload (BazaLoader)", "value": "fb46649e51c1b2fc47d3bc0a129563c7bcb6f7e5353d46e0a0bd2f1205d675b9", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147177, "uuid": "c7e42ac3-423a-44d6-8ddf-27ba4ade3a8d", "comment": "Malware payload (BazaLoader)", "value": "76cd17dc22890e34cb4adb3f34b7b904dc751cdb", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147177, "uuid": "cf48485e-af73-40d7-894f-0bdee7faed45", "comment": "Malware payload (BazaLoader)", "value": "d917dcc86a1671e7c7712e72e4ea784cc189b634fa926567779485edc2809b24520b04e42905c164f349ff3735f5efed", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147177, "uuid": "0c60b877-3a6e-4970-a28a-586fd584e302", "value": "T10C546DB6F2912DA6EAD1C879C216B1B4F28368373765E1D0B5A706D3102D4E4CEB6F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147177, "uuid": "3b947448-b5d0-4ff2-b77a-213a99eca204", "value": "f2aa966974790b641bc88c5a5bd46a40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147177, "uuid": "b49a7daa-fef1-4d33-922c-f41ab3845569", "value": "6144:VWvccklaZIIq3+Q4gdD3iD9Rd3YdFT/od3kQV:VIcZao3+Qr4zMFTwXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634147177, "uuid": "bcec01a7-85e6-4787-8e51-c4d95feda00c", "value": 289415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634147177, "uuid": "9985ad4b-da3c-480a-8ce9-31006ea02e00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147177, "uuid": "6133a233-0169-45ff-bb0d-173a9741725a", "value": "afb7e73c9d9a99b395074a1e39728b36.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bae2584-2bf1-11ec-843c-42010a9c0014", "comment": "Malware payload (Lazarus)", "timestamp": 1634107724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107724, "uuid": "fe5888c6-3d5c-4f22-9c88-755465c0de55", "comment": "Malware payload (Lazarus)", "value": "22827467f52cc5cf4f6461ea008bcd54", "object_relation": "md5", "Tag": [ { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107724, "uuid": "147fcc2d-e9cb-46f9-b016-499b3c9c2ea1", "comment": "Malware payload (Lazarus)", "value": "fe0a9261e6dc402ebd92706d6f5126e00057b478084a3bcede17a0f049adbe91", "object_relation": "sha256", "Tag": [ { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107724, "uuid": "27290c4f-d355-4006-a265-cd66013651e4", "comment": "Malware payload (Lazarus)", "value": "c614831d3ba85ca296ba8a69e3117a3c138c1ea7", "object_relation": "sha1", "Tag": [ { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634107724, "uuid": "ba8c9401-bbec-4cdd-8181-f6bc0c5c3248", "comment": "Malware payload (Lazarus)", "value": "a1c94f625e802a12ec07fb6651f263bd635d73386cb13fcb02bb9aa42c7aec7df90874a197f92c853df706cd75768878", "object_relation": "sha3-384", "Tag": [ { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107724, "uuid": "89fdabce-66bb-4b81-8d69-3ff6badee876", "value": "T13392D06D428D0636DED18D3BC54451CC6E3AA5B945CFECC62D6DB63BBFB0AC4408A234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107724, "uuid": "1ecf4e59-66a3-4aa3-949c-0e5cb0fe1f2c", "value": "384:FSQAiZyZUIBn0M+XVlEyGB4QsAqLHf3JuQkhvcBIGA9neWp6S7TU:hAuyZL0M8YpsAq7JVkaDMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634107724, "uuid": "5828d6a1-b023-48f8-a3a3-96aed5ad8fd6", "value": 21041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634107724, "uuid": "da8c0b90-d78b-4c82-89ae-076a8474f0a2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634107724, "uuid": "59a06402-d933-4de1-845b-132512583562", "value": "New Profits Distributions.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b094c71b-2bf4-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634109047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109047, "uuid": "f2c50791-3e57-44e1-8a0e-91dbd3c3f3bd", "comment": "Malware payload (Formbook)", "value": "1708ec34ff4cd862e935fec79966887b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109047, "uuid": "1d9b929d-3b9a-4c34-8ad4-7a1743dcb143", "comment": "Malware payload (Formbook)", "value": "fe6bd626fd98e3c0e4a2c350e5d927398e22e7731e7c2e1f31bc02181735c4e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109047, "uuid": "e49eb1f7-24dc-4658-89e2-64884feba9df", "comment": "Malware payload (Formbook)", "value": "79ea76f3939a052e58ca214b839a7c5431c42cb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634109047, "uuid": "caf60afe-b1fd-4603-9cb8-744fe9b0239b", "comment": "Malware payload (Formbook)", "value": "046cf8211a7503ea1e6b560abb1fcc7e67314d49518d5bff6bc3318fe0d50d2756d2842b48bef54535e6b8ada05b96f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109047, "uuid": "64f9a7e6-8dfd-4e4c-bd01-5f5f13158f5d", "value": "T176258D2E65E24832C23A0E746F5A8325AD397E507C6C794B6BF61D0CEF3434278697D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109047, "uuid": "a26e3536-2fcf-41bc-9873-f2ddc7374ffe", "value": "138bb79e60dfba5fe7eff385ab7df367", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109047, "uuid": "483aba0b-b271-4924-afb7-83ef9f23caec", "value": "12288:Up+vmyY9beSkj77NADGFvGq+EOvLkOUvIVPJvC+0yRK2urqoXkxsdr64lprmi:UMO3g13Wih+kOzPJp/FoiKrRpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634109047, "uuid": "46dd2491-56e5-4e4d-a576-7da58b1fecd0", "value": 1025536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634109047, "uuid": "558d1953-4ae2-42aa-94d9-f0d9ee70a2ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634109047, "uuid": "6eb2984a-8a4b-409d-8cc3-3878d8ca0bb6", "value": "Potvrda narudzbe u prilogu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3249e3f8-2c4f-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634147919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147919, "uuid": "2e9b084b-1139-46a1-bd3e-548578b33bdd", "comment": "Malware payload (Dridex)", "value": "6678c0c700a81cd5752fa4cd214feae4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147919, "uuid": "a7225f41-15b3-46ed-ac7a-51963738056e", "comment": "Malware payload (Dridex)", "value": "ff0b0878821718f9f9626ee6f60ac6268f9a3c529f18cacf485236767f249f23", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147919, "uuid": "f4bc3174-b2a4-4f02-91c1-93db22b75367", "comment": "Malware payload (Dridex)", "value": "593e5c032de20268d97b911dce86fe7af06d643d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147919, "uuid": "e7de9ca7-a66c-49f6-b3db-6a9f94302c18", "comment": "Malware payload (Dridex)", "value": "864bdd4668f9bd1df38094268a2d130fb903d7f69712172fa597eddfd0d1f941a4d3391b9a0ee29ed69c545286bb0707", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147919, "uuid": "312b8b67-641e-4acf-88b9-07c5a3a745b3", "value": "T1A9D4F7013A04E821E7E55575DE2AC6E85B183D49EFB1A4CB78E17F0F2ABA9F3D215301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147919, "uuid": "1053507a-8233-4a3b-9591-d93be2daeb73", "value": "0e85111d46389e6a0b245ea738757602", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147919, "uuid": "aa238b2a-b8b0-4166-9289-0fb0ebab4ae9", "value": "12288:LE6rSiT4Tbs3j09TMmonCh5atbz9+eoQoUZpDd7Da1nX9y1OO/zFZx:Je103j0dMZnCutz4zI5xDwXUkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634147919, "uuid": "45cd3552-35e8-4642-af6a-6b4f5e004ba2", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634147919, "uuid": "856cb33b-0a42-48e9-9320-f4e74af1f9f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147919, "uuid": "28cc414a-6561-4ac1-b812-24b7ea63670b", "value": "6678c0c700a81cd5752fa4cd214feae4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427a3546-2c52-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634149235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149235, "uuid": "0b056b03-b361-43d3-96d6-cbff7a129419", "comment": "Malware payload (Formbook)", "value": "16f7045eebb451234ca8078222c5994c", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149235, "uuid": "6b1cf26b-b40e-4edc-92ba-b9dfb06f91be", "comment": "Malware payload (Formbook)", "value": "ff344e635b268090aafdb8fa830e76c41f34d7cf9a9bf03ed4ede2705008bfef", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149235, "uuid": "c0f54fbb-09dd-46d7-a010-b48bd8cc1ce3", "comment": "Malware payload (Formbook)", "value": "99e8f263f9e34ad13cb8cd6af1bb816deffb5bde", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634149235, "uuid": "a6becddb-c660-4858-ac40-badbffb9ec71", "comment": "Malware payload (Formbook)", "value": "bba5659e9d40cde686859f9f422efafcd67a12478b722ee878b9041771998558215cf2cf6b7a335922fb881808f19be6", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149235, "uuid": "df1740fb-a8ff-48c3-ad7f-25dcec497be4", "value": "T184B4CFA47F85DC4EF36A9CB81131DF44DB2D664A3713C625D9BE607AD2AC7842CC2287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149235, "uuid": "9ca4ded6-7524-47fb-b1ab-06da3f4b5af9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149235, "uuid": "86c1d899-48e4-4173-bb28-5e5c12830966", "value": "12288:x0K9jbtvzZPJukNeFrmndcPeGGUQSB/a:xh/plBlMFrleGfdB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634149235, "uuid": "ec59ab2a-9720-445b-9a5f-ef5052256126", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634149235, "uuid": "8a6a0ab8-5365-4346-b7d0-9332fe6f38f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634149235, "uuid": "70ff892b-c5a0-4df9-9a3f-606559029d93", "value": "Factura de proforma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97079ef-2c05-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634116417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116417, "uuid": "01d79e45-14d3-4bf0-b9fa-378659e551d3", "comment": "Malware payload (AgentTesla)", "value": "9fc5e3f7bd22edf9bd8df34405f0e64e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116417, "uuid": "0f091c6c-4992-4180-8198-97df143a6ef3", "comment": "Malware payload (AgentTesla)", "value": "ff4f34c27b47c6ec925edfcd49be81c8f88ca06c4f3d54274f4cbb09fc8f7bc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116417, "uuid": "4c4601d1-af57-431a-a217-4c8504ecf71e", "comment": "Malware payload (AgentTesla)", "value": "22ef28503612c9c26a82c6bbb353f017c1ecf90e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634116417, "uuid": "3a14c229-50a3-4dc6-92d1-c78d95334844", "comment": "Malware payload (AgentTesla)", "value": "dcf81339ee705188c81dd29f6ad1c2c4fb9dcfef652cb19533f7ab3d44771ba5f340b3a46ac91c576dd0d97eca17fb1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116417, "uuid": "3efab468-9124-402f-956a-b589c0f3310e", "value": "T100C4225037F84322E2E9B7F596AB1A0C87752A275453F35C8EC120EF19733655A90FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116417, "uuid": "07d16443-c1cf-4a6f-9004-7777229e0e89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116417, "uuid": "50e6b2c3-e2f4-4702-9c04-449c0271fa40", "value": "12288:HbLNPieOycoof6a9FcVGfvKSs4MVhmg44nh8+BF1Qh2JMSB:9Pe6a28ii0u+BdJRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634116417, "uuid": "4d521aa8-0b66-4af9-92cf-51c69c406546", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634116417, "uuid": "2302543f-0a94-47e0-9005-4525bda6fdfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634116417, "uuid": "c0d59736-5c14-44ff-ba50-f4aacff9af09", "value": "9fc5e3f7bd22edf9bd8df34405f0e64e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4515d83-2c5e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634154607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154607, "uuid": "f3bf0913-0dbe-43bb-bd37-989db4f86c05", "comment": "Malware payload (Mirai)", "value": "2af19bdfe5b4c7bb3571651f24b7e2ee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154607, "uuid": "9a89fe68-00b6-4db6-8169-bb27f990dc90", "comment": "Malware payload (Mirai)", "value": "ff8435aab8c3d7c0a940313a5a20915aab11084896589e313c4cb4b6b1793175", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154607, "uuid": "77d1345c-e1ba-46b2-ab83-e64a7c69d5d5", "comment": "Malware payload (Mirai)", "value": "d0450395a42cff1166fbad290c66035261990797", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634154607, "uuid": "8edbde71-65ee-4e1a-ac66-1ce91a980c1e", "comment": "Malware payload (Mirai)", "value": "861eb27c68215c2ffb0f2ca44480326ab7c155f841a8ae63d226735a8db4d4ed1ea813af129601db11c83b4f3b29ac17", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634154607, "uuid": "15420f95-6819-454c-908c-c824e1af6363", "value": "T135D2D135A4857CB9C73A283CA63DDA041B1E363DD2E27966173526A0EBE3097937C0D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634154607, "uuid": "d1d4f60c-b77a-4f35-b5b0-2e90e3d5d6c7", "value": "768:w36ufvq91mNAhgeQQfeAHFjkmWG47edcmVM51+s3Uozj:e6Iq9WACYeAdkmG7edtMXjzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634154607, "uuid": "ef6cafdc-a3d0-4e8a-9a79-889b690dfd87", "value": 28628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634154607, "uuid": "2a495be4-ce13-4c19-a76c-81922b3bcbe4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634154607, "uuid": "9f43463e-2485-4030-8f12-11ccae3a40d3", "value": "Tsunami.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724c8a87-2c4d-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634147168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147168, "uuid": "bbe5a6c4-65c9-4212-95b8-d6de5a645294", "comment": "Malware payload (Smoke Loader)", "value": "5ac5ee380a2c953dbcfb8775d79643b9", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147168, "uuid": "28fec5cd-9398-44bc-aece-497ab26d39af", "comment": "Malware payload (Smoke Loader)", "value": "ff9460e1f512fe522007f82dcec1da7a6186106f4b2833c51de5d873b8986dd4", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147168, "uuid": "0cba5643-dae8-4a82-bf05-cae10a512471", "comment": "Malware payload (Smoke Loader)", "value": "70ce39a71beea0ea3a9b05264dc53bda9842350e", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634147168, "uuid": "ef6a59ab-8c43-4c0a-99db-48ff1098aa72", "comment": "Malware payload (Smoke Loader)", "value": "dae8c0b0b6bb3cd310464568543dd3ae5dcdc136433af909331775758fa049243e7bba71c6751a27167dc1287c6238e7", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147168, "uuid": "92012b92-5869-404d-937d-c05a036c0533", "value": "T175647D10A7A0C435F5F716F949BA936CA93E7AA0AB2490CF53D516EE4634AE1FC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147168, "uuid": "6a8d4f36-136d-4486-ac54-e612f27374c2", "value": "e97201e7ef5f430ebcbaea94835aaebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147168, "uuid": "a98e4a5b-d7c4-4b9a-8d6c-deb3a8d585a4", "value": "6144:fmkdyv1gZnhCD8Y6cvazQpQpljgbz2avSw/5YE:1PZnhCD/6cC5plU2avPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634147168, "uuid": "8d7c4bed-8e0f-40db-9e40-9a22a2f10e08", "value": 318464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634147168, "uuid": "1ade325f-91f6-45a5-b875-a776a40c0d15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634147168, "uuid": "819c0d87-ecfb-4b19-9c9b-036c5b581229", "value": "5ac5ee380a2c953dbcfb8775d79643b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4708ce5-2be4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634102182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634102182, "uuid": "6aea906d-abd9-4a8b-b0be-88a938058e24", "comment": "Malware payload (AgentTesla)", "value": "7cf062edded4f602cc9f83cd9c261ce0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634102182, "uuid": "944d8024-ca68-4df8-8254-1c20768a55df", "comment": "Malware payload (AgentTesla)", "value": "fff5d7996e7fcf691c43affed4847551fe1f665b404cf6cf46ae70b604ed3bb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634102182, "uuid": "e7a2f460-8cbc-4ac8-86b5-d773ec7de63a", "comment": "Malware payload (AgentTesla)", "value": "5bd304dcc6ae7b7093c16ab3b38ebc2d029037c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634102182, "uuid": "b1b5f08a-eb18-4e86-bb4c-3874642bff05", "comment": "Malware payload (AgentTesla)", "value": "a1b8c515fd3306ed72e3a79d4b59e37c42cb96fa78ef27507b1c9a85747924d30d5faff515cb9386b70867f97fd04b09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634102182, "uuid": "bb3afe5f-abaf-4465-af05-c904db530255", "value": "T158C4235AC00878FBF476D59C2232C4BD4BAD86D82486D6F298BCCA0D37BF992114367D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634102182, "uuid": "04710adc-9db9-49ea-a531-5967f6430900", "value": "12288:bT3Sk6KIu+I/q90ynVIMxJiYs6rMVK/408HCHWtij2icIHo5KpdFg:H3Sk6/u3/q902xiN6I7HBIRcII50Fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634102182, "uuid": "c9665546-d406-4d59-bf6b-9754b7bb1ea3", "value": 545075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634102182, "uuid": "5f397fc0-7e74-48f2-86d0-8a56571d007f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634102182, "uuid": "1486d1f7-473b-4fe6-b897-7f2bdb0dc454", "value": "Payment details_10_12_2021.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }