{ "Event": { "published": true, "date": "2023-02-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-02-03", "timestamp": 1675468981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8aa3e092-b0e5-4ed7-baf3-5ad19ebb2a91", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1020d5c-a398-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675411279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411279, "uuid": "9f141610-5659-407d-ba2d-7b4bc497782c", "comment": "Malware payload (Formbook)", "value": "6e5a2898dacc6de7829089de3188c8f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411279, "uuid": "f6fd2318-0e83-496b-9029-40f3ffdd2473", "comment": "Malware payload (Formbook)", "value": "0122584da96994f6298919ddd4ac732ad4430977acb87563b1fc6794aa346ca9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411279, "uuid": "450588ab-b6a6-41f2-8b54-1edb710dffd1", "comment": "Malware payload (Formbook)", "value": "153163e10313050f6a49193c38bb3c363eb53e2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411279, "uuid": "02c0f285-575a-4797-85b6-7cc7a6e26fe2", "comment": "Malware payload (Formbook)", "value": "4590c5b387068f4721643789e84888f5de51687b0fc1809e52c74e841f1888fde38544fbe9a8bbf1bc02f36532cbf287", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411279, "uuid": "cb4e5ad6-89f7-455b-80b6-2d6df7c9689a", "value": "T1F4057E6737B195B2F78720B104287B886BF07513BE16E2938BB73BC06785DB77298152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411279, "uuid": "ca026268-a995-4ed9-a153-fc9c504f4d34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411279, "uuid": "fff05fbd-40ed-4ac3-a208-79b50e3c232e", "value": "12288:lhefaqG4yPaVnDo/AtLCN4COYqxxXGrefVngmB9G8Q6Fy2Mxzo3:jeSqG4yPaVnMotGWMFrefVTB9s6F0xM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675411279, "uuid": "6dd208cb-4353-4ce2-8788-adefd0fe866e", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675411279, "uuid": "a9713a0c-9d2e-48d9-8dce-9cf9600feb10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411279, "uuid": "f96b5d26-6488-4725-8a33-da7d1d70aa36", "value": "Payment Notice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb418971-a3e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675442998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442998, "uuid": "8c6dd818-961c-4505-9d1d-94bda266247c", "comment": "Malware payload (Formbook)", "value": "9f0e000d75cf201d56f68e51a0c43cc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442998, "uuid": "45276b20-67e0-4d23-8994-816b41fcb34f", "comment": "Malware payload (Formbook)", "value": "02033ee5f18dc5c14cca3e808111693ff1b41d8d705268ae55e86251fe6bcc8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442998, "uuid": "dfbc906f-bd8e-4358-af67-46477346d1aa", "comment": "Malware payload (Formbook)", "value": "54d6592876e9261109fbd60ae2e078f475f74f1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442998, "uuid": "ad88470f-e03b-480e-bbae-09559efebd64", "comment": "Malware payload (Formbook)", "value": "67ba98272f55f7499718cc6181b3163056ccdd6aa1b9032c841343e5de0089a6a3533957e7c26e8dc4a64aa66b977787", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442998, "uuid": "bcbb74a5-3a01-40f0-9cf5-f5d725123b6b", "value": "T11AE49E1263B84537D1371AF98C2A5B685C167D303934A80E6BE97E8CAE3B751F42A1C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442998, "uuid": "e87e8b38-60cd-4893-90ff-07381085395f", "value": "26a25227f74e66185102d6e0ba9c1593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442998, "uuid": "731e2c2a-c44c-4f1d-9126-8f2eed7daadc", "value": "12288:+J8P4O2utBLvuQ4ZNn1AjnJzQFftOZCcgy:mIWutBLm/NnoJzQFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442998, "uuid": "efe827b0-f431-4fc4-ba85-e7b977e7adbb", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442998, "uuid": "e0b56b4b-1095-4e95-9d20-adbad0efb614", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442998, "uuid": "83ecccfe-8c77-4201-991d-647372d3a7ce", "value": "Attached Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0693e573-a417-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675465431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465431, "uuid": "f1410da8-e3e0-468e-a918-707c9bfae9a9", "comment": "Malware payload", "value": "80b9d4b0b3fce803d043f655517c71b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465431, "uuid": "1f8696b8-9a4d-4998-a5d7-2b665806cd71", "comment": "Malware payload", "value": "02a3045615925cfd09f7b121b520b14bb10784d21b0b77e0895140306c54c3fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465431, "uuid": "ee5d7a31-63c6-4ce0-96f1-59dbd2301e16", "comment": "Malware payload", "value": "b9cf599da5488b47b1abb97b15963d2ef72bf6dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465431, "uuid": "c6560eef-43cb-402b-bcaa-69858ce51b26", "comment": "Malware payload", "value": "59193cc4dbc38b19377af7df87f927d959a6f35d98ecf0c599f8aa0ee84308560ae5d15ff579dc14cf3ef26f295f809a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465431, "uuid": "c4d28e7a-c8f3-4dfd-83ec-050e8e6a0772", "value": "T1AD64F1363280C0B2E46711304865DBA5EB7FB8306579961777991BBE4F336C0AB3A35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465431, "uuid": "e16d31ab-aec9-485a-9c38-e5b5368f9d9e", "value": "11deee92ae37204b8493d8d64f5f1f69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465431, "uuid": "0321eec8-e178-41c5-974c-c0b86b2d87b5", "value": "6144:GvFLNd39X555427c5kt8/KamYRG7AMW0Tkpr6cOPxHhAX:GvFj3Q2MaamYRG7A0kprqHOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675465431, "uuid": "2cfa7176-7e4c-4c33-84d0-65f13de46b69", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675465431, "uuid": "8bd881c9-5d02-4d32-b5cd-326eb5dd5bbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465431, "uuid": "9d885d31-2209-477d-8d9b-5b30ce8e5486", "value": "80b9d4b0b3fce803d043f655517c71b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1468f35-a3f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675452430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452430, "uuid": "6b9c922e-0456-403f-abb7-50a557430f1a", "comment": "Malware payload (AgentTesla)", "value": "8d0a2a254b9cb085a733265d00950789", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452430, "uuid": "09fa68c2-a6e6-4b68-8641-5e7065476120", "comment": "Malware payload (AgentTesla)", "value": "02efa36dd4234ec4d70a085ef835696433943672021e90a20bb1d61bf0871ed8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452430, "uuid": "f0295cab-cc16-49a1-83b5-f1008bb4b44a", "comment": "Malware payload (AgentTesla)", "value": "e0ad9b267f52bc134ce9f72e77e507fc9e4f01c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452430, "uuid": "3a627e43-3e3b-4f52-818c-fd06f4e730ab", "comment": "Malware payload (AgentTesla)", "value": "5ac0ab3522f12054eac875bbb9bc005aa7f342caed4c645fe655759273b79fc6f5c4136e31e8af4400dabb25ce454e3e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452430, "uuid": "8f73e72b-68b5-4c41-84e0-85ce1070e4af", "value": "T100058DA337B199B2E78720B10434BB885BF17513BE16E2939BB737C06785DB77298142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452430, "uuid": "f0a8b701-7cc0-466b-a88c-a85624fe1e60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452430, "uuid": "fac41046-0c3c-482a-a140-f065c26a3b32", "value": "24576:HeSqG4yPaw6F0s14r5K7R6Zp79Y9OtgOSBVaogRM:IlWs14r5K7y9YwtgOS+ogC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452430, "uuid": "59e32afc-b9d2-4f31-8c2d-c0a643ba0246", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452430, "uuid": "5e11217b-8f7e-43f9-9a2c-6350b77b42ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452430, "uuid": "4e96b482-8885-4980-ba5a-0b1c84992752", "value": "FedEx Receipt_2314174712.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98222b0d-a3d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Pandora)", "timestamp": 1675438617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438617, "uuid": "4b89f41c-c5b2-4a53-a03c-9b2aac710d49", "comment": "Malware payload (Pandora)", "value": "d101ad37f3a632da18a297946851704f", "object_relation": "md5", "Tag": [ { "name": "pandora", "colour": "#423BD1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438617, "uuid": "abebcf09-7827-4c33-950b-4b128c428e3e", "comment": "Malware payload (Pandora)", "value": "035e930157848f2a4439c096471d2296b0d7379d92a1762a0de5f51ab106be68", "object_relation": "sha256", "Tag": [ { "name": "pandora", "colour": "#423BD1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438617, "uuid": "f0207a12-4d8c-45c1-b9b1-7a5203e2c371", "comment": "Malware payload (Pandora)", "value": "eebd6f0f49c6c48850e3c02137d352e1d5233c10", "object_relation": "sha1", "Tag": [ { "name": "pandora", "colour": "#423BD1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438617, "uuid": "10ab7ea1-cd19-489e-ab84-037cce19fe2a", "comment": "Malware payload (Pandora)", "value": "349beadec0556bb43793a622dab075766399560d1c398cb07a403e42db6b829c292f38402114deb3598bd31f444db223", "object_relation": "sha3-384", "Tag": [ { "name": "pandora", "colour": "#423BD1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438617, "uuid": "92eb5bf5-0a61-40ac-8e55-60db6faddf5d", "value": "T155B46CA7B2E115A9F07AC13887464716E2F3F8F45360DFAF0360DAA52F5E9A1663D700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438617, "uuid": "3445520e-bc61-492b-91e4-1c5a7c0555be", "value": "5f681881fd4172ac30d02a4f3266be92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438617, "uuid": "9f009351-c7b5-4550-9381-52030ab38315", "value": "6144:AV+XZ+t6L3cYw5fcqQhBTK9jB2Cimot3eJ99p9SpRvpp81U5zmtdmAk/ZvmO:AUXZ+tgcXtcqQhpKpQC5otOH1jtdmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675438617, "uuid": "0cbdbc6e-a93d-4c16-afcf-dce8c56b07a8", "value": 509440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675438617, "uuid": "ec50ba11-676b-450c-b176-ae086556224d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438617, "uuid": "1bec7887-98b0-4575-a7ba-dff738888658", "value": "2023-02-03_d101ad37f3a632da18a297946851704f_pandora", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4839a3ca-a3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675442349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442349, "uuid": "72096ae7-717d-4674-a5b4-838ea4859040", "comment": "Malware payload (PureCrypter)", "value": "d8848c4399130b94784433ee04c41e26", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442349, "uuid": "582ed9f0-d1ca-4654-8a4f-a1007519b4c5", "comment": "Malware payload (PureCrypter)", "value": "0487dbe76c55bb13881635436dfc7fd3441075f2c8d57f64c462eac80325be2f", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442349, "uuid": "aafc7d5a-074c-44c7-b9ee-65ca3c0285a5", "comment": "Malware payload (PureCrypter)", "value": "d01aef8320666401111ca1276219a6cc773c954f", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442349, "uuid": "88c2eeb1-830f-45bd-8bd7-2b2ce105d49f", "comment": "Malware payload (PureCrypter)", "value": "f8f63c43ca0d2c99010ffebf6fe21e3011d45fc0d1201b742d78ff16ac3331394bbf21690f91dbc7457fde745c34b186", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442349, "uuid": "06be28db-fea9-4fc3-b8eb-91d061d339a8", "value": "T158823D105394AEA7D9A78FB04515334283F06DEBCF86CA2F5CCE612A3B3A1D17D9AD04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442349, "uuid": "ffe63c56-b829-4b75-b863-b588b17b440f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442349, "uuid": "3e0fe69a-ad0f-4d41-9c75-b27933aa877a", "value": "384:H3efq/2EA9UYLYp3bmjh/D2yrlffkxttF:06k/D2yrlffw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442349, "uuid": "03045597-a905-4cb1-a0fd-c8484e0d87c9", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442349, "uuid": "f128568b-9d9b-4c6b-84f8-ac3f72bba29d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442349, "uuid": "8099592e-6cec-4ba1-9190-979013e5a017", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa21ae7-a37d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675399537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675399537, "uuid": "27d73519-a05b-4ae8-84ba-0d5d2b54d644", "comment": "Malware payload (AsyncRAT)", "value": "a2a7dc85a78e43dd4f3412b73d5a9118", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675399537, "uuid": "a506d245-5011-467d-b4cb-fc276b925098", "comment": "Malware payload (AsyncRAT)", "value": "04f5fbfe8dee8d02c12f92e02c9dc24368298daadb76068ee911f00b06d9e36c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675399537, "uuid": "49173e96-9ec6-4146-9041-be34fa5093b6", "comment": "Malware payload (AsyncRAT)", "value": "49fbd27ece106d3979461d40c10f277ed1907c50", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675399537, "uuid": "e59c85b3-a984-47c9-8a48-efea6cabe7d7", "comment": "Malware payload (AsyncRAT)", "value": "56dc0ac692384a7bcbd14486381f8889f184364a8c57ca95f79110b522333d9d4be6f629a47522f2269ec49ee5d2cfef", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675399537, "uuid": "67d94bcc-470f-4be8-bb59-a5f620bbc07e", "value": "T103333B0477E9C12BF27E4F74A9F3224586BAB1773603D64E2DC401971A13FC19A42AFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675399537, "uuid": "722d8ba6-d83a-498b-9a99-9dfb3456c814", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675399537, "uuid": "fcfa9bf1-0099-4c2a-acdb-e40e9cd24563", "value": "1536:ku1a+1T3xN2s2NeyHSCmb00iMSdBvbMLZWN:kucST3xN2s2Neyy7b0CSTbMlWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675399537, "uuid": "0cd4c43f-9100-4aa0-b553-c5ccc078f58a", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675399537, "uuid": "fdb698df-7040-4aac-a9d5-175e7a8c4463", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675399537, "uuid": "5f85f628-9815-4531-bdaf-3ad00a67f7c8", "value": "a2a7dc85a78e43dd4f3412b73d5a9118.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c245afaf-a36c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675392302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675392302, "uuid": "19c5bcde-6272-4a96-b49b-a98a3f793330", "comment": "Malware payload", "value": "17fcf3e55b08d32955e580625ed4bf90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675392302, "uuid": "8c6acf03-49b9-4339-9060-91c828b946d6", "comment": "Malware payload", "value": "055295c96bf732e9716b9f50e8fe8e3c5fa546493132035d085dc29b9a619031", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675392302, "uuid": "9d2d38b4-ed74-4667-9651-d02dc7f6615a", "comment": "Malware payload", "value": "bce25ad0478d68f5be4aeaa7d3b507f27d3bd745", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675392302, "uuid": "ed5064ff-d6c0-4988-8dfb-7ede11731915", "comment": "Malware payload", "value": "39fcfa0ffb738dfeb442cc37a8c7df0695092ad139948773001748c403b87d77596dacd67101185b86e7d4572ef39466", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675392302, "uuid": "29e4631e-f86a-4911-a6c9-b908dc0929db", "value": "T12B76336036F04877C2D19AF18EE8AEA973FDFC9C1F28059347F6186D2879205924F9B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675392302, "uuid": "7d321f51-9ded-413b-80c8-b29b02e4cd51", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675392302, "uuid": "09671580-05ef-4173-96f4-8b9bf58e809b", "value": "196608:91OOd6QowyD7UBAhrXqAwArow9vZlVAbgCocl35+WtC3GWUlx4MERzx:3OOdODgAsAEsxLAgCocl3Nt0/Ulx4MEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675392302, "uuid": "f1bc4bef-b83b-43b5-9fab-85784b008164", "value": 7637186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675392302, "uuid": "a414d6cd-a9de-4091-9875-8d76ec55fb64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675392302, "uuid": "9f92ec6b-b773-4975-bb11-1c007e731177", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf70b1e0-a3cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675433959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433959, "uuid": "52d31bd0-78a5-418b-b50a-c4c1a4371c4d", "comment": "Malware payload (AgentTesla)", "value": "27fcb39b98a7ba6798ec8df4e14ffae3", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433959, "uuid": "19eaeaa2-41f1-49df-919d-2869a9ecf889", "comment": "Malware payload (AgentTesla)", "value": "0650a6d34c45ef78c623b570e8954a2b5a8717b025e00b23e586624be2a55869", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433959, "uuid": "eca694d5-28be-491e-96ff-c00dd6e314e5", "comment": "Malware payload (AgentTesla)", "value": "7acee1dc555e349d601a2953919b38f049f77e20", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433959, "uuid": "2a89f668-0599-4a54-a995-784a5881dc7a", "comment": "Malware payload (AgentTesla)", "value": "7c5c0ce52c01c9d357ca636445fe4c1116770c416206c97e02e442b24e70417faa461b0a3b901463df01f430ddce09eb", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433959, "uuid": "69bee1af-6fc2-4edc-b430-2a224b46a150", "value": "T1FFB42389E4F217B8DC3734F9CC60EDBBA15D39BD2A582BB48E01B411E67A150537ACA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433959, "uuid": "db1d0988-5cd9-428d-8146-0fc405f3854b", "value": "12288:gsuOU9bRvrJoMOdozL6GVqyCeqyJtrc1tZgYwt+:g19BJKo3VASG1tZM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675433959, "uuid": "a2708c1b-e3d1-4605-ab41-e5d766f739b4", "value": 516826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675433959, "uuid": "d6dde376-eca1-4bd3-a329-4202dfdad0e4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433959, "uuid": "a9c21039-3f7f-4119-8ca2-a763a7db7845", "value": "AWB NO. 8148557141.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c4c055-a3ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Royal)", "timestamp": 1675447094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675447094, "uuid": "dd1a7eb8-91ce-473d-8481-407f40a9c3c1", "comment": "Malware payload (Royal)", "value": "87adb14271dc49e6b0f2eb4b03f4bbe7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "royal", "colour": "#57A996", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675447094, "uuid": "dd5dc75b-7d75-462b-903a-2913a8b88a2d", "comment": "Malware payload (Royal)", "value": "06abc46d5dbd012b170c97d142c6b679183159197e9d3f6a76ba5e5abf999725", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "royal", "colour": "#57A996", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675447094, "uuid": "f94410ae-ee8c-46a9-9423-4497d7326d9d", "comment": "Malware payload (Royal)", "value": "76215e7047773dd05b8af8e96689b2fe7e7b2ffc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "royal", "colour": "#57A996", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675447094, "uuid": "17d1cd36-7ed8-46d5-a1cb-5aa9862a5ee4", "comment": "Malware payload (Royal)", "value": "9ecea9e44f2e2c2733fcf37ffc502a170d67ccfa3be68bf760ff0e54b8b09a155e0bd740e3bc818c7ffa0ad7dd865777", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "royal", "colour": "#57A996", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675447094, "uuid": "35e40ad8-338f-4ce1-a4cf-809641104e2a", "value": "T115C58D27B8A610BDC9DED430866F8132AA74B45C43607F3B2295D6313DB3F286F1AB55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675447094, "uuid": "96448ff4-0bab-49d4-a44c-0216d76de221", "value": "49152:2bjPXEinhLENX/bX40MA4sDM9RIfiv2eZRBqnlptIU6iQnkgWbwL/KIRpvg9Suj:4YinhLEBo0MA4sDoIqv2eZOnlw+QnHp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675447094, "uuid": "1fb4a9de-988a-4700-a164-e1df628a40f8", "value": 2558055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675447094, "uuid": "a12aff98-b8d7-40b5-8248-702988e63a2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675447094, "uuid": "57176ba5-1c55-4022-b6ff-b09c2cbb0e61", "value": "06abc46d5dbd012b170c97d142c6b679183159197e9d3f6a76ba5e5abf999725", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c748726b-a3c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675429248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429248, "uuid": "7e3534ce-8d3c-4346-b0ea-77815ce96f2a", "comment": "Malware payload (GCleaner)", "value": "a2fb7054cef5ccf72e392677f0efd376", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429248, "uuid": "75d65c5e-ccff-4b83-8f90-39ee0280b413", "comment": "Malware payload (GCleaner)", "value": "0794ad10c866dd0532c0aadce1577f1d241ec261e42a55d745d9b0f352689e36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429248, "uuid": "5021d021-7c39-46d6-9c06-e2b2b23e1954", "comment": "Malware payload (GCleaner)", "value": "b8c5fccfcff4e94703eff652d1cc20504119dd83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429248, "uuid": "a709cdd7-6ccd-4b6c-8743-a5a55b44504d", "comment": "Malware payload (GCleaner)", "value": "1d23d9fa64a07afbfee7522ba3c3474390181fe97bec35854dab2438fb60448c5371b083507835be684168b9cea96e9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429248, "uuid": "196b3390-8fad-407d-ad46-73ea45a40953", "value": "T192A533CA91B9CC33D122D3B21D7603A3FE337F2325B55384697E6D2E2F321A46569618", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429248, "uuid": "18b9b342-7adb-45d3-8282-09821add646d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429248, "uuid": "cb557356-76b0-4aa9-9ccd-94e6dec1f1e3", "value": "49152:ygqryIITVMh4Gtn2eHwA6Ex4tnA6+gMvBCeBLCgv2MR:TquIITVMhRtFt4tnygawetv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675429248, "uuid": "d81aed6c-ad26-45c7-9435-e3fc9922a096", "value": 2091865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675429248, "uuid": "81f1284f-2609-457f-aca1-4f283d762ea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429248, "uuid": "ad2f3c33-54db-4d83-8a17-9ccda5ca9e4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1121c734-a38b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675405320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405320, "uuid": "f0b724f6-4a61-43e5-8b14-8a0bab3ac5a9", "comment": "Malware payload (Smoke Loader)", "value": "56100628ee1fd29a772db64eed2abc96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405320, "uuid": "0f78d99b-a176-499f-9fe3-327356615a3b", "comment": "Malware payload (Smoke Loader)", "value": "084c0aa92e9a0cc7c14f9bf1215cc72f56aabb22d8ec7283abf77d4be03c7c98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405320, "uuid": "708d90d5-58cd-45fc-bd92-4ea57e1229ed", "comment": "Malware payload (Smoke Loader)", "value": "57a0687e2cdbd11e503bdb08069a271d5ff47647", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405320, "uuid": "e1048361-9e12-43bf-8953-92f634d59c7d", "comment": "Malware payload (Smoke Loader)", "value": "8fe37fb53788848f3e17a486b9f6933ad11b609aeb869897850bbb14f0935cf90dce9dd955e67eed6034d9062dc0cb83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405320, "uuid": "2aa5a248-fbce-49af-aaa3-64e82695b9d4", "value": "T1BF14D03239C0D072C87A01709871DBB56B7EB8329779594BB7942BAE4F707D0663A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405320, "uuid": "fde9e4ae-1997-408e-bdbd-6a1ca77148c7", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405320, "uuid": "331287f5-2740-4942-b91c-6ea27a33608f", "value": "3072:BHlXwFpRDUWLx83cWS258ofxhi0EfKXMHDSSyefBISTXHUUngGw:BHl6lLx83cHjsEfBH9ZISTX02hw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675405320, "uuid": "6c217230-2f6f-41e1-87c3-c21efd09cc77", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675405320, "uuid": "20e00606-e1e5-4fc9-9a3a-4540cf6d999f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405320, "uuid": "388b71c3-4298-40ff-b417-0b025ae55854", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b2f7ea-a3c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675430508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675430508, "uuid": "8e53a9ea-5e0b-4524-b292-d4d47df749b5", "comment": "Malware payload (RedLineStealer)", "value": "fe67f059b15d5fb7eb766773d7a6923a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675430508, "uuid": "1f1eafff-ed30-4e59-8cd7-9b18d666eb62", "comment": "Malware payload (RedLineStealer)", "value": "08d438146f690f7938ae3f29ff6f522913cf77a17654390017bf075c2429adad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675430508, "uuid": "e4bdcbf1-ea4e-474e-ae3d-f4cb9e71a738", "comment": "Malware payload (RedLineStealer)", "value": "98b412e21509639a3d0f9cd2676f7e22e32b13e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675430508, "uuid": "37fbc3c1-605c-4edd-a017-50128d3ec619", "comment": "Malware payload (RedLineStealer)", "value": "ad5df9989e8b4fd9e78767fd072d343d85b0e5ba51e8c02e85ce5b3c55da03b2c6bf36ab8b3a3cd2b3120cada493b3d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675430508, "uuid": "18af8c8e-981b-4906-a635-5e49f00286e3", "value": "T151D4123239A0F4B1C63A59355815E7BA7FBD7C3192708827BF440AAA4F713C16A3635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675430508, "uuid": "c92fd2e9-f89c-42bf-9754-0fd389103c10", "value": "6b1aa8e68ec0f35426270b76446d282c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675430508, "uuid": "c84f2780-1d28-4b69-82ae-df226c931749", "value": "12288:e+5LOxuCxvs3nSHf+v8WVKhBYAbrHqFy9jY3BQxHsS:ecnwvk+f+v8WgJnHMy9jE6hsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675430508, "uuid": "46dab525-8180-4a38-a9b0-c26c58693d13", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675430508, "uuid": "9b96e3a7-1730-4b2f-bec5-e92956440ed0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675430508, "uuid": "9d8777fa-df3f-445a-8f7e-ece6503307ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c227e5b-a366-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675389661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675389661, "uuid": "698a730c-be9f-49f8-a23f-c8891aec0648", "comment": "Malware payload (Amadey)", "value": "ee2a5cafdb342bc92db0bfbe6a08ad4e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675389661, "uuid": "5699ea7f-1a1a-4acb-9687-e679409b0db2", "comment": "Malware payload (Amadey)", "value": "08f841395225bc62295167b859c6ac86c9058050bc7231bd693af3fe1b5e95ca", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675389661, "uuid": "43addfd1-2d54-4860-b7fe-959890677c1a", "comment": "Malware payload (Amadey)", "value": "692664464169499f5871abd174afc39fe890f13d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675389661, "uuid": "448b72db-6723-4e18-a5e9-2e2ab73d982d", "comment": "Malware payload (Amadey)", "value": "451aa0a6bd295e684698d7f93344d3cceba3ad7729a8ca0447cdf055e60bce5e47e1d9cbcb84ded11c11e26228b6d4ec", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675389661, "uuid": "38851237-8c24-47b0-97ed-eeb21d4ba11e", "value": "T1DA648D82A2D2FC59D621CB729E1EDBF47A1DB9514E386F6612185F3F1872173C2EB210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675389661, "uuid": "fa80909c-45a5-4bf8-a2f1-5d991e286bd4", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675389661, "uuid": "5ee5a8ba-0487-4dfd-b548-8c377fc9b3ae", "value": "6144:USMRLm3LghP9fM7jIdohilwKwpxmqjV6ptCbNKN:USMRK3sLE7jJQleZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675389661, "uuid": "7ec30b08-11e1-442e-b223-1e4f12c1a191", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675389661, "uuid": "05421514-16f6-43ae-ade8-42427259d126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675389661, "uuid": "b596e861-dddb-416f-9004-148c8550c5b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "023828ea-a399-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675411308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411308, "uuid": "91d8f808-3ef5-4ae5-86d0-66835ac74eb9", "comment": "Malware payload (GuLoader)", "value": "8c18adf76d8579a3a50ac19b5a831624", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411308, "uuid": "51289a8c-4766-45b9-bfe7-6a2134f96fad", "comment": "Malware payload (GuLoader)", "value": "094594bfad677f27a513daec7ced645aea58685dc59016f545c8dcdfe3a88524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411308, "uuid": "510942f4-005b-426b-ae19-6abfcd555efd", "comment": "Malware payload (GuLoader)", "value": "a0266617d3639dd18d83806e97fc29bbefe91659", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411308, "uuid": "40cf2dec-3c5a-4dbe-9bce-e53db76d3ab1", "comment": "Malware payload (GuLoader)", "value": "5addd493b3f086841d6a468a2368aebe9bf29ce53f53971ab6f6b3f80ba07a95c995a1f22db93e3675d4ba065210639b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411308, "uuid": "096cbff6-d8bf-4de2-8fca-dcdf9b1286ac", "value": "T1DF553325E129F07ADAE17B310C9AED5A0EE34E53947836076BDEB5192FF3340429A743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411308, "uuid": "b70f88c1-f96b-42b8-95ed-d45ffe393085", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411308, "uuid": "e8a00636-d06e-47e2-9668-c579486f22ae", "value": "24576:Ai5wtRcuWbuqfD9ORBPfCgflzQgqYPGX4XyuoHd1ZoHo8fv5nw/:+Wiq78xK1dX4AHdPoFnJw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675411308, "uuid": "c0ce83d8-36f7-4314-bb7c-2de151c198d2", "value": 1381776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675411308, "uuid": "a9a8b3ef-d14b-4380-ad4a-b9e5df5fb1ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411308, "uuid": "e7278fb3-526d-4dc4-b83d-8f8b276d3677", "value": "resurrectionist.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdef2d61-a3ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675447271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675447271, "uuid": "d94a8fbf-a76c-4c9e-9701-1a4dffc0c057", "comment": "Malware payload (Rhadamanthys)", "value": "16a972d24cf31e93b391962a1779b1ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675447271, "uuid": "19824be6-1c52-447e-8985-5a342aa6a002", "comment": "Malware payload (Rhadamanthys)", "value": "0a80f680c49fc98106e3025d3c6c2ac9376f175d7df2563b75abc5b814e62e13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675447271, "uuid": "7dbd6e4f-2f24-4a9c-9dda-46b4bd937fac", "comment": "Malware payload (Rhadamanthys)", "value": "c954897daf6a275192463320e4fcc60381a00b57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675447271, "uuid": "0f665cad-3c13-4bd9-bb76-552ee30ffd8d", "comment": "Malware payload (Rhadamanthys)", "value": "18dc7f0c3adaf74897d997ed15bc6ee945b32f0b1fba9cfbe72e41ccab25df3313702ac06b8d1cfd5739924292c9c66b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675447271, "uuid": "cb3bfdc3-fe75-4535-9ac9-5db0fb4d575d", "value": "T1A714D03236D0C0B2C1BA54304864D6A5BBFEB4314A758A4B7BA427FE4F746E0673A357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675447271, "uuid": "95e79829-81e1-4fed-845f-ef381b783153", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675447271, "uuid": "055843b5-0823-45bb-8f2f-3d76e66dadc2", "value": "3072:3ebv1M45sh5iZ+LZjQ7dfWbe5Krh2dVvyImntQ3L16NLA9zZ:3eCD5iZ+LZQ5fUrYvybtO16k9zZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675447271, "uuid": "2ef41659-8384-4cdf-8711-936974b71a36", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675447271, "uuid": "b1405a75-c394-4292-a3a1-12bd0b6a015f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675447271, "uuid": "a941e691-1c53-40be-bbd1-febe22267979", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf38aff5-a3f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675452024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452024, "uuid": "4cb547b1-e57f-4f01-8576-7970db093f91", "comment": "Malware payload (RedLineStealer)", "value": "0223a36e569fa7e78bd10c16fb623062", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452024, "uuid": "8089c0f4-ac76-423b-9dde-f7cf5344d397", "comment": "Malware payload (RedLineStealer)", "value": "0a9ad1b516536e141fa37603f8dda726720b4c776f033024fb4f7272f641f9e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452024, "uuid": "ac795632-5e2d-460d-a2bc-f3cb21e1a0f6", "comment": "Malware payload (RedLineStealer)", "value": "a28bbf67540d635d4af3a13c76ead9592f1f0b4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452024, "uuid": "923c2df5-fe6e-4ba4-aa3b-c36d0e86ad71", "comment": "Malware payload (RedLineStealer)", "value": "0e31b67e6064e8e918aa57dc08ff07eefbaa45fcdb5221b0414eb21173df347fd5f522cf607490fc55512b3fa1a8bc09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452024, "uuid": "dbe09e86-94e7-40e0-8d3f-33844d16645c", "value": "T14AD412223590D072C5B7203A6834EA5EAB3FB5354578971B7B5813BE8F703D36B2721A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452024, "uuid": "cb771a47-1e01-48fc-8596-ce2c3b16db50", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452024, "uuid": "c72a627a-c1b9-4965-8fc6-5ac3328a1797", "value": "12288:KCgjQDk7tgdPXYUjxhbiS8lbNB7+gIRVQZcRg5kVZfl:K1cMtgdPjNkfb7qg4rgWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452024, "uuid": "15564ab1-26ac-4c61-b78f-2bad36a8a027", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452024, "uuid": "54c81b0e-3780-4b01-a033-1c64a7b891a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452024, "uuid": "287c2a4c-b9ad-4a08-9f8d-5ddf4c4cad77", "value": "0223a36e569fa7e78bd10c16fb623062.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9fe54e-a36d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675392833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675392833, "uuid": "201fcc37-0ef1-450f-ba64-1fdf23d544b5", "comment": "Malware payload (RedLineStealer)", "value": "68d18d3984d0f3c62a55c9ee9c5f75ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675392833, "uuid": "90a382c1-9658-438c-a60b-80115242c075", "comment": "Malware payload (RedLineStealer)", "value": "0adbe3e3424923497dafd5266f869c5d01fb556b5c860742e40ff27b1f57d9ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675392833, "uuid": "890e93f7-efe5-4ad6-8397-cb13fc5cd092", "comment": "Malware payload (RedLineStealer)", "value": "fb8a7bcf42c9b87642fc4b0827cbb87c0457c215", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675392833, "uuid": "757ca988-5087-4912-a276-0878c034bec9", "comment": "Malware payload (RedLineStealer)", "value": "4f3dbda04ea4dc76460e510fceeb8e6772a310adb5f52b76d959f542b8bc7147323ec9d048ae61b2e5d8a8cf48037467", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675392833, "uuid": "ede495eb-c381-4941-9ff1-24936ed0d054", "value": "T123E1C811E7EC5B33C9B14B399CB223920378A71A5E13CB5E58C4521F9C8138A4B60FA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675392833, "uuid": "56e91303-6093-462a-8d17-6a2c8c13aa74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675392833, "uuid": "b56f06aa-924c-4c23-b876-7f3ed28fe22f", "value": "96:ikVpYQfmFp2T4OPOGvMtON6C6kIFBTvbFnU:i0qQqpS4OPJhHGV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675392833, "uuid": "03625a81-2396-4e33-867a-aff34c8fbee5", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675392833, "uuid": "39f51c49-f310-4554-9bd6-3dc51f381be7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675392833, "uuid": "e41c7ccc-4c6e-49eb-827c-28932b5df792", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0114aaa-a3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675422874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422874, "uuid": "9021833c-e191-4fd9-9db9-aabd7b56b377", "comment": "Malware payload (AgentTesla)", "value": "3acd1db34ce4dd50dc5d29903745c811", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422874, "uuid": "44f1c85e-e710-4403-be4d-193e51f7be0a", "comment": "Malware payload (AgentTesla)", "value": "0b22f8d00db84847ab53b292dcf2c5ca7f4d01f170c4493ca67eb57accaa0ee1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422874, "uuid": "1596ece8-54db-46cc-9e06-208e1682d8cf", "comment": "Malware payload (AgentTesla)", "value": "020d1a583d0bd6fb71094bef324a09f0141e4093", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422874, "uuid": "c2d4beaf-d1a8-4c5e-9a1a-d03abe038a00", "comment": "Malware payload (AgentTesla)", "value": "6e2d3d2c3b6cdcd41ba9542024fce9765727d8b6b0399b18523345fe377eb696664007bd8e482652a539e3f1f672ba82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422874, "uuid": "002add38-14b9-45d0-956c-fcce90aa6624", "value": "T1C705293E19BA57E2D039FA3942A18420F6ED93837303C998EDD62AC4CF115857EDE61D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422874, "uuid": "e0d76126-44d1-4646-954b-abf0b6900f41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422874, "uuid": "ab7fcb42-c441-40db-a97c-03672c8aaf6d", "value": "24576:rlda7MTyPdLX2tuCAe/ZXy1M+N4nnL/1v3F+csOxltKwJJ:sG5n7KKrJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675422874, "uuid": "0b1e07d5-623e-4c37-921b-426d1d70c046", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675422874, "uuid": "85589a59-8784-47a9-b5e5-be8bf6412edf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422874, "uuid": "fc19221f-8379-470e-90ef-63bd6ebea24b", "value": "PO-1012023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecaaa36a-a3cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675433176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433176, "uuid": "8c85a741-1b43-447a-8d78-9aec1e491ba4", "comment": "Malware payload (Loki)", "value": "2d9d9dc24b22cccd2ca8ca4d2975115d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433176, "uuid": "9659da02-ec40-44a7-89cd-7bfd858d1036", "comment": "Malware payload (Loki)", "value": "0b31e3396946781f4215290726981f96511ebc2d286a56d911e102ee7145c6ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433176, "uuid": "bf3eac6e-e695-49e0-8905-eb7c003b4370", "comment": "Malware payload (Loki)", "value": "1fc2da1c1c87af9637bfb4858fee4037cd5e60ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433176, "uuid": "b7c56211-cccb-446f-a3de-364fd10ee947", "comment": "Malware payload (Loki)", "value": "cb59317a89fa2ad1078c08b0cc1dc19bc6451485687bceda02f9f433bf9d54588a7e9704f2f0bde1380ca6d6f17ae68e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433176, "uuid": "7c239298-65cd-40a2-a1bb-0f767eb5fd7f", "value": "T1C5F46D6337B199B2F78720B104287B885BF17603BE56E2938BB737C06785DB77298152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433176, "uuid": "0233ca6e-4e1f-49b5-a48f-7f8ee4eec88b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433176, "uuid": "ef9e2181-032e-4025-b707-d0e036980403", "value": "12288:ehefaqG4yPaj5XwBtP3NjHetuoOqFyq6Fy2Mxzo3:geSqG4yPatXwBtP3N4qY6F0xM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675433176, "uuid": "c138e096-fcfe-41d4-b492-ca09d25fd8c4", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675433176, "uuid": "b1c916df-8a2a-47ba-bb5f-506f785538a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433176, "uuid": "910b5438-72ea-46cd-b324-6f99f6abffde", "value": "kellyzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9cc6bee-a3c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675428795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428795, "uuid": "98e20f34-adbe-4e3e-a201-340839d81bc0", "comment": "Malware payload (RedLineStealer)", "value": "6e57c8d50cd70893baf47fe8f0b6ef63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428795, "uuid": "6727e254-4c3a-48b0-82ae-bede0fb04153", "comment": "Malware payload (RedLineStealer)", "value": "0b4dba50a4b4673f6681be4e06175409d0e13875d2bb8f48deb85c4de82b9c44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428795, "uuid": "508b5c1c-708e-480f-9ef7-552103e80aed", "comment": "Malware payload (RedLineStealer)", "value": "a81c715b9dcb00b66b13bab34bc4e9ad53045c55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428795, "uuid": "d463a160-1a12-4880-8b21-c4b747bfa874", "comment": "Malware payload (RedLineStealer)", "value": "09fdd5e4ba44289d9950139f658f3062d2f26f7dcc44cf954a4f3a211bcee028ad61c7c0684b8bdb8ae067590366b2d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428795, "uuid": "b365ba37-5e80-4ce0-b10f-bd3676e0b498", "value": "T11ED4123732E0C4B3CA365931482897B8773DB43155B845AB776C97EA5F713E0633A24A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428795, "uuid": "a90eeaaa-372c-46c5-9275-3ce65924db7f", "value": "6b1aa8e68ec0f35426270b76446d282c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428795, "uuid": "4a834ac6-45df-4f94-a9de-5b7482fa65ad", "value": "12288:faIaicz/XKJBQpwocV9RyEVgNuUtApCTRriukI:fZIL6JOpCV/zg9tAA9riO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675428795, "uuid": "6582c52a-d783-4032-bd4f-90af6597456a", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675428795, "uuid": "24d7bb8a-fb4c-4fb6-a82b-6d48908f462f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428795, "uuid": "b5123a06-ce5b-40cb-9efb-ed6566f90a34", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df48468b-a3d9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675439166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439166, "uuid": "3122cfcd-f066-408b-b89c-0d78ca03e198", "comment": "Malware payload (Amadey)", "value": "bf80ffcb489e283a31b948225315eaae", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439166, "uuid": "6a5ae197-c234-48cb-87d5-a20a3d26df28", "comment": "Malware payload (Amadey)", "value": "0bc3e1cd63dd563e6b710ee50da92608d2071b322bf06e901bca8b50281d64b1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439166, "uuid": "f2dd4449-c404-4a72-8183-4de5fc742f9e", "comment": "Malware payload (Amadey)", "value": "68100dff4c605e510704851a3baef5c1879fc24a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439166, "uuid": "9d01cf8a-59bf-4a96-8ed5-3651e2431532", "comment": "Malware payload (Amadey)", "value": "0ad0e409415b6cff7b2b8972a79420328ca5c2cf76240c7c17ab85f915f8882403951756d1f77d21461c9558bdaf6e27", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439166, "uuid": "90977688-0b69-4661-9c52-deba688ea54c", "value": "T13DD4122276D0C032C16F103498A4E6A56FBFB93156F9995B776C17BF4F302D07A29346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439166, "uuid": "b45a059b-621f-4e36-9e18-dfd4b01817a5", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439166, "uuid": "b5e71ee2-a0c4-424b-95c3-1119c7fc3b3f", "value": "12288:n5kdqvS5yLB0twLO7oh0+cyApkcICkPiXAFX39W76Xt+G7BRkj:nuQCyLB0KLOk2RcCDXCn9W76X5Wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675439166, "uuid": "a7f3cc9a-344d-4a21-8aca-4b1c1454ecfb", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675439166, "uuid": "ac17a90a-5fca-44d9-ad53-853df662ad78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439166, "uuid": "f8e360bb-2b47-4bc4-b401-827a96e7f6d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9c4f53-a3a1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675414892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414892, "uuid": "d4231bd1-78e6-45ea-a04e-c1ac0a342267", "comment": "Malware payload", "value": "c0c924231b31740a45f9d13992905c2a", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414892, "uuid": "43b38472-ac00-413e-82f0-32848a5aa2b8", "comment": "Malware payload", "value": "0d781feece557451c861cf2b6eff3e121d7aaac9b156f17ae10d20702a1f962d", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414892, "uuid": "db83781b-67a7-4079-b777-91fe0b5558d0", "comment": "Malware payload", "value": "42f7bbf4e8342c43023e0574ab234bdb26c7dfd1", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414892, "uuid": "c101a349-6e12-475d-baaf-b62b7cb00942", "comment": "Malware payload", "value": "e05769e178f2c20bcfb06d0c50596caf41713cc0f18484b2a596191d2e14d69f455db1eb17578c4a1b7f7062c43d3a86", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414892, "uuid": "f5e948ff-8722-42f0-b6b6-05e3f1bd793f", "value": "T146E3D0323AB84681C3B42BF25AE67F0A6A2FEE1623571B1F5395521F4DA0244DD04F4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414892, "uuid": "3bfbebfb-b6d1-49e7-926b-dab54a4af3b9", "value": "3072:uGbAVfBWQdmUeG33oEkIrrJFxeauCm35hvuWt4AJERnyNenUWHCoTCCCCCCCCCC4:uiAVfBAa33o9krJeDz4iERB6zSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675414892, "uuid": "f6a55c28-73ae-4f7c-9d4c-ad45b0893963", "value": 150272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675414892, "uuid": "54e70e9e-c497-4bf6-a2dc-d9ba910b4bcf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414892, "uuid": "404f04f2-7503-4eaa-b4b9-b7e75895a4cb", "value": "cancelation.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c77127c-a3b2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675422304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422304, "uuid": "154f5696-92c9-4805-9e0f-60b00fe7ff1d", "comment": "Malware payload", "value": "8c79a72bcbc2a99de3ff08db67faef18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422304, "uuid": "3b922d09-c55d-4e7b-b12b-21b11210e304", "comment": "Malware payload", "value": "0e2db11d049ce4da246c9c09e3f42e82d632c8b7d901d4a733fd41a1e378c132", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422304, "uuid": "751150e9-51fc-428c-af47-208c213f4c20", "comment": "Malware payload", "value": "8b4940b906429e832983cf9db2c9580483a801a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422304, "uuid": "f318b849-baf9-4291-b9ef-afc225f27a72", "comment": "Malware payload", "value": "9fb8762f8f868cf0075a112d315a0f111628d60b855a3b853471943835b0fa0f10115787bbc96c158c045d11ed2a8ad3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422304, "uuid": "3d295d01-aca6-419e-9702-5b51f35eba9a", "value": "T1AF04AE3238D0C073C96761705824D6A5BFBDB5314679A84B7BA81B7E9F306D0633A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422304, "uuid": "682a05d9-b306-4f08-a60b-60fa159fd0b5", "value": "b65d7d05727ada8b2acd168719f50dd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422304, "uuid": "4482a976-bdb9-4b78-b034-06fa5d984b7f", "value": "1536:hlnKXeUkNU9AXGMutRhmGzA1vLdqUvK2P2ObIy0G1koLxg5:/nKXet6F/zKL3TIGWiu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675422304, "uuid": "28854d23-5577-4f94-ad24-78cca131f464", "value": 177393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675422304, "uuid": "4fe42778-303d-4a18-8148-ed19a1bc4107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422304, "uuid": "47675248-2141-4cbe-bd55-675b8398793d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ab039c-a3d7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675438041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438041, "uuid": "6728aa48-8a2e-4e40-94b2-623187bc824d", "comment": "Malware payload", "value": "c5c5e49fc32b180f3ad39abd5e7ebede", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438041, "uuid": "07291d1e-7acb-4234-a32e-c35acf4d11ac", "comment": "Malware payload", "value": "0ec726fc469641dd59d7b7a6814dae76cade4af36730d4d9ca2d345e92ebfa0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438041, "uuid": "666593be-8423-4c73-92f2-3bf5d8be9dd3", "comment": "Malware payload", "value": "196f917967beefb3bbaf24540f312b731832e603", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438041, "uuid": "7a0e9d08-5364-4649-82d2-923cb9cb5227", "comment": "Malware payload", "value": "3ba077f1c174b20a1b91dc11ae844049dbe1c2ad77667694c1450cbc1241ad0f8d3b8ddc29cb5c7077a2bf9c50258356", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438041, "uuid": "b7c8bc80-424f-47d2-a44c-431066a27c26", "value": "T1EC76331032D188F6E9A154B3C6A81C90E2B6FA1D1F6BC1FBB3F9947D64FD419D228B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438041, "uuid": "99f7b334-6d5f-4c79-b5c8-eb07010d3df7", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438041, "uuid": "cf4bed9a-aac4-4c6f-970d-1c427ed447ed", "value": "196608:91Oo9Wded+aY1OCEeCwDtJXB8AWyU0wpQwJLXyWp:3Oo9WdeMaY1xxJNBHqQwJ7fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675438041, "uuid": "59c42d6e-9e33-4583-ae7f-b1d122fbbbfd", "value": 7593497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675438041, "uuid": "516ee905-7325-4dad-9a4f-7f5bf9d64b7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438041, "uuid": "25eca76a-7d97-4092-b388-5d221d039dfe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2d8e21-a3ad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675419941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419941, "uuid": "3e166c59-81f2-47c4-b8c5-1583a0316a29", "comment": "Malware payload", "value": "b1f822b740a92dec295d6717cf71f2cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419941, "uuid": "2b5289ff-8055-4682-bf7d-0c44d1a1dbba", "comment": "Malware payload", "value": "0f4762639b00bf14acaa62b357fa57d47f04960d15d8224cb79c8c55b9b43da5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419941, "uuid": "dae371da-f004-4f24-b314-fc332871d84c", "comment": "Malware payload", "value": "914635e96637acac86c6db5b1e4554c1494f620b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419941, "uuid": "33b0bdd4-c571-4879-abf4-3c0677f9b7bc", "comment": "Malware payload", "value": "1949775cb933c70860d7515f1fe7b41b1106bd52f025c7e105c75a465afbb1e9430d2a134a462ab268dcee891faecbdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419941, "uuid": "9e682ecc-f31a-4eee-8289-c54c48b2d015", "value": "T12E7633D23EDAE174E10A70368EA1EFF1F1E4BAE53D74143B63592AE41F34064E91690B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419941, "uuid": "0d8fdbf3-cc4b-4b27-ba41-ae7628cc844a", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419941, "uuid": "b78bbb4d-bb3c-4950-b46b-a58a12b2973a", "value": "196608:91Oacx/EDAJw5c9FXMSrQmpfq43fU+9HmfA:3O3/EMJKEdpv3ftmfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675419941, "uuid": "7e2a7190-0d01-4b7d-b3e0-538235b386fe", "value": 7620346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675419941, "uuid": "b46d4beb-9aee-4c77-8f70-b4f2484bd827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419941, "uuid": "55193916-b9c1-402c-b278-49f15557a3db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f727d7fe-a36e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675393250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675393250, "uuid": "fc7cbad1-7f31-4229-8178-7ce70323fc9a", "comment": "Malware payload (RedLineStealer)", "value": "a3d5cf59d2c36ee25e9ad0723983ac2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675393250, "uuid": "c33c7109-5f0f-4728-ae63-7f0c48179de9", "comment": "Malware payload (RedLineStealer)", "value": "0f7041360dd47ff87c4bae150381148b30c3f293665e1c45f5bb64217455a4ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675393250, "uuid": "212e6f23-fcb7-496c-b279-f24ab1cb658b", "comment": "Malware payload (RedLineStealer)", "value": "a15c66c9e2833258707f0f108cd8fce0cad63105", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675393250, "uuid": "86fa667c-73a7-49dd-a82c-365155f5c3ec", "comment": "Malware payload (RedLineStealer)", "value": "ad79297ad38d4d07205ba04f202c535868b6d0544db736ac6f45cc5272b657b515bd013b29112ff49635155230927af3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675393250, "uuid": "d0a98a4e-45b2-4fae-a6a3-11c4a83ec0b7", "value": "T15294AE42A292FC41DA26CB729E1FD7F47A1FF9518E687FA612185B3F1872173C5A3210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675393250, "uuid": "e666dfc4-02d5-4d73-b461-289b4d00a776", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675393250, "uuid": "14dbdd5c-cd13-41d5-a328-287c8275c9af", "value": "6144:ZalaL88okM9t+V3zEe7ZP1fvVPLMAdamVHHWk8ZZia3lwKwpxYjV6ptCbNKN:Zalag8BMKCelZvxLfNVH2kCZiele0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675393250, "uuid": "d530b39f-516f-4afc-b0a5-7f0b55c56bb9", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675393250, "uuid": "cef1f2ca-d98c-48b7-a508-af7cb3140ec8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675393250, "uuid": "78909018-6e7a-48e0-8831-dd3e64296d78", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40fb221-a3ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675448596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448596, "uuid": "46ed6ab9-c0d5-4836-bad9-9d4f128a1004", "comment": "Malware payload (Mirai)", "value": "c28208ac94144aa638f51b695f8bffef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448596, "uuid": "5cc014e4-5e67-46f8-88e9-290dd85b535b", "comment": "Malware payload (Mirai)", "value": "0f9c027785e86e1c4fb12347cea2e22dd0b34a3fd9a15ce7865a83de44c62a5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448596, "uuid": "0d106164-6d38-465b-ab65-c69752476afd", "comment": "Malware payload (Mirai)", "value": "9aad91b6550f1440b9c2a7c453c398161a4a04da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448596, "uuid": "80294d72-91ba-4671-be78-223dc72750f6", "comment": "Malware payload (Mirai)", "value": "1c2f60ed5495f5cbab940d86a23b651c6d88059f39d5f037e4becf8f8917acc93a6a5429cb8c02f76b99f7e1102e2bae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448596, "uuid": "d477f3d3-f301-4f29-8c92-d9dd5b6f4bcf", "value": "T141A2D025D345AEF4DFEF9D9456C1C2C2BAF943C7268AC8E340EEAF012516042BB88D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448596, "uuid": "2b67d9a4-f431-422f-8d6a-04883d5f5577", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C53M4uVcqgw05VxJe:mRxsSVsMD6xiJJE5zRWNC4uVcqgw09c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675448596, "uuid": "56acd90e-4f2b-458a-adec-cf6804785976", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675448596, "uuid": "1f03d304-dc65-41eb-b09b-38badf4c3e39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448596, "uuid": "b6f694a6-eda3-4e02-a503-b78dbdb336f5", "value": "c28208ac94144aa638f51b695f8bffef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ef953a-a3d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675436473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675436473, "uuid": "fdfe52d1-83dd-403d-810a-b4cdc0d29b8a", "comment": "Malware payload (RedLineStealer)", "value": "5db0ff47ba7e170e575a91a14a97710c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675436473, "uuid": "cc43f788-aaf9-4104-b56b-8a5b92464e1b", "comment": "Malware payload (RedLineStealer)", "value": "0fbaa3eb6ea93afc5b818a70ac69f4a06997ea4a5b00ab8f3ac286773962ced8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675436473, "uuid": "d1cf9703-1271-47f0-a70c-81603a0c8ca0", "comment": "Malware payload (RedLineStealer)", "value": "c8a07aa651300bf795706d528ed954b0ffe8a1d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675436473, "uuid": "a82583be-5b96-4cc3-b14b-dff286315f35", "comment": "Malware payload (RedLineStealer)", "value": "72845a8a1172d3e6eedf1f9b18be953ca78c1cbf2997ac639ee5585c466eaebab7f127a592b0e719f46592db4ceb32f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675436473, "uuid": "46d568f0-9eb3-4f91-9a4e-f89390382f0e", "value": "T1EB54F12636C1C0F2E57B54300814EEA5ABFEB93215BAD91737E806BE4F706D05A3A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675436473, "uuid": "ae564f81-108b-4bd7-af8e-c95fa170b75e", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675436473, "uuid": "bf386599-034d-44bd-b0d9-afcd47e6bd56", "value": "6144:H5Lu+MLSpssLNhPAF0lPaB3VYfkaFfLETZtgvr8D3xjJ:H5FMhsnPASLfkaMtgvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675436473, "uuid": "3121580f-adb4-4def-8e00-a3fcef3e6386", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675436473, "uuid": "def8c673-84c5-462d-bcfd-f5c066bb76a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675436473, "uuid": "b8d73909-a507-4989-b3af-73a3006d13e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34fa2a6-a3a1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675415121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415121, "uuid": "9f0c8c7d-944c-43f2-805a-ed6f8d0661aa", "comment": "Malware payload (Amadey)", "value": "182d88a224c7556fd85ae3df7ef89e7a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415121, "uuid": "c7453fcf-5f7c-41f4-a689-c2d08a732267", "comment": "Malware payload (Amadey)", "value": "0fcb22b5f80a849c4000fbf88d6f80dfc4a5e337cd612c46e13f7eb54d69beee", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415121, "uuid": "ca0fcf55-0fd5-4a11-8252-b7a917455231", "comment": "Malware payload (Amadey)", "value": "a95138d6d64cb8135438656a85a9cecc7dac246c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415121, "uuid": "40e42563-30d4-4758-9719-d7fc0e0c2674", "comment": "Malware payload (Amadey)", "value": "e9ef1d73510d3f4216446c18de832e7d921a8c496618725b5031fd71ce7708f3b85cddd126540e400f16360f231d629d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415121, "uuid": "13fb7dde-eff4-4c26-b5d9-d4ca9acb8d8f", "value": "T1A9D412327980E072C29F0530992AEB65AFBC653245255A7B37F915BE4F706D02E2E34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415121, "uuid": "f3743313-5fb4-41ac-992d-d5c00d643b3b", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415121, "uuid": "7ffaa983-1407-44e0-8385-9e4eb66a5e0d", "value": "12288:4HYLOn3akEthce2Q+nvCGO2WIPVj6je+bjT04VGo8emF:44VkEt9ytfWuVj6KeT0EGoZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675415121, "uuid": "67619ca5-15c8-4bad-9c38-675bbc6713b2", "value": 616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675415121, "uuid": "81d6a6df-d3f0-47d5-92bd-b7b5d59398f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415121, "uuid": "ee75f9b2-29c3-4471-b8fd-2e29ee65dedb", "value": "182d88a224c7556fd85ae3df7ef89e7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7c5756-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675454065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454065, "uuid": "9aaaee4f-ca61-4571-a31c-ce7fe241362a", "comment": "Malware payload (SnakeKeylogger)", "value": "6629c7221ee11329938fd94f0c6fc801", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454065, "uuid": "d8cff43c-fa23-4c8b-a6b3-56ae5779a1b8", "comment": "Malware payload (SnakeKeylogger)", "value": "105720dec1383492add8156554e740af732a92fbc9fb60edcca566f29c8f6ae8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454065, "uuid": "f9170ac1-6c62-4ed6-a908-5b8df8833954", "comment": "Malware payload (SnakeKeylogger)", "value": "44fad623bea310259be11fcd7655f50cf3518690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454065, "uuid": "7c6e9854-9dae-4c9f-976b-966835e3030e", "comment": "Malware payload (SnakeKeylogger)", "value": "8b0ce31410b8a31d88e3bbbd33212b0b59d1bb0e6da82b2b601cfaef03ba739cb3363352cbe2e0a0cec0bd3e01f9e264", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454065, "uuid": "071d31d4-e16a-4e54-b57b-ca2c9b9f1389", "value": "T10E057E6337B199B2E78720B20434BB885BF17503BE56E2938BB737C06785DB77298152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454065, "uuid": "4f7fb2b0-cb5e-4cec-b1c2-f27dfd9a82b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454065, "uuid": "1d4cc213-c2fe-4659-beee-02bd27fcc366", "value": "24576:WeSqG4yPaLNRQ1BZa6pqZttAv7N76F0xM:lRR8QpX6vMWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675454065, "uuid": "cadea859-9936-48cd-8b93-32a21fb8ba20", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675454065, "uuid": "3bd1dddc-bedf-4c3f-b365-d8f1505a402e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454065, "uuid": "79ae276b-8f23-4632-b281-dc24f57c0590", "value": "6629c7221ee11329938fd94f0c6fc801.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d89959-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675453946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453946, "uuid": "6886c98c-9498-4bf6-ba3b-394613cbd4d6", "comment": "Malware payload (LaplasClipper)", "value": "7aca913279c053180d4a033dc35f33f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453946, "uuid": "bb0be9ba-ef5c-4a3f-9c69-71cff28147f9", "comment": "Malware payload (LaplasClipper)", "value": "1063dbd630ff2a5917a3f66fca581c5742172d2fdb8e6f7c2cfa6d68fdd90420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453946, "uuid": "3304755a-7705-43fa-a080-c764353158dc", "comment": "Malware payload (LaplasClipper)", "value": "f5d580d11f08cc3815b9ee326d6aeb5742919de6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453946, "uuid": "57eec694-b75b-4a7a-bd5c-c28b56624301", "comment": "Malware payload (LaplasClipper)", "value": "0548c2aa20cca20bee9e561f25f3e977303c534a733ec8ccc422f51c50adb13657402fc633aa6e92e497c761c0a5837b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453946, "uuid": "bd3793ce-f7a7-4ecd-88f6-4ba4558dbb80", "value": "T1348523713860D836C5BB63705D11E9C8A9FEFAB51625544B63E952980FB03C0AB3739F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453946, "uuid": "6826d272-4f5d-44f0-b688-5dea89e4f205", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453946, "uuid": "83c31fb0-c984-4dd4-9373-6f0513c84344", "value": "49152:ZqzNiMuaoX9f8Ib7FD373DQG7r8Ji6mp7IA1US:szNlufJVxII8g64k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675453946, "uuid": "128457e6-aea2-43c7-87e5-8b6831b06e44", "value": 1871872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675453946, "uuid": "eb1e4179-0732-4dca-a955-1b0b07337898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453946, "uuid": "a45a31ce-d040-4054-b5fd-bea2a912af9e", "value": "7aca913279c053180d4a033dc35f33f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a61bae2-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675453949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453949, "uuid": "147f4c81-2dfb-4143-9b9a-21798d50fa6c", "comment": "Malware payload (Formbook)", "value": "2904d42cd32ebf5f8f6dc42e64546bd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453949, "uuid": "e50e4a92-9d9f-4ea8-ab43-6f013d8ca70e", "comment": "Malware payload (Formbook)", "value": "1077b8e8b1042a3b67b5ee5a508e71095174ceda299f6f68f5c8872d69323c44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453949, "uuid": "7eec8dbc-39df-4495-8554-76cd926798a5", "comment": "Malware payload (Formbook)", "value": "a6c1155cd1bea2070c6be70b6675868989d061ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453949, "uuid": "9bb23c29-6117-4bbe-ada2-638b100ed288", "comment": "Malware payload (Formbook)", "value": "1f720986d68b82ea7725cf3872a12ccf4a15327147d70c08862126208c59c6425c266f506d28d1fc28039f069ff90f3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453949, "uuid": "6c00f0d3-ec3e-467b-a839-2271e26c41a5", "value": "T1BA54BE4832582A0FC2531BBA09E0F3F80BB48DB57595E7A59EF1AF67F485B490C814F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453949, "uuid": "5962a3d6-7943-4918-919e-cec85d91cb55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453949, "uuid": "e0b72a1d-319f-4b36-92ac-dd23ee4a5e30", "value": "6144:+IvkfQfBZ6zXklsneek615BHy6XOQ+u241Nab22+G/Aek6/PF:FvAeD6zXklcyAtyGO7bTb1AeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675453949, "uuid": "2f813b58-51c1-4c8f-bc57-78ffefb3265b", "value": 292864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675453949, "uuid": "5fec6844-c51f-4ef3-99ea-7093992d9192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453949, "uuid": "8512ede6-676c-45aa-beaa-426d6a510746", "value": "2904d42cd32ebf5f8f6dc42e64546bd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ab7156-a38c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675405856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405856, "uuid": "f821c297-4d5d-46dc-af6d-cb1445b789bc", "comment": "Malware payload (RedLineStealer)", "value": "d95a2912157ce9142896755d8bc0e5c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405856, "uuid": "f5320656-b364-42dc-9127-94071320356a", "comment": "Malware payload (RedLineStealer)", "value": "108b4cc2b2cd99dc41167741c901b81da2248edb8a99de11eef045733739fc37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405856, "uuid": "0c5b9532-c00d-49ab-b2e2-c182201a5fbf", "comment": "Malware payload (RedLineStealer)", "value": "d2a3ae1af7a5e7b90f8893c268dcca04cc679a88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405856, "uuid": "9815d65e-a386-49ad-96fc-e5f788c1f756", "comment": "Malware payload (RedLineStealer)", "value": "a0ff483b20164dd52c925e6faf9d2a813d09ee34b6de91a60b5bc26d477e6a3b23dab8c5b3101fe83790a78f2ea63139", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405856, "uuid": "28d5fe00-975b-4c07-9a8f-6241877f09e1", "value": "T1E064F1323580D072C8AAC6346935C7913EBDB83116B9598B77981B9F9F70BE0633634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405856, "uuid": "c5ae284e-9715-421e-97a0-67abaf7637dd", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405856, "uuid": "1b0284e4-f4a4-40ea-9587-7620d9bad82d", "value": "6144:d7q3E4LU2OCYHx3c/tivOHCXIhFw9hU9/FV+QUKw:d70E4YCYuti+WIhuc9j+QN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675405856, "uuid": "6226ed80-af95-4581-8c74-737c42fdd1ab", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675405856, "uuid": "7aa820d6-49b7-4313-a336-6686c5e63def", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405856, "uuid": "94f64818-dc48-468f-81f5-5badc3ba41e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b76372-a383-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675402076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675402076, "uuid": "cd915327-e9e4-46eb-8a61-0e596e6ed6f7", "comment": "Malware payload (Amadey)", "value": "70907e6acee545054b06a989684f0497", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675402076, "uuid": "866fe1e9-3939-4bec-9211-b1d141dbf8b0", "comment": "Malware payload (Amadey)", "value": "10b35cb93d991f52e7ca14c7a2ab707c2bf51d3337adbf47e7833d695a2b2e1c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675402076, "uuid": "0694aafb-1774-47e8-aeaa-b5e62c394446", "comment": "Malware payload (Amadey)", "value": "9492b6d49e6460f1bcc13cb4dde5465b3ca6b0bd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675402076, "uuid": "8afaab13-8f9b-4e80-9718-5743c13829d8", "comment": "Malware payload (Amadey)", "value": "a86eaff6dce8bf622c64507b5be962d1a27c6155cc7a48c1980cfa38426c9be89ddafac605b52c3d4d36b4383caa3691", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675402076, "uuid": "37aae3d0-7f0c-47c0-9071-05500416ea3b", "value": "T105D4E042A292FC91D621CA729E1EDBF47A1EB9904E387F66321C5F7F1972172C5A3310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675402076, "uuid": "558e7027-bf0e-4c85-af93-ac0e8072fb79", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675402076, "uuid": "11e50620-527e-46c7-abc6-ed068b9ceb36", "value": "12288:pfpQuK/d8ZDhmidbV78wRJa4jXcO/a67emO2t:5Md8ZF1bh86JaQXcga67est", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675402076, "uuid": "2971819e-f8f1-4a3c-a617-6d0bbc11079d", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675402076, "uuid": "1074af03-45fb-4088-81da-8517f42fbdb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675402076, "uuid": "3f3cad74-4e92-43fe-99be-0a600bdd6ebb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0621362c-a3d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675435366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435366, "uuid": "031571ca-3a2d-466e-8d0e-4772a1f0f811", "comment": "Malware payload (AgentTesla)", "value": "cfe7f1e9916b1a504d0ba86d34ea8095", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435366, "uuid": "f78b848b-b9ca-448c-a961-cc7b648dbf5e", "comment": "Malware payload (AgentTesla)", "value": "11654f1ce1b35a98ec1e3b34877c553b91668a72739a387ae9fccf81cc63fa8d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435366, "uuid": "59be6c20-67bd-4797-a859-c33a60119b18", "comment": "Malware payload (AgentTesla)", "value": "9dc049d810c9c529057e8e2fb537ed5e21f8e8f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435366, "uuid": "d40880fd-96eb-4d12-820b-13ab202a613c", "comment": "Malware payload (AgentTesla)", "value": "6f1165ec84581b7b9c5835dfc1f275f9bb48a8eaa073f747f751a7c8023115a4ad8b6e9d4ecf7e587ba33ef0e5e7a7a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435366, "uuid": "e67d793f-fca5-46b6-89cd-f83df57c9372", "value": "T10A058E6337B099B2F78721B204247B885BF17503BE16E2939BB73BC06785DB77298152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435366, "uuid": "38916ee5-2d4e-465e-95d4-bbc6283a40d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435366, "uuid": "5c50b2e8-08c3-46a3-9b58-996c89a8fcf5", "value": "12288:Y1hefaqG4yPaL6Fy2Mxzo3ohAUTg20OQ2eddZ9y2BepG75N:YTeSqG4yPaL6F0xMIAugf9nZY2gG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675435366, "uuid": "efe44c14-d661-4514-8b9c-b12ad3699439", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675435366, "uuid": "05398e06-9bcc-41c5-8913-d894b0219d27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435366, "uuid": "b63edf96-06ae-42a5-b27c-24b310cd47dd", "value": "NEW SPECIFICATIONS 20230203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540d1943-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675453965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453965, "uuid": "b01ecc11-5c58-430c-893c-469f13ad6bb0", "comment": "Malware payload (Mirai)", "value": "5061ad07ccdd5a0b00a8098f6064dd6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453965, "uuid": "8705b21d-01da-46a4-8dcc-707161f57252", "comment": "Malware payload (Mirai)", "value": "116a5e02b331a5b20fe60dbdd1dafa107e06bdf304e296749961afeb4b02170e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453965, "uuid": "335ae41c-93af-42b6-b6c9-a06694cb4867", "comment": "Malware payload (Mirai)", "value": "ebd169d93e9343929c8e60a2aec396f84bea5436", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453965, "uuid": "62be3e4a-56a1-4a8d-889c-73fdcd690143", "comment": "Malware payload (Mirai)", "value": "e237a67e4b2b8fb2d6adec5563970527b582a6c03467c298958c8bead5c4b6a870247f63a9772f9a4d55281d3d7c855e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453965, "uuid": "d6767b8f-49b4-457d-8e89-212ee5622b4d", "value": "T1B183E70AFB620EB7DC5ACD7B15A2174028CD551BA1A93B36BD30C81CB54B64F1AF3CA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453965, "uuid": "ff67c831-adf2-404d-a154-1d2199cfa2e5", "value": "1536:i9NBpAuc0/pD3hOcrK5xwRDPaaFCP5IiqMrwx8Ir:i5OWK5xwp9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675453965, "uuid": "060982c0-2c59-4504-998e-9ed78e55db11", "value": 85020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675453965, "uuid": "67c22c2f-02c4-4e22-8148-31944360a355", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453965, "uuid": "60e03de8-0eb5-46f4-9aaf-e8a0c7362778", "value": "5061ad07ccdd5a0b00a8098f6064dd6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50be276f-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675453960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453960, "uuid": "7ad9b302-331d-4578-aa74-652fe55dd872", "comment": "Malware payload (Mirai)", "value": "0e0181075506f127a798019645a48d16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453960, "uuid": "de2e747f-8635-4ecb-b453-97ecd3d7555f", "comment": "Malware payload (Mirai)", "value": "116eb793479a3b78d4b6ea9143801543500ca9a95949fb1bb5228052660b3183", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453960, "uuid": "5a14ff35-a3d9-4158-a593-9d112e226860", "comment": "Malware payload (Mirai)", "value": "cdff527872a1001d15559c8914ff0591897f88fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453960, "uuid": "9422ffec-607e-4d24-9ad5-4239be13b909", "comment": "Malware payload (Mirai)", "value": "e8aa009427e32179d22b5e8547abe8022b914bd7f7aa9869bc9a4aaa93a69d1e8c5bdb41170825414794cade1338763d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453960, "uuid": "18fddd90-502c-4276-bcbe-16e3f4268a79", "value": "T147830C0ABA318FADF75C867553B38A20968C23A776F1D241F55CC9002E6074E256FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453960, "uuid": "fc1d0cd4-ca7d-4762-a3e4-f2a03b94b250", "value": "1536:NA3HbjqCBf9bUZsB8y5bD7Z/OQcMpfIrXC:NUbjXBf9bjB/FMQcOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675453960, "uuid": "190605bf-546c-4b82-9536-c4f1ff0a4483", "value": 85020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675453960, "uuid": "fac4e92f-2dea-434d-ac34-d1e6e57fadae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453960, "uuid": "31b34cdd-ee56-47e7-9712-7047c36565f5", "value": "0e0181075506f127a798019645a48d16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db598ed0-a394-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675409524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675409524, "uuid": "8cccaadf-f13b-4ecd-b6b4-e3e5cc600696", "comment": "Malware payload (RedLineStealer)", "value": "2aafe20790329eb52da565907125f993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675409524, "uuid": "560c898c-4b27-45e9-8c83-462c4e0bcc52", "comment": "Malware payload (RedLineStealer)", "value": "11fbcba70e0d9ee48f7223046c93e50736f3ad418596495ceee97235e3ec3e9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675409524, "uuid": "601b69c7-ed36-43da-ba79-299c6782b361", "comment": "Malware payload (RedLineStealer)", "value": "eda9a10ab9bf5b2ae4b45433bdceb0869fa0dc0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675409524, "uuid": "73b37706-b605-4722-8e0b-d8d6effd86eb", "comment": "Malware payload (RedLineStealer)", "value": "9da626113afe3d9b74a262fc82598900b5f9f0c78b3d764487b91bbb16ce348b997b76494ac0173248466cb7344eef05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675409524, "uuid": "bc79d9ed-ee03-4c61-b48d-36cfa0b416bd", "value": "T1B684F03274D0D072C5E745309C20D765AB6FA43101B8A94B3BA827AD7FB06D1A77E39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675409524, "uuid": "34bbb5fa-1f17-4259-90bd-a3986924ceb8", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675409524, "uuid": "ddfbd697-d664-4c30-9b5e-370d69126331", "value": "6144:THiX1L6jwJZuT1yM8WhyIk7IIatChic4UozsWZcxZw:THg1ZJZuT1AWdKIIaAicVa5cxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675409524, "uuid": "871f2967-4c29-4db8-8ea9-79a0cc45a5ea", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675409524, "uuid": "8c1fc5bc-e383-4795-b191-f97f1f42f903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675409524, "uuid": "84e55da1-4755-4841-8856-045eeca2b303", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fc50ab-a3bf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675428012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428012, "uuid": "66f76419-de53-43e1-887f-396ce7871b91", "comment": "Malware payload (RedLineStealer)", "value": "377b3601e08bb6fb8ee6f0fd0f5f7a12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428012, "uuid": "755b576c-f87c-49d6-805e-4db13717f21c", "comment": "Malware payload (RedLineStealer)", "value": "121338e806a7572ef0380f109151859c033b08413b3bdaeb0e28aeeb9df8b539", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428012, "uuid": "06800091-0259-410c-9109-7aa7ffbee6ce", "comment": "Malware payload (RedLineStealer)", "value": "e4c66e770720f434d88e338b8a594a96f2a0de93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428012, "uuid": "a2a0768f-670c-4ed0-b034-2aeae05e977b", "comment": "Malware payload (RedLineStealer)", "value": "7e340c5b3b5edd1ce6a11d0ea1edf6d9be2e90741d7efeab1dd0ea0c0a392e118b38ad477ec00b349ba74595a27c7d18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428012, "uuid": "2e510b0a-d048-4ff6-ba3a-c5e75c58fa5a", "value": "T161D4023239E0C573C56354315829DA66AF6EF4322EB489477B681A7DCF70EC12B3921B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428012, "uuid": "f878b001-8568-4e65-a357-cd237a386f1a", "value": "6b1aa8e68ec0f35426270b76446d282c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428012, "uuid": "477e613b-3a22-4150-9e49-86a47503c8e8", "value": "12288:dWf6tlDJA7cAsbPthBR6TzzuyG0+o38rqQ0:dimScAsBhH6vh/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675428012, "uuid": "598ab903-b139-4581-9961-ccc863bef064", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675428012, "uuid": "e3efe3aa-eb03-4c25-9d0f-766316322765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428012, "uuid": "09cf7af1-66f0-4f76-bcf9-e7c5a2664a59", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bbac53-a3c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675429453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429453, "uuid": "f7b9920f-11f1-44d4-a481-307e61bc54d4", "comment": "Malware payload (AgentTesla)", "value": "86f997e44576d75d1b91c3a9c3959a36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429453, "uuid": "d7e57a89-f491-4205-b640-3fc5b66479ec", "comment": "Malware payload (AgentTesla)", "value": "1292d87e050ab2fff750bf26be57a4d139dd3af1b46f4451da597baab6817ba9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429453, "uuid": "6bbc4439-5010-45c9-b25d-6a62a00a43f6", "comment": "Malware payload (AgentTesla)", "value": "66a7e205f5d523ed90d6e4cf92ed0808fd72d06d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429453, "uuid": "d364297c-66ed-4f88-a5e3-35c382195d6a", "comment": "Malware payload (AgentTesla)", "value": "a7eac4dc53277f701ba8707df303003251f395fb82aad9bfda3182b16507143f3d707562cbccfb807746a9fc1ed921e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429453, "uuid": "57db8ba2-5fd3-44de-b8a4-44b2334f174d", "value": "T18DC3D45232496DB7F7131CB55E1D86A100D7BC3920A6A61D76AA321F49F232212FF72F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429453, "uuid": "a8235acb-1e48-4313-bf4a-f0cdc7b395dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429453, "uuid": "82b2cb92-0b80-481a-9f06-688b802b8197", "value": "1536:vFvcDptX35NyEps1HRwm9IDWptkNF4h0VYCWc4iQlkt+:Qp53+EpIrIaptCeCWc4br", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675429453, "uuid": "110ffff3-90c5-407b-bc38-a80ccadb078a", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675429453, "uuid": "ebf4703d-a32a-45d3-8932-905a2686f297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429453, "uuid": "a7e0e4e5-e8d4-4630-8ddb-2701a5b8536b", "value": "00000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c4f4367-a3c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1675431242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431242, "uuid": "4f56da67-f25a-469a-b4fa-7b3399d206e2", "comment": "Malware payload (PrivateLoader)", "value": "915e55500d552c75cbdd999773e94ce3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431242, "uuid": "003dce18-e8d2-4758-8002-ec6546616f7d", "comment": "Malware payload (PrivateLoader)", "value": "12cf76b7c8b5e4f8b304898755bd12150e2f8c12263862a994a4ff1cb5543982", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431242, "uuid": "7670995c-d51a-42cb-a054-f20735ffe945", "comment": "Malware payload (PrivateLoader)", "value": "71d5e1fd58482b2251e36919b4abb2ec02d2ad32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431242, "uuid": "8e6bbfcd-1f98-40a1-bc9f-25a86601b637", "comment": "Malware payload (PrivateLoader)", "value": "746e047d4270ba504c9e8268792c00938343ea9581933bdcbf735dc42c839fc83f04b013bccbd6bb3bc06e956a008369", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431242, "uuid": "78a43c26-748a-4f72-9058-1d8ce776460a", "value": "T16C461227D3490AC2EDBC83309D2BAF8173F9D5A6A480CF3B15D115C63E9BA906DD9607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431242, "uuid": "c8f3a253-6e49-479c-9a97-557d658db991", "value": "87eb4bc6842457c0bb0fd7289803e078", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431242, "uuid": "6a206b89-ebe8-4da1-a726-e6c85e9b0e2d", "value": "98304:n4bnwT9Wurcv9b72AVXs+gCJmF7WinxSCGbBtKG4MFh3amG:n4bgs9PnPgsmMing1rpFQmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675431242, "uuid": "c54bf5d4-cf74-4ff3-9ed7-76da017375b8", "value": 5368824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675431242, "uuid": "a731e384-8494-4dea-9caf-f3a06f3d4cfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431242, "uuid": "00294951-92e8-4241-852a-ea3e9b4a03b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2039a4-a3cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675434007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434007, "uuid": "d96d1b27-5664-42f2-a9a4-56df701ba921", "comment": "Malware payload (Quakbot)", "value": "b6c8d82a4ec67398c756fc1f36e32511", "object_relation": "md5", "Tag": [ { "name": "obama236", "colour": "#DA0789", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434007, "uuid": "28a19fd8-016d-4c86-b5dd-6c2bf424b35e", "comment": "Malware payload (Quakbot)", "value": "12f21e8b7d02f5f48dc6966ec41307f810ef92bf02f9fce4872839153081dd9c", "object_relation": "sha256", "Tag": [ { "name": "obama236", "colour": "#DA0789", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434007, "uuid": "bdc3c778-5626-4c0b-9866-42ff1b2912a2", "comment": "Malware payload (Quakbot)", "value": "e56a3f2c911c0876fa3ce29dfeeac7be07c0921b", "object_relation": "sha1", "Tag": [ { "name": "obama236", "colour": "#DA0789", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434007, "uuid": "b1642809-3282-4f5e-b1e5-78abff328597", "comment": "Malware payload (Quakbot)", "value": "e967f0fc0e50e2b1c2264135560da508960ca2b49c87bee1e91b7e6b934f76a3cf9144a544bbf1c6c975182297ba5089", "object_relation": "sha3-384", "Tag": [ { "name": "obama236", "colour": "#DA0789", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434007, "uuid": "988f32aa-530d-461e-b97e-e1ce0aa2d2b3", "value": "T12FB3E10173E68B68DBF12B7158F56B353726BA20A276872FEE86313D5C60188CDD524F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434007, "uuid": "fbc6ad57-a5cc-4cd1-91a1-4c6abd7148ef", "value": "1536:qflBiZVfBWQdCj/UeG0wc4K0olXQwY2ZbhTh40EvLjJMApEIBvwZAIi:qbAVfBWQdmUeG33ovY8bhTh45vLjJSAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675434007, "uuid": "e6e8b571-46c8-4baa-9db7-77c001996df5", "value": 114234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675434007, "uuid": "4753ee03-bbc1-4233-95e1-bc2537c3a57f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434007, "uuid": "aaa97631-8ea7-4fd1-af4a-de5b5670d603", "value": "DocumentsFolder_845783_Feb_03.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54831d06-a3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675442369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442369, "uuid": "51a29195-de05-4f31-b9fa-7da438fb1ab3", "comment": "Malware payload (PureCrypter)", "value": "bc5a1d9d12642cb93a0ceb7077723a46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442369, "uuid": "748ea03d-8459-4245-82d7-ed142acbc1ed", "comment": "Malware payload (PureCrypter)", "value": "131adc1bb67169812a58709e55fadd78b8d625f52fac3616cf78ac413bb46d4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442369, "uuid": "ae3370e3-ba78-42f5-ad80-090e687e24ea", "comment": "Malware payload (PureCrypter)", "value": "ba4b5ab7ec2aa70fc08be1eb49a4f69b6652b147", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442369, "uuid": "07d67d0c-86e8-4d38-bef2-8644455edf6f", "comment": "Malware payload (PureCrypter)", "value": "b57393d930964b5102cd855b676d9e82d4458020e35223de22a29bc03a16d9c01e515a30587f93dff68dd1914fb61242", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442369, "uuid": "a833b07e-606e-4c9e-b358-7902c9faa726", "value": "T1B755336E23AC8495FBCA1B212D5DEEFC31C7DB6E28314616419E21F049E16C784D2DBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442369, "uuid": "1b7894cd-3aef-4b86-ae48-efc08da26d25", "value": "24576:Jw3FF2p8R05KYCMN0uVYjl/FxFhQqkF4e4EK6xN6z/qnk+sl:9o04YCAWZrFhQnsEvDNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442369, "uuid": "03fbd845-7a72-4371-ad95-808b67d49386", "value": 1299711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442369, "uuid": "28f888cd-0ceb-48d9-a14a-e04ddfe1c6d8", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442369, "uuid": "2bde8b45-122f-4611-b477-cc42fa972084", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75312a6c-a3cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675432975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432975, "uuid": "dbfb198d-74a1-4240-98f1-7f9d216a8381", "comment": "Malware payload (RedLineStealer)", "value": "ac8b7d8ee7fabfd7f31551facb4e214d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432975, "uuid": "b984cd36-1327-41c6-8c91-a3da6fa40c53", "comment": "Malware payload (RedLineStealer)", "value": "134ab8a05fd71a6762287cef0ee99a8ca08c076ffcc23ad44c32fe4f537f6c7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432975, "uuid": "7fac1bf8-a5b8-4ceb-9908-d0142fc36d76", "comment": "Malware payload (RedLineStealer)", "value": "0cb5f79a14b1c1c991bc0f34503b1a0e2873a6f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432975, "uuid": "4f0e8e36-016e-491f-8a64-0a7e494c5082", "comment": "Malware payload (RedLineStealer)", "value": "dabf5b089e201813e42889740ec7663c89d882302e0cf8baec17a265b9a5738617a29e841414a83dbf1667ec0f847b26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432975, "uuid": "6e024daf-d55b-4159-809b-c6f2ca0fb782", "value": "T1D25402313280C07EC67B60394C64FEA6ABBE7430557AD9577BA807AE8F312D16A35347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432975, "uuid": "593f3814-5779-43a6-888d-71972006c9f5", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432975, "uuid": "ae8b3064-5a51-40d6-8375-d169cd95caea", "value": "6144:/e92NLAvpoxuImqNRDAtSQuG8gJEVq6rZSOKU+XiTrLQq:/e92NwoQqNREtHQgWBZSOKUMiTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675432975, "uuid": "4d4f1562-41f5-411c-b55c-c742d7008541", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675432975, "uuid": "5ae42581-2c04-44ee-85ff-3f6675186043", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432975, "uuid": "89b753eb-53c2-4be3-ac06-31e7ae01a6c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822e05e8-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675454042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454042, "uuid": "0e555c1f-d4a3-4d17-9397-c9861d0afe28", "comment": "Malware payload (Smoke Loader)", "value": "58cf1b134c96e1f7aa46057ba36b2d75", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454042, "uuid": "de7535eb-4264-427a-9fa4-4dab4f420bf3", "comment": "Malware payload (Smoke Loader)", "value": "139eb0032a63f3e1e8bf067e18e998c1b59d3b66a4371c36a6bd1eed2b8ad718", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454042, "uuid": "51e0398e-f17d-44c1-a36b-7313f649c291", "comment": "Malware payload (Smoke Loader)", "value": "b7af84e3102083c10e7cda1b9dfd97e6c8090132", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454042, "uuid": "7d7f5680-87c9-49c8-a355-9a9bd09a208d", "comment": "Malware payload (Smoke Loader)", "value": "206b5b8a52f9eff2dd64b7e85b30638b6a8a3c4e0d11e2e0990ba339fe72db13a22e41fe7c413af5f63ec3c736f72523", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454042, "uuid": "4b3a59e3-8710-40c1-8283-d9c0bd67e4cd", "value": "T19E14D0323690C332C6BB11704C64EBA5BB7FB4314675895BBB6B17B95F302D0663A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454042, "uuid": "184a0e22-f0fd-4102-b99e-752becda029a", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454042, "uuid": "e8d994df-6633-413d-83a6-fabe974e5eca", "value": "3072:ma4ndH/na6iLIV+SJZ7XDWVu50HnYzahhNyIXNorPaUpcn+:mak/iLpSj7XDsHYOb9ohpcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675454042, "uuid": "55a5ed8a-1e4a-46c8-a522-339ddb8f13a0", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675454042, "uuid": "5db448c3-b048-4796-a440-1c18a9a6c456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454042, "uuid": "9f289f82-f98a-42d0-8f6a-0d8a15cc88d3", "value": "58cf1b134c96e1f7aa46057ba36b2d75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c86adc4-a3f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Nitol)", "timestamp": 1675452637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452637, "uuid": "15fbc558-44b2-4ba0-bdae-d8b728acd688", "comment": "Malware payload (Nitol)", "value": "8d1a2dbf8171ffe9e87bfccc57818ccf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452637, "uuid": "19b11c70-63fa-4313-bf6c-dee08d906355", "comment": "Malware payload (Nitol)", "value": "13b9946788e24e61351377d877b5bc1e3294e1a17456800f68a994923fd2562b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452637, "uuid": "a367ac54-335c-4069-a37e-e05373bbf4be", "comment": "Malware payload (Nitol)", "value": "766f1dbe5a7d4e818018af6c2881c58c3f874fb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452637, "uuid": "726762c8-fcfb-44d2-9a7d-571a1cf3cc64", "comment": "Malware payload (Nitol)", "value": "8ed2bbb0573d0706fddd3231623ea34a41787b66ccc1fe956d01a712165224d2cde28d0a94ecb0c46cbdf9e79ba8423c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452637, "uuid": "b896ceff-022c-4c06-ab71-a78a15b0c202", "value": "T155F423CB9247EC72CE4244B078F7E07CF7345C996C4D37716B50BE6A7A922856638AE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452637, "uuid": "dcc96e1a-979e-4280-b0f9-8ce2c3ceb749", "value": "00d215ed59c06f739575f7bb1d2f967c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452637, "uuid": "77c581e1-2795-4af8-b4cd-b5658733f657", "value": "12288:5ucgkaQ/56vUcUsr3oSXvpuFFrJLRJHjC1LlXyr8ANb/yCLYfw7Op8Rdb+:ocghi0fXXsFbLzH21LlCr8ebKEDxdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452637, "uuid": "f5b2acf5-d25e-4f4e-9ae0-2c410c0b8888", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452637, "uuid": "6c8e6482-0442-4ce0-ae36-ea5eaee68242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452637, "uuid": "e76a9cb1-c46c-493b-9850-54c75e431751", "value": "8d1a2dbf8171ffe9e87bfccc57818ccf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f912fe1-a3ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1675434308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434308, "uuid": "6770c14a-7895-4dba-9c9d-b284e8a0f671", "comment": "Malware payload (DarkCloud)", "value": "b1d0250f438992f8f851e0fcb9ba2e36", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434308, "uuid": "d10b4b4c-1443-4edd-8187-d316c61dd73f", "comment": "Malware payload (DarkCloud)", "value": "13ce470fae6d0e88415b25bd7eb623c6aebb9183e9853c23d31921e7a37c0af3", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434308, "uuid": "554f05b0-afd2-4353-a5c7-2f034d84a1ac", "comment": "Malware payload (DarkCloud)", "value": "e54a7006b3874f3c16342b026acd0c169e0595ef", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434308, "uuid": "ae6409e8-cc8d-419e-b439-4ccee7dec20c", "comment": "Malware payload (DarkCloud)", "value": "e8a0dffdc9dd3f5d22cba6a89c8dfeb61a33730068c325469287f53e7d9b20d6962d0b904520775de7d610ed17ab49a3", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434308, "uuid": "1cd13744-1b18-499e-9236-a6a757880445", "value": "T121351202BEC25672C4A31D32667ABB20B97D75601F65CEDF63914AA8EE316C0D6307F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434308, "uuid": "a309c19a-0fbf-4cf5-a419-f227997f83e9", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434308, "uuid": "7a0adaa1-e465-4058-a74c-3633f0f1b5fa", "value": "24576:9TbBv5rUeTYLAXjXXRQFX8KZmhwA5xRMa2tSim8BpS:XBvYUtQSZiaN2ftpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675434308, "uuid": "e524d687-5e1c-4ca7-b824-d62f6b54ccbc", "value": 1108915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675434308, "uuid": "4011842f-cdb5-4e94-bf3b-1b28c4e96e8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434308, "uuid": "2d70d3b4-4022-49f9-87eb-928ae1fa5203", "value": "13ce470fae6d0e88415b25bd7eb623c6aebb9183e9853c23d31921e7a37c0af3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1cf44db-a3a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675417588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417588, "uuid": "285472fd-e261-46d4-8007-3b750f3a0060", "comment": "Malware payload (RedLineStealer)", "value": "e02ce43db8c035eef98028ed2de1bf5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417588, "uuid": "ab9f95c6-eb88-404a-827f-3c27015570a2", "comment": "Malware payload (RedLineStealer)", "value": "13fbe02b5bda307ba2ea7f12de31966d5d93ced9c2e9755d05a44902231f8f2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417588, "uuid": "15c14919-173d-4d9a-8472-34cb59e0214b", "comment": "Malware payload (RedLineStealer)", "value": "ff92d7955dca85e3f76f93cfa843df34143a27ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417588, "uuid": "d150e874-340c-48e7-b03a-4d6f0fe040e4", "comment": "Malware payload (RedLineStealer)", "value": "0bbf8a4bc344d39e3128919587a7a9a3000cf32a566c3d84534de166602befa5f04c2443a9c8ecdef175b4797fb3d243", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417588, "uuid": "1c131dda-12e8-4e3c-ab97-72617eaf0291", "value": "T126B41222B880FC33C0B641754831EBA5A7BBE1318674C84B7B955BAE6F706D1372635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417588, "uuid": "0a160412-8b44-4b09-90e6-efe933435543", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417588, "uuid": "de7314cb-7d76-4cdd-a374-1b63637695e6", "value": "12288:WHZ7vafTCOu7ToGYkCo1z+7k6MjGUnqaSD+CnGt38+dRhq/F:W5mfG6kCocY6a6i3NRhq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675417588, "uuid": "7540b8ab-3f61-4645-b092-b0695245f540", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675417588, "uuid": "c7d4533b-d823-4dbf-8132-06d60142010e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417588, "uuid": "a6e33128-ad18-43e5-a122-6c7841810c61", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22a9445-a3fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675453291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453291, "uuid": "cb8e1bb3-0204-4e45-992c-363399f30268", "comment": "Malware payload (GuLoader)", "value": "ceba3a31aeda8eea8efc26bb787ec690", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453291, "uuid": "1f97625f-c546-47db-807b-7e96979362d4", "comment": "Malware payload (GuLoader)", "value": "1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453291, "uuid": "189abd40-5905-47b4-ba96-7edef1e6acfb", "comment": "Malware payload (GuLoader)", "value": "b3a8b39e8438984ba680fe597df728940ed09a66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453291, "uuid": "3f88f06a-0610-4749-b916-e23c80017d78", "comment": "Malware payload (GuLoader)", "value": "a3b6de0294c2b66767671848cbe6770418ec55d990655082de3ee83b5141e592118a95c06de97ac0cb76548a184d6901", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453291, "uuid": "e2b108a0-9701-47d7-86f2-1063ff070269", "value": "T185E401A37B90D097C0265B31C1A7EB71153BFE71AE414E8762E8BB4A3B62303451F5AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453291, "uuid": "14101592-965d-4cb7-b763-297f223208b5", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453291, "uuid": "b0df7cb0-5fd3-4979-9681-f103ae5caa40", "value": "12288:2cMkhWAEQ0J6rpEretKUjQ0kKSMtpSe2Tahcjd/1FhUxsBPGtVppPNF:czQ0J+EreVFkKSekehm/1FuxsetrhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675453291, "uuid": "98a4b400-0254-42d8-91bc-9f8c8633d34e", "value": 706520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675453291, "uuid": "265336d8-ceca-458a-8a1d-ead58db8a4bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453291, "uuid": "a18a3ae5-24d1-4b54-907c-2b82a4248e29", "value": "Purchase order 50048205_JPG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1185e098-a381-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675401025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401025, "uuid": "7dc9f109-ef05-4dc9-b0e8-965c53a3b71b", "comment": "Malware payload (Mirai)", "value": "87837ac6ec3bc4c966b72344ae367473", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401025, "uuid": "84423580-1fe5-44ca-920f-daba2b94e806", "comment": "Malware payload (Mirai)", "value": "14313d85dfc5e779cc072fb183dd260b4f6b9bb61aa62e02e300c8e826711a59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401025, "uuid": "fb3d6cd9-3d70-4ed6-8508-330df487c21e", "comment": "Malware payload (Mirai)", "value": "97bc7d3041a835bb4db5d053138509a73b201f85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401025, "uuid": "3668488c-cbe8-4282-a7a8-1294d5b7aeb3", "comment": "Malware payload (Mirai)", "value": "80e34987d3b592c4fcfebf8d719cbd42f8fb9a4ed7b10f8d0d74844900467d2b205728951e850a962f7c7f4f1abcac88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401025, "uuid": "eb26fe32-e02b-4603-ba61-3c412b7ef8c6", "value": "T16BF2E0236545DDA6CFF0317AE6E16201BFA81E7DC168747222511B18BBCF98F20A028B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401025, "uuid": "41f8c43b-610e-469a-bb12-66004d32461b", "value": "768:Cb+GsIbn0XpiTAPB4bT9bOs26GIa+UqaXEW9q3UELQs:Cb+GsLidbT4s26dVUqaKLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675401025, "uuid": "a2f8cf0b-319b-4b6b-a205-67dc572f6fd8", "value": 34488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675401025, "uuid": "b4b3ab79-cd00-4577-a8ff-7a2a4c4ff371", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401025, "uuid": "1f39fb7c-f8b7-450d-a692-341e8bac731f", "value": "87837ac6ec3bc4c966b72344ae367473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47e6265-a3d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675438665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438665, "uuid": "f09ad93e-bbcb-4fe2-a289-2b761b44972e", "comment": "Malware payload (Quakbot)", "value": "ec448bd82cadfc5bcc9667c135e8325f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438665, "uuid": "355b52f8-f43f-4e00-872e-fbcc4c73618c", "comment": "Malware payload (Quakbot)", "value": "14680e48e2c6bdec71e8b1cc4d82fc4ffe7b813d0665bd69a419f1a564ec63b7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438665, "uuid": "0b1d8efa-a958-4a08-87ee-15a0307e9abd", "comment": "Malware payload (Quakbot)", "value": "b1bedf9f408480d4a454a452dc5fe95ea0695786", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438665, "uuid": "fdc9b40f-344f-4206-866f-5b2065337fd5", "comment": "Malware payload (Quakbot)", "value": "716c49d3e5ab97c1aad3b819c3aebdaeb9bd6c114a4a45d302f7524f54ffb506ff552e219418190d8fcb350e7708542d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438665, "uuid": "0f73be01-8c65-45a4-b1af-41e68063e13b", "value": "T1D985AD1242CC129AF14D3B78243C1F7FD3BBB7A87B19634E9654B8A9AFAB7D34115600", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438665, "uuid": "c84b52de-6053-4817-ba15-1b87be2e3d6c", "value": "a3432b773266dde6a100dba767517009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438665, "uuid": "41c0d068-c26f-425b-b170-75659113aabe", "value": "24576:zrj3nPW3ednWPiT8VTBqcATV8KIyydLXGcq8z+0uaEYmgEJ/tc1:T3nCeCiT8aHxyM18z+XatEJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675438665, "uuid": "24ef6f60-2ffe-4fd0-8aa2-f44c37c591b6", "value": 1761280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675438665, "uuid": "ce50b1d5-73c5-4ed1-b8ae-82aaec5291b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438665, "uuid": "a1b3e9d6-93cb-4ece-939a-bc196a7630f9", "value": "82467.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9d3148-a3ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675419918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419918, "uuid": "18616024-58c2-4cf6-a788-6093d31f665d", "comment": "Malware payload (Smoke Loader)", "value": "72b13a1d97561bee7133adff6c03a264", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419918, "uuid": "6d867781-13f2-495f-a3cf-5e4e65dd30f9", "comment": "Malware payload (Smoke Loader)", "value": "158004c34b25ef3e94f1664151012731bcb029a905205f16c42c4f3087f129ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419918, "uuid": "9eda490b-28d6-4325-afa2-f213ee647ca2", "comment": "Malware payload (Smoke Loader)", "value": "16c3c41e36d048d335dbdd98fb222286386e700a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419918, "uuid": "7f7e1138-5f91-4194-9fb6-2174c518778b", "comment": "Malware payload (Smoke Loader)", "value": "e9bc28baa3dc1fe122559b0857c0f4b76da00f58bc9f39357411df3e12c3d04a058a6e73dbcd5596cb12ede5edc7214b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419918, "uuid": "a455eed4-013f-483e-a6c7-41e4fedb575e", "value": "T14214DF323980C072C9A791744B34DB916B7EB83186795B5B7B940BBE5F712D0723A32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419918, "uuid": "407def8d-870c-43ab-b7a7-d1949b0ceeb8", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419918, "uuid": "b6c3a191-53b7-4577-a7fc-1cd29780280b", "value": "3072:IwGCXubnRZTcLtCTKGW5V5tVcwi4mA3Ow82sJR89hB6VGDsJw:IwGCeALtCTKGc/cB4mmGL89h4VGDqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675419918, "uuid": "4174cbde-f1fc-44df-b657-86a221b4435c", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675419918, "uuid": "869a77cf-af09-4abf-a8ec-7c430492ace8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419918, "uuid": "4d48a3a4-d2fd-4e48-a324-8424898d4a5d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284a83e5-a3f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675450885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450885, "uuid": "f61609d9-c10e-483b-b650-0edc7bad274f", "comment": "Malware payload (GCleaner)", "value": "c9084bf4bcb230df110846ff773db0c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450885, "uuid": "3b0ef616-0d1e-4b8a-94c1-bdeb954be31a", "comment": "Malware payload (GCleaner)", "value": "15c5496631ec71a49eb3ca69d24711a37c7da01bc9059a1ebd71fe4b87296c7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450885, "uuid": "80cdb3ca-1414-40ef-a526-145dc94089a5", "comment": "Malware payload (GCleaner)", "value": "26ad08f80af2d80490da1cdfa6da9df77410c243", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450885, "uuid": "fd771e70-bb1d-4b3f-911c-bc6087457b21", "comment": "Malware payload (GCleaner)", "value": "7bad3d1057b01576b2916ff70e9d9c5eab31def9205c60934755197fee5accc3242242f45c9e1c9217686de3bf4b70eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450885, "uuid": "a130ffa2-41b2-44c3-8c6c-aa247b1252f4", "value": "T1A9A53342E4F9543FE0E2937A916468C1BE763EB7A0F6F31A395E354DAD3B2942C44321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450885, "uuid": "9f9e7745-39fd-4de0-bddd-2dc951b3b6c2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450885, "uuid": "11f6fb8e-604b-409f-8bc1-26d966d4979c", "value": "49152:ygHdapq65UB8jTJiAJP014Vt5DQjIUq/oyrKU4LCgv2MR:THQDP0qVrUcUGozUwv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675450885, "uuid": "7ee7a010-e318-4321-b2c5-dbfe2c3a76ed", "value": 2067110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675450885, "uuid": "8aa834ec-9897-4b8b-879d-be037cb775a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450885, "uuid": "806dd0f2-44f2-4c20-be1f-70f76dfcdc19", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ae5e5e-a3ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675448648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448648, "uuid": "72f3f99a-41fb-4636-b1b6-613e30ab4a70", "comment": "Malware payload (Mirai)", "value": "cf653249f95d337773d6bbbd5f6fb8d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448648, "uuid": "6faeb1ce-dd14-4380-9355-3abae9842de3", "comment": "Malware payload (Mirai)", "value": "17243053bd976ea95e42a02405547b05552035b444871114f7d7a94000d6ed0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448648, "uuid": "26dc505f-2a55-45a1-818f-6e960afcdb76", "comment": "Malware payload (Mirai)", "value": "619a167bf20ade088ae3feb87ec20a126d0ca980", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448648, "uuid": "55dffdce-556e-4831-8677-469e66929ca4", "comment": "Malware payload (Mirai)", "value": "e45ced8817e00f1c710560652ab1d5bda541c58f31b880e1470a7889101fa569ac8d71fbce0eff32b81615f67ea518c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448648, "uuid": "e18d596f-48e6-41ce-a54a-b0a2167e68dd", "value": "T1C7230271880E8EF514703C76EBD9D7937AE12AB1C5673023D6290B382FB96131E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448648, "uuid": "cf275515-c153-4d98-b996-b7582bcdf062", "value": "768:S/TYCoIxdEk+AxoTZAZHFeq8b3qmv9q3UELbUXfi6nVMQHI4vcGpvC:SECFd+A6YHAxqNLRQZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675448648, "uuid": "53db7d1d-28ca-4410-8ba3-9b7afdb825cd", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675448648, "uuid": "d34e6902-a608-4476-8103-cbe2d07fe4a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448648, "uuid": "2c91e3e4-00a3-4cdf-9fb7-13d5c363a264", "value": "cf653249f95d337773d6bbbd5f6fb8d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e439ac-a39f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675413914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413914, "uuid": "8912a3a2-a6da-4385-890b-533fe95b2fc0", "comment": "Malware payload (GCleaner)", "value": "1dcc3365b16ccaf5ba4dd36ffea28e20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413914, "uuid": "e1bb98aa-a5da-4dfa-9f8b-d04cb8bcfed8", "comment": "Malware payload (GCleaner)", "value": "18024e1c5b0618f21b02cf2f4b9d016ec872904aca2bc79de207345230ef7f8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413914, "uuid": "6833326c-2947-4620-958c-2e2c2bf8902a", "comment": "Malware payload (GCleaner)", "value": "d09604fbbd66682099b162e609bf714fb21a0afa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413914, "uuid": "88eccfb9-7860-4fe7-8334-30769b15b0b6", "comment": "Malware payload (GCleaner)", "value": "1a70e47116ecb10e1322f8d1477f043a86ecdae8a71623fa00dbe6332d3c623d41fe7eb296216445552c11d81b1066e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413914, "uuid": "4e407ac0-9596-4fd1-8a51-47f73b567de5", "value": "T1C5A53353E5BA54B2C0A3D3390C387A824F277E6CBA36A070716D67CD3EF71506A29635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413914, "uuid": "34a4e3ac-f7c7-4abb-bc1b-90cb9c25f2ae", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413914, "uuid": "3b0644b5-69f8-4fef-8952-afa153417e67", "value": "49152:ygl6COLgo0Y0yHzaFCYM6sIn0SOtXZnlOnG5maLCgv2MR:T48op0+aFbM6sC8ZOjyv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675413914, "uuid": "375be387-e652-4e3b-b4e2-934cab500d58", "value": 2084855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675413914, "uuid": "f8f368ea-ee13-4b16-9a95-b6c7dd4e86d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413914, "uuid": "9c642eeb-6286-49c4-830a-e8f08e913437", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43abeb70-a3a0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675414424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414424, "uuid": "b7522bda-d552-4924-95ec-fa09d8e1a9aa", "comment": "Malware payload", "value": "cc86e6991c08947f51e59ea3b6df524b", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414424, "uuid": "83b63caf-18a3-4a85-925a-a7723a93a7ac", "comment": "Malware payload", "value": "186d2972106079c8bf0c9e9000a15056161602dba947d0f85bc7141ef2066d5a", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414424, "uuid": "2b7e5710-3aa5-43a3-af1a-0885d5af9348", "comment": "Malware payload", "value": "9d339cade786f30857f38497be3d920624ec28c9", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414424, "uuid": "2d04395c-935e-4d29-ba3f-f4e0a67e8016", "comment": "Malware payload", "value": "cc217e607096e131b336f2b9cf2aa952c8320347487d9c343bf713e0fe101b8bae6d11bd4163ef59e4d5310f2842b334", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414424, "uuid": "1e152f4f-9c96-4464-82ea-f0790c978ed4", "value": "T197247D19139B55E8D7B2BEF44DD29A06FB369A23552CC78E8F71BEED0C10124DCA460E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414424, "uuid": "e1318029-096f-4b89-ad2f-4717766ca291", "value": "3072:DaA0YRw9/WITtTWR7IbNzvL1aPhuWt4AJERnyNenUWHCoTCCCCCCCCCCCCCCCCCJ:za9xytedL1Mp4iERBLV9u/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675414424, "uuid": "d3a5706a-1ce4-4d00-b17d-3acd98d8098a", "value": 218456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675414424, "uuid": "f485a966-2a6e-4646-b580-c4dc267e751e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414424, "uuid": "f064cc3f-4554-4c3f-88dd-fd101548f990", "value": "SCAN_02_02_#1.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6ef4b8-a386-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675403299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675403299, "uuid": "580fc1f0-280f-4f0e-99d3-ab7861da2dfa", "comment": "Malware payload (RedLineStealer)", "value": "ed98d89ee3ff45670756e8dda4345b62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675403299, "uuid": "d9d174ad-48fe-446d-85e3-bcd7eb5bd55f", "comment": "Malware payload (RedLineStealer)", "value": "18b11eae56eaa7b76512c5e88aae06fda4faebbd477c01e837f5ca1b3ffd1985", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675403299, "uuid": "25f2cf5b-e973-46d8-b2c8-e7248bce64db", "comment": "Malware payload (RedLineStealer)", "value": "d8cef7e32b2261447f3e53617a1d53647e4dae6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675403299, "uuid": "4430edb2-bc1f-4aca-a07c-b020c48f15a5", "comment": "Malware payload (RedLineStealer)", "value": "38efca6ae6b222f4eac91de435495c2dc0572eb1bcaac701a2650c4cf8fe861cd30d55fee3a81891d50f5e265afd0491", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675403299, "uuid": "47ea07c8-3e8d-4050-9af6-9e25a020787c", "value": "T11604C61437FCCD11E1BA6A3F6961605143BF9802A842F65B76C367CD1E32B40FA57AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675403299, "uuid": "2af0c959-d62a-4297-9b4c-9dd83be43a39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675403299, "uuid": "06796867-7693-49bd-b586-502f816d129b", "value": "3072:KxqZWJBaKULo3xj9peT5FGhMXxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+O:4qZIxjeGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675403299, "uuid": "5696d5b5-d827-4092-9592-95f3ce0ce169", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675403299, "uuid": "7f77cdb6-f885-4292-9798-8963fd5ac75a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675403299, "uuid": "660cb65c-2ca2-4b28-9748-43c325760df8", "value": "ed98d89ee3ff45670756e8dda4345b62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc60b6dc-a3af-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675421176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675421176, "uuid": "8f08c653-a651-4a78-b487-136b40f10ef2", "comment": "Malware payload (GCleaner)", "value": "df5d54eb04003183202235d8e4b7c290", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675421176, "uuid": "c6b282a5-982c-4ffa-b2a6-8971b19f4176", "comment": "Malware payload (GCleaner)", "value": "1967e4b3a43e0cc14beb8fc732e398c0fb744d0cff24d19875bb52aa08fb0052", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675421176, "uuid": "1cdc68cf-86fb-4b3d-9150-53d762bc54cb", "comment": "Malware payload (GCleaner)", "value": "751f102762b8fb1509356a72eb35466a572ae95f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675421176, "uuid": "96d35d60-0c3e-498c-b38f-5dabb9ab695b", "comment": "Malware payload (GCleaner)", "value": "487f3e0d53bac06873fc6f3508f615f932e70a38efde4bbcdf57c55313f2be5b27b2bc422e4d946b8a70122552ba3394", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675421176, "uuid": "fdf823a2-0452-44fb-aae6-b5e1d3992a17", "value": "T12E9533415AA180BBE587C7B39C399140FE71AE3838F5170E711F209A5F379E2FA145AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675421176, "uuid": "6924f383-559b-4b8f-9ae7-783ac52d7110", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675421176, "uuid": "f8807bb8-3650-405a-bb78-6b9fb2c3b12d", "value": "49152:yg+Nfus8ylYUAy3CX10+md0sNGskFSLCgv2MR:TOus80hAaUsPQ6v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675421176, "uuid": "1d7a6767-9986-47c6-bdc7-80be82d701f8", "value": 2027475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675421176, "uuid": "987282d1-aeef-4432-a4d8-bd028d58c0c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675421176, "uuid": "c6fde544-df83-4040-816a-fee0717d656b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde77e8a-a3e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675443003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675443003, "uuid": "05e77c3a-32b2-42c9-b0f2-2a869f7b4fa6", "comment": "Malware payload (RedLineStealer)", "value": "a4ab9547bec4c8fe0f187a8bedd3f8b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675443003, "uuid": "93701cd4-52f8-43d8-b3de-844aca60c093", "comment": "Malware payload (RedLineStealer)", "value": "19ef515572e854be0638523790c2f83ab245178b3c27746dc9f9b04c1c1319b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675443003, "uuid": "88d49310-bbc2-4f03-a84f-736af6bfcc8d", "comment": "Malware payload (RedLineStealer)", "value": "fb0f71ba6132b0cc7b3844c07b9dbc5f8bc578b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675443003, "uuid": "c0de1a38-d645-4629-bed2-00be4e6bc18d", "comment": "Malware payload (RedLineStealer)", "value": "1755fdef253616b02230970e694e3ba99aeecac90a442c65c57e81109a1fc4636ad56189c13151bb1015bf08479f6a62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675443003, "uuid": "0a1d0c69-9eb2-4aea-8bb5-1bbcfb3816d7", "value": "T1DEE692C76AD18A95C631337BD267874486E2D7912607E27BC96F23830F83B7D79844E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675443003, "uuid": "3b7a2bb2-92ba-4536-bbee-337b996810c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675443003, "uuid": "2033734d-c53b-4536-9b31-f401b9fe146f", "value": "98304:bIr63hrtH0wcQkh2hidp6okCrsl1O1C8e8ZTVQJaeyF91KZVqg81ElLbf:4avcQkh2wdXkHO15LVZ7909V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675443003, "uuid": "061dc6d0-0baa-4c01-810c-24cb0dcd797c", "value": 14685696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675443003, "uuid": "95f5b9a3-b9d8-4416-92c6-4cc4d6187da5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675443003, "uuid": "4165bbca-8403-457c-9f84-42d980c38261", "value": "Photo_GoogleMaps_myphoto-7-0-56-1-01-photo_my-11.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7659f1-a3cb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675432798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432798, "uuid": "6656968e-e5ee-47bf-a0b4-e724b42d081a", "comment": "Malware payload", "value": "f28cc09c077e067d36f7f69629ee6297", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432798, "uuid": "515344c0-9ca9-4456-ae07-01e52f1fe6e2", "comment": "Malware payload", "value": "19fa93805291d9f16dc348ea35300aeb6ffd9bbee855948fa351c6c6791fc821", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432798, "uuid": "a130bfd0-da84-49f9-ace3-206c857831d2", "comment": "Malware payload", "value": "bebb8b40f38f66df1644edee949adecb474fb9b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432798, "uuid": "78e22839-0f7f-4e17-8c5f-0a1d0207b767", "comment": "Malware payload", "value": "ffaa00f678ef01aafce195c9002103935978176c4ba96b94dba4e9a1b17d2eb2629b2451bd469f21798a2a05a52f1aa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432798, "uuid": "2eefc071-cf7d-4eef-858e-3c578dee0240", "value": "T15BE1B584A3C80372DEA34B379D73A3921A38F3619E0BCB5E2494554FAC56A5946B3B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432798, "uuid": "408d5d61-be2d-464f-ad82-a74b4f397266", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432798, "uuid": "71a44ccb-adf6-46a0-a948-99cc1a761b05", "value": "96:+wph816+leOL2LPQYHFZiQBq58xY+s6koCvP9ZdxzNt:Bph816+leOSrQYHLZI58e+sHo4rJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675432798, "uuid": "88fd4f3b-a4c9-4853-9466-eb84d0474ced", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675432798, "uuid": "ec8f9e42-fed0-4180-aead-438fa90a3eba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432798, "uuid": "d0f90053-050f-4867-8987-477e18092886", "value": "00000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99f77ec-a3f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675448955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448955, "uuid": "5075f6fe-801f-484b-8855-bb32c26f3bee", "comment": "Malware payload (RemcosRAT)", "value": "ecaf214bde2e9e856ff914ff601323eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448955, "uuid": "4eb8938c-7a7f-4fc1-9928-e909ab9f3064", "comment": "Malware payload (RemcosRAT)", "value": "1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448955, "uuid": "4582c706-c741-4b10-a248-5c49c5a93bce", "comment": "Malware payload (RemcosRAT)", "value": "b20382c8f2337277c3467b07f395cda96827f497", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448955, "uuid": "e68cb95b-6b79-49b3-ad16-a3cb1ff3dda5", "comment": "Malware payload (RemcosRAT)", "value": "f0216379a54e30e8fac72b51fb7b7d66e4b7107017a011ea9faa25b0a507c9cc2cde7de3e17789daf1e5000a761eb1c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448955, "uuid": "0105cc35-25ba-4162-b1e6-ed6a8ad177e5", "value": "T1D34533092C684E7AF1449DBC952F3F571A0A5F129DBB6BEA258877D71F38A71C7820C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448955, "uuid": "4bd76539-590f-4d64-9f64-2c2a3e5c3530", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448955, "uuid": "123b9dd5-dc27-43ec-8f0f-41848b9ee6de", "value": "24576:TLz3VowLzh0xOxua+8uTUcQTWTbh9/+rHZ8zZQ6gqtQkBMATHXUelVE6:jVzl453DXQTZre9QRqtNRX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675448955, "uuid": "e63906a6-7004-478c-99fa-c9e18bd05a93", "value": 1248768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675448955, "uuid": "ffd7b276-12cf-43b8-8570-b1ea0b55a0c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448955, "uuid": "73ea8c19-5260-42ca-8a70-3e1f60f3878c", "value": "Mwqtxjbh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786ff90f-a3e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675445866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675445866, "uuid": "b1255609-20dc-4a21-9311-b67b4b7f3691", "comment": "Malware payload (GuLoader)", "value": "90e3b7c3ab8e0abd36736cad3675ea94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675445866, "uuid": "36b18d29-0846-44fd-a518-68466bbb485b", "comment": "Malware payload (GuLoader)", "value": "1a90a71654df0522262f5650fc5f7bc7603a9f2d4639f87889d703acbd0a1680", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675445866, "uuid": "8f7dc0d3-51fa-452d-b7a3-7c3becda0e1a", "comment": "Malware payload (GuLoader)", "value": "8d258a23b86e189d1e6163b99f48888bb7f25dbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675445866, "uuid": "1c5a2154-fbc3-4dab-ad6f-fc970cd2927f", "comment": "Malware payload (GuLoader)", "value": "4cd2297c1a9fb50fbb5087532adc19fb0b52569dcb2593fbe523d44966799043f372c28fd3fea5396004d8fedf2cb1da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675445866, "uuid": "aa3d40f5-5b96-4b25-ae87-12567018a521", "value": "T1548423050FF1D557C2B1CA352E749A5EAEF976442888570FD3300B9ABCBDB41C92B39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675445866, "uuid": "0f57251f-353b-4275-bd47-01ea9bf7a623", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675445866, "uuid": "9f56cc6b-8c4d-433e-a91b-371a63e5e2a2", "value": "6144:pmOP0zcxxjlS6q/hMPfpNJm0FLUSI/wmkDiItbmMoG71fXk7py7rBL+6NMt:cc/lNBNJm0gw5p1G8BL+6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675445866, "uuid": "4f92b82d-bfe9-4338-ae0d-005158bc0e3f", "value": 374934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675445866, "uuid": "50de4b37-40e8-46e4-993c-28da17c7ac01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675445866, "uuid": "2f5c06c3-b81d-4ee4-b526-aa1708b0f149", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.17055.366.4698", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c078219-a38a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1675404908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675404908, "uuid": "64b2561f-0f4c-462e-b8e7-e92fdab9a89e", "comment": "Malware payload (Guildma)", "value": "5784672e0612278940ef6f9d7ea3baef", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675404908, "uuid": "3ece500a-a612-4544-83bc-bbd85dd861d6", "comment": "Malware payload (Guildma)", "value": "1b6f57a7fd197c501f8c4ea73a0b7b5f0bfb77b9981f9c55de253fb3d5e2d02f", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675404908, "uuid": "38e5e436-c5f9-4c6a-ad2d-c775e00b7b69", "comment": "Malware payload (Guildma)", "value": "a1838477854d1e43532fa876c6b5d7685d8be644", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675404908, "uuid": "a96a0bfc-d84b-4705-bcc2-eb0212202e9e", "comment": "Malware payload (Guildma)", "value": "3a40f485896be294f891f72fe03b30255fa70b5d00e4d143a9143b8c14259d69a40afceea89de0c7f8540d53664c778d", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675404908, "uuid": "b08dfb6b-f0f8-45c7-8f2e-93a914fe93ab", "value": "T1DFF0556EE2323F82F01E3D348D16473E5D5E7C870B06A6E31D99025867B084D9F2A8A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675404908, "uuid": "c0653523-ddb9-48a1-9dad-77f673e38006", "value": "12:8rflM8OBE6ZGIWgkccjdjMLWOm4m7upR2fFpou5Yf:8loGIWFcclMLWOPm7eR2IMYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675404908, "uuid": "f59a7809-7a21-4b11-9dda-b36ffa7f792f", "value": 505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675404908, "uuid": "9a661947-b4cd-4d6f-9633-00c7e4809e00", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675404908, "uuid": "95710180-526c-47c7-bed4-bdb0ecc5adac", "value": "16313825_439.36494637.509508.53913.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8b1b79-a392-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675408667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675408667, "uuid": "4fa3aa1b-8981-405e-87b5-4ee788bfe75b", "comment": "Malware payload (RedLineStealer)", "value": "d7ef23ae00d0fd408acc17dab19ebf85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675408667, "uuid": "c64c36bd-3bfb-45c2-aaf7-0da62cda6582", "comment": "Malware payload (RedLineStealer)", "value": "1ba028487eb5211d096b9b0966eab10dc167735fdaa955b2009e867331ca4797", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675408667, "uuid": "862ed236-d882-448d-97ee-f19acff57521", "comment": "Malware payload (RedLineStealer)", "value": "fdd0d2ac72c5accf4858215e2971aed46af627d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675408667, "uuid": "c03a92a9-ee45-488d-a727-a467f634b632", "comment": "Malware payload (RedLineStealer)", "value": "74b6dfec4692d7c9e4c171016ffcfc86710c29f4184834d793b78808a7951f94e49d7e29796bb7c4a0353218fac97063", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675408667, "uuid": "71dbaabb-6f0e-43e7-a054-ee45505cc1e4", "value": "T164D412327540E032C9A79734AC21EB582FBDBD3106BAA41F77994B6D5F703C1563A38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675408667, "uuid": "00f02816-4dba-419c-beca-89db505296e9", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675408667, "uuid": "aa1f1f82-714c-43bb-85ed-4eca5b89d807", "value": "12288:NTMMeowvPMxTx3kjc4jr1OHYSGAaLsT0idkR:NgcwvPokLr4YS+LsT/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675408667, "uuid": "e21f6569-d8e1-4548-9e70-84665e7f5f0b", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675408667, "uuid": "0f002e91-6993-44ad-a14a-bc0a3cfc9ee1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675408667, "uuid": "3a8940a6-c269-4fd6-a35e-20ab3986f622", "value": "d7ef23ae00d0fd408acc17dab19ebf85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de2bd67-a35e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675386121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675386121, "uuid": "831e8099-fadc-4df1-abe1-3ae00931308e", "comment": "Malware payload (GCleaner)", "value": "a0dcb084976da634371cd02021857f9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675386121, "uuid": "0277a0e1-fb22-47bf-b435-8d7fa34742f7", "comment": "Malware payload (GCleaner)", "value": "1cbfaa72d5bce93fdf13613a7e32aed003376297017e6efb7d8cc5f99ce3b5d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675386121, "uuid": "ef9f3e2b-841c-4a8c-907b-0a990d039dd8", "comment": "Malware payload (GCleaner)", "value": "2aa6b10ee926c1ef1d7d98c605bc1fe10adcb541", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675386121, "uuid": "18ad3bbf-b41f-4128-8a1d-b39e391d151f", "comment": "Malware payload (GCleaner)", "value": "02e2b808423bdfc311220831ddd2fc966d3fc022c08a7d2764a24aa78f0ffb1f8767eb928c797d9bbd2f4476c349f8ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675386121, "uuid": "9c98e1ef-95ca-4764-88b0-f8e66c293797", "value": "T1AFA5338BA173CA37E2025B72396949C7E7721D5C54B00332331EA6AE5E732D5683E9DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675386121, "uuid": "048ecd1c-f557-4fd7-bdcd-b542e2230d7a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675386121, "uuid": "3565073a-641c-414f-9191-c1da1e3cea7d", "value": "49152:bg0u2jED3Ee4CBOB+z0UTOimqRTc0wAczMw9qUvAj+T1nyGXsvNZLCgv2MR:c0u2jEDSCBOB+YGm8A0JQMoqwAexyWsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675386121, "uuid": "76c49781-89f9-4d8a-b576-bb2f60ee4cbc", "value": 2106335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675386121, "uuid": "308dda6a-95c2-4842-96ac-ef2386aed517", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675386121, "uuid": "0017f464-443b-4683-a6fc-5a5b76fbc92d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a78d8b9-a381-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675401121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401121, "uuid": "1bed4d37-fa92-4506-818c-b46404539c53", "comment": "Malware payload (Mirai)", "value": "7fef27edb67846b31f89c376f366b18d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401121, "uuid": "8e4c1814-2851-4ed3-b455-0ca90b22dd85", "comment": "Malware payload (Mirai)", "value": "1cda00aea9a8354fb44d4bec12420383eacb33298e68380e7da3ca1bdd7af77a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401121, "uuid": "be19df49-d11c-4bb2-8874-b0a71db1ce07", "comment": "Malware payload (Mirai)", "value": "4f2d4bd5b3cf275c286c390818fe8bd0bb08eec8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401121, "uuid": "acc96b0b-53b8-42c7-aea1-0e0cb2aea301", "comment": "Malware payload (Mirai)", "value": "2dc1948832b1b3a2f4bfa110b422227664c4de6f39ddc6003eccf3a0534d89d2c549a93b8736b627986665d4bc2f2f4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401121, "uuid": "90c74491-43c6-4ed0-b2bd-d2ae3d4d7551", "value": "T14533F122B6721F72ACB98877F5B801566AC987BC50CAF6734248C9DC4563B4BF05E4D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401121, "uuid": "3171863e-33fc-44fb-98f9-9086ae11478b", "value": "1536:bOIlMtSFSIhqUXKpdhi41Hf/ZVwLv8WH7:bOmMoBlapbief/ZmLF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675401121, "uuid": "164a2494-69a3-4472-96fa-9c7754711353", "value": 53636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675401121, "uuid": "5dfa184c-eae2-4474-9f5f-cbb02a788c78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401121, "uuid": "42841ea5-3c5c-4a17-9f53-851499335b5a", "value": "7fef27edb67846b31f89c376f366b18d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f1edd8-a3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675442375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442375, "uuid": "88d553be-d861-4c3a-8494-200e5455f610", "comment": "Malware payload (PureCrypter)", "value": "7851dbe1e194ac7833d3d586bc64edb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442375, "uuid": "29a135f2-fc86-4bc5-b764-65ddbd5ec976", "comment": "Malware payload (PureCrypter)", "value": "1ce3f1a0652037cb9325e9ba04b431488490a8f88f1204dab181d771756de715", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442375, "uuid": "f6f517dc-cdf5-4a9c-b69e-e606dca39cd9", "comment": "Malware payload (PureCrypter)", "value": "957a5cd1394c6d06f0102110e49c23354c2f7039", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442375, "uuid": "a878c211-5b92-4716-b232-3c161222af0f", "comment": "Malware payload (PureCrypter)", "value": "cc76d4f91b6d3c1f59b68ef78ecc3c4817f89e2c4e2f625ffd12984d0dd01273b21aa37be2f217dc877c3cf3aaaf99bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442375, "uuid": "028922c3-170e-4143-a475-f2e238454cdc", "value": "T1BF55337145E0C7A04027D7A3F8919E0F2D54FB1F73B36C5901DE046DAA30A3AA8DA6F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442375, "uuid": "ea34a4ed-b9b3-497c-af78-3d13688e157d", "value": "24576:MnGfQp6j5zLcyR1M7ccNNx34uzeA83xm685PWhogeMbk+PRdZ7Q/oIIb:MnGfQ6DzM7c6NxIueAakPARj4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442375, "uuid": "6c77f094-a33d-4401-bd63-f9b37afd41ad", "value": 1334402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442375, "uuid": "fb29a330-4507-4b84-9155-3c916704f58e", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442375, "uuid": "5bf38ce3-faaf-4210-9859-8942e1e7c470", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb348ac0-a3fe-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675455024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675455024, "uuid": "303a5b0a-706a-4de9-adda-3568b2e3def2", "comment": "Malware payload (RedLineStealer)", "value": "ea76a7437b2b5a9390a5c0b53966085e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675455024, "uuid": "743998d9-f3b3-4869-9ba5-238dcbd2fd4a", "comment": "Malware payload (RedLineStealer)", "value": "1ce750a2b863c4863b648ed0b3d0d90e87652d935e0616333d4c94e8d98143da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675455024, "uuid": "1a7ff18e-af0d-44b6-b02d-ff6c6970ad4e", "comment": "Malware payload (RedLineStealer)", "value": "b755ffc6e3027d444de4cbd18361e360a3820232", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675455024, "uuid": "24fea90a-448a-45db-b761-da0501b60816", "comment": "Malware payload (RedLineStealer)", "value": "52ee19fac95817b0b50a5ac11e2e70613aadc35611e556773cf4e4ef5c224f6beaa314b6df9ea5e3703445e41031348a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675455024, "uuid": "2cfcd518-e853-4098-8b08-c7ed0628be9c", "value": "T191D4123235D0C4B2C02A6131D866FB95BB7FB9326E75C653B76806EE2F302D15A26353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675455024, "uuid": "40c4dbd8-a27d-4334-93b5-0c4fec0109fc", "value": "11deee92ae37204b8493d8d64f5f1f69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675455024, "uuid": "9f643186-77ef-4d3b-bdd9-e5603c823f7e", "value": "12288:goO8y8MS4ltkRc7h9fIcLHhvz1wAr57N63zt5uw39mORigrWh:gPcdR2IctvRwC572tmcrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675455024, "uuid": "52e1f37b-2395-40b3-b349-45c31aaa8d61", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675455024, "uuid": "e82b0d41-af05-4613-98a4-243a42d229d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675455024, "uuid": "a8a3cd9d-77d5-4a8a-8ae4-a792409b41c7", "value": "ea76a7437b2b5a9390a5c0b53966085e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c20b476-a383-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675402010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675402010, "uuid": "af68342c-9e4b-47b2-b962-9f02c58178c7", "comment": "Malware payload", "value": "f1c6aa9c0f12e1c67f63173af6cf4b10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675402010, "uuid": "1fee18f0-5181-4f46-ab34-878d562fc3c2", "comment": "Malware payload", "value": "1d1e07e64d29cd109b453ab3df4218e53107ec5ab9c542dd3daa763c452cc240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675402010, "uuid": "340b7561-9893-4368-8129-b09db4a84eeb", "comment": "Malware payload", "value": "247503b4cd2292fbb715af95705919ad9aeacd86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675402010, "uuid": "bb67724a-7be4-4246-8c12-f32098f77142", "comment": "Malware payload", "value": "41720f436430d6f4a9f72dfab76bf8349f8e0656426199ada6ff0008c8b1313adf8665c82bdd90d7e2705c5f110613b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675402010, "uuid": "fcf5aef7-6d89-4588-99fc-61e3c3f3723d", "value": "T11276335530DAD8F9E21642B6DAF07DF0E189E22E0923887F6FC819510D7EC49932B5F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675402010, "uuid": "0a65c7c1-56f8-4a6c-a357-fe5e046f4fd0", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675402010, "uuid": "0549bdb9-687a-4d92-8d9b-0f81ef75ba1d", "value": "196608:91O3bOqtiFtZqPbRlGcWIF0fVUODTNI6pE1/Pj:3O3bO4iFtZYGcWi0fVUODTMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675402010, "uuid": "89d666fa-1384-47c1-9b04-5532554b607f", "value": 7630665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675402010, "uuid": "1a7b5cae-126e-46ee-9ed3-22d8753ea1aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675402010, "uuid": "0c778ba2-fc7c-4a01-ba53-085d38b1f827", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4434a552-a3ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1675432464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432464, "uuid": "2cb70132-91a5-4924-ac23-896cfc9067de", "comment": "Malware payload (Fabookie)", "value": "96c4b701f34650fc7b63d914e97ec748", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432464, "uuid": "b59622d1-732f-4e3c-abaf-749a2ff716af", "comment": "Malware payload (Fabookie)", "value": "1dca016132150deae0eacf5c70e49d800da68214b1468012773afa985270c820", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432464, "uuid": "539d8459-bcb9-4b55-ab1f-67712000967b", "comment": "Malware payload (Fabookie)", "value": "e58732b87dd33bd03c6a611dda6df47448511b7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432464, "uuid": "4de66709-272d-41d9-a84f-7952ea6fa9f4", "comment": "Malware payload (Fabookie)", "value": "f0b1b791d655e1c845e1e810a4a34d80e1dee49be13f405737984dfa2e2bb2fbf3dcd03846cc2ee3ca3eb20554611642", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432464, "uuid": "7a0d9117-ec0f-44d7-ad59-7f9d33b24174", "value": "T12AF512BDA1483768C81ACC345533EE48F2B6512E16F8C9EAB1DB76807F7B451E612F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432464, "uuid": "a9cc22e0-40b3-4c40-acdb-30369fb64b04", "value": "245fbb05d3da4d7c6badd5cc3e1f9b98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432464, "uuid": "ea18642f-96e1-4253-a58b-58cb9148bb5c", "value": "98304:ERPETze2Qx/zv9yDqcoZQ7cp6mg1AhDvbkS:GPExQN7Vc1cpTg1Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675432464, "uuid": "30dd8fdd-f42d-4a17-8b9d-377b5e7b0586", "value": 3652096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675432464, "uuid": "b997b570-7005-417a-9496-6e232671e10d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432464, "uuid": "818bb7f8-ce72-4fcc-98db-f179a21148aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc8900a-a360-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675386950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675386950, "uuid": "a1eee6b6-4aa8-47f9-9d80-5335e5a70b5c", "comment": "Malware payload (GCleaner)", "value": "5eedb030d213da807b45678c55222602", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675386950, "uuid": "a864ee8c-68cf-43f3-a1ec-d49ff2120f77", "comment": "Malware payload (GCleaner)", "value": "1e56fd140a4f6da199a96f838b9b9b461ccda805fc552e0f919aeac9f68ae38a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675386950, "uuid": "5f8ade77-dcb4-4d66-967f-4f882d97dd8a", "comment": "Malware payload (GCleaner)", "value": "8c9dea79b6577d5be61871fc75f97f50e19c37cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675386950, "uuid": "f012b79a-1e28-4faa-802f-112a148f6e39", "comment": "Malware payload (GCleaner)", "value": "deefbd539ca7583b0d17e9925716d1a46f3bb6e317f530b65f041d0adb456816264b64a28036c54d9ee5aec4ea024234", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675386950, "uuid": "072d1952-519d-4190-ad33-e8a600935fb6", "value": "T173A5330AB5E1D1B7E4504A7C2C2AA496F4B7FF6A30B4B258346F335D1B33390A41BB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675386950, "uuid": "63e4056b-4bcd-43e6-930c-9568f86ce44f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675386950, "uuid": "0f76ff23-6522-4ff7-8b4d-431a253487aa", "value": "49152:bg85LqsIXa3TVPlOHLIe1YX31O45jTNs4LCgv2MR:cO3L892n1O4LTv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675386950, "uuid": "b4aed3c6-85f6-48d5-8cf0-f52889bdd392", "value": 2085585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675386950, "uuid": "f9f12cbd-405e-45ae-98b9-925707fb6b91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675386950, "uuid": "dc34d760-34e5-4dad-b6e6-7d4690af5b1c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d905fee-a40e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675461712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675461712, "uuid": "5aa93268-590c-4800-aa18-3ffdb998c673", "comment": "Malware payload", "value": "bf3520c251f5472a26599b3a2f85ba5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675461712, "uuid": "7bc8e68d-2bfa-4e37-be53-42b380c93d75", "comment": "Malware payload", "value": "1eef979aaeed4f8d8ecc60196d66ed7affdb8562450b84f1e7b648d854b84fef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675461712, "uuid": "a76ae733-b2bd-4cff-8a42-b18cd3480d72", "comment": "Malware payload", "value": "93b1de841d76f7095429f4f400cd71963e512b27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675461712, "uuid": "51a3924a-be6d-42f9-a3ca-6dd914f41ed8", "comment": "Malware payload", "value": "4401ac305e8bbae511bef056002e5a595d8df845a3b1313760b535ce4c1332df21291e6d168eb1f4cd30d5263fa27822", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675461712, "uuid": "780302c8-564e-4e59-8427-3600aef217ec", "value": "T1B114CF333AD0C072C17B05348C64DAB567BEAC3286795A0BB7983BAD5F706D0663B356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675461712, "uuid": "f91d896a-41b6-46e3-846c-8096aa6550ef", "value": "11deee92ae37204b8493d8d64f5f1f69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675461712, "uuid": "0e9b53c7-828d-4ace-bf81-c22cab6ac5c8", "value": "3072:BoqUPih8jL8Wko0WfH5aQJVuXBkRo35TwVJaeC3oyTN9NEDiU:BoVjL3p053aRodwVJad3oEN9N1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675461712, "uuid": "b8f65c61-dd76-4a5c-9fd5-31f5969ab135", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675461712, "uuid": "1eb28f0c-8932-4f13-9796-e020cc4667fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675461712, "uuid": "7e1ac19b-c21c-4b3b-b7bf-6f683f1d8490", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c22614-a373-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675395014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675395014, "uuid": "454a00a8-78e3-4080-8323-9861e25a9377", "comment": "Malware payload (GCleaner)", "value": "6d87987c60bfe4306f7143db41abd968", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675395014, "uuid": "b533df89-e5a8-48e3-9254-4371c63b3878", "comment": "Malware payload (GCleaner)", "value": "1f4dbae7751f4f4b11848678f6da04bc88cc137fd9115f1d04da734706870268", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675395014, "uuid": "f1d932cc-151f-49fd-b625-52ecd972842a", "comment": "Malware payload (GCleaner)", "value": "a71048b469dc2a8781bcf1891750c06cd2a3d235", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675395014, "uuid": "bcae6daa-69eb-421c-bc75-f9852cb6cb2f", "comment": "Malware payload (GCleaner)", "value": "9e3ff8ec4023a9461efdaf3b680c2b9a8aebcceec65b32bce9669440369440412a039c8606aa6e308bf08fd74f10a39b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675395014, "uuid": "cc88ff9d-91b1-4ec6-acee-826859a30f2e", "value": "T102A53349F3A5423AE2438775FC2949CAAF2BBD55127C3764364E2A690F373C4241F36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675395014, "uuid": "7101049e-d224-4985-ba26-7d8e24f1aa7d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675395014, "uuid": "12c5602e-2cac-49c3-b827-7bf26acb938d", "value": "49152:sKYH50Ll9cbRw8q2F8Cq0rf7BE78RuzZVNLCgv2MR:b6yLl9cbRVVq+VE78RoXRv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675395014, "uuid": "1056d387-a56b-4794-ad88-8bf347749140", "value": 2115899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675395014, "uuid": "e0e817ca-3ff0-44d7-8d36-466b57cb0ff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675395014, "uuid": "6a698074-2f49-4ccd-b4d1-b0ab1a06fab6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4e49b3-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675454113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454113, "uuid": "f2819446-2738-4319-bd82-b05e8c5a996c", "comment": "Malware payload (DCRat)", "value": "e9cc39d72c3687a5a226c4c614efd1c6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454113, "uuid": "2f8bb02a-f099-4a8b-9e30-305c8b465988", "comment": "Malware payload (DCRat)", "value": "1f55849d92ac081d32c8da3486e5aa258955c9863fc586de33635020d5e279e0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454113, "uuid": "53f629cc-65fc-4fd9-83b9-313d2d8733e9", "comment": "Malware payload (DCRat)", "value": "e3e4367ac7d7b07039151cf21df29e490b608348", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454113, "uuid": "7f5dc822-6ad4-4c46-a352-5440a7d21e41", "comment": "Malware payload (DCRat)", "value": "35c4a746e0c2a289bc39627ff63f2c596c12fd37aed02b2aa0f4b6e66cd40cec5c560d94d7d1bf6cc7a5aed8f51d066e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454113, "uuid": "437265b6-1117-423e-a153-8ca2ac328a63", "value": "T1D6557C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454113, "uuid": "0604a2bf-4ac0-4927-a4f5-a47126b42a57", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454113, "uuid": "dad85829-ac4c-43bf-ad95-b7a85c5f8d87", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675454113, "uuid": "46fcb57d-7880-4f1e-a9f0-7968d451f373", "value": 1408203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675454113, "uuid": "c58c0a98-d8a2-45f6-af86-058466cb416d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454113, "uuid": "4473a80c-8276-4b93-b06b-772222625ace", "value": "e9cc39d72c3687a5a226c4c614efd1c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472b17ab-a3da-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675439341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439341, "uuid": "c9efc95d-f7da-412b-8b1f-cd45052b9c4f", "comment": "Malware payload (Mirai)", "value": "97abffeaa7bdfaa81532bd6028498225", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439341, "uuid": "a1fd2bd8-47b8-4574-86b3-437c85ac720d", "comment": "Malware payload (Mirai)", "value": "1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439341, "uuid": "7f646042-67bd-42de-9bee-3d0280330029", "comment": "Malware payload (Mirai)", "value": "26ab576a0abf7085ecf6321a311a7b3088ee48ae", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439341, "uuid": "9c8b3f06-2728-4a0e-bbcf-0a0eb7d97414", "comment": "Malware payload (Mirai)", "value": "6bb405b270ed1ae78d519ca14903898d6b2f603f812ff196d647a1ff2b03f13d0479714655b1a66106014dcec638aae2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439341, "uuid": "c6d17964-4413-4dd1-99ea-d37f656642c9", "value": "T197F6C003B5A180B5C07EC23085E59223B631BC591B319BD77BC4AB7A2F76BC05E3A765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439341, "uuid": "d07ba7af-f70a-4d57-bb68-0d5216cca423", "value": "aa466c044f0d2d2f6270070fe1bddf7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439341, "uuid": "6b69e215-c056-419f-929f-5e5f8ddabb4b", "value": "196608:aMygJ9edfbhSo5Kp8qPKlL8QgYVhqhOM8qTsSqwLM:7XJ9e1wo548qSV5VhKOeTsRwLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675439341, "uuid": "8fcd5aa5-4d5e-46ed-9d40-9338f083f0c2", "value": 15654896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675439341, "uuid": "bef9f9db-eaf4-4e7b-8493-14d9c5cbbe03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439341, "uuid": "2f39b63b-3e6c-4c14-8ef0-bc61c3dab726", "value": "1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a632d53-a3e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675445681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675445681, "uuid": "49ed7d53-47ff-4063-bfb0-bd14c128180d", "comment": "Malware payload (RedLineStealer)", "value": "3f805c7eb92b2f8cd6dbc1caa76d7d46", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675445681, "uuid": "ee02215e-42bb-466c-9df1-67d6294247ee", "comment": "Malware payload (RedLineStealer)", "value": "20513f8028a7a32a2d3754c20e321d86a4bfe2f6eee46adfa4b757580ad5e00c", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675445681, "uuid": "82c51427-6b66-47bb-b233-4c7ef2b9d0e3", "comment": "Malware payload (RedLineStealer)", "value": "53a3f44c3eb28865577cc608ae037d583ab4c6bd", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675445681, "uuid": "58ce461c-a305-46d9-80b8-f059b3b7262e", "comment": "Malware payload (RedLineStealer)", "value": "86c36f5492e02fe58a6a82375369812776865011ee6d7866489a06178c6f409203b1e2dd422b09dc7c61f1ef028bca34", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675445681, "uuid": "cc542921-63a9-4b51-8562-c48d650aa763", "value": "T1490633A859A5C3E2FDAB23BA0CE10D1D2F2D1965D59A781D841339F41B623F13C7F829", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675445681, "uuid": "f9137a04-7413-4b32-aa7c-30445e74912f", "value": "49152:DW2eBNflqdcJq42Q0PRtIdjWEZc0v9QL5uP5avFx++TO8LoB11ARK/lQp:q2C7FODIdZZp9aE5UnfqMK/qp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675445681, "uuid": "3f5273f5-2bdf-425d-a41b-2e02233b1989", "value": 3916522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675445681, "uuid": "11c7ff64-6f0b-471d-aa4b-fbc5f33baf53", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675445681, "uuid": "80fb4dd9-9559-44aa-b633-6a5781f0a09e", "value": "3f805c7eb92b2f8cd6dbc1caa76d7d46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a224825a-a3d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675435628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435628, "uuid": "a83ed3e4-9c89-4db1-bcb8-2813daf3984c", "comment": "Malware payload (GCleaner)", "value": "e78152c46fbdd0e8f1eb23ab4cece1c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435628, "uuid": "f4de8ffa-c3f0-4f49-9217-abdc782c0ac5", "comment": "Malware payload (GCleaner)", "value": "2072d14da5246dbeb54489005723ce71ffc1c4f84fdb18f251d4b75f79a89fb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435628, "uuid": "e31cc49d-c480-465e-a5e0-fd0b4b86f2f9", "comment": "Malware payload (GCleaner)", "value": "77a13d7f260631af57cbfca00ada5b971f1dc548", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435628, "uuid": "f290a195-5cea-4edd-9689-794024c019a0", "comment": "Malware payload (GCleaner)", "value": "9619215745cf3e1637476d0c356a952a26ac7cf12b97f47de40bd7b551bfd92a2885537e14b2eca6a5f4a48ee856a4a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435628, "uuid": "32f283f0-a022-4d8a-bd58-7adebbb1b70f", "value": "T118953356ED524A73DE43AB379A789321EE325C8A38744245309C631C4FB7A50847FBBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435628, "uuid": "ba09f4a9-a8df-461e-983a-e30641bb016e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435628, "uuid": "dfb23c8d-35c7-49f1-80d7-835a854cabad", "value": "49152:ygOUxOKBE/AlsmvTcEn3j9pr5XIB/+GfZ8LP5YLCgv2MR:TOUn2/Alfv423j9pdYB/+Gf2LPev2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675435628, "uuid": "979f7058-7907-4a79-b42f-c10501079ce4", "value": 2052346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675435628, "uuid": "dc4e1f24-57bf-4470-bdbd-00d1c6e54c49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435628, "uuid": "0c6b7815-75a6-4ec0-96a3-f7e4fb0e332b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5b8ffa-a358-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675383780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675383780, "uuid": "84211478-3dc4-4d26-86bf-d5345d32fe9a", "comment": "Malware payload", "value": "8a68b7e032abcb251e193aee7a9cd2ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675383780, "uuid": "f12fb074-9024-4819-bd5f-b7febe6b7f8f", "comment": "Malware payload", "value": "2080c727765a98c7e167204263e56d4636aed07ea29d54b93d4bd5d5850bf191", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675383780, "uuid": "2554af85-c37e-4aa5-a451-df7a2656102c", "comment": "Malware payload", "value": "2c405cf331829f521b45fc9ea967d30d396e4bc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675383780, "uuid": "2f18d317-96f5-4182-9f52-a62fe6c75121", "comment": "Malware payload", "value": "5a366fb8f640bfba207fb3e393af4023c0b5968e5587e98a9b736854ceb6bef1da5205f8e241cab73b04868838b950ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675383780, "uuid": "95b74cbd-cca0-4256-9d02-bad86594a463", "value": "T157763313B8D246B2C3B8D571A65C36C1FDE7B6E44F5008AB0378282F7F35E9489A195E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675383780, "uuid": "a88ef8fb-7c49-4d3c-93f5-cdb2e7eb73c2", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675383780, "uuid": "b72ecc5e-820c-467f-8d1b-f9c04eecc428", "value": "196608:91OjTvwZT5vJXOCdk4HL/QwIDNwO8ZCTr5ODY3QGMPp3UptoaZ:3OXvY/X9Hr/QwID38ZKoDPp3UB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675383780, "uuid": "0fb65e25-3f35-4481-9709-edbf94c7aeba", "value": 7643330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675383780, "uuid": "fff06fd0-a1d7-4ca3-8a9f-7d03e901d8fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675383780, "uuid": "d9ce9f39-79df-430d-bad7-3fa878f7560d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13479914-a3cb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675432811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432811, "uuid": "fb27a3aa-43aa-40b8-bf9e-5ebcbf1e9791", "comment": "Malware payload", "value": "c737cbfdfb87d459f1d5fae63f285978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432811, "uuid": "03cceca0-010b-42c1-96c0-341578547115", "comment": "Malware payload", "value": "217fc4aefc7d9382b2668ffc6b97083b3baa15f5ee53fc00d9947404283abebe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432811, "uuid": "050921aa-9fa5-484d-86aa-3528e4fc0b1d", "comment": "Malware payload", "value": "2cbce557f578b8dc99e30932bef0cbde4ba0203a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432811, "uuid": "a049d6f7-a82f-4939-a2f4-c9907769122d", "comment": "Malware payload", "value": "a424b9237fb4d0a51b3b6597ff02432942266b9017ab968fad40fcab77c4250fdd35707bd607f9b2f5bd1e8c5e9c75ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432811, "uuid": "a7b5a29c-0e13-4a4c-9442-0b4388d27510", "value": "T158E1C684A3C80372DEA34B379D73A3921A38F351DE0BCB5E2498514FAC56B5946B3F21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432811, "uuid": "37fce89f-4f0b-4b8e-869b-b3f80ffc8eb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432811, "uuid": "7cc05d71-64b9-48b0-834e-5dc299fb2bad", "value": "96:wwph816+leOL2LPQYHFZiQBq58xY+s6koCvP9ZdxzNt:zph816+leOSrQYHLZI58e+sHo4rJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675432811, "uuid": "b44f44e9-a8bd-4835-aec5-a6922303d815", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675432811, "uuid": "600031d1-8f06-4609-8bda-ac50b1b58460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432811, "uuid": "0c8335d9-3208-4448-b36e-f71f3c780ac0", "value": "3398b740e0a0ee3e332d79cbccff606e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1de2100-a392-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1675408649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675408649, "uuid": "9f40c1d5-40a0-4a49-ab93-0b0146fdb2cd", "comment": "Malware payload (zgRAT)", "value": "21fc808d0840be3366ef79e5a15c51a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675408649, "uuid": "1c25a219-d009-4cd3-a796-87ebb4659617", "comment": "Malware payload (zgRAT)", "value": "218150c8d3e13fd5de782d48a45433b76d64a4f82feb9e4853543b1c8a9a1498", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675408649, "uuid": "5b9d9d38-28f7-4ecf-bb9f-12e28defcc74", "comment": "Malware payload (zgRAT)", "value": "c9c3d63a7fa8f99766fb0560dd14a70e90e57c4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675408649, "uuid": "7c5788b2-2865-4fce-92a0-289c790587ea", "comment": "Malware payload (zgRAT)", "value": "30efd6898d888ff1a7039b47e6faea6d5ac80a2f75747596efed8c604244767aa8284fac8a6093b3efee92e573bed20d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675408649, "uuid": "e569d224-b5d2-41ed-9284-1160f54cc46a", "value": "T1775501F66D8E70EAD4D536BC358A2E164B9DFD82256FCC60338165ACC09A250BF587CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675408649, "uuid": "2085b7fe-7df3-494d-be6d-eff619105212", "value": "12288:X2hfjFNHUaymttZedE59j8fmVuXQ54jNg6QDloO7pe54ZHW4WASSxqHs9Enat0N+:QjDUaFbwWqW6H5QHWjiqH67V0AMwrdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675408649, "uuid": "9dc71438-f984-4e27-8fce-2a7b6977e7b9", "value": 1318912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675408649, "uuid": "47274f40-52b2-442a-9f1e-3f0741157e85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675408649, "uuid": "589f8b6f-db43-473a-85aa-e04a4c7c9f6f", "value": "21fc808d0840be3366ef79e5a15c51a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf9a4f9-a39d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675413070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413070, "uuid": "eefb21a1-d9a5-4f87-9a92-4c029e879aa4", "comment": "Malware payload (RedLineStealer)", "value": "f6f6f560f644057ca18cc7bd0900cdca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413070, "uuid": "dba0b00e-2791-4da4-8afb-a0d3047f013a", "comment": "Malware payload (RedLineStealer)", "value": "21a5bedf02f13d8f0e0b74041a4e55731ebcfd5f03fe8864febd0609dc8f0966", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413070, "uuid": "404c48ea-4261-46b1-af65-81c3423c4ce9", "comment": "Malware payload (RedLineStealer)", "value": "7a4c80b777120a10c2b4a2b9ec0d76dad98631c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413070, "uuid": "8bdd3edd-ce79-4f39-83a8-f612284b8483", "comment": "Malware payload (RedLineStealer)", "value": "11bc14985ee0308d2494389a39930c623eaeebe449025e9e72fe1f450348f94a8ef4d739e29871f44836ace05758e88a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413070, "uuid": "e0e03052-1f7b-4805-b275-bf87097d40c4", "value": "T19284F1323980C07AC8A750709824D6697E7EB9318936594777A806BE1FB07C1673AFDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413070, "uuid": "c7a034d6-9e30-4f94-a309-0e7bfb6cfdca", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413070, "uuid": "d819a6c1-79c6-4ab0-b2ea-f299fec1a793", "value": "6144:BwGqFrLoPcP1pbl4jmd8F41Qz6+e3PMGtUB1H5n5f8ydu6umKKLSbj1JGw:BTGrHP1OriQz6ZNUDNcTfbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675413070, "uuid": "7043568f-d3c3-4f52-8cac-511f3bc396a9", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675413070, "uuid": "b335fc69-a6ee-430b-9b1a-5a3a783434bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413070, "uuid": "c398dd3c-b480-4426-a58e-31b9da482593", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3c3355-a381-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675401156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401156, "uuid": "55cd169f-de09-473c-8f2c-5657737c6c7a", "comment": "Malware payload (Mirai)", "value": "fa7f5cdda65e215a2707a2c8dbb31857", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401156, "uuid": "200c653d-df4c-4f50-a51d-202859285db3", "comment": "Malware payload (Mirai)", "value": "22956db13c037d32651d1dfb487579a69197aca7494bac1ef1bc5deb1883c307", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401156, "uuid": "bad3a1ab-979f-4488-ad25-f795232fac34", "comment": "Malware payload (Mirai)", "value": "b89b571f1c96086f83378a3fc92f88595417b931", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401156, "uuid": "996ad70e-3ce6-4e52-91ef-c8eb42d5d8c3", "comment": "Malware payload (Mirai)", "value": "6ae7c838c871995f27dc67f4da3c034d45671b66b8d46b8df9b73d9373c81d780ad0b59b72e37a69d1dc98e2be7e5be7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401156, "uuid": "5a3301ac-4128-470d-80ea-0e860ac7a232", "value": "T188735B24A9792E27C1D4A17E62FBC321F1E6230E25B4961C3CB60F8FFF1465464562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401156, "uuid": "87d37b35-06b9-41e5-b75a-f48582298aaf", "value": "1536:SbHmkTSo3BOIqS5aq+Dc035R9QuEk6vNNTKjf7FRo:omcjaq+Dcc5J+vNwjfLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675401156, "uuid": "3691708a-c405-44b3-b545-6dc890c2d106", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675401156, "uuid": "f46bf8e7-b4ac-43d2-b920-2cda0dab2082", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401156, "uuid": "de8c7fdb-3090-4952-884c-936711801ba4", "value": "fa7f5cdda65e215a2707a2c8dbb31857", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34be705-a416-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675465345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465345, "uuid": "6a66440f-3ab2-45e4-b587-ef25ccf77c15", "comment": "Malware payload", "value": "b906281413db3098675fcf6920c592d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465345, "uuid": "e5d89271-2e66-464b-8e5d-dd03b4dbc354", "comment": "Malware payload", "value": "231e2e48339eb5cd6eddadfa3581e8ffd83d281c270423c38e21f752dddfd291", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465345, "uuid": "2a10fccd-a677-4a06-b515-dd1825f5a9d3", "comment": "Malware payload", "value": "778ceaf8f54363cdff0eda6d59a880cd3e397839", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465345, "uuid": "e854b205-b045-42aa-8d2b-04fbdd7d5953", "comment": "Malware payload", "value": "68897ae77b23d2f9a8dde77ad32a58b69c58445724a851f1fd86c55be8f066fdb1765d1a607198ad8ba11d12bcd236da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465345, "uuid": "2b190cac-2e0b-410a-948d-66da88a7fc63", "value": "T1DE4401E13B90C032C15615311D28CAF5AB3FAD33D569C507BBB80E6E6E711C1BA6279E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465345, "uuid": "1e8059a2-adcb-426f-b6a8-eca25d8c6411", "value": "d8db521c1aabdcc02e1c1d2a0eb59db9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465345, "uuid": "70c13039-0b18-4dda-98d6-cd4e4d5faa3a", "value": "6144:l4LslzUii9sScSRUSdNqXRsFHBv2GNwK:l44lztiqsUWqRsFhMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675465345, "uuid": "ccd7aa05-e67c-498e-9379-66208cb384f6", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675465345, "uuid": "8e7de45b-8aa0-4cc7-9e09-8b94a768c065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465345, "uuid": "b270281b-f70a-411f-b61e-e7fad6de65d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd410205-a3cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675434868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434868, "uuid": "2b139a53-527e-41cd-8f34-56a7bb27aae5", "comment": "Malware payload (AgentTesla)", "value": "49c85634a86ddc630bf63c9a9f20b216", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434868, "uuid": "e614a32d-7b75-47de-8916-1944374f3061", "comment": "Malware payload (AgentTesla)", "value": "23b733b80abf2a3de431fdc75ec1ce480c4352a92c97d5dba57a3a45cb1030fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434868, "uuid": "32a8ac87-de15-42cb-9b03-9d0cc63d58ac", "comment": "Malware payload (AgentTesla)", "value": "82c72d1f6afd188285e2510da83364af2a686ffa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434868, "uuid": "2ae1d142-e0b5-4e9a-9500-61b515c35483", "comment": "Malware payload (AgentTesla)", "value": "173ab626f583c829aacbf3c5c4284784ae7087a1a1c77653f5602fd1357db5bf5fd0592202578aeb2e0e55c206560d2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434868, "uuid": "da43c843-057d-4d06-853c-d4b1f0da544d", "value": "T13C057E6337B099B2F78721B204247B885BF17503BE16E2939BB73BC06785DB77298152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434868, "uuid": "9279de6e-e2b1-49a8-b9e5-69f8b81966ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434868, "uuid": "dcdd4892-157f-4cc5-a415-078d57dfd36e", "value": "24576:kxeSqG4yPaKppo5TNrSOsez3ImX86F0xM:kaTS9ez4mXxWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675434868, "uuid": "42557f36-0e8e-43c4-99bd-b810b95d92f7", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675434868, "uuid": "e0bd59ce-ab08-48ba-8e5d-cf0e40170c26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434868, "uuid": "6279591f-ebb4-44a7-8f9f-e375e7158080", "value": "Msconcepts22..........pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38af80f-a3d7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675438341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438341, "uuid": "ce97c570-021d-400d-9a6b-fbee80082384", "comment": "Malware payload", "value": "d64dc93e51af87e033063032191fe291", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438341, "uuid": "02b7e3c3-0fd1-458f-977e-e44e3f69f6fc", "comment": "Malware payload", "value": "24e8934cfb8a3f8773054455916fb8ef595230bb644df38bcd6bfe98ec4f4bcc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438341, "uuid": "96951eef-30be-4ad3-9a54-23cd8e2be8f1", "comment": "Malware payload", "value": "bf225e80850647d872fe7988253bc6a14af1efd3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438341, "uuid": "4ece2692-bda1-4ec9-9af2-be343878dc2c", "comment": "Malware payload", "value": "4e597ac88dc9c8003887c27e09781342dfe1eacc4a141b2a875b30d45e9f3d5dedca8b516178d18e7119fb0e8447ec76", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438341, "uuid": "22b0d0db-6614-4c18-bfd5-60c7c7e3338a", "value": "T190636C05BAD1D870E57E29355420EAA16B3E79224EE0DD6B3789063E4F306C0DA35E7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438341, "uuid": "9bb38bcd-7b6f-47c9-af1d-f595738dfe7d", "value": "96b2a40442392f3caf3d245c65a2a11b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438341, "uuid": "12ed92cd-d2c0-4d08-8b70-6dacc6907833", "value": "1536:t+3r75k1UeRS+PlMlDO7JCWl6fIZZgsWccdSyYIWg8Y:8+1k+ClDO7SfIjcSfIT8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675438341, "uuid": "4f9c19ce-6c08-45c1-b880-7abd8016ccd6", "value": 72707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675438341, "uuid": "3b18ad08-1322-4706-8d21-3bc2846712b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438341, "uuid": "b286a702-1698-4ad1-970d-daa638ee972e", "value": "d64dc93e51af87e033063032191fe291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d72c47-a381-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675401064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401064, "uuid": "10f7a04d-dfe5-47ea-8982-b65c47af1d1f", "comment": "Malware payload (Mirai)", "value": "af3f9e6048d547160de12f6c9e8302a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401064, "uuid": "edd1bdf0-147d-4a71-b9ff-80980e65c82d", "comment": "Malware payload (Mirai)", "value": "24f651b16cebe0b0daf490b533a717ebfaaee83f035f1c14211aed55862292a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401064, "uuid": "0a0516e7-7352-4907-83ad-e2aa3dffd2e4", "comment": "Malware payload (Mirai)", "value": "b7aff44fba194f83e7d60eb9d83d5c43171d4e4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401064, "uuid": "1da4329a-72d3-4e65-b40b-d432eee5bad8", "comment": "Malware payload (Mirai)", "value": "701fc3d043432d95d486ce302bb2c19e733f613c52378ca9bc817f6561fc5564063c9d35f38ca60bc98e69bdb06d27aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401064, "uuid": "0710f624-74cd-41dd-9cc2-8eb9f5387f45", "value": "T1F5E2E09E64F43C99EECE4C3D52DD0859EC9B64560319DFD9232244C0EA2F85ED1AC47D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401064, "uuid": "64d06910-2376-460c-90b1-91479acd9e07", "value": "384:A3fpCLrsjHIX69URc+hmnulY1qHprFKt6zNJpRwD9MH+Duvidps+XJa3FRWGVCz9:4fpWcehzJFYKn7gMHRGyuJa3zWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675401064, "uuid": "fa1ed67d-3cd1-42b4-a6bb-d65c8246b1ef", "value": 31976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675401064, "uuid": "771323e5-386b-4ab5-9f78-e5d58df91030", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401064, "uuid": "06008dc0-8f34-4590-aa89-522a6989a914", "value": "af3f9e6048d547160de12f6c9e8302a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cffd67be-a3ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675432698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432698, "uuid": "6ad9f609-e106-497e-bc41-cbed3ec6c0b3", "comment": "Malware payload (CoinMiner)", "value": "82c1f1562192ce312655191789398b63", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432698, "uuid": "9e9cf1af-005b-4314-84ba-735d34de7d89", "comment": "Malware payload (CoinMiner)", "value": "25726ce8a7a9050212e3aace576182e7091bf66feb73a7c8bc534d0322928690", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432698, "uuid": "e372f6ef-4ded-40f0-ae12-3c1df06a9fb1", "comment": "Malware payload (CoinMiner)", "value": "87f6e34addfae4428d15c3706eca3e93cc23d2e4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432698, "uuid": "eb17a97b-d7d8-4016-abe9-ef043912acff", "comment": "Malware payload (CoinMiner)", "value": "44d7acc2d5e23b5cc8be4485856da14610a2ea1b6b99a9767b74dd6607c4f8941de72aeb2beb50788a54ed1d9e0bd168", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432698, "uuid": "d7e337c7-aec3-456c-8c3a-5aa3d9de98b3", "value": "T10AE52E2D7B79EC34E406A5BBCBA285A2D506DC31D923CA1B3509FF98B536F5012F134A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432698, "uuid": "003b7017-1025-476e-98d9-edb6164a0f63", "value": "112651ded2d3404ec6d2facdd2c2de79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432698, "uuid": "eb650892-4e0a-47a1-9255-7aba2d5a6efe", "value": "12288:iDyhqxs3Om24I9qU2JESNQBrzpfmH/J5nL3QWwZxF0HibnG+i97xzVB3eqxWV:NqxsO9r2JQrz0JR3vkxi97FeqxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675432698, "uuid": "e51b507c-2712-4e58-87bb-e0a9d8fcb78c", "value": 3062784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675432698, "uuid": "4f9a7aca-ab0e-4386-914a-e9e21b257a75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432698, "uuid": "0e09506b-350a-4495-81ee-c3ac9b29826a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee32b85-a3a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675414523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414523, "uuid": "dd01e35d-cdf0-4260-86c9-61e790604aec", "comment": "Malware payload (Quakbot)", "value": "4a1fbd71010494ad1cb579cd6c395c80", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414523, "uuid": "5629c54a-5e0b-4047-8d7b-5217554d68e5", "comment": "Malware payload (Quakbot)", "value": "26a5c35034800e786a979358b4cd86cc15ddef9abdf711fd2d3cd38ba59ee4c2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414523, "uuid": "674e4ab5-f7d7-41f0-8e85-d00d83dda2a4", "comment": "Malware payload (Quakbot)", "value": "fd97b9875641a5eb8b95b716fb17d1d36ff81afd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414523, "uuid": "3b804fa4-8158-4d90-872a-86d2382b1468", "comment": "Malware payload (Quakbot)", "value": "67e32bc1126f2ee827153f277602d7e16d7077af5ef2d92847ed68a6495c86c64e50062aa7d9b4b8a5c386fc997580c5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414523, "uuid": "99f79b8f-4723-431f-ba31-e0091882ecc5", "value": "T15BA4F91D7A16F034D49A00BEBC18D1FE4468B930566D4893BBC2BB172CD52FA9CA2F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414523, "uuid": "1598a47d-1cc9-480a-b9c4-d76cc764fc53", "value": "1ccffc494b14223940b5ff7c5d6ed9fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414523, "uuid": "1c857128-c26f-4ae6-bbc0-688f4864876a", "value": "6144:C3P9EKUug7ptz0KE05TG2mLsh0H7wiWsxhQsjdDKlos8Wno8Kdygm/K+VybKK:iEKU/I8kLFUi/sRJKYK+4bKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675414523, "uuid": "12953cc0-cb25-4d8e-b34e-872ebbc3bf27", "value": 475309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675414523, "uuid": "6c89a2a7-fe22-47d6-97d2-7ba6becdecdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414523, "uuid": "83285108-e387-4ab7-878c-7420d371ca76", "value": "1.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114cfbac-a399-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675411333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411333, "uuid": "8dcbbef1-9369-44ad-b05f-fa492fd2d197", "comment": "Malware payload (AgentTesla)", "value": "3370076797c4dd963a75819389d0767b", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411333, "uuid": "1dadfe5f-4261-4cd8-a635-cdc4e068dca8", "comment": "Malware payload (AgentTesla)", "value": "26aa42c4a761319bc122bb65c8c24917371047b47370e60a083bce432c9f36c6", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411333, "uuid": "f6550bc0-5025-48e1-a598-d390d835178b", "comment": "Malware payload (AgentTesla)", "value": "c49f5ea0041709191266c54a480a6fa45eeeb344", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411333, "uuid": "8728da92-9bb8-4069-b67e-cfebf10d159c", "comment": "Malware payload (AgentTesla)", "value": "20f20f6bb929bf52d9db33af8d66043963c25f9336ce56fade0ba97540f5aa43c34ae5f9a27fea844dc79e7617f81a08", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411333, "uuid": "48e8fc89-2f7c-498a-b92c-a50c69c08f0c", "value": "T13BF423C61B91E1D4E286B76BC42F41876B1DAF8D0BA0BF4E9E944F94CCEED824159F01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411333, "uuid": "00433c01-e9d4-4843-8fde-a8499d5691be", "value": "12288:OfMRc/u+Mx+7fbMeDtjqhiQXhQS/ZpooEw9hjXNd33JH/Z5pC5UW:OkOG+i+T95OdLfooF1pHxu5UW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675411333, "uuid": "52550b89-186c-4afe-9957-d0fbe9083d01", "value": 726298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675411333, "uuid": "223c50fe-bda0-4ba2-9017-337ca25abadb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411333, "uuid": "efcdaebc-8908-4076-ad71-8f0bcf64fa4a", "value": "FAXMESSAGE.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39607e43-a3a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675416554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416554, "uuid": "a1541563-b44e-472f-afc2-bd6127d9477d", "comment": "Malware payload (Smoke Loader)", "value": "0d23c231387e96bd29900a143a93eec9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416554, "uuid": "d2feac91-d01d-4a20-972b-18d657eb7455", "comment": "Malware payload (Smoke Loader)", "value": "2735371bbffec3c5d97b7b5f060485920a152a70629215cba0d66c91142009f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416554, "uuid": "f499ef96-4311-4268-9780-dba34f665dea", "comment": "Malware payload (Smoke Loader)", "value": "8aef1c2c5e1bcf901b74048315e24af272758ee5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416554, "uuid": "19eee285-f0c5-4dbb-9242-dea65fd133ad", "comment": "Malware payload (Smoke Loader)", "value": "ee190cd7ff74251ae1c22d6eee84edbeba9da7b10021bd81b88d674dd358c8a9395e92b341249e7ab2c0724edd07612f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416554, "uuid": "2626ede3-0d2f-4d70-867b-bea7719b4dbb", "value": "T19714D0323980D072C9BB11745820E6A4BBBEB4314F79955B7BAC077E9F706E0762A347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416554, "uuid": "fe84c096-e758-40b3-8ade-98fdea98c36c", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416554, "uuid": "199ca39d-8a81-49aa-b3b2-7948211de387", "value": "3072:NHZXozY15P57c27LMg07OW+q5Fs6e2Ao+RD4rYjoj5QLqsw:NHZF57j7LH07O7DZ2x+RDCp5I9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675416554, "uuid": "6d58cbf2-33af-49f2-a369-58bafd900b63", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675416554, "uuid": "eeaba2ed-9f11-4abd-a76b-7b557bdfae1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416554, "uuid": "280d99e6-d84d-4e88-9fc8-4a4865e3dcff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3532fae-a3ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675447253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675447253, "uuid": "1e49bfde-779f-4eba-8b4d-d372a7a0a8bd", "comment": "Malware payload (RedLineStealer)", "value": "9aca92af0068026184e9ebb0ec613db3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675447253, "uuid": "946bf6cd-b7ae-4569-85c3-9e0a45693d8f", "comment": "Malware payload (RedLineStealer)", "value": "27804821e96c2478f457a6addf374d6e3a19363c99aa109006b936bbd6c7c4c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675447253, "uuid": "69c72f2d-bf48-4fb5-bc44-3ca7e0a0344a", "comment": "Malware payload (RedLineStealer)", "value": "befca1b451f3021941359152a615256060ad01a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675447253, "uuid": "dab090a0-adbf-4266-a5bd-745335da57fb", "comment": "Malware payload (RedLineStealer)", "value": "5bfac7e6ebc6d6da6d75c8d3910f9604b87476841828fbe5c2e8420a69efcbc71f04527863662932ac772db632198d3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675447253, "uuid": "f5a7b612-9091-4e1b-a126-b811c5ec6c79", "value": "T1A064F1323680C4B1C26B54345828EBBABBBEB5305936B9573B9407BD4F716D1933E34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675447253, "uuid": "40c8cd3c-36de-44b0-944a-4767b635adc6", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675447253, "uuid": "724615b0-bbc1-45d0-bf4c-53eeb91daf8f", "value": "6144:F6xUrqLzfnPrsGdvJ/1p0DWzbb2xfoZy+QfMbgiWk1:F6xUqXPr/B/1qDWz2xoZhQfMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675447253, "uuid": "0c97d013-5902-4112-963f-7dbdc8666170", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675447253, "uuid": "d56f0b50-da70-40c9-9033-ade142a4f289", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675447253, "uuid": "493de4ef-a6b5-405f-ad31-9c589f5f723c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f3ef36-a395-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675409725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675409725, "uuid": "c8f87fd0-c944-46df-a06a-bb13e1fb0959", "comment": "Malware payload (njrat)", "value": "a713d73534ae9f37b4e20e852588f19e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675409725, "uuid": "7162947e-9f8a-482d-b286-724cd1d8ec77", "comment": "Malware payload (njrat)", "value": "28416f2f2d47f21c50f816e11b9be468ae24518539954269bc4330f9f02abd55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675409725, "uuid": "83ffd11d-aef9-44e8-baca-213e79cf02ac", "comment": "Malware payload (njrat)", "value": "7300f54988acbef5dfa586781e18afde0dbb2176", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675409725, "uuid": "88147135-c699-4712-99a6-cc3574ff1e2d", "comment": "Malware payload (njrat)", "value": "670e2aa498cb168adc29da6ed18fa12ad409c4b879b3f0406c611926069e816de7ea022021ac2ead23a55f64bbfa7526", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675409725, "uuid": "386834c6-9d2c-41db-b8d1-e81b7d48bf94", "value": "T10813E78CBB84D174D5FF8BF1F492B2890BB1A167A806930B99F114D98F73AC09511EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675409725, "uuid": "6a0e1f4c-288f-422d-99e6-7aa0bb078096", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675409725, "uuid": "102ad79d-87b5-4416-8029-c8839d78a39d", "value": "384:QZeoQF3VarE8yTTTfqtiWqEnmDai0+TQ28Bh05HFNNCo33LU6jKswJDot/greT0k:WDi3MY5TffqtpoDY1Bh05HtH3KY3+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675409725, "uuid": "83b7fc21-0465-4e30-92c2-66092e85df2e", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675409725, "uuid": "67b8aa02-e5eb-4a38-9438-8fb8ef828128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675409725, "uuid": "fe03cc2b-b576-4797-838a-4a8475d48768", "value": "a713d73534ae9f37b4e20e852588f19e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5714e56-a41a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675467040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675467040, "uuid": "5225dcda-b023-421e-b679-b1f44b5aa1bf", "comment": "Malware payload", "value": "a35bb134a1c1441f9591d8fcac0e422d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675467040, "uuid": "ee56dddd-97af-4398-8696-34158420a621", "comment": "Malware payload", "value": "2872c261acc83347022326bf8685d8afac6575d455584efd9a711722a1416067", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675467040, "uuid": "e82b03fa-c26e-412f-9380-f20cd83090b5", "comment": "Malware payload", "value": "78e84a3ac9407bd097c59a2c8dbb14526367b6cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675467040, "uuid": "db2a0f22-568b-45ee-8b03-4a23cf43b0b3", "comment": "Malware payload", "value": "568ec922f687071329c1f25b0abca6030674bdc65cdb92aa05de3257818bb305ad59e28ef839821b2339131a857b3c94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675467040, "uuid": "93ca1ac3-4519-49a2-a5ce-c29f979b8181", "value": "T1BB9533534163D473D0268A70AF11AAE191BF7F591CB16332705E72AF0E376E3249EB29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675467040, "uuid": "3cbf646b-1b48-4e42-bf11-0ac25841c1bd", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675467040, "uuid": "73c67288-3b06-4bc7-80f2-9be6dd8cfa67", "value": "49152:ygUb46pYWcIhSpGRpy01sWYatAMFI2wykenu3x95jHmv/uvejLCgv2MR:Tt6EIhEGXz1sWYkAMnk2uGGvenv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675467040, "uuid": "05d60d97-d5cd-4555-b856-90fcbf12e8a4", "value": 2047814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675467040, "uuid": "8ac4e8a1-c0a8-4d9b-882b-9d93c6db2121", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675467040, "uuid": "cf377211-fdec-4c52-9289-45deaa4de997", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df3881f-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675453982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453982, "uuid": "68218574-7310-4089-a1bb-b17fc3004741", "comment": "Malware payload (LaplasClipper)", "value": "78c6a105d5413f9ab57249dbdfa5a93d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453982, "uuid": "8da0357d-4793-4b3f-b250-6cbcdd123c48", "comment": "Malware payload (LaplasClipper)", "value": "2897232c5333d1ba26ab1b9769b1bd87894f2c8d1f6c6c3cb0fa47d8b3afc56d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453982, "uuid": "1335320a-b036-44ff-8dc7-55304c229fb4", "comment": "Malware payload (LaplasClipper)", "value": "e6bb2feab29a36e032c64280bbb06eb2a5fbb4bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453982, "uuid": "11a6bf3a-453d-485e-81ec-aa80a5642148", "comment": "Malware payload (LaplasClipper)", "value": "76352c0bf657849e7556d54674021ab5473d5c7902835abbe372d472600d40231cedd421d30f76fe96302cfc17e3b447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453982, "uuid": "f9082fab-6b96-49e7-91bd-c3ea7b59190e", "value": "T1F49533157DD08072C02F96706A94CA6B9B28FD777A35994337E903EE4EB01D0673A3DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453982, "uuid": "a1d99041-bcf1-445d-8d07-741ae87ebb69", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453982, "uuid": "31b58929-480b-4f56-a1df-2052e5ac642c", "value": "49152:5D4sjLcOfX0E8vTcMFFTJDjkmr6dvuu4rPl8:ZvZX7KVPlDjkdduui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675453982, "uuid": "e38d2a85-23ea-40d2-a975-736ee9c6f089", "value": 1964032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675453982, "uuid": "856f3bae-5479-48c8-a3eb-3a93ab2afc9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453982, "uuid": "03b9e1ac-cb48-4251-95bb-f3671c3101ec", "value": "78c6a105d5413f9ab57249dbdfa5a93d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838c19de-a3cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675433858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433858, "uuid": "d99f0b1e-5b6a-48e6-8b0b-c8aec7abdf1b", "comment": "Malware payload (AgentTesla)", "value": "2de2794b929fdc5d714a931156bc5cdd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433858, "uuid": "5913dfbd-556b-4fc7-81b5-895fad1782e7", "comment": "Malware payload (AgentTesla)", "value": "289799ee9df4edf429712a12fcc4149c9daebccf3ade82f503e10ce3c0593e08", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433858, "uuid": "0aabea85-4ada-4358-a344-964176a5eabf", "comment": "Malware payload (AgentTesla)", "value": "d7d67dea23ad3f7f10fdbbd27a1caf8b30497587", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433858, "uuid": "d38252f9-61c9-4278-b489-df1d141ca3a5", "comment": "Malware payload (AgentTesla)", "value": "aea1d57b768edc9b21c9e50c76e591a2163d413deed5e9858f1eadfe7dfe4c75c5f824b280a4121fefbe0762684ec700", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433858, "uuid": "45b85173-3467-48e5-9713-734ea2c402c4", "value": "T1EEF4E53D297717E6C338FA3186D58420B6EEA1923703E969DDE61AC14F026C27ECE51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433858, "uuid": "3d881df0-dd97-4fe8-a07c-c02fab81915b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433858, "uuid": "e09bc994-cdc9-4c8f-9a05-bebbc66c0c9a", "value": "12288:Mo+C+2SlLVseHKNTn7tunA+/kStljwXcd7wsqTRauTbCjMKFPBRH88smWErzqY:ijseHKNTn7tunA+/kSTKIcaKCoKFPatI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675433858, "uuid": "783b4a38-0c8b-4f73-83dc-004299fcd75f", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675433858, "uuid": "a2784c6e-5811-42e0-8001-a50ef7edc9c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433858, "uuid": "87248bdf-3c6d-474d-a7f3-e2da48c9fa22", "value": "Statement of account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0135d6da-a3f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (PixStealer)", "timestamp": 1675451249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451249, "uuid": "00ec2189-3392-4a66-977f-433300a15eb0", "comment": "Malware payload (PixStealer)", "value": "94f676d6748bffb81b587c14bc4ce1fe", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PixStealer", "colour": "#4647D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451249, "uuid": "056d1d8c-ff7b-4a7d-8687-3bd055e270be", "comment": "Malware payload (PixStealer)", "value": "28e8170485bbee78e1a54aae6a955e64fe299978cbb908da60e8663c794fd195", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PixStealer", "colour": "#4647D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451249, "uuid": "bb0a02d7-0ec3-41ec-a43f-071f074051ea", "comment": "Malware payload (PixStealer)", "value": "ef0f997a5e7415f689a204339a50d916e9bfea71", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PixStealer", "colour": "#4647D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451249, "uuid": "18afbc22-ce5e-4a51-a37c-90b83e53aaeb", "comment": "Malware payload (PixStealer)", "value": "29cda8f93b273eaaebe480e0fc1838f84f7ca9ff6589ef409ac4116c41a5cd22fa3eb92622bdebeea0ace0160e63131b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PixStealer", "colour": "#4647D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451249, "uuid": "889fe20f-8868-45bb-89a5-686f99aaa7d6", "value": "T1E7B50146E708A02FC9BB513349BB132616974D8A48D3AB573D58721C1DB7AC41FAEFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451249, "uuid": "c4d18f34-1f29-4b03-9fb6-144e31fe9fbb", "value": "49152:5CoJ8Ba91n6VjjQS+qvcXZCykJT2MQSqQ8QnbG9Toifr9HaqB:5CkD91nKjnQkd2MQSqQ8G8oifr9HnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675451249, "uuid": "c9f8cfcf-947e-46ec-85d1-3eba6c09dfd8", "value": 2457294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675451249, "uuid": "be2e3147-a49b-4b72-ac72-c6fff3306def", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451249, "uuid": "ec1f9f05-b77c-4aad-a0a0-145975c2c3e3", "value": "94f676d6748bffb81b587c14bc4ce1fe.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735d5f78-a39f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675414074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414074, "uuid": "db97dc0a-c153-4e4f-a958-3e757a3bf547", "comment": "Malware payload (Formbook)", "value": "abc971a4318aa36cfdb2f1f2fdfddb50", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414074, "uuid": "8de91d6c-928a-4464-a6a2-be57a62d0738", "comment": "Malware payload (Formbook)", "value": "296ea78bce9134af8d207dd915a66ad8345251887cf983ed1ca28e972f4670e5", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414074, "uuid": "e0665ec9-8b35-42bb-bb01-c6cc4424919b", "comment": "Malware payload (Formbook)", "value": "bdfc826a1b32273a6de68b6ae8cf0ec015e9dd85", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414074, "uuid": "a84e5205-d692-4792-9331-ae06141292b4", "comment": "Malware payload (Formbook)", "value": "df5171c4dc54ac85549bbd3cc4816d3b5ad8482ed23b68766bbe73ece2f305c93b266be89026b17812560b56ba6bc2b3", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414074, "uuid": "d7a7f367-9b9d-4be2-bc4f-1cca8bc99fe0", "value": "T14B059DD377B198B3F68B10B51028378D2FE07603BE85A263A7777AD097518FBB698141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414074, "uuid": "dafe95ff-1d13-449a-aa05-4f1e806bbdca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414074, "uuid": "a1c93b12-abe6-4816-a1b5-f2996b132010", "value": "24576:m1dH+AfJ/CcWD7mVKjom96F0xMpqG4yPa:mPHrfJ/d2VEmoWiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675414074, "uuid": "e861b9cc-ab89-449e-be82-61c49ba7ef80", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675414074, "uuid": "5b28c7ed-d46c-4255-8f47-8c3a9f93af0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414074, "uuid": "a3188efa-4516-469e-8ee8-316e31324b2f", "value": "DHL Notice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820f7565-a390-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675407657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407657, "uuid": "131a906d-f553-4658-af98-cf82fef9fd3e", "comment": "Malware payload (GCleaner)", "value": "05662284f6c39864a7014e42a0ef8287", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407657, "uuid": "de0d35bc-5f2b-407c-9be3-3546b97d91fb", "comment": "Malware payload (GCleaner)", "value": "2aa859413eff1032b4bfbcc0c810d28700650b171bad8962590d26d0f25e0b16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407657, "uuid": "6a5e2bad-fb1b-4b0f-9640-46994689934b", "comment": "Malware payload (GCleaner)", "value": "6702462a91e531a66e7d08952fed76003a3df362", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407657, "uuid": "6af8d0c3-9eb8-4eff-92f0-92215f5a9402", "comment": "Malware payload (GCleaner)", "value": "47e04eb0b2be00d074d3171a7286ca85b022245e222bb07b37d2af4c35afcd7fa10d03123d6f95d662d74dc605a894de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407657, "uuid": "381f46ba-8db4-4fc1-a308-8ce3dbafd849", "value": "T1E0953346A1E34136E4139BF0A8B043D0BC37AD601DB4B22636DDF38D0BBE561A95D77A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407657, "uuid": "af23a272-21f9-441b-ae4c-6e52105fb3ab", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407657, "uuid": "711bda20-1662-48a9-a3d2-203346c0914c", "value": "49152:ygK4q/lx2pZ4YvUtOa2YJklcQ41crBp8LCgv2MR:Tg/rMtctOawKV1cdp8v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675407657, "uuid": "0971daab-62d9-40cc-a3ad-05e1d293dc68", "value": 2008545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675407657, "uuid": "5a7e75f6-6b1d-4f08-bea1-c3d7df1e9cbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407657, "uuid": "a71bf872-0a3d-4fbd-95de-3a1b71bf0a94", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd567f00-a391-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675408212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675408212, "uuid": "cff97c82-9bef-46ae-a156-a41731d9e306", "comment": "Malware payload (RedLineStealer)", "value": "f5a6ab6c02686de837417ff14f6edf69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675408212, "uuid": "e856a50c-d6cc-435d-9455-78dea8499334", "comment": "Malware payload (RedLineStealer)", "value": "2b49784b561617cf947f55faf2692dcd97960f92e50dc9a1eeb926d534d56e77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675408212, "uuid": "47261614-2570-4503-8210-84d7cef3df0f", "comment": "Malware payload (RedLineStealer)", "value": "f8093eaf387f66765ecc3a7e9e46334bd3c24a2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675408212, "uuid": "25044db0-67d6-4013-b617-4276ce9297af", "comment": "Malware payload (RedLineStealer)", "value": "603eadc2c62aae45fad17737205b1325984f636dfe231aaf1ed97f68178b23e9ccfd50d7c6fec39e9ea2a05ba471f7f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675408212, "uuid": "dd0826aa-8edd-4da0-97e3-8bb623b56058", "value": "T10194C003B2A1BD58D9318F719F1EE6E47A2FFD508E48377A1218AB1F14701B5CA63729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675408212, "uuid": "4adeb319-c755-4397-b466-a5588d27042a", "value": "64f2017133017378e6738b9a4be235bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675408212, "uuid": "5af81417-09cd-40f1-b7b1-c96fa6c5e6a9", "value": "12288:saFzCDm9aM7B9C/otxgS3R3l6uYo9CJb7d5v:X8m9a+vYotxgStl6uT9qb7d5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675408212, "uuid": "f1cc7fdb-16d2-481e-a2f5-60b9b348ab85", "value": 435200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675408212, "uuid": "384cb3ef-cd6a-43ca-a86b-bb07fa46414f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675408212, "uuid": "c47571cc-abff-4892-b359-8c6ac6a67dc8", "value": "2b49784b561617cf947f55faf2692dcd97960f92e50dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a810820-a395-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675409604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675409604, "uuid": "9dc19f02-70c2-4074-a689-acb513153c14", "comment": "Malware payload (Vidar)", "value": "07cfd4cd7d7245d4fa52a947df50f521", "object_relation": "md5", "Tag": [ { "name": "CCleaner", "colour": "#8825D7", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675409604, "uuid": "01c54bfd-9d1d-467b-86ef-da2028f691aa", "comment": "Malware payload (Vidar)", "value": "2c26d50adf37115b3323245a922135e1525326f438ae4cf4a22de42687cc1df8", "object_relation": "sha256", "Tag": [ { "name": "CCleaner", "colour": "#8825D7", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675409604, "uuid": "048d308e-655f-4dfc-9e87-306443c49fa6", "comment": "Malware payload (Vidar)", "value": "6d9ff82056d69d2a2f32d800205d2c4f4b464896", "object_relation": "sha1", "Tag": [ { "name": "CCleaner", "colour": "#8825D7", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675409604, "uuid": "0a6e0824-1dfc-4d9c-b826-88012bde33e9", "comment": "Malware payload (Vidar)", "value": "d9c91e2fb3a48ca1c3c645eb06befa9f719044c0f9d1a780dbbbeb2b6aa4359b078c61a085ba873d4900b37fc3673666", "object_relation": "sha3-384", "Tag": [ { "name": "CCleaner", "colour": "#8825D7", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675409604, "uuid": "1ce60db6-d9e9-40fd-9488-2548b513ef37", "value": "T16D16E03B74ED1E02EB1817C5DD4799BB4E79F5B70348ECE4B68AD181ECA9448AC13782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675409604, "uuid": "4d38f910-850b-4450-95e5-7f7fa20bc338", "value": "98304:RncIFH0cksA5WU1BFQKiVOLEmjcVfY4P9SzeNRK+rhbJ:R/UmoWUnFQZVOLEmjcVfY4P9SzeNRK+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675409604, "uuid": "f938514c-8dd6-4b0f-ab91-fce9e3e89dd9", "value": 4117274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675409604, "uuid": "fcb6c446-2382-4c67-9ce2-fd77e0ebb5ce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675409604, "uuid": "467cc086-4ff9-413e-a4c7-e6cff5fdb27a", "value": "Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea5849e-a3ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675448587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448587, "uuid": "972451ef-6e31-46c8-b65b-1efb9cc9831b", "comment": "Malware payload (Mirai)", "value": "af106b320a9eaa5757854d0689ff4ceb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448587, "uuid": "b44fc855-16e8-4eeb-a603-d6f090e76663", "comment": "Malware payload (Mirai)", "value": "2c45127e2de3bde8b807a13080c669e400d2991d30a37a460d7c078ebd565037", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448587, "uuid": "de5502a5-e953-4ac6-898b-9809aabcabf3", "comment": "Malware payload (Mirai)", "value": "f664ee7f37a0bcd52fb897d7425c091baf57a97d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448587, "uuid": "4771c09b-d382-4c49-8f97-b39e69d585d1", "comment": "Malware payload (Mirai)", "value": "6831d6546381625c9a61e9cef68529259c0becb664cc92ed339917020f0e79adc221a36c85674d5497ff7798c81ae371", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448587, "uuid": "388e069b-d28a-4e34-9127-acd2dcd984e6", "value": "T184432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448587, "uuid": "ab59e68a-9c6b-4d72-af38-da6b89202589", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwG:RqtmZPuutfbltZFBSJsBcfDSTFI+BEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675448587, "uuid": "0deeaef0-45af-45d2-8244-d1ff981d9bdf", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675448587, "uuid": "ebf5a55a-e174-4519-af47-ef7990ad77a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448587, "uuid": "1e6fad82-8f1e-48e7-a5ee-2d03028d8594", "value": "af106b320a9eaa5757854d0689ff4ceb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3f1be0-a3b6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675423968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423968, "uuid": "60078104-2e57-4326-bb6f-7f6c76b1f339", "comment": "Malware payload (RemcosRAT)", "value": "6e40df8770ce9ff8b80b75f30a2c619d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423968, "uuid": "24e72903-9003-43ba-9b76-67df803f76bd", "comment": "Malware payload (RemcosRAT)", "value": "2c52a17288f1cf1d69abdeb9d8c18b8ac61ff7a7c73a6597e0916cdcbc6ddda9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423968, "uuid": "b3559b37-f9fa-4b93-8971-eedc9a2c3cd3", "comment": "Malware payload (RemcosRAT)", "value": "7af3526582fb9aa9df693a10d8e0d68bf05a7f91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423968, "uuid": "0235e168-3c58-475b-a823-bb3bddb8e9e8", "comment": "Malware payload (RemcosRAT)", "value": "e66c8bb2ef8cb991ca7e6b963e633c34ec5082702f86696ba0a6b2cfa02c8a231a77a1bbf9f7f29ff48d1b7ddfd8792d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423968, "uuid": "fe3528cc-b033-45af-ac6f-e509cdd7a1b7", "value": "T161B4124272C0CE53C0B586B1992AC9739696BC3D5D80CA4733B47B2F39336739A3D686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423968, "uuid": "1010fc1d-1540-442b-a9ea-abc2d355818a", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423968, "uuid": "f5c52e23-bdfd-4064-93f3-8ceb27a8bba6", "value": "12288:SzVlnHPlZaogGwQSspbNCnwYk3V/xrC55QN6W07qaG:2lvG3GwQtJm4/xrC5hqaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675423968, "uuid": "bd766463-a200-4aec-84b6-d49a4bfc6e36", "value": 515440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675423968, "uuid": "f4ba709f-cc0b-48fb-a433-9697ab2a7235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423968, "uuid": "807f5218-3678-460d-a526-88f28e9ad9a9", "value": "2c52a17288f1cf1d69abdeb9d8c18b8ac61ff7a7c73a6597e0916cdcbc6ddda9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe957b1-a3fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675454361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454361, "uuid": "ad43a7bb-9619-48e4-aee8-14d932043c4b", "comment": "Malware payload (PureCrypter)", "value": "fdd2f22f85ac82786f7614f0f9bda182", "object_relation": "md5", "Tag": [ { "name": "41ae5c5fe7e4c5f343be8badbd4d79ae", "colour": "#19D9F6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454361, "uuid": "952e37a7-590c-4991-ab04-e51b1815ff39", "comment": "Malware payload (PureCrypter)", "value": "2ca156b0edea7b919b4c5e87ea24609b57c730b16a4303baf8946ebc02f7edaa", "object_relation": "sha256", "Tag": [ { "name": "41ae5c5fe7e4c5f343be8badbd4d79ae", "colour": "#19D9F6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454361, "uuid": "a1445fb6-e7cc-443f-bd54-5fff0a037106", "comment": "Malware payload (PureCrypter)", "value": "77045ee16f7e86660b33551ae5c555c2837d0270", "object_relation": "sha1", "Tag": [ { "name": "41ae5c5fe7e4c5f343be8badbd4d79ae", "colour": "#19D9F6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454361, "uuid": "6f0249f3-202a-4ddb-a052-77d7cdd81604", "comment": "Malware payload (PureCrypter)", "value": "da20b367c278ed3490568c81bcb7724766562da4fb6bd72d9cab020c5e682b956fd77156defdf9bed6de3fbdbef88547", "object_relation": "sha3-384", "Tag": [ { "name": "41ae5c5fe7e4c5f343be8badbd4d79ae", "colour": "#19D9F6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454361, "uuid": "5a5f00bf-ca3b-45da-ac74-e44251336833", "value": "T1ABC5188672D3CEB0D2045737D49A58240B74C7526313F30B39AA132DBC937E96A696EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454361, "uuid": "0c2bad2e-f256-4383-95a0-6bbb4d360c9d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454361, "uuid": "0f755cdc-0e4f-43ed-9f28-d1786a789305", "value": "49152:35cnHhlTkbp/673C21/ibgEFgGlzQfQiyqCTyDbsUei:35cnHhlTkbp/673C21/+uki2obsUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675454361, "uuid": "72cba970-0fed-40b9-952a-dc0b7d88e3cb", "value": 2597376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675454361, "uuid": "5333b8b9-4cf1-4827-bba3-814be3a53a3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454361, "uuid": "8041d781-7842-4de9-a0cc-93e5c22bc05b", "value": "41ae5c5fe7e4c5f343be8badbd4d79ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d77adf1-a3e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675441901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675441901, "uuid": "710c9334-caa5-45cb-a25c-015dad79b92d", "comment": "Malware payload (RedLineStealer)", "value": "43c5bf2a28882ff7bfef4dcf12568899", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675441901, "uuid": "681a6d43-f4a2-44ba-b6c9-7be51af7e45c", "comment": "Malware payload (RedLineStealer)", "value": "2cb82f52c961d092242e4db39563663c1c375a0b1e5f9ef012081173f6d6a4cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675441901, "uuid": "27c337fb-f829-4ef5-8fb6-27318c7d93af", "comment": "Malware payload (RedLineStealer)", "value": "6b45b78337895f6867e373e777940e1acbb43725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675441901, "uuid": "50476699-9912-41bc-9510-80201f6a2b08", "comment": "Malware payload (RedLineStealer)", "value": "b253522ca60b050bda81fbb3a10bf790224e29dd6cacb84f9e221922be3b801a5bd827054e95bb101e0c6d396edd5777", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675441901, "uuid": "522c48f8-931f-4277-8e75-7fd84d1d365b", "value": "T19A5402B23691C072C96720315C60D765A76EB83256B58647BB681BFE8F303E1D63B31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675441901, "uuid": "a28a01aa-e1f9-45d8-990e-d639ce17c644", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675441901, "uuid": "adadbe85-5e2c-491a-bd34-26a61a89c755", "value": "6144:D5BgFLQIZkHqufdq4iIu6XHSogdT3xRUZ+pFFz+vcS9IaJ:D5BcrkKufsN6XHXghcZ+pFsc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675441901, "uuid": "6b0fb151-986f-4ee5-bee7-affda7f1cddc", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675441901, "uuid": "e387603d-a3fc-45f0-aa42-74b43d0d5078", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675441901, "uuid": "da6d0b3c-5c24-4795-bb68-7a233a5e20dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48275fe2-a3ca-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675432470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432470, "uuid": "29ad3fb2-799a-4738-9f4c-bbcb7220c093", "comment": "Malware payload", "value": "b2317d9db31b23bb4ceab69da305030d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432470, "uuid": "2e87764a-698c-48bf-ac9d-7872797710e9", "comment": "Malware payload", "value": "2d5c9942f08420a5e55cfd84c26931bf645aaf730de6b2f25654d7a166bd9735", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432470, "uuid": "338ab6f7-aa6e-440b-81a7-7f6a44e6175f", "comment": "Malware payload", "value": "f36b658da96f62b34e1558cc2da037a11a031868", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432470, "uuid": "5c81460a-bc30-43cb-86c0-0613c40e41df", "comment": "Malware payload", "value": "719d4dcd89db1736e96961da387e826ee4214a08f2bbe8411aa11b5fde78d0ef6e355ba2566b34f2f44ba9fa071cf5ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432470, "uuid": "4d5bc274-7370-4586-be22-df8b6b6b6676", "value": "T17B063328DAD5D427EC7AB0B65A3A22213017BD304A150F8F9BC2F1963D7C945FE8179E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432470, "uuid": "0f7d9350-2adc-4b9d-8008-adbd81b6887e", "value": "9ce981287240fdb113aed53e842cde51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432470, "uuid": "436f6f79-60ec-49e9-b144-827c6da2347f", "value": "98304:dRaXDP+c9XNhKeIph/GxR5gRrghNEaP22XrZT7:HaXKehKeAs1NEaP37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675432470, "uuid": "a11988c4-c2a9-436d-b081-953204b67e9c", "value": 3935744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675432470, "uuid": "af45227c-e1dc-4807-bd34-dc05abd58880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432470, "uuid": "0d78944c-36bb-403e-baff-903735c311c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb553bc-a375-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675395920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675395920, "uuid": "6d36b65f-a531-43eb-aab7-7fb728a2c46c", "comment": "Malware payload (GCleaner)", "value": "9da0f8e2bff6bb84ef052997e566e596", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675395920, "uuid": "164ca559-c8d0-497a-8d53-5796df7a1368", "comment": "Malware payload (GCleaner)", "value": "2e7af0cf5bfd23215766d5773158e46acb6f0ea918e2ae4fd84a1c60cc94641c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675395920, "uuid": "5b1967fc-bf34-42c2-976c-87632c8901be", "comment": "Malware payload (GCleaner)", "value": "d88036cd161e64d466bec1c84a872464a3f2bf1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675395920, "uuid": "dae44a52-e9a0-49f7-a53c-633dbfcf3dec", "comment": "Malware payload (GCleaner)", "value": "ca2765acf808d9da425aa1111d10e272d858bc5ffcba3155c992d952d8bd1c61789f326bf25bb977b7690825f47f20ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675395920, "uuid": "549d87f1-f35a-433e-9a8f-fadebd130d1b", "value": "T163953317B6E0E536D650C77A0D7A4093DB21BAAFAC39021531EFB3BC4BAB390641935D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675395920, "uuid": "9a7760c3-97e9-4b28-b7b9-455a5f1a0ca7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675395920, "uuid": "2462777b-ad12-4e91-aa2d-692f8af1e193", "value": "49152:sKuKmyxwF7AXB317tC4DUzPcmCv+mRFEoeyAjz+hLCgv2MR:bu9yUMXB317kDcmCv+mEoRRv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675395920, "uuid": "4c20527b-d8dd-40ba-a972-ec7cefed1191", "value": 2060307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675395920, "uuid": "387e2f5a-2696-4158-bfd6-41b1798b6708", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675395920, "uuid": "4f12afd0-05d5-48f6-a4ed-aeecef23958f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6c320b-a390-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675407862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407862, "uuid": "e45bfedd-a7a7-46b5-841b-9d41cf1dbe4d", "comment": "Malware payload", "value": "9a96071e13f5fac40cbbae83a996f053", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407862, "uuid": "3be1961a-be01-499d-81cd-374849007f65", "comment": "Malware payload", "value": "2eb3ddf16258cdb559dc5f6af500567c800dc17cb7e4017d7828e523b3954f21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407862, "uuid": "9fb0d743-bb42-414a-8b71-4e8fa4fcd53b", "comment": "Malware payload", "value": "1cfde9f45aeeb080dee3f4287e9e4437c7181893", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407862, "uuid": "554ec1b5-256d-45b9-9572-602dc44fa007", "comment": "Malware payload", "value": "c43c5b73a7f4bc4e417c71703393716e451b4d8fc1ebb06e5e5d6fbe9406d6b89a40e92898a31c1db8e5ade1bca540c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407862, "uuid": "b005ef70-2d72-4204-bb6f-b6fe1cf85583", "value": "T1D676331172BC4C79E352C136FE65BCEA41F6E3A8CF0844931788491B7F2D9C1A61AE5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407862, "uuid": "da1e86fe-1d13-4c92-81e8-923d4785b8e7", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407862, "uuid": "b66b205d-6dfa-4d58-881b-68e262ce3001", "value": "196608:91OhXW9E+8iNw7F6kw4AneVaargAEwQ7A8rsTRwlGLGq2:3ONWAiNKYk4neVtrgbw3no2GV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675407862, "uuid": "4e23cde3-1234-4258-ac9b-de8e7cf0b012", "value": 7612800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675407862, "uuid": "39dd7966-964e-4e3a-9498-31fa9011f9bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407862, "uuid": "da098831-c02c-46dd-8c21-6fada6b9bd56", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac30a63-a3b4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675423321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423321, "uuid": "136c08d1-7013-45dd-b38e-88203a723b05", "comment": "Malware payload (AgentTesla)", "value": "55a82ffb030b202e586e65d79ee79048", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423321, "uuid": "844187ee-c0ac-40f7-9e34-2ac3625a8b6d", "comment": "Malware payload (AgentTesla)", "value": "2edc303792c48c6db9abd3b66374a28fc5c0d9beb73f67da1834f596688fad96", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423321, "uuid": "853a6768-b27c-4b7f-8e64-5d506496a6a4", "comment": "Malware payload (AgentTesla)", "value": "d9002f98ba0c9b55bdd5dff31a3e94aed703d93b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423321, "uuid": "8205f65d-96db-40e0-a158-cbc2f3b2f962", "comment": "Malware payload (AgentTesla)", "value": "32373cd9cc7ec0acaea4652dd518530b01124973ae69977d9977401053abaa84b3b486ac757a7c557debf682929caae4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423321, "uuid": "64d392e4-93db-4f8b-abcd-1cb7e7e49d92", "value": "T1B1E4120732895B96D268127AD1FF282C07F29FD72733D68ABF4DA38C15123A75E85B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423321, "uuid": "a2026dea-52c2-49d3-ab8d-9729d724f135", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423321, "uuid": "79989cf8-99ba-43d3-a65a-d5c356ea4a18", "value": "12288:wk99cAQhYEEQPpWc8wCWNZLN8OsjLKqMZrZmUXyxcelOBgVw:wkHcRHEQceCcmFjLKBZXAc4Yg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675423321, "uuid": "0f1251f3-2a05-4e98-b051-5a87e38567ec", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675423321, "uuid": "6c2eb9dd-eb89-4410-8be0-2342138d30a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423321, "uuid": "aa3c8bde-5656-4018-b93b-2f43293b811c", "value": "e-dekont-20230127.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20a3dfc-a3d9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Conti)", "timestamp": 1675439144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439144, "uuid": "6a38f3cb-5d97-4b4a-982f-b9225f07bff5", "comment": "Malware payload (Conti)", "value": "b2306ae0dcd36a0d84f954825178d594", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439144, "uuid": "3cb1a3ad-399c-423a-9571-c7260641607e", "comment": "Malware payload (Conti)", "value": "2ee6dfbfb2afd7442c9f2212eb142876698851c3ffb552ee420c0281e35a836e", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439144, "uuid": "48ad8517-7c05-4a89-be2f-d6ddb74ce8bc", "comment": "Malware payload (Conti)", "value": "68f1e3ce4782a242cfcc4fee968b150a3f208bf7", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439144, "uuid": "6f987c6f-b652-4ede-a51d-55a5711280bd", "comment": "Malware payload (Conti)", "value": "df9281abdcd75f11fd86040040b413b565cf9c58f4756a2c798e249a107684e7b75841dccc5262c5c1338639785084d3", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439144, "uuid": "5a963208-d82c-469a-896d-e64aa3aecbd2", "value": "T10F360112BAC2C0BDE052D0F48B6A6B3F9638BD26472165CBE3C05E2D1D31AD29B35757", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439144, "uuid": "c8032470-4b74-4743-9ee1-426deeb09160", "value": "98304:w3StAYjEtOdVEfrmNNTC2zM9yklTIh5DBWM2UPXY+3C:w3St3dRNUj9rlgeMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675439144, "uuid": "f2335ccb-87d6-4e31-b028-28428c10ab86", "value": 5126144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675439144, "uuid": "c3b1ed55-c94c-4283-bb17-bd12b4661309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439144, "uuid": "88d8974a-cf40-4804-9ff0-49f49caba0e9", "value": "2ee6dfbfb2afd7442c9f2212eb142876698851c3ffb552ee420c0281e35a836e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d8ec525-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675453927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453927, "uuid": "5a5ae50f-bf5f-4dd6-8aff-772ab9a88278", "comment": "Malware payload (Mirai)", "value": "8e100d5c04b3d789c7c9213ca29d8f61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453927, "uuid": "d4d86b42-366d-4391-86bd-1dfcd8df9e38", "comment": "Malware payload (Mirai)", "value": "2f5eb608085c7f57bc9ade4e980021ed96518509aa1bda1395d832e38432335d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453927, "uuid": "7725d6df-c2f5-433a-8141-bb5d3ee4cf2a", "comment": "Malware payload (Mirai)", "value": "1ad0253aa8ccf3e721367e0a042608bec501f4d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453927, "uuid": "e8692f18-e1a1-4fa0-8727-825cd8c0972e", "comment": "Malware payload (Mirai)", "value": "183cf680a3f8b1eb85700a303a437964c350d8ec3bbb609b438bd3f39f82f2a114b18e4352cfbcc54ea85f5477a3a926", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453927, "uuid": "8a291769-d3f8-49c7-abbf-03f64fc0a5bf", "value": "T1EA633AC6E123CCF5D90509F53072EAA04FBAD17BB16ED943FB604825B883D456B22ADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453927, "uuid": "9423f245-113f-4096-973d-93dbf8c13108", "value": "1536:F5bLI6HKkarUGJw+zL9xxrfCD2tOCG3mzqI+k:HbE8KkarUGC+VxxrqD/j20k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675453927, "uuid": "2d91eefa-7f5b-42cc-a2d2-02dfa86dbbc2", "value": 67280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675453927, "uuid": "e8634abc-a3a7-49af-9d17-146c44262c15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453927, "uuid": "b4b1e02d-b490-45f0-864f-14d4b4e2d2c4", "value": "8e100d5c04b3d789c7c9213ca29d8f61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112243a3-a3f8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675452135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452135, "uuid": "597d8805-73f7-4f93-8b42-0fa2f8a834fb", "comment": "Malware payload", "value": "a5a4b316cc349db892a27c9b5429dd4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452135, "uuid": "c724c13c-ef70-416f-b49a-26f0c5c24696", "comment": "Malware payload", "value": "3065df9608a4d29f1cc7f4934ecd7445d83f6e5ecde5b7f8ecca656a7c384657", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452135, "uuid": "63a823af-2662-4779-8760-19605ec77855", "comment": "Malware payload", "value": "18e025e751a08d3af69bf8fbe26939bfa96c1668", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452135, "uuid": "0f4549d5-9bfb-47a6-958e-471dd9f54c2b", "comment": "Malware payload", "value": "f1609da989f9add8a9ce35d639ee2bf2a46f2c5f5f151e7d15640f71dfd491e116fc38709092b025432226eefb83a331", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452135, "uuid": "444a174f-3e7f-4d74-af25-644ca945b026", "value": "T186D2A31767BC8732F5762B765CA2C2800F75AE276854FA5F28C570BD1DB27008A12B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452135, "uuid": "77c47b36-f677-4212-a00b-029aaca6d4cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452135, "uuid": "fafdc599-a5df-45b0-a13a-1c9336f90046", "value": "384:IUsQruz2H58mIajRgJTQo5pkvwKwq6u/FB:IGr42Z8c9vn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452135, "uuid": "d4a31d05-9502-4e1e-aaf8-e3326bbedca5", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452135, "uuid": "c9896d15-4ca1-41b7-ba6c-98525de2d358", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452135, "uuid": "5e4cb697-79ce-4608-b26c-2e2a8f311b72", "value": "a5a4b316cc349db892a27c9b5429dd4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d4a740-a3d7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675438018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438018, "uuid": "cf663741-c722-41ed-a2a0-b5bb5dfb6d5e", "comment": "Malware payload (RedLineStealer)", "value": "39ccc851f6a2ca6f38e80c1fce47fe87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438018, "uuid": "807744af-56b2-45a7-8101-c3b2eb9a436d", "comment": "Malware payload (RedLineStealer)", "value": "30c06bafae44cd57f824a3c46aa9e0422e03d0c768b5c3b677b1fffb3eb39c57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438018, "uuid": "df8a8e1f-6952-45ba-abc4-2d7327a2402f", "comment": "Malware payload (RedLineStealer)", "value": "fbf3debd0359b2f0d8bae9b84e815d59d2197211", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438018, "uuid": "cd872785-e0d9-4855-bbd3-2a75af577b97", "comment": "Malware payload (RedLineStealer)", "value": "b52aea447494a8b56349a42f88f5e029d10b043d93584c9cf9c429d8e071de4d7e3c7d299ddb67fff603a971892f5ace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438018, "uuid": "f4d3e7f6-090e-4fba-8282-aed5ec0ce12d", "value": "T12314D03235C0CC72C6AB50304864EAA57BBEB5315675DA177B680BAE5F303D066FA34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438018, "uuid": "5ce9cf72-7987-4f0b-8f04-5f9df6c34f98", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438018, "uuid": "42b2ab91-d35c-419d-a23c-481bc82f3eea", "value": "3072:/e0mHLrrwGmLGS02G1pWd+5e7fYO+hQRLdnVPcknFH+7JMTl4hPeI:/eB7mLZ02+pe7D+hcLdKkF+7JEeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675438018, "uuid": "aa8728fe-efcb-491a-a63a-5045819b0c72", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675438018, "uuid": "43961ae5-d026-4110-9086-368202e79049", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438018, "uuid": "48e194b0-dbb8-4b46-ac82-90a352fd1747", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f481e5-a3d3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675436361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675436361, "uuid": "1176e481-8fb8-4c13-bd1a-2a60de4841a1", "comment": "Malware payload", "value": "3f5586e9b5d95cbc24085103cff3add3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675436361, "uuid": "ebdaa0ba-d5c4-4875-92ef-cd72ea80c795", "comment": "Malware payload", "value": "31a651c46e9c6ec751decc58d3c74d2b13582dac007c505e018c7ae659434a92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675436361, "uuid": "97a3effa-4781-46fc-aec0-bba928d4c106", "comment": "Malware payload", "value": "f84a262fdf0543a991a51b569ba4018e266a108b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675436361, "uuid": "f612684b-b9f7-4fa6-afa6-629c54e31edd", "comment": "Malware payload", "value": "f025884fc096babb2b501bc6b83a5e380b6942f7c7dc629d7bd0c27cf729921cfcbbaad5c7e673c74847025b6aa6a492", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675436361, "uuid": "84fe6f55-ce78-4f3c-89c1-e619a56b8099", "value": "T12F057CDE12F5055FD21906B4D895AFD01960ECB87A92C71A7D40FCCEAE323E5A4622F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675436361, "uuid": "e828ace3-0cee-4ac0-918d-0d89935bc7b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675436361, "uuid": "88ee4657-aa9d-4206-a0cd-eab261ca172c", "value": "12288:dQjnbjPAzz2IZX0mtc113pIoBw8TWiBsuVdMySQn/lMfy51g42sehZAO7Xlr:mjP4Py1XI+bTWJciCn/lMMgGehZAO7XB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675436361, "uuid": "d396918d-d40f-4c10-86c6-16328389a60e", "value": 818698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675436361, "uuid": "1d3a6f92-e6b5-40b7-a846-28004e745197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675436361, "uuid": "cbad294a-f263-496a-988d-4b3df608a497", "value": "bill.rar.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac2a264-a383-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675401980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401980, "uuid": "94e68ce6-ea94-45f4-846b-a691c0e06028", "comment": "Malware payload (Smoke Loader)", "value": "1977e2e9d5ab18bb2fc05caf299e4ec3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401980, "uuid": "c0946204-a6ce-490c-898f-980cecd4b5bb", "comment": "Malware payload (Smoke Loader)", "value": "323d285f670c92118fa148f0511a13c2d3fb12806a3c50e050946590ebc19881", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401980, "uuid": "34ef64ed-baff-4f6f-abb4-915ef00486b1", "comment": "Malware payload (Smoke Loader)", "value": "f1302a2023bdab85f9df706b2115ca91f247e8b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401980, "uuid": "4129e825-07a1-42ec-8788-f036ab5c0a2b", "comment": "Malware payload (Smoke Loader)", "value": "aece7e2e7b0b84bab39837fc7f3c49db4509e2ce75af91fd8e1bab80bb4bfe61ae8d0b9ec6a39ca20e0bd3eea06a5562", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401980, "uuid": "2ae6a2f5-8250-4953-8050-3910f8e89113", "value": "T172647D02E2D2FC51DA21C7729E1EDBF47A1DB9518E286FA6121C7F7F1972172C5A3220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401980, "uuid": "effe4d10-d33d-4334-8c79-8bde4a9d50ee", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401980, "uuid": "81996230-1423-4bcf-8821-0ff0488e0cb7", "value": "6144:yqPPLjOLdBwcz8QnN+K9mblwKwpxsbRjV6ptCbNKN:yqPPfOQQ7sblesbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675401980, "uuid": "84171711-f4dd-4ae0-b286-5e2d73421fd1", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675401980, "uuid": "34629512-2ea8-4d79-9a28-cbb2cb11225f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401980, "uuid": "05593e5a-3e67-4224-ace5-e8ad6320e601", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6abed3dc-a3c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675428663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428663, "uuid": "c8a6ca24-27e0-45e2-865c-eaf1ca2f15c8", "comment": "Malware payload (Smoke Loader)", "value": "1fdcefc88cc35b4ff7199ccc87bf870e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428663, "uuid": "cc915f18-fdc8-476d-aabf-6710b3c05d36", "comment": "Malware payload (Smoke Loader)", "value": "32cb8276e6a47e5ab898033755df317af903c775ad2ee52b393a306f9e01b77c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428663, "uuid": "efe62c75-80ca-480a-b3d6-2dd8d9825cad", "comment": "Malware payload (Smoke Loader)", "value": "ae709515d1f927583c15c9d19e8f7f75a292c070", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428663, "uuid": "cec8b12d-e968-4948-862e-e3b80296ba29", "comment": "Malware payload (Smoke Loader)", "value": "461b0227968c933ba549b5b267bff35816c7557c5b354ba04989aa0a46176434c0ba7047295fcab29aae0e906861a457", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428663, "uuid": "6b676953-d63d-4b1f-b29d-ccf4a4335b08", "value": "T10414BF3235C0C0B2C66B11307C7CEAA57B7E68315779895BBBA907AE5F306D06736349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428663, "uuid": "29db6322-1885-4cad-8a9a-53c720d002ab", "value": "6b1aa8e68ec0f35426270b76446d282c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428663, "uuid": "eecc9ce5-636b-4cb3-b56d-fbf217f17705", "value": "3072:WabWMwTZfLsbzmHkOW5U05VbgBE1tSSBEpc7r5hiOv2eL72skMa:WaYfLqzmEOcg21tSr0hiOXX2skM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675428663, "uuid": "6b8a4e7d-de4f-48ca-b7ec-c6a96949b527", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675428663, "uuid": "464e7d6e-31e8-4a95-99e5-9e7466e53fcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428663, "uuid": "6c7597d5-015f-46a8-b19a-cedfc97791d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085744a4-a38a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1675404875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675404875, "uuid": "a8de5810-a264-45c3-84f3-3dac45ba53b4", "comment": "Malware payload (Guildma)", "value": "79a4584328fc491d022d09984e07106e", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675404875, "uuid": "916d3cc1-2ed0-4fd1-8f59-b0bb9e23da3c", "comment": "Malware payload (Guildma)", "value": "3324e7dc50690a9f030e982680c3f84c9a4ecc4b4ae48977b9ad9b9a9a1e6992", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675404875, "uuid": "3c3f1b97-3578-4696-aee1-8649c8b08c36", "comment": "Malware payload (Guildma)", "value": "9977618fd15082d4b0b611eb4f6287e0ed1e5817", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675404875, "uuid": "2f798eea-ff69-4c5a-a344-994e4b89942b", "comment": "Malware payload (Guildma)", "value": "7ed0e57a9078df2b53ec5045d6176d2fb4f7b3d3bcf8f7a81a9f9605df4d9c76a53aaa32dba8f6bd32c16966d096ac0b", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675404875, "uuid": "310223cf-2cf9-4b68-aca2-a4a77666aabc", "value": "T1F132BCC5E2CF8E86FBF42B1964BD4146EA1704F1B2547940B9B011B729AB15733E8EEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675404875, "uuid": "371378f7-e71f-49c9-b787-8f3a080b939c", "value": "192:IlWtZvZJRjiUtTExViqlj0v8DJQsp1H7vwNY3Ij+w:IcqUAiqlj0vwL1bvwNY3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675404875, "uuid": "f172cf2f-c30f-4834-aaa7-33a3fb29ff11", "value": 11078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675404875, "uuid": "0e9da128-6e81-4dcb-8b43-1b1cbfbe9b06", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675404875, "uuid": "91ae9e16-fba0-4b42-8f0b-0304c1554734", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f99d02a-a37f-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1675400190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675400190, "uuid": "c95c4c2d-d320-40c1-aa08-5a92678b0301", "comment": "Malware payload (ManusCrypt)", "value": "a854af7b7731cc670a3300abdf4c1d7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675400190, "uuid": "1f274bcb-d141-40a0-890a-6956fdd9becb", "comment": "Malware payload (ManusCrypt)", "value": "3385554f10c31dea3869818e5f99b80d89459886237c92b48996dc6ccab636c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675400190, "uuid": "0335f12b-d7f3-4c14-b130-1725ff560022", "comment": "Malware payload (ManusCrypt)", "value": "56834e988875d534b085a7ae97b3357f130606ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675400190, "uuid": "17baf966-4644-4bed-a33d-50b99003df31", "comment": "Malware payload (ManusCrypt)", "value": "adb75739dc5cdd58401ad54662a3d8e712442f982976cd3e522d297e4ea31cc61b129fad326c2d02ff96ef35a0ddc58c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675400190, "uuid": "7bd84557-65a5-4c05-8e7d-8e4cacf8b6c4", "value": "T13C0623D8639F0865E1FE2C381843D9179D2D2BEE0FA9EF002976736E40A69C4C4D5D6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675400190, "uuid": "8cfc562a-e0c6-4c7b-894e-e678ff6093dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675400190, "uuid": "ed142c80-0563-4069-88ef-d87f7d4d00a6", "value": "98304:7Wg1Fuwcp8QT/tMDbYjk8MPpPtsDYa6fheRV2LwUx:7LqT/MbUkbPtsDEfheRELT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675400190, "uuid": "2abfc67b-5336-4d72-9bfd-15539f81946e", "value": 3745792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675400190, "uuid": "6ef4b4ba-5de1-47e0-88b1-0dc6f3cad616", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675400190, "uuid": "2435391e-708f-470d-8a1f-e8072dc883af", "value": "a854af7b7731cc670a3300abdf4c1d7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc5569b-a3c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675431080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431080, "uuid": "1a93bef0-b2e5-4881-ba0c-342f782e4fb4", "comment": "Malware payload (GCleaner)", "value": "c8a4842ce722b45d49a9bd7c7bf7f43b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431080, "uuid": "b5f44bef-7acb-49b0-ba76-11e5b053efbe", "comment": "Malware payload (GCleaner)", "value": "34b3b735bdc826d9de1787249988fc62cdce0567737eacbc228bae6b11e000f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431080, "uuid": "30f79b3c-cc01-4f25-a9c8-39357f19c954", "comment": "Malware payload (GCleaner)", "value": "a0718066f2d16964b405f5bcb2ff9d4b24c3925e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431080, "uuid": "8f37e318-e7d2-4313-9277-d11a94650d79", "comment": "Malware payload (GCleaner)", "value": "ee2e283f14a783ce80c25739a80b968edd55c3992cdf544119390ff0533ba7925d6e6567c201943b1c50339fd41d0c57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431080, "uuid": "88ffba67-6dd7-48ea-b164-df749736995d", "value": "T168A53347A1938433C137D93A7E1968A09E377A6A14356751796C7C8F0E333D1AC2FA3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431080, "uuid": "33791a25-6768-4b17-bdd6-31789802ffb3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431080, "uuid": "d125a220-d1ac-4295-93ee-5b047d4202cf", "value": "49152:ygZ9ntXmyCGeFwEhRv+AJYU3EWly1vfztAr0JQqMKiN1LCgv2MR:T/noVZ+XU3nORAr0WqMVpv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675431080, "uuid": "f5bb3714-ce01-4223-a5ed-92d0e00095ba", "value": 2074850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675431080, "uuid": "a8b40f1c-da2d-403d-9ea2-b3e5676d0461", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431080, "uuid": "2047e1fa-4f1b-4b8c-9bfe-0921c4d3e9ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5693c85e-a412-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675463418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675463418, "uuid": "8b82e022-b0cd-4580-ae5a-44cfecb75dc8", "comment": "Malware payload", "value": "ea1c5f8ca2df1309e41290e5e2e334c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675463418, "uuid": "cc793507-fc52-4b05-ae91-9c52f0814186", "comment": "Malware payload", "value": "34f15be16d907b9d6ea12e988c7dd340f176e97c3ad991617000506444727e7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675463418, "uuid": "9c894d55-055d-4797-aa15-b5fa5c088cfe", "comment": "Malware payload", "value": "ce53fef3de6b7c1ef5b0fc197aaccb501e21385c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675463418, "uuid": "8a46bb6f-d80d-40e8-9784-413b5ca41487", "comment": "Malware payload", "value": "dc2efa80292667c387f1c78bf6eb4944130dd488647d4d4e82b2b4e0fd170c9ea6443ba0edc91e343f02a164b58be201", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675463418, "uuid": "dd86ad92-484d-451c-94fc-e305d84f0106", "value": "T16155334751A69AF4C3E3FEF24AB86F1C53AF00756B28AC84675EEF0F810D21B5632159", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675463418, "uuid": "02bad64d-f1a0-4a30-9017-169272fef47e", "value": "24576:iI7wdCqxIEt9+oNtwDM0GAc/Nza0CUZPSrrAIsU3gJM8YDWOBDCcfXnge6P8Yw:D7wdfIY9+onw4bxa0AAO3Z8YiOBDnXg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675463418, "uuid": "bb2f7a54-c506-4cb8-bbd5-85e32700b640", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675463418, "uuid": "540eff0f-44ed-4cbf-a1d2-4759d59d7fb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675463418, "uuid": "0db7a2a7-1ccf-4fbb-80af-a85a112790d0", "value": "SecuriteInfo.com.PUA.Obsidium.26722.28173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5dbbe6-a3cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675433393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433393, "uuid": "aa52b079-d77f-447b-b1b6-b3ba57d2c7ea", "comment": "Malware payload (Mirai)", "value": "a5861885a88d55f56f2c3e38e6d064dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433393, "uuid": "2ece9d4a-0ff7-4a28-a7ac-78c605fbab41", "comment": "Malware payload (Mirai)", "value": "36114d04cae138e3c5194c849fa3985e57487c7287f9db5879d3b54cfdcfa399", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433393, "uuid": "0cd5708c-95cf-4c2e-b017-a8183ec083f4", "comment": "Malware payload (Mirai)", "value": "9407929118a3741b4c571bfa35cbaec9547005ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433393, "uuid": "92c03079-2142-4de5-846c-01569f2b1f75", "comment": "Malware payload (Mirai)", "value": "894b5c53b1fb1e22b6106f8baf96dbe87e29f4222bd8db683d6005d242fe68ce72bf7cb1ee163f35958eceb25407a3e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433393, "uuid": "85f68f2f-c1c9-48e8-9b4c-d7b34dc1387d", "value": "T10EC3842E7E12BFBEE668863107F35F70879521D227919382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433393, "uuid": "f5720670-742b-48fc-8bb5-b214bf664e49", "value": "1536:47je1TwGq+f+AM2rK/jeve9eLe8B2rK/4eBmq0GAzQj1l72HBenEJaAW/GrmW+IR:3ClkB0MZQHvJaAW/GrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675433393, "uuid": "3156b48c-2bf2-4155-ab25-f83fbb484e94", "value": 125959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675433393, "uuid": "466e69fd-f790-4221-957f-9d4adc6238b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433393, "uuid": "7f10bd77-077e-4ee7-a314-c710a6c3ca88", "value": "a5861885a88d55f56f2c3e38e6d064dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c4dfd6-a364-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675388792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675388792, "uuid": "88cd613b-a89b-4393-a9cc-b70843871666", "comment": "Malware payload (GCleaner)", "value": "17321d69114822cb94393d4aea56b5f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675388792, "uuid": "ae4271c9-3346-4b33-a633-6c43493310bc", "comment": "Malware payload (GCleaner)", "value": "3630f3955da19f6c636b2c3472c5698ee579ae420e0ca2d21282ec7f8b68de93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675388792, "uuid": "1b8cab63-7100-48a7-b83d-c4bf26941184", "comment": "Malware payload (GCleaner)", "value": "5d1b14382767ae01a093efe15b991c95e9ee3047", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675388792, "uuid": "c6c3c670-591d-47fa-92eb-dd804867e4ca", "comment": "Malware payload (GCleaner)", "value": "ff376d64cd4f0ce0d888db2befaf36fa3d42552725fa06b861e1b7707902f81b8c36bc4c19101071eb718ed01e069c6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675388792, "uuid": "caeecb41-2440-45e3-8484-97283579f099", "value": "T138953302C25688FAE74BC6313D291157F973FD90B8386366741DA14F1F272E1B987BA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675388792, "uuid": "d5842184-4435-40e0-91fe-2d160df14182", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675388792, "uuid": "19334248-1d07-48ba-bc42-fb599ed94e5e", "value": "49152:bgcM9xiLeJli23fUGbf3g8X1MICdI4DibkWLCgv2MR:ccs8i3fUC/1KdI4GkGv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675388792, "uuid": "b344bddb-b1c3-48d5-8cf1-a2490427f6cc", "value": 2061458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675388792, "uuid": "0aef8403-4bfd-4182-8f7d-fb4ade2026e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675388792, "uuid": "b90abf5e-069c-4dce-9cce-32484772ca82", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b412e0-a3f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675449513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675449513, "uuid": "42f41a9f-480e-46b6-a23a-c61fbb9786c7", "comment": "Malware payload (CoinMiner)", "value": "58d3792b52c2b78d290626283744bbe0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675449513, "uuid": "df65f94d-1540-4cc5-8005-61483aff0218", "comment": "Malware payload (CoinMiner)", "value": "369a8f58f280081f6f85707aef7404638afae964a748e7dc90a082410a5b6cd4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675449513, "uuid": "2496d5d3-4375-4428-8820-a57692d8740f", "comment": "Malware payload (CoinMiner)", "value": "5b633c6fe5c38c1332fe87aa6d60c8201be4b6ed", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675449513, "uuid": "ffa2c234-d276-4e1c-98db-7401884035f8", "comment": "Malware payload (CoinMiner)", "value": "f3cc5002040647c614d54d3f29b6868c5b49f2c3ac2a03f4d282734aafa49c82ef7f049ec9254dd92fd19d0cec41d1c4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675449513, "uuid": "221d4358-880f-459d-bc62-1a95c07eaaf4", "value": "T10EE51D2D7B79EC34E406A5BBCBA285A2D506DC31D923CA1B3509FF98B436F5052F134A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675449513, "uuid": "64c42176-2828-467c-af48-2615f6aff908", "value": "d8fd5c28a1255e9518db9e387b2e8a9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675449513, "uuid": "7364d034-aa4d-4014-862d-76c7765c3011", "value": "12288:rDeQztfZ5LYVJESNQBjaRRTjOWGdelFJOZiZ4Q85LfrCEgf4w5vVsRTTA:WQn5MVJQjar3TYeleY4PZfWD55vWRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675449513, "uuid": "38ecaa8c-884b-40ac-a2ee-1434a7d8c2f8", "value": 3047936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675449513, "uuid": "a56a9830-c800-4514-be4e-f5086f2e70f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675449513, "uuid": "1e8aa40a-dee9-4c3d-9908-caec7992cbc7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5c3640-a3e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675445416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675445416, "uuid": "b2a1f0f1-df73-490f-8792-b748f72acd77", "comment": "Malware payload (GCleaner)", "value": "bbdd774fd919804e0203d59d22b57ec1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675445416, "uuid": "4a3e53d3-e8c4-4414-bc42-047eb49b31f1", "comment": "Malware payload (GCleaner)", "value": "3826fa2b7c6845ad5141964e0a479ac63b59da9c317064b72b57809b83d5942c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675445416, "uuid": "e47e1b00-2893-42c1-8320-b0b07c803eb3", "comment": "Malware payload (GCleaner)", "value": "d229c2a6230afaa6d8f34a710456f18c6f3e886a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675445416, "uuid": "6b738ba2-7f68-4cc7-a9b7-6bf217833c7b", "comment": "Malware payload (GCleaner)", "value": "bbfa8a58b084142d4e09a8f9da9693d9b81ebeee6bab49461ec4cc049e9fc1230fe4e20197cc38d4b324aea3441a6f7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675445416, "uuid": "e8825f92-94f7-4462-9e3b-b8b0fa963b82", "value": "T10895330A91B6C1B2C835CFBC0CA465A25EB34957B135A32B745EBD7A3B375C3284B913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675445416, "uuid": "3be5b842-2ec1-4269-8e5a-7ceefac7583d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675445416, "uuid": "a597ece7-15c7-4906-a56b-6f828c594a8a", "value": "49152:yg9WT2TdAEeUxJLiYIS3TmJNOdGOhekcLCgv2MR:T9brDdYNOY+cv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675445416, "uuid": "dc90d22b-3f2c-4296-9240-bf8d1db4ef3d", "value": 2052582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675445416, "uuid": "75ab61ef-b256-4395-9953-ab90ce9084cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675445416, "uuid": "b34c016d-51b4-4147-b16d-379af5a3adaf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec856e5-a3ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675420133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420133, "uuid": "16c6f3a8-5fec-4b6a-8475-46ae06051948", "comment": "Malware payload (AgentTesla)", "value": "d32276128d0afbd1a0b9f0c240b739fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420133, "uuid": "8ad9da5b-c43c-4329-aa39-b9963a1b5786", "comment": "Malware payload (AgentTesla)", "value": "38d3008f4ff06a838960f3ac4ae0df1d94743a5c33e58818f62bbd5bb3cdfde1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420133, "uuid": "a22b48bc-82fb-401b-8519-09d247e4560c", "comment": "Malware payload (AgentTesla)", "value": "50fc3549db6dfd01ba8b333a6e097a2f1f433e43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420133, "uuid": "fa75bc88-5856-4317-b8b9-44566f798364", "comment": "Malware payload (AgentTesla)", "value": "7da78e96ca3f74d170c293ab0362624fbc02677b8484275b04b28e5241cc8f3336e7e5c7f7de857d04177db195dbc4fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420133, "uuid": "065cfcc3-44c5-450c-b5e2-81627c66eb2b", "value": "T17462CFFBF1BC60048ADC87F3ABB57A5E935E11C073EB69B4D94BB83606900A41867724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420133, "uuid": "de91f3cd-9b91-4f34-a124-5fe257c58868", "value": "384:UEo2jZRhoaLFuuK/DGLSBuSZFQglYLCwnXqMA+9vE:Bo2j9xuvA8rxwXL/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675420133, "uuid": "7e14c107-7851-45ed-8c83-58cf20dead49", "value": 15127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675420133, "uuid": "9fe621e0-937c-4c97-a020-40b356ce9f7e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420133, "uuid": "dbb9948e-5a86-4ec8-b026-4fa989ba357b", "value": "BANK DETALS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008787d9-a3de-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675440940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675440940, "uuid": "bd2c9ae5-0070-4e84-a933-ce092050790b", "comment": "Malware payload (GCleaner)", "value": "ec01bc75444a9431f54a0a9328ef621c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675440940, "uuid": "a8840daa-3d7a-44fb-bff0-9dbd75304494", "comment": "Malware payload (GCleaner)", "value": "392566c9021fe2675b49eec582e1870f34bf28bcaead97efe32cb33bb61cf08b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675440940, "uuid": "1fe6ab4f-30d0-470c-9be3-d214913f3e19", "comment": "Malware payload (GCleaner)", "value": "e459a0432577a5471d74e266a056a91f5359c8c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675440940, "uuid": "d47aec03-c7ba-4c8a-ac03-a2c3aea8db22", "comment": "Malware payload (GCleaner)", "value": "433fe45b1b0c559da92e9d64e7dfd744e789a62dbf35269239cf6d92856075baebf10d0e5e8018e5c896d9130e25dacb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675440940, "uuid": "0e666d65-06e3-4108-ba86-a705b7b826b9", "value": "T1AB953337FB674033E3231AF26D096602AF777F3860B85291B469731E8F5B1826CA9355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675440940, "uuid": "5d45602c-94cb-4712-a36a-2842fb38f630", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675440940, "uuid": "f6ec72c5-39e2-464d-b867-de2315dbfcad", "value": "49152:yghnfXRX+DD9cuExjLBfFo+/UKaHUgIsfXm+aLCgv2MR:TlkDdyjLBdoYx0U6ulv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675440940, "uuid": "eed327b5-5afe-437d-9bc9-d476b7b1a3d2", "value": 2003653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675440940, "uuid": "a320943f-728c-4d21-ba21-d880e1f52bea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675440940, "uuid": "fd6f7c0b-1509-468e-aa7c-2b67f376b4bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b3534b-a40c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675460724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675460724, "uuid": "b1a9087a-faa6-4704-977a-6736a1ab7641", "comment": "Malware payload (RedLineStealer)", "value": "4f460f61a71327c6b22bf71394e3beb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675460724, "uuid": "639f271c-ee3e-46f2-9bd5-79f1282550e2", "comment": "Malware payload (RedLineStealer)", "value": "39c748040f01c934c73c23f4612cb33a0846219d8dd7ba3e0adbbc9d047027e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675460724, "uuid": "4f64dd31-7496-447a-af0e-fd502f3732ab", "comment": "Malware payload (RedLineStealer)", "value": "9a0e334e45421834734c4a226941cf410f5b7340", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675460724, "uuid": "769ed745-79d2-4e0d-bacd-1b195614603f", "comment": "Malware payload (RedLineStealer)", "value": "6aa95082519755e2325bae0412afd539a24f6c71250eceeaba59b7fabfd86f8a1b6a220a4e6068d360e41fd451da2b63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675460724, "uuid": "c83844df-f022-402a-a5a2-4635929b1110", "value": "T15C36232312A42087C5E4D0398837BDE8B3F69E7B4681A876F4B1F9C11A759F096C3E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675460724, "uuid": "baced5e5-5dbd-4812-9b6e-3fa03c1066b2", "value": "b0a438491df559e2ae875aca71787ff8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675460724, "uuid": "9843be22-f21b-4ee7-b0e1-f6b2a9531261", "value": "98304:r2hN+VqOJSrzvSgur5lLSlLduBp9OGmzogX3tefN+tJGrLPSYU9U42TjczbqTI:6hoVqO4nm59iun9z2te0qHaYU9U46jeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675460724, "uuid": "d11229ba-aae5-4d3f-a8fb-3664e2ca5d5e", "value": 5229056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675460724, "uuid": "8cf7a98f-d087-4f31-a429-9b2b07e074c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675460724, "uuid": "fac9af1b-c2c8-4b4a-9b73-22bd8993182d", "value": "39C748040F01C934C73C23F4612CB33A0846219D8DD7B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50451f41-a3ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675419599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419599, "uuid": "99835079-a824-4524-b579-8c1e47a79ff7", "comment": "Malware payload (AgentTesla)", "value": "e4c7b38c4df791fe186be2f87b27a9ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419599, "uuid": "2cd5cf66-464b-42b9-a4d6-fc59bc3c431a", "comment": "Malware payload (AgentTesla)", "value": "39c9937c4ca938731f9f619d8f4dd0964834dac013f3b9c2478b6b8517c6a78b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419599, "uuid": "fb377764-e560-4e01-ac0e-f333c919d035", "comment": "Malware payload (AgentTesla)", "value": "84d990175620498333d94cb0b58077a6d44769a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419599, "uuid": "714a00ff-bd34-42c8-81e0-0d69f2228c53", "comment": "Malware payload (AgentTesla)", "value": "d6b9ab6c581e381cc9da798182bf73d2ccdf6f58ed08f2ee525617e8d20d70ad85c41e8fb75edf2cfcfa951db55519c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419599, "uuid": "0e68d2e1-1686-42e3-a70e-2f1960e8fc2c", "value": "T10A52D050212455BBA95AFE164B354D3B513DBCB50C9B03DEB1236529EECCC0B439CEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419599, "uuid": "e3325c84-bf1b-4da2-bb5c-ba23b021f628", "value": "384:ITX+nJN2sJxxzIuSL+cUvVkDTIpo7LFiPU/:ITWRJH7SyDyDT2qV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675419599, "uuid": "84e6569c-c50d-4899-87a4-a8295c5e96a7", "value": 14112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675419599, "uuid": "7f1bba4b-373d-48fc-b753-bb0a2d4e17cf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419599, "uuid": "fd5df4e1-63e4-4ecd-915a-e76c458dcbba", "value": "DOC.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5562269e-a3ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675419608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419608, "uuid": "091de47e-43f4-4801-84b2-b32959dd05f9", "comment": "Malware payload (AgentTesla)", "value": "78f270cbab89f32c355f1b9354e74a17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419608, "uuid": "5a5cf569-f24f-48d1-a7ff-b6e22c0730be", "comment": "Malware payload (AgentTesla)", "value": "3a0a9c9d17e7d5ab347cf05ec50ea6a758b966859e218ed36a95eefc9a5eff2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419608, "uuid": "878788c6-dca2-4397-9ee3-c9cf03328120", "comment": "Malware payload (AgentTesla)", "value": "ff6eb90ea94ce75c0cfdf1c5c967c41e1f467093", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419608, "uuid": "5f9bddb9-1fc9-404e-85f4-aee2528f7d41", "comment": "Malware payload (AgentTesla)", "value": "6b5b8f854e7d34248781378bc12d03ae9a0d7393ace4d8d7a31c1b5a3947e9073238a0689de76a40095cd4a4056e7c28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419608, "uuid": "08b3d781-7940-4103-b216-40ece9fadfd6", "value": "T15C03EA9821AC8B33FEAE1BFE146965DB97F665376010FF892DCDA1D46195B404300B8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419608, "uuid": "2c86dbb7-d9cd-48b3-9cd8-45d0b4690c38", "value": "768:tevPNqfe1TxGW+t12vXOguVQt+hEqt5RYVMb824v:ONqm1T4W+t1eXVsw+CqtfYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675419608, "uuid": "15db9e62-bd38-4e45-9da3-34e1abf49d6f", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675419608, "uuid": "cbdd60d2-40bb-4535-9533-0ff1424d9941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419608, "uuid": "f8644859-0916-474a-b57f-4347d0c45a2f", "value": "DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1e0f6f-a410-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675462542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675462542, "uuid": "a9944cc5-a3f2-46ca-8761-3ec536d1359a", "comment": "Malware payload (NanoCore)", "value": "565044691fedb39980cb814dc26f9ebd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675462542, "uuid": "d33c0096-98d6-4a8a-abde-61165eb8dcea", "comment": "Malware payload (NanoCore)", "value": "3a1c1eabfbe52d5a822e95462e730775ea9eef9d8d653f3a1ff6904378ad3e0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675462542, "uuid": "d05a8c65-37a7-41e2-aa62-16a6bde20f25", "comment": "Malware payload (NanoCore)", "value": "d92f48359c385fd03a419e583495ead52428654e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675462542, "uuid": "1ee4f21b-a358-4f9c-8fdf-fa5ed0f7bf2e", "comment": "Malware payload (NanoCore)", "value": "cc257425dac9fc49ac19fc72fb14a2396fac05e1a5d7b4ad56a69e551af61021f6ed4d5c6b8cb77ed7c04188b5d77e03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675462542, "uuid": "f6eb4cb1-d4ca-481b-aa3d-490f4b710ef0", "value": "T173F4E0537A00B2E5D8B044397C1AC1F34B99AE3999543E573AD4BF3F38B5123960A73A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675462542, "uuid": "e601c7ad-f83c-4668-9866-10a6e9e31423", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675462542, "uuid": "e922a83a-fbd2-43c2-8804-885e3b837296", "value": "6144:8Ya6SW0O0WqiBiGei7FTjUosytWnSS1SqY7WnoVhcOdN3eJznS/FK0Y4Zh/9VR9A:8Y6WqyTT5WnoLX9dK0XZh1RYCChaWKDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675462542, "uuid": "b1188cf7-3bc6-4392-b398-e31f4dac29c9", "value": 775369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675462542, "uuid": "b6c5b829-fe74-4f5b-a6d5-16318506e3b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675462542, "uuid": "632210ed-727f-4994-a3df-8935f4d256dc", "value": "565044691fedb39980cb814dc26f9ebd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1714d1ac-a356-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675382566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675382566, "uuid": "4448505a-1bc3-4a46-8ba8-07af02078326", "comment": "Malware payload (Amadey)", "value": "486b53b165c2be14c46938bf2cd5a732", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675382566, "uuid": "aa422b52-c6d8-4a8e-a56c-5d68ef2bcbde", "comment": "Malware payload (Amadey)", "value": "3a8c8f73dd5035211c3b1ef10ca3a89b5ab6938d1d64b2fbea1189a7230c01e2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675382566, "uuid": "4d8117b6-f126-4ecb-9f70-ff81b893b3b2", "comment": "Malware payload (Amadey)", "value": "72823bd150ad6b6eb1fd6c79464ac7aa70a1563c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675382566, "uuid": "6c48ed11-8202-41f4-ad27-876af89f4890", "comment": "Malware payload (Amadey)", "value": "36e173dd782f2f5999ea03e641be94863b047b83fcac537723265efde6d53637140be7d6f32248e4e7d49ac8a9319790", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675382566, "uuid": "96a05d16-1e23-4c17-8545-38fb3d672a8b", "value": "T1D9648D42A2E2FC41D621CB728E1EDBF47A1DF9518E287F6A12185F7F19B2173C5A3250", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675382566, "uuid": "052f2765-716d-48b9-b68a-d6a6a5a99320", "value": "2ff60b2f756b6533c2643b340c02a5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675382566, "uuid": "299320f8-add6-445a-b181-89952d54164a", "value": "6144:lteALBxhWAc04RjPlwKwpxZHpjV6ptCbNKNc:lteAFxzc0Able1tf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675382566, "uuid": "cebe771c-edfd-459e-8434-2bf01a2a1f32", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675382566, "uuid": "9bce0516-a90a-4e70-b9d9-ee191c4a2c08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675382566, "uuid": "aa294639-06b5-474c-a3eb-6d86453476be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e003de20-a390-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675407814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407814, "uuid": "091978ec-e895-44fe-9cbe-8ad5803ee2b0", "comment": "Malware payload (RedLineStealer)", "value": "d433d033355b488118e8c06274d3cfce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407814, "uuid": "d56293b7-7809-455b-808e-e2c288c69186", "comment": "Malware payload (RedLineStealer)", "value": "3a9211b22f16d7109b59a3f2a013b081ee9ded4f92fb0326df4c8608cb0563c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407814, "uuid": "755fef74-78f3-48b0-aefe-93f53ef2bd75", "comment": "Malware payload (RedLineStealer)", "value": "c5f5c54a2e99d9a2862d7d6334b6176aea70b45b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407814, "uuid": "9487eb83-7925-40ba-b4c1-e2ec64fc72ea", "comment": "Malware payload (RedLineStealer)", "value": "cf52f50534eeec42871d2cedf743c4b55c753025b9c242ca8266601633b99a39366fd7576ab7701e309090c10e191631", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407814, "uuid": "bdd2e397-8203-4686-9f4f-0f3014013988", "value": "T1EC04C51437FCCD11E0BA5A3F6961A05086BF9802A852F75B76C367CD0E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407814, "uuid": "3dc72b10-5391-4b95-943a-678eaec22655", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407814, "uuid": "eaaebeb3-b8d5-4509-bac6-c73390e31f99", "value": "3072:pxqZWn7aNQYF8YLFcI4Meqs9rhvPxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOL:bqZuYLFcrXrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675407814, "uuid": "92edf9b5-e7db-43bc-ac06-a94acd2b20e1", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675407814, "uuid": "c7e39e3a-2663-46d1-a428-c0d4e3e54d26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407814, "uuid": "639b1a6f-5221-4f59-ac20-a88a58d16b96", "value": "d433d033355b488118e8c06274d3cfce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b2cb49-a35f-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675386636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675386636, "uuid": "85b0af0a-2eff-4855-b135-0fdcdfff7e6c", "comment": "Malware payload (njrat)", "value": "93e9b7fd179298c55a8fe005ac3f863a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675386636, "uuid": "9d6cc925-bf58-443e-92f8-e15411cfbe37", "comment": "Malware payload (njrat)", "value": "3b195bab5420856f63db9b62563bee59c5719c1d0a841b4bf9c21c9d18296e53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675386636, "uuid": "c6285fc4-18cf-427d-9d61-23293c595ff7", "comment": "Malware payload (njrat)", "value": "e128bd15eae77b862521a771329668e0433172fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675386636, "uuid": "7c340ddf-10b6-41ea-bf0f-3fc1fd6d1eb9", "comment": "Malware payload (njrat)", "value": "ed608e5f3e03b8d30a3beaca9b905e496bfd4302928f18c3a294569407472436c97c6923717e2ec49bfa13696db67acc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675386636, "uuid": "277a594d-72d3-402f-a531-26dbce5b1c93", "value": "T121D21A09B3F54B32CEB943FC506361006B799C6B6566E3825DC1B0CA2E63F50479AF6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675386636, "uuid": "34d1d681-2d85-4751-bfe8-aa2aa8f2a778", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675386636, "uuid": "8a8504dd-28a5-4307-99e6-18abf6260539", "value": "768:xZ2nIRkfAJKLMlmX4hivQJzSTSa7xtz28gjnNMvp8:xhr65RgOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675386636, "uuid": "825be794-91cb-417c-9b50-02c190abd51b", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675386636, "uuid": "2d0843ba-022a-4c5b-b978-d4c6afdd8393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675386636, "uuid": "0c38b974-1dd4-4aed-9b79-4913aa5ad5b3", "value": "bunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8b0558-a3a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675418522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675418522, "uuid": "7752bcf4-fa4e-45ac-8c04-19cfe345f6cc", "comment": "Malware payload (AgentTesla)", "value": "3c6c3290e572f9c5808adb3c5cfe7752", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675418522, "uuid": "8677ea08-0f47-4509-9844-11b04c054f8f", "comment": "Malware payload (AgentTesla)", "value": "3b20b54c7bc0dcca37d1842bd4f6d7686c094b3f853050ac7849bcc9e861ac84", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675418522, "uuid": "76331ec0-e555-4a30-ab1a-983f2826d1b2", "comment": "Malware payload (AgentTesla)", "value": "e3fe810f5b7386d99a78ca930f9d33e913bcc245", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675418522, "uuid": "50158384-0286-4c69-bd74-5cc1d0dd9060", "comment": "Malware payload (AgentTesla)", "value": "75870b20157fceb2d5f44d7cceac169bea3b36e8908131163b3030e7e74fb9fbdf689107b17304f24099c9a0cbaa0104", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675418522, "uuid": "1252800e-df8f-47ad-b001-366ea9615047", "value": "T112059D9337B1A873F68B10B5142837CD2FE07503BE95A253A77B7AD09B119FBB298141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675418522, "uuid": "89b63d2d-bde3-44ba-8588-7a4990a9135c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675418522, "uuid": "ab78666b-1d7d-40ad-83fa-b2ec11129784", "value": "12288:e2iNZlSE+AlRvX4d9hpmtOe/VdFB6lZvLYu4NCVVKgW6Fy2Mxzo3pqG4yPa:e1dH+AlZ8hpyVd2gp96F0xMpqG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675418522, "uuid": "f1e2a3b5-14e4-46de-a0ed-694bdaca2a53", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675418522, "uuid": "d964ca5e-a3f1-4b2f-bab0-acfdfa6d8bf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675418522, "uuid": "40dda178-62c1-4160-be98-d58fdf8e19a8", "value": "shipment airway_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58593f1-a3d5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675437459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675437459, "uuid": "df87e4d1-66a2-414a-8f61-d605c94a7feb", "comment": "Malware payload (SnakeKeylogger)", "value": "51b95537e2f88be4e97ca30fd565c6a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675437459, "uuid": "8aa58a54-465b-447a-b668-c7ce67a5a156", "comment": "Malware payload (SnakeKeylogger)", "value": "3b6d60b69e3438ca5aaad8edf8b87f8c39f72803aa3c90a929aff5239d998333", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675437459, "uuid": "ae2f0a58-7dc1-402b-8bea-19e879433a5f", "comment": "Malware payload (SnakeKeylogger)", "value": "3c19c4f72b3737b8c365462b578e46a681990470", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675437459, "uuid": "a15e3d3e-99bf-4b57-8d1e-fb348d5627e8", "comment": "Malware payload (SnakeKeylogger)", "value": "88de2c0a709f068b148b29725647dd770caabe780660c908eac393bfc97ca26c4262d50ed9cffdc4e44b7e9fcdf80d3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675437459, "uuid": "8a57f776-bccd-43ec-8b0a-e0e027b9010a", "value": "T17DE1C911A3E94F73DAA64736ACB263404379EF0B6943C71D24C852AA6C967960B50F32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675437459, "uuid": "5d813a0a-82e5-40e7-aa53-83464205667b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675437459, "uuid": "232efcc8-1cc5-4089-8963-ebda79bf437e", "value": "96:0+10kTSeg3MLEmVJsdtldCDxLGP8ZY7ZMtblNb6k2wImQgJtXstMtzNt:0+nWeg3SXJ45C5GPGldHbIfgzXEMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675437459, "uuid": "802437ab-93fb-4d19-aee0-4c771795663b", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675437459, "uuid": "26cda663-6fad-4ba4-9631-4f78a25f5605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675437459, "uuid": "9be58663-73dc-44d1-9866-c5f85e885ac1", "value": "Uarngd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449d64a8-a3f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675452651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452651, "uuid": "b702234c-9ded-4e28-a9b2-fe7ce8070938", "comment": "Malware payload (NanoCore)", "value": "b6c9e205bbe4752d743e4f49588bf35c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452651, "uuid": "7d1ecc5f-14db-4a98-908d-c64475c5ab05", "comment": "Malware payload (NanoCore)", "value": "3b9b213448c7d1d3b5b9f9c19cdad35e6215af54e1e2e4995a74877f02bf8e0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452651, "uuid": "b46ad709-cc3a-479f-b6b0-eb00e4b757c0", "comment": "Malware payload (NanoCore)", "value": "dca5d1249746a9c95e78ad6f1c71b9598081b895", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452651, "uuid": "f2f902e7-3b4c-43db-8b92-71e5ded3a849", "comment": "Malware payload (NanoCore)", "value": "455e7b69fab932e67f43744a62474d43ed4b467afc3265dc09474db5955fe4b5d4115b8966780a9bf22f83834f467ecd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452651, "uuid": "3dda6c11-c07a-4ac0-822e-666413c3c0a7", "value": "T193159E6337B099B2F78720B604387A885BF17513BE16E2938B7737C06785DB772A8152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452651, "uuid": "855b1465-d14b-4cc3-b0bc-45e6f22fb212", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452651, "uuid": "fa544160-015c-44d2-b229-c77532b7cb0d", "value": "12288:ThefaqG4yPaJ6Fy2Mxzo3ZuJ+ZKoz+ZpCs83seI13+OZAMMOk:1eSqG4yPaJ6F0xMzZKssX+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452651, "uuid": "0350eef5-bcf7-495d-957b-1c5cc245909c", "value": 881664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452651, "uuid": "4056c4df-0cda-4a25-ae5a-22e978f88bff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452651, "uuid": "1e9f5536-7253-421c-8999-29fa45321c58", "value": "b6c9e205bbe4752d743e4f49588bf35c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "248ea1ee-a3c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675429834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429834, "uuid": "b3d723c7-4ed7-45ad-bc34-96baf39463ce", "comment": "Malware payload (Formbook)", "value": "3ecf5c9c01765b190d04d945ac736974", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429834, "uuid": "0730f162-7411-4b96-b3aa-598dd3a62dfc", "comment": "Malware payload (Formbook)", "value": "3c3f093d0bc64c55690f0f713351c65dd043d028d651257feb582c5228955120", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429834, "uuid": "9a06dcbe-6daf-446c-abdc-baab1fa0a2ab", "comment": "Malware payload (Formbook)", "value": "15f5cae1eb82c8cd0e1ab5522e0e023f4d724de9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429834, "uuid": "e5411853-3060-49fc-966d-085d546f778c", "comment": "Malware payload (Formbook)", "value": "276147cd3d26ac7e454b9f9b7120b89da413581b2495e04f4cce907760732b3910acfe92e7a745ad07621a5cab5b91ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429834, "uuid": "465733de-0fe3-4310-ac6b-91da6261dd60", "value": "T1D154126A59A8D277C8E203720D3B5B65DFD87A121459A74E0330B70E3D239A9EC6D363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429834, "uuid": "dcb92b0c-d00b-46e1-be52-dceeeeb706bc", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429834, "uuid": "f23ecae2-dfbe-48b1-9d60-9e6e7fffb1bd", "value": "6144:/Ya615V28YdawKjNSnyD1rC08Xevs35WHMYMuIJDCXDy:/Y354bgAnc1+0+goR3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675429834, "uuid": "2f60fc9d-6b32-4ea1-a1b3-74e53507b834", "value": 293449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675429834, "uuid": "c711aba5-e1aa-4c94-9178-b6e396f4c49e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429834, "uuid": "56207b5f-b6a3-4c8e-9c88-d4c8efede600", "value": "3c3f093d0bc64c55690f0f713351c65dd043d028d651257feb582c5228955120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a69234-a3db-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675440033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675440033, "uuid": "de9f2b1a-dc18-4b7d-95b5-fa9feca2292c", "comment": "Malware payload (RedLineStealer)", "value": "6526fbc5e32e99bd4b77e3e3eb4aadb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675440033, "uuid": "7dc3715b-7214-4b51-bfdc-1b06285da0cc", "comment": "Malware payload (RedLineStealer)", "value": "3cad5fc80ef5be3ce164cf7499ab336f124715d60ce99e7bd9c53718e6ca326d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675440033, "uuid": "a9712e6a-5201-43cc-9ce9-a32426222cc6", "comment": "Malware payload (RedLineStealer)", "value": "039f952ab251ff0cebcfb268812297d0bd47b150", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675440033, "uuid": "446ea0bf-b5af-423b-83a6-addaf64c5268", "comment": "Malware payload (RedLineStealer)", "value": "d610e939a966c6bb6fdac1360df330b68ea9dc5158066530adf2b70ad7bc99520ec1505a9a87be347400cf884996072e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675440033, "uuid": "4ee6f773-4500-4c23-af92-aa835743a6da", "value": "T19564F12232E0C072D56B51301428DBA5ABBEB5311575D94BFBA80FBC8F702D166F639B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675440033, "uuid": "6176c549-9953-46a2-8976-0959659808de", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675440033, "uuid": "5b28a3c9-47c1-4d33-b8fd-bc66505b42f0", "value": "6144:TeLnPLPOCaDpo1FRK98M7ad8/p8qUghNMZL9a8RD/jTTdZJgWm:TeLnPfaDeoL7m8B8tjZBrD/TRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675440033, "uuid": "a4624618-99b3-49b7-8b8c-d8ba43177242", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675440033, "uuid": "0e52e5d6-fd18-4e33-8829-7e3ab8ca221d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675440033, "uuid": "1cfb00da-0040-4761-b927-54c5dffb36d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5146221-a3e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675442988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442988, "uuid": "18e8ee99-7470-48e4-98af-2a7afa2ed5f0", "comment": "Malware payload (AsyncRAT)", "value": "8bbd2be296defd6d01791397e80475be", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442988, "uuid": "b2b4a974-79ad-42c2-987f-2cb72b55b16c", "comment": "Malware payload (AsyncRAT)", "value": "3d231d40fec4567fa23bdf83c9859ace322becaa809e0a01fe8fdbcb4170a780", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442988, "uuid": "567a4b79-1489-4669-9bf9-6cc920f49202", "comment": "Malware payload (AsyncRAT)", "value": "638f7d23f4ae1dc0004fbe5c7b006fd51d7118e6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442988, "uuid": "c2633cfb-1100-4152-9982-f0db0ddc37cb", "comment": "Malware payload (AsyncRAT)", "value": "e772e64bde9b0dafbab444f37a7edfb90a47788362d49a3edeb185a3e1e0211e356ac626aea12ab7385943430730109f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442988, "uuid": "0f9371a6-f8e6-4a56-9c4a-e5fa4b9f73a2", "value": "T11DC35DBE0E2036B819D79D14C0596705ED285B928DE12355BC9EFC21CB68F226BE7CC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442988, "uuid": "4f4b9e98-4fcd-4a57-be14-3e055d7b745c", "value": "3072:NP8ln3P8lnJP8lnBTP8lnSP8ln5P8lnPdP8lnYP8lnJP8lnGP8lnvP8lnRP8lnI:NPkPsPETP7PYPedP5PsPpPsPoPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442988, "uuid": "23e8aee3-28d3-4504-9322-d13c1b7f73fb", "value": 123471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442988, "uuid": "876768fc-ed29-4613-96e6-7c5a48f39c68", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442988, "uuid": "62fc805f-c65f-4c11-9cd6-45c08ef5a754", "value": "Voucher_Reservation_Detail_Booking.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b18f37-a3d9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675439199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439199, "uuid": "1e079b3d-6b72-49b2-ad26-e597b7c88302", "comment": "Malware payload", "value": "6a7b2c486baa38a1d89e10889fc0802b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439199, "uuid": "5ec9f5b6-4962-42aa-adbf-1bd7f1bf5bce", "comment": "Malware payload", "value": "3d4f84e20d5cf317edcefcc98bdd7e126078b25cdc56b816edbec532a8763096", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439199, "uuid": "bcb20a4b-540e-4c29-91c2-2f0675892716", "comment": "Malware payload", "value": "6b8ddf08972160a12e144e00aa8a486b3c35e5e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439199, "uuid": "4843a315-f8da-478d-80ab-c6905ed82b6f", "comment": "Malware payload", "value": "58cb0b31f88630be2c8038cc1c674a40ce0d1262b962fb1365308251c5db49383eb98f83bf8e40efb233c9e661a0b8d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439199, "uuid": "800abce8-8162-44e6-9f80-7867be15477a", "value": "T116664A03A3D68036F1A326704C7997245673BD605B35CEFFE6857A0E6E72AC29931327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439199, "uuid": "1f53cf71-0a64-4db4-aaec-f47c41042eb8", "value": "721b7a2e0911a652e4c7d1af2971046f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439199, "uuid": "5bd68c3c-5b09-4a6d-886f-30963bdebe99", "value": "98304:RfrQZerQZ2cK5YOXwnS4rV340Jy9+lG498HL:Rfr2er22KIJZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675439199, "uuid": "f9922d3d-92d0-4578-9869-821012c80c8c", "value": 6602377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675439199, "uuid": "da674eb1-b69c-48b4-bdff-a428230002ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439199, "uuid": "2ff2edce-66e3-41bd-9217-79922cd1996f", "value": "3d4f84e20d5cf317edcefcc98bdd7e126078b25cdc56b816edbec532a8763096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe60dd2-a3ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675420055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420055, "uuid": "3c860690-4eb8-4594-b456-b7c804fcc71f", "comment": "Malware payload (Mirai)", "value": "f302df1c0013f87b8e94f4c773d52f7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420055, "uuid": "70ad6345-8afc-4391-8fa8-e036ff32bf9b", "comment": "Malware payload (Mirai)", "value": "3d6792ed47aa930ef0486e6e166b9b841a9bf061c6a64cbf391065133d42138b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420055, "uuid": "7b1143ff-0dfe-4462-9b4c-72dfe24e6c1f", "comment": "Malware payload (Mirai)", "value": "5912495683f0bc10cbb2d9fcd6cbacfc15a84037", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420055, "uuid": "6aa0c6e5-7169-441e-9d52-139f1f3ad3a4", "comment": "Malware payload (Mirai)", "value": "82ae47f8e2ef2208909352eab5b688266caf6ce4802c305970ae1cb204ea245cbe8f721484261f34239b074de4f63d66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420055, "uuid": "302d5dab-b27f-4030-ba45-995701d9cc41", "value": "T17FD33B46FB818E03C4D5177ABAAF414533239764D3EB73069918AFB43F8AB9E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420055, "uuid": "e4c89a17-2633-4f9f-8fe4-1dc34888ae21", "value": "3072:JGSCc37Mdhe0X6NI1YSEAqvAyZInKDnlWM/9lMqrLjW:sSCc3QP/XA2YSEAqvHZ7DnkM/96qvjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675420055, "uuid": "86767385-5740-4892-8aa2-9749ef9ee883", "value": 135795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675420055, "uuid": "bfffe8ed-ddee-47c2-a2c4-ff16ad8c6d63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420055, "uuid": "e32da1c1-4026-4510-8b59-1c9ead3bf0c9", "value": "f302df1c0013f87b8e94f4c773d52f7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f2602f-a407-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675458912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675458912, "uuid": "fe39d07f-f8b1-43cb-8def-f1f142051758", "comment": "Malware payload (GCleaner)", "value": "168951b656d758a8c7f7e2c0e1b2ab3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675458912, "uuid": "059e93b2-528f-409e-9ad1-02a430d8d8ad", "comment": "Malware payload (GCleaner)", "value": "3e1da483da70b2e735484e66fc83d67beeb16b540ac28b6772c647a503733cb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675458912, "uuid": "1c63df55-b3fa-4dfb-919d-a33a7b93b097", "comment": "Malware payload (GCleaner)", "value": "ee3f29082f7f3fc392965e7dcc662ec80cc3190b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675458912, "uuid": "256c1061-198d-447f-86a6-4f7dca80f9a8", "comment": "Malware payload (GCleaner)", "value": "4db100e7523c90a4d2f1ac5bada7418b4730dff2bba0e8c41a1b5b24003062f05a9144d5d43794b7f768cc309ad52562", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675458912, "uuid": "1d96296a-3a02-4fb2-96d7-34a274e93a16", "value": "T11C953326B5B36637D2036B766511AE01FEB2AE1026B44010319DB70F2FF3A51F81DB9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675458912, "uuid": "be793d83-b7fe-465d-b717-078e382b3eb5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675458912, "uuid": "a2fdb0b9-301a-4ccd-b902-8d976c92cff0", "value": "49152:ygK+06NHe+XAxVXA0VE+towM9qI4xavVKh0n+0SjVBK697LCgv2MR:TdVNpXAXw0BtTcq3xa0h0nCV82vv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675458912, "uuid": "ad4a7b95-c35a-47b6-9430-c8e5ec495844", "value": 2037333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675458912, "uuid": "999555e7-2abb-43b0-a38d-98348304dbf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675458912, "uuid": "b2c9f751-c170-4029-a983-3dd5ba4f2030", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f54f23-a3ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675434312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434312, "uuid": "661a51f7-2abe-4490-b66d-e42fca43cad2", "comment": "Malware payload (RedLineStealer)", "value": "0c1df574f5f641bc7006cd315be16c66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434312, "uuid": "40ef6d4b-4b26-4e6d-8aa0-3868f3285519", "comment": "Malware payload (RedLineStealer)", "value": "3eb1efa80684197fea660eaf63b28d4e81420ab382a53e1ade960f76902a6aa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434312, "uuid": "c7bd75f8-d91d-4414-ad7e-9697ab6a1c2c", "comment": "Malware payload (RedLineStealer)", "value": "7a3213403b5fd6960761ab7b2a4186b47ad0eb75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434312, "uuid": "2c5d8071-485d-483f-970b-562e227dbc82", "comment": "Malware payload (RedLineStealer)", "value": "a1977d83c57d0d2b2248199822ec121e37478a273382522e4184b5361808b14747e27064952e351b85292814f766c848", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434312, "uuid": "9a9d71e9-47e0-4b0f-b255-75037e722e63", "value": "T113A52302FADAC472D4220D315D28B765B5BC7E302F25896FB3D81E1EDB71190E624BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434312, "uuid": "1fda6618-7650-4a94-8605-ef8304950dc9", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434312, "uuid": "2cde3f9b-3346-43ab-a423-e0157fcb88cb", "value": "49152:V5OxASfrgTnb0iMgrRfXkqwy0h4QbZhtZuXNKOGV:V5IAS+4iNfXkTyyheUOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675434312, "uuid": "f28591da-9e05-4ffc-9a17-ae11d3a1b9e8", "value": 2158834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675434312, "uuid": "e98931d6-d898-409c-8fb0-c1fffb3d76a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434312, "uuid": "6e11d3b9-58f3-47a9-9d1b-0328a0d3edfe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8130c7fa-a3fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675454470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454470, "uuid": "e95e5553-2e8c-439e-a583-eac5b001377e", "comment": "Malware payload (RedLineStealer)", "value": "6232b8123dcf33ccd5d57560bcda643f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454470, "uuid": "3867cb46-7454-4f01-8534-c42b09e4d367", "comment": "Malware payload (RedLineStealer)", "value": "3f7c67f546b0a710c50c2ac089a4181ec9420cc87508848899db020a8cd1f20e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454470, "uuid": "cf0da105-a8d2-442d-a767-64f8581eae44", "comment": "Malware payload (RedLineStealer)", "value": "bbb560d40406449585e878bb1ae773b87ba8e2ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454470, "uuid": "086e4f09-b611-4cc4-a351-2716b5f2508e", "comment": "Malware payload (RedLineStealer)", "value": "a112f02ff8eedd00e890277b9ad74ae11f3994bdf64a6c8f95d7926649215b3f72daafea3d0dd1e1bf6136fef5fdaeb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454470, "uuid": "17a77854-533e-437a-a148-748cf6d96cc9", "value": "T1575401327B90D073C67765349824CFA5BBBDB131407AE40B7B2917EE4F306E0A66A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454470, "uuid": "2e6fd97c-9dd9-4cc2-8caa-1c89a2dd50e4", "value": "11deee92ae37204b8493d8d64f5f1f69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454470, "uuid": "ae9ce580-7917-4323-9287-cdff6981e5bd", "value": "6144:2oaLNB/FyyFOQ5Yvd2g+zusOTnL1KP6mf4VE8bJH:2oan/QyMnvXWuL4P6mgZb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675454470, "uuid": "ea247967-7cb4-49fe-8aa1-07c14d2ca15a", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675454470, "uuid": "6d6c46c4-0dce-46f9-b584-1e671af5a860", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454470, "uuid": "4982b29c-1dc8-454d-b375-6b754ba05fab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88d56a6-a3e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1675442994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442994, "uuid": "4b0e3af2-eca2-45be-9b95-535b99828e3c", "comment": "Malware payload (ModiLoader)", "value": "a930377177f54ebf1dcdbec559df9921", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442994, "uuid": "25ebcc44-c8d8-4bce-b448-b33733b9de33", "comment": "Malware payload (ModiLoader)", "value": "3fc5fe06474624df2032970d6c877080a12fdbd0b35f53622e11eb8788ed6c4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442994, "uuid": "4cda0f42-7e33-4c8d-9d6b-a29ccabaeff4", "comment": "Malware payload (ModiLoader)", "value": "7aae6ada2da3a77ab9bcce228f69aada9d537865", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442994, "uuid": "ce5a0012-5461-40ad-ac8c-db6be4c761d3", "comment": "Malware payload (ModiLoader)", "value": "1accedd1e67213672338577b1edda4cadfc84ee2e9478ac4a58a30d69bad1d5f9124167d5291270230dbdcd092aba546", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442994, "uuid": "b1355b50-7079-4c28-8f4e-b992fc6d37c8", "value": "T167E4BF36A2D11937CD0D667C5C77E7A8692ABD323D345487BBE92D5C0F38290783A1A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442994, "uuid": "7d36b4b4-1964-4019-bd23-400b17232aa7", "value": "c27a057e1266983bd5bb82ac08c499af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442994, "uuid": "4c6e8b31-356e-4780-8032-bd1d14e2693d", "value": "12288:sL/ZNrRZBps9ttZ8DL2QXcGEMTD+aGgFZfPvfofHQsr0Sa:C3TBS9TZ8DLUVMGrGZfPvxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442994, "uuid": "91cab846-c83f-4ac1-953a-1cb75989b8f2", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442994, "uuid": "7817d2da-5ab9-4b22-bc96-9cc9b81ceae7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442994, "uuid": "87cb4e79-85d6-4211-9db1-69b7b7d31843", "value": "Ordine Acquisto n. 1000052006_5870078070.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a3c5b6-a3ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675448621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448621, "uuid": "56832e77-50e3-4527-bd3e-92199126cdff", "comment": "Malware payload (Mirai)", "value": "43d4cfa391dbd33b3e758045c13d9ed1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448621, "uuid": "77b57fed-af33-49c9-9cfb-d37faa40aa4c", "comment": "Malware payload (Mirai)", "value": "408b2576cbc477a1d3a58d32154227b0c3ecad86e13a46b8db2d7328d0db5c68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448621, "uuid": "3fc6349f-d49b-478d-a81a-f2f29ec4807d", "comment": "Malware payload (Mirai)", "value": "439d6320ff73310ced73fbd8cdbd78463d08bfae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448621, "uuid": "edb9918a-3434-4f6b-bcbe-c9ce5ddd441c", "comment": "Malware payload (Mirai)", "value": "fdb48b7276d14aaf902654eb037d8db0cfaecb1e6f161d9b29bb495be766feccfdfeb636c11de1115ad0c1884f94c1ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448621, "uuid": "2b4bfb46-f379-49b5-90e7-ba218780a86c", "value": "T1C0C2D0E07722FE31C420AC3EE52A4D893A51167CC1FF383664258C359FC265A63B44EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448621, "uuid": "f440c61c-6ac7-4140-8ce7-b96b9d0d3d35", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrw49q3UELub:OKy4qfqoeJdXWgwhLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675448621, "uuid": "42d28ff3-fbe7-4f74-8da4-4a7cb199f611", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675448621, "uuid": "e7e4e9e4-f129-4f18-af01-5f107a52efb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448621, "uuid": "cde40266-0c65-4b8a-a845-4ff45b6cca85", "value": "43d4cfa391dbd33b3e758045c13d9ed1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d671b57-a37f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675400159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675400159, "uuid": "93206dc6-19c2-4871-af63-727640381d0c", "comment": "Malware payload (RemcosRAT)", "value": "679104fb0479ff61c4b5e4b88f77d94b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675400159, "uuid": "19552fa7-46ed-4003-87e9-8bd0265329de", "comment": "Malware payload (RemcosRAT)", "value": "4134bd82bbea78103d0e32728df856870eaa2c0188b59423115c7d779b2bf83a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675400159, "uuid": "ef49a6d4-73f0-46c7-88af-1fc5454f3ab4", "comment": "Malware payload (RemcosRAT)", "value": "bfbcb5d48fb4ab25d52e4e1bedf37a4e7a4a3cab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675400159, "uuid": "c6179f24-ecaf-464a-8e0e-94bf954e918c", "comment": "Malware payload (RemcosRAT)", "value": "19d490b7c5234c8f3803cdca8b24a2a0f440ceade9432da396baab9819d18d565c7fb66e807e74ee5e21c16ea7bbac94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675400159, "uuid": "1e6b8520-33eb-4110-9298-fe97d6de5ecf", "value": "T1D2D1D910E7FC9233DEB74B74A9BB73410378B31654139F6D68C062175D52E864762BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675400159, "uuid": "a87c5fa3-6c3a-4b7b-a503-063561b6cdb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675400159, "uuid": "a0fe9479-b61f-4987-8909-d35067e0fed2", "value": "192:zU3efq7iEM9gdH98dfQbLE5lF22vjWwID:Q3efq7iEM9gdH98dfgLE5lI2vjlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675400159, "uuid": "d752e8c5-4f1a-4e13-9b65-b86097cc9f29", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675400159, "uuid": "34c9c0d1-2125-42ac-880e-1f7d3b472b34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675400159, "uuid": "29ccf58f-2dfc-4440-89cc-05cb18862fbd", "value": "679104fb0479ff61c4b5e4b88f77d94b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5fa53af-a368-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675390564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675390564, "uuid": "410135e7-ee7b-4cae-8004-7547a23dfb32", "comment": "Malware payload (GCleaner)", "value": "06e4b4fb4a6b56a41292c05f0c68cb22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675390564, "uuid": "dd48d43e-c1c3-4e94-9f56-20dcc572ebac", "comment": "Malware payload (GCleaner)", "value": "41ac80f0500db7260a55797e90c23251e1c2758e646a626a6bba104c80a56d81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675390564, "uuid": "7f07c858-703f-4d31-8dc0-357aa859306e", "comment": "Malware payload (GCleaner)", "value": "bbe4ebb9a6b4e7ec9ee45ef7996c7a24337d24e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675390564, "uuid": "08d2d2cf-256c-4c7d-9e9b-31eabded74e4", "comment": "Malware payload (GCleaner)", "value": "adf384180ae4e07399b4151609bf24a62fcb76593bb04c6576728a2dcce5939f67043a0b5da0fbd3a09a67695b02fa35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675390564, "uuid": "78c0d537-752c-4423-adad-1f66bed8ddf0", "value": "T1B3A533A36B758430D171A6B2D63D62417972FA60307C67113A5E7B0B2D3F360A19EFE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675390564, "uuid": "ac335576-253b-4bd1-9b83-f428210bdd16", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675390564, "uuid": "af7f2919-f40b-4d74-abd4-5082aadac53e", "value": "49152:bgRyA6DHjHGtkpcyxUDpQ/emmwRBLCgv2MR:c9YmScWYmVtv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675390564, "uuid": "aef8072e-0518-4ac5-a269-63e98f7c9844", "value": 2102729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675390564, "uuid": "886daf5a-dad2-4bcc-be2c-07aecb465928", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675390564, "uuid": "5561056c-a243-4b92-9ff1-e668f7563a82", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9a3205-a3ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675420509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420509, "uuid": "57d1c38b-8929-4ff4-99be-77890676852f", "comment": "Malware payload (RedLineStealer)", "value": "2560dff4f321ad8a201bd8d5c5694268", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420509, "uuid": "37402abc-d546-4cbd-b566-52403d3094d1", "comment": "Malware payload (RedLineStealer)", "value": "4250602036e16dedef56f32955aa4611628e3a87fa53bf2e23e30ddd8b4bd8fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420509, "uuid": "9295763c-d0c5-446e-8cd3-6a73501c1a61", "comment": "Malware payload (RedLineStealer)", "value": "cc04d188f88436620214c998baa92802632ef064", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420509, "uuid": "af6be3ec-587f-4d3c-8dc8-031afb341cb2", "comment": "Malware payload (RedLineStealer)", "value": "d265c9973528b5d37cf42f50ebf986b9a6008877ed96dfaf47c099078c1d0be8546a15b2ec8228c84312c25372c545ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420509, "uuid": "a5f95004-97fd-4536-971c-4c9b4ec4953d", "value": "T19E84F1337580D472C9AA54306D34EB85BBBE79301876AD0B379A17BD5F706D2273A30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420509, "uuid": "99d9311c-9f56-40e1-af37-ba85f4dedac0", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420509, "uuid": "d170b4bf-7580-4e2e-a09f-06502e2f1bd9", "value": "6144:67CjVSLd+uB6AOAgTUhLN3m0xYQPdxRyeerTi2DJS5dhBu4lyEw:67KSF6AOAgohLMjQPdN2yZuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675420509, "uuid": "ee616afb-6f69-4bdb-a7bd-b4962ec5a86f", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675420509, "uuid": "a8e06f38-ce13-4791-a45a-46681cb7a5d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420509, "uuid": "adf89513-069a-4e35-b757-a192fd5e3820", "value": "4250602036e16dedef56f32955aa4611628e3a87fa53b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f4cc05-a3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675442363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442363, "uuid": "48e612a4-e42a-4f52-9b5e-0a8129be38d3", "comment": "Malware payload (PureCrypter)", "value": "123d306eaa469993e5cab019c46f6f0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442363, "uuid": "869d23d5-e4bc-4770-9639-355b2d2cceb6", "comment": "Malware payload (PureCrypter)", "value": "429d78a34dd119d9d5e33ab4bfc018bce2f2f6d09698d7245c2377b099c9ac56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442363, "uuid": "7d8ed72d-f87c-4dd0-9ea7-d89d281c72d1", "comment": "Malware payload (PureCrypter)", "value": "5aada3a5d2bdb71e869122d5fcf38137c1bc7778", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442363, "uuid": "025e8f72-88de-4e3c-b7be-4cd9668c9c4a", "comment": "Malware payload (PureCrypter)", "value": "03bd395b47406d6e55e272a24951192e8f1a35529c93c2aae3de43a6efad8526893b8b7b1f9b5640e9731f3d62043c95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442363, "uuid": "7d066600-64d5-4cec-9623-3bb0d2081825", "value": "T1F345338D2E427AB85FF0D696D1592E1D172F07186F3F90840FEEC2A3391AAC855D48E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442363, "uuid": "b86cd264-7dd4-4d44-bb56-80b4f95473e1", "value": "24576:RvTytIlpcI0eBXENImvnniWr7knftouz9+EoQf569AuGgz:FWtIXcIMNlviWcfj9mQ8A/gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442363, "uuid": "3c0e0bd5-3b8d-4e99-9a09-7462496567f1", "value": 1264059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442363, "uuid": "97e2f930-1d48-4751-8c1c-6b60177ab769", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442363, "uuid": "b726e54b-0c65-456a-80e9-9bfa76085d42", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b47e5c-a3ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675455360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675455360, "uuid": "43caec41-d266-43d7-a958-188391545988", "comment": "Malware payload (GCleaner)", "value": "d07494bcc83e8eeaec0e30bd70c7b89d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675455360, "uuid": "479c3ee7-7804-4789-9e51-5527398a2215", "comment": "Malware payload (GCleaner)", "value": "43964a89778e08190475844b8fc1002f25d8d54f9c81c4fbd176832e41cdd4ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675455360, "uuid": "9ff8f185-6cd3-4757-a858-1d00f43c4988", "comment": "Malware payload (GCleaner)", "value": "3b79fdd1fbb995854ded3ef918fae44db18f6b60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675455360, "uuid": "a1f1eb04-d3c1-4bf2-a5c4-6c0f1d08d5bd", "comment": "Malware payload (GCleaner)", "value": "ab1dc029a2ac8b5dc70da0a871d237e6ed2666a534932d802fb3059ff5395a878b2d959c31b26e4436483ceaacd0d817", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675455360, "uuid": "79414711-c09b-4b79-94bf-b47f874e1938", "value": "T1B0A53342E455837BC4C25270A0205314E62BFF7DB93A532A24BDB8DF5E3B360F95B296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675455360, "uuid": "b0d8b242-d2ec-46f1-bfff-ba2130c2410f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675455360, "uuid": "950e2f9f-bf8c-420e-9b4d-ddef615dea53", "value": "49152:ygleC38Rjtb0g6FYHPejLGTboSwXCKgwmfM+w1WgTLCgv2MR:Tijt9a4wLGT8S4COmzyWgXv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675455360, "uuid": "7e18cc28-f965-4053-86f8-f94bc6b44c6d", "value": 2071817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675455360, "uuid": "f8a82631-b1bc-4090-b8bd-be8e1e207d5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675455360, "uuid": "fd5e9395-753a-4a46-a25e-b6433bfb06c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ef4f12-a381-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675401080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401080, "uuid": "fab12215-791d-42d8-90d7-4e0ca6e50a4a", "comment": "Malware payload (Mirai)", "value": "ec8ebc787a01276ff98ba9153c9a3c08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401080, "uuid": "2cbf627f-6d5a-48c5-88dc-767417a9be50", "comment": "Malware payload (Mirai)", "value": "4410b6bd156bc7e059e105d22c862094c64aa3583f1bfb97b68eb18f973fab28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401080, "uuid": "5ba90437-8cff-462d-a8e5-e022dfa2aa7a", "comment": "Malware payload (Mirai)", "value": "252d364ed2be3d63bc4f76c6ae476c0aa7441ca5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401080, "uuid": "b9b1b162-6a92-4660-a690-d3c6e7430f2c", "comment": "Malware payload (Mirai)", "value": "8095472c903d20a27f7ba2e0e856765a2837f2c92e3d0a9f187d9db703ec3ceb85e440ef4c5d1214b0f335b8fee13f20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401080, "uuid": "6da2ae70-6df6-47f6-af6e-c7d524bdd89d", "value": "T10AD2F1F8EF798B8BD0D5A73E4C9D8C0E75ACBDA71A7691190B410D226035E60E5E8CD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401080, "uuid": "b3979286-c845-4650-9eaf-1543e35f3e8a", "value": "768:EN8fWlfoQmQAXV7EAQciiRcrHKOu3AfqD:YMNXFl7NNnOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675401080, "uuid": "6268f18e-8849-41d9-ab9c-b3a3364e66b0", "value": 29912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675401080, "uuid": "bc446fb7-9f80-4461-9175-3a2d6a30a988", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401080, "uuid": "3cf66713-77ab-46b6-abf9-5ac5011aacaa", "value": "ec8ebc787a01276ff98ba9153c9a3c08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e040a205-a3c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675429289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429289, "uuid": "97b50362-ec29-4f5b-8093-46ab0a55cffc", "comment": "Malware payload (RedLineStealer)", "value": "8b78784923cf9c55d70b121f3cdc8060", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429289, "uuid": "748d5521-9720-4777-8148-eef659f6e526", "comment": "Malware payload (RedLineStealer)", "value": "441ff4beae0a388f028ae3ac1b191f9bd3717f9a2577164028e71c8dc5d16677", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429289, "uuid": "01cd890c-adf1-4b1c-9f96-6b25f8e4013a", "comment": "Malware payload (RedLineStealer)", "value": "14211a12ea2a4af3095cfcc273676c781ae87d8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429289, "uuid": "46703e04-afb4-4924-9b19-d47f26d9d382", "comment": "Malware payload (RedLineStealer)", "value": "dcf671d803569350c796a78362d545d75cc013356ae5e98182e39d2dad62944ac0c5eb886ef30e1033d0810b7c627154", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429289, "uuid": "055cba8a-34f7-4f2e-8785-f883093e8518", "value": "T19864023135D0F671C5262130A830EFA6ABFEB931557985077BA413BD9F306E1A73A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429289, "uuid": "71d29173-6d1c-40c1-b95a-b1c24f7b3583", "value": "6b1aa8e68ec0f35426270b76446d282c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429289, "uuid": "5390b1d0-10b7-4e9a-a590-e847dbdaed65", "value": "6144:2akmL7eeQG/kbcCdhMJWDB4LpQFqBdeqUlTXpaWIw:2akmjQGpohOWNSNYqsLFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675429289, "uuid": "4f536474-b0bb-456e-a21c-26146fffd7bd", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675429289, "uuid": "31b8b863-7bab-41d8-98a9-9a88db67de90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429289, "uuid": "b353a7a6-8334-4c73-b2ae-1a33fa138810", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c557ecb2-a3f8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675452437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452437, "uuid": "d6e5a726-c3c6-45cf-8c80-a9f340fe4e8d", "comment": "Malware payload", "value": "eb529efe16b4f7171fc8c4e132ce0c60", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452437, "uuid": "153c8620-8758-4db6-bb36-d859052ebe2e", "comment": "Malware payload", "value": "445ee45f82c11bdaaeef1a816c54d537307aff9cb575acfbc214eca86231e133", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452437, "uuid": "fd53643a-3e6c-4f7a-9f76-01f749b0cf13", "comment": "Malware payload", "value": "57847e14c4e9b3d11d03bec969b1c79c34c1d434", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452437, "uuid": "21e14e0b-41cb-4ac7-ba99-d2ec13742ec7", "comment": "Malware payload", "value": "e07ec514a9c6e3cf3024e49f1e25663327d6f54796fa066e7bc6d19514451dd388cfa3cd4bc4695c7ef6df6448b34f3d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452437, "uuid": "9db13d71-fea6-484e-916d-f1860d28493d", "value": "T1E2456A3A597A07E2D439F73502B1C430B6ADAF927313C958ADDA3EC2DF321806D9A51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452437, "uuid": "a8952837-fea8-49d8-aea0-265b077b0624", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452437, "uuid": "23caeb0e-441a-4e60-8ed4-31652befa7fd", "value": "24576:AlGce7MTyPdLX2tuCAe/ZX81MjOxltKwJRWDnFeoS0EnTojbFA4Pdox/O:7GjKrJEFTEnTaFxoF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452437, "uuid": "204f355d-650f-4d90-8f2e-ba8a52ec4a64", "value": 1190400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452437, "uuid": "20c03eca-9445-4c93-b109-2e56d686cc60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452437, "uuid": "e8ebf354-ce48-4779-912a-d7321666208a", "value": "DHL #109#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0529003e-a3a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675417755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417755, "uuid": "32521e5b-f34f-4503-b7b2-86eca7583e5a", "comment": "Malware payload (GCleaner)", "value": "8889000c0f00a4cc8f3bca0d1cb7d874", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417755, "uuid": "c122b9fc-1d0d-4bb6-883b-e95a2bf2140d", "comment": "Malware payload (GCleaner)", "value": "457bc72806cb41ddc32294a48f4b7ce9b6fe4cd6458b880d3ec33a3733f0ecb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417755, "uuid": "4c58c429-a721-4026-9911-9e17c16f2625", "comment": "Malware payload (GCleaner)", "value": "7e6b01a91f2ce5e7d9815d92a8ec949932f63b36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417755, "uuid": "a64bc36a-00e5-4780-8355-9d17438c87ba", "comment": "Malware payload (GCleaner)", "value": "5f5ad48f5ae6ec4aa99a01a24628df612909f0a5009bfb86c56b8ba640a2b216610651b93e8016788f6a2259e741db51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417755, "uuid": "02ba560a-a973-4c60-ab33-770d9e57f0ce", "value": "T167953389F474A173D3ABD734A87898817E7B3F2E64BA3151B14C360F2E377D1684921A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417755, "uuid": "827ba697-44da-49dd-80a7-23c81d4fe49d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417755, "uuid": "59d9bc44-c379-4c1d-8145-15de2d8ab0cc", "value": "49152:yg5U0HrNZb2XuM5ims5H4a4seEggRtmxAdlUm4mLCgv2MR:T+cNZStkVz/RtDUvWv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675417755, "uuid": "c0775812-6486-4534-80ac-1103da09b473", "value": 2001064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675417755, "uuid": "88c92e6f-27d3-4a5a-a575-b97266e34a9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417755, "uuid": "58008653-051a-4c05-a078-06e07aca8f54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982a83e3-a3a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675418431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675418431, "uuid": "f3ca1147-ee7f-4f2c-851b-ee6ef7f7e937", "comment": "Malware payload (DCRat)", "value": "ac27c0a6f62525fe96a24691ab05e83e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675418431, "uuid": "549d9989-a77e-41f9-93fe-875c2e5e1b7a", "comment": "Malware payload (DCRat)", "value": "45bb804f2217118de509c8aa1f6366aa64a6c9ba596236cf36cb0f814e4b1080", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675418431, "uuid": "4c09eadd-edbe-4ec4-9e2c-1aae79400caa", "comment": "Malware payload (DCRat)", "value": "8c4e59a5aec502672f45bdb82b5f430ddb3d54e7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675418431, "uuid": "f5076628-3fe0-4fc6-a1c6-967ab8f58350", "comment": "Malware payload (DCRat)", "value": "0ad25ce5289bca8e550953b7a6a09b9fa4a2865b57629e8336ce5cb6aa004e9e453b6a325f78e20c48512635b92e08f0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675418431, "uuid": "0d4d5275-14d2-4e52-b3ed-98859d3dbc7e", "value": "T114657C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675418431, "uuid": "bf380004-b7de-4489-ac1e-45748d9822e9", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675418431, "uuid": "7940fe28-5329-4658-aa8d-e9ecfeaf8f4d", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675418431, "uuid": "77da2850-31ae-4734-b511-8858f23868b9", "value": 1410970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675418431, "uuid": "3a1fd2ea-3597-47c1-b8b5-d50b0b7cb13e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675418431, "uuid": "46704588-82ae-4c0a-9092-7b3e895c34e8", "value": "ac27c0a6f62525fe96a24691ab05e83e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bdc2649-a3b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675422142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422142, "uuid": "3c917b61-4835-4998-97a4-7f5cf8992f49", "comment": "Malware payload (RedLineStealer)", "value": "dfeffaeb0f2be370d215530091c8ca98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422142, "uuid": "799e07d5-abce-4446-b8bd-47e31645ae51", "comment": "Malware payload (RedLineStealer)", "value": "460dd00c9d92a72214592d5a06c3968b7cad9f06276302ebc5bd1a7d8c67cf92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422142, "uuid": "0642eb99-feb7-4d4a-8a68-cae6fd4eb602", "comment": "Malware payload (RedLineStealer)", "value": "6ccf73eef3fcda2c3e0652f1ec1349f258a8ea7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422142, "uuid": "59f7a275-f229-42f6-8959-27dffea8930e", "comment": "Malware payload (RedLineStealer)", "value": "1f29ff23b599d521ac9b191d2435b05265e7a31cfeb954f70e4a1f4eaddd9bee69b22169483c23842091c8abc8968d83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422142, "uuid": "a5f40346-82bc-4ee3-bd38-cbc071bbfa94", "value": "T1EF64012276A0D072C17790304D20DA65B7FEE631157D684B7BA907AD9F302E2A73B35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422142, "uuid": "8d7cc0c2-4fe0-4459-be4b-c1904708b9f6", "value": "b65d7d05727ada8b2acd168719f50dd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422142, "uuid": "ed5a84e1-b88b-4d56-a7f5-e16d53d1ba67", "value": "6144:gna/oowLMSQtbZlQp+v4UWuH6Tm4e0DgqgpANcl8Ua+kh/3g9:gnIwytbZGpelWGoDgMw1ZkhfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675422142, "uuid": "e770529e-d767-41c9-a37c-e6a9da5dbaa2", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675422142, "uuid": "ba146990-e8fa-4d8b-9060-cd20726c5c34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422142, "uuid": "1ba23ea3-805b-410a-8d33-ea173c05e9bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e2ff81-a3f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675451893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451893, "uuid": "49626e74-5a1f-43d0-a8dc-a67b9eaf9d6b", "comment": "Malware payload (SnakeKeylogger)", "value": "973d6bb15efd90c87c861bb50682b4e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451893, "uuid": "7dbc7c00-4e2d-4cfa-b969-b7134f990e51", "comment": "Malware payload (SnakeKeylogger)", "value": "464bf35525b6f482b91e5a1ba287c58304e7c41558c8070e42bdaa19769b5b05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451893, "uuid": "99e3a12a-40a3-4f71-929a-275ce40cded1", "comment": "Malware payload (SnakeKeylogger)", "value": "6be806023c19d7b332118bdc60ec2cabf4afd7a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451893, "uuid": "ffb260b7-de42-47c8-ac5c-4ec061987713", "comment": "Malware payload (SnakeKeylogger)", "value": "797bbcc827e1d64de0ac1e2b9c84b1ecc45bd2abe144e6b6ee132a911277b48a90612bd6d87531280d2203a3628ba453", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451893, "uuid": "ef6ef5a1-dd85-482a-b40e-8f23063d825b", "value": "T10F3601F1A0FB8492F147CD811678FDA545B230E3EDD908B8531DA744CEAFD963A48A4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451893, "uuid": "47276f36-60bd-4b81-9cc0-85fc94910a3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451893, "uuid": "25c037a5-a81a-4be7-92fb-6a6ae38b36cb", "value": "24576:VBgHFLM9d5M7WbzMdMp+5R6hIONsEQ/xWxPNnb1T/d+BIPFsKmQhhEG6veOSV1jF:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675451893, "uuid": "d67a8e2a-5105-4563-a709-be111d7c2fbf", "value": 4988416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675451893, "uuid": "8a6e06ba-a64f-45ed-8f10-d5bf1f6dcce4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451893, "uuid": "1e2be328-e651-43d8-bc14-a943558187b3", "value": "SMGS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966611df-a3fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675454506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454506, "uuid": "9a80a1a1-020b-4e30-9fec-7d290b2260c1", "comment": "Malware payload (PureCrypter)", "value": "f170fd20713fd75cab9e7f107f099e9a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454506, "uuid": "e8dcf69e-1dcf-4094-89b6-4031d9df1af7", "comment": "Malware payload (PureCrypter)", "value": "46962910101f24cea5430b64f9ff9830585a94824b8835c452c36e2db74ed033", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454506, "uuid": "3a5efeb5-4409-48f6-912e-e259a541a5cf", "comment": "Malware payload (PureCrypter)", "value": "01aee2e18af4a122d34ea5d666e3301e64725bfb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454506, "uuid": "959164b8-73cd-4a78-a1ae-64043dafc546", "comment": "Malware payload (PureCrypter)", "value": "a9497f19a912baa234137bc96f0020688eca93c404c4cdcdea872f6a5183924218538f956e848b157d80272f201a9688", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454506, "uuid": "f5d45ad2-2236-453e-bde6-d6481571c009", "value": "T10AC52907B9D5CE61EA582F73C0AB6C1443918762EB13F30F29ADB3245C037A16A995DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454506, "uuid": "b1f5bf5d-e557-4cc6-9f0f-fb500aee6960", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454506, "uuid": "5283f6e7-7f6c-45f1-9c93-a528f04359e3", "value": "49152:bDSzpwjSGz2l6Sujw/yQPu6zlFMPEdqNc1uKfZQ:bDSzpwjSsUmlmShNZAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675454506, "uuid": "f263ba10-a42b-4b58-ba54-fd88162c70fe", "value": 2569216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675454506, "uuid": "ba0a9cc8-5528-4c97-8544-850afa3d144e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454506, "uuid": "1693887a-e166-416b-a1f2-7434b02e2efd", "value": "8008b1c3d4681d0dfcb746edb5f96295.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c5ea7b-a3d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675434939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434939, "uuid": "4c559c77-8a5e-40f2-937a-ee842b6c679a", "comment": "Malware payload (AgentTesla)", "value": "8a80deda6089d4ec669248c5ac2e8cca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434939, "uuid": "41d2db27-2d45-4994-b78d-d10bfcfe212f", "comment": "Malware payload (AgentTesla)", "value": "472e60a2c0f1f41c0e2adf4a849376a09050a035d0f8cb2ca8b0f341daefc4a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434939, "uuid": "b99f16c1-f4f8-4124-b741-b231b5c38b72", "comment": "Malware payload (AgentTesla)", "value": "7840c07d4d8f75dcd747d96912d2518659c0cd56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434939, "uuid": "c4c369a8-1cb2-4cc2-9d27-62fbe01aa21d", "comment": "Malware payload (AgentTesla)", "value": "1688b225653e0adc70e375fafbf53b64045ef150cc2d4d25e8da190d3346c770af642669f546490d2c8e41819d16cb28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434939, "uuid": "b625a12b-2bdf-4c94-94ea-78e077c080f3", "value": "T183A401952BC44B6DE8BDA3782675384057B3A2CBFA72C72B7DCC52F53E903812782165", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434939, "uuid": "ea436492-f7cf-4f8d-b237-702c69d41548", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434939, "uuid": "8c812a09-82a6-48f4-a64e-e49f18ac78c3", "value": "12288:JCQ5gnHbL8z2hb/ha9SctISaeumhiF0AQ8Zazas:V5gm2bhqh8Q8ZaGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675434939, "uuid": "30b176d4-318f-439a-9255-d0360f512fd8", "value": 487936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675434939, "uuid": "2f426ddd-1b05-4694-ab9a-57203dab55e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434939, "uuid": "fa5b3fc0-666b-4649-a9d4-05700d3494be", "value": "RFQ ORDER-T2190-CVE97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc9917e-a3f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675451911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451911, "uuid": "4cd83df2-d951-4189-87cf-049e2a76772f", "comment": "Malware payload (SnakeKeylogger)", "value": "496c2794aefc720bc71fd57c5ddc13a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451911, "uuid": "f2122a4e-92d9-40e4-833b-c8d3ca0924e7", "comment": "Malware payload (SnakeKeylogger)", "value": "47a98390d2ac2a88d7853877e3c2f1d3253f90a0bb0f61b37570294e00a1107f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451911, "uuid": "10a67015-4fa8-4168-b4fe-dca0c2ad3e80", "comment": "Malware payload (SnakeKeylogger)", "value": "324d529b527c343695ffd4ce94abde0dd29252c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451911, "uuid": "bf270aa2-de23-405b-a8b4-9350be563a53", "comment": "Malware payload (SnakeKeylogger)", "value": "cdcf00843faa0eef945c96537f5a25beb2c3259e99a3f095e77e9997adcab9fb84332b0f19f3377464532927e6bbc809", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451911, "uuid": "9ccf9881-b8ff-46b6-8f76-2ec251376a2a", "value": "T1113614F1A0EB80E1F147CD811AA8FD9515B230A3EDD90C79131DEB44DEBEE953A44A4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451911, "uuid": "7aaf1cdb-6a82-40c0-885d-b089532c7e3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451911, "uuid": "4f3b0b6d-7269-43d2-886c-380344d48aea", "value": "24576:50Mwg7OQcjsDvuvkxDaQ9vSmR7d7lacOJuJ6Exgd5Hf2icQaux8:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675451911, "uuid": "c2bb9a1e-997e-4a7a-8ec1-9539291c79cf", "value": 5061632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675451911, "uuid": "6e4649be-a7da-44bf-a7f1-4a0689b173d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451911, "uuid": "cbc157d1-108e-4c83-b4d1-fca194ac5187", "value": "INQUIRY - TENDER RFx-2172200126 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f512c0-a3f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675451316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451316, "uuid": "b28eac79-f93f-483b-8f03-5a94731105e3", "comment": "Malware payload (Mirai)", "value": "830028831f3c7d154478bb3031d49eb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451316, "uuid": "31f4530a-36b3-4fb9-9afb-9bbbe54a1247", "comment": "Malware payload (Mirai)", "value": "47de64ea7c5d09a2d4d661bdb60720b9cf83f0e71225a7c6d2085f54b38bcba0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451316, "uuid": "6f61b137-84d0-4ce2-bfb9-994cd1ee9e44", "comment": "Malware payload (Mirai)", "value": "13c6f11df0454bd64c648a3bbd5fd95311bbaf36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451316, "uuid": "c63a9576-0bf0-4f1e-a21f-8449e2d5b8c9", "comment": "Malware payload (Mirai)", "value": "61cd5cc33485305d76b12d96510f9d6298dde9658df59b1a6302f3ee56220ac481f7c1e652d5082924845043cd470b58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451316, "uuid": "b4ab6d13-4f65-482c-aaed-e9e4b1691f91", "value": "T115631A86F4A18913C6D416FBB56E50C8375A43AAF1EF3203EC210F547A8695F1E33E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451316, "uuid": "102cb4bc-3a18-4621-845f-1a0fc92079cc", "value": "768:Z6DJDueELh5e4Cj8+7ZGrwR5rLS63nPf/uoxCWlNq5dRa8FhRByfelbkNt:KJDHEl+74mrXP3GWidRB5LIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675451316, "uuid": "269bb5d5-b5a9-491f-bad4-f4091b844590", "value": 69436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675451316, "uuid": "8afbf9d8-f038-4af3-b24b-53a653f7fa67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451316, "uuid": "af72e5a6-d54b-4970-a435-bd04a11da169", "value": "830028831f3c7d154478bb3031d49eb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf6ace5-a3ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675448613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448613, "uuid": "8f684d95-b23b-4326-b39e-e3ba288c0fd3", "comment": "Malware payload (Mirai)", "value": "2b8f57665ae9e45c23b7e725c27f1ec4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448613, "uuid": "70e7876b-d64e-4d5d-aee0-ef25785239e1", "comment": "Malware payload (Mirai)", "value": "4820fbdacb658a500d1dae415c1a9a7c145c06982d42425dbf89f27d9b0364b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448613, "uuid": "c62f7d9a-b5ed-4ff4-aad3-55f1ecf7ed00", "comment": "Malware payload (Mirai)", "value": "5231f39647b1abfc0cd6118bcf04ba6ab194ede9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448613, "uuid": "2e05c598-e863-4ed3-8f1e-e5873b429c12", "comment": "Malware payload (Mirai)", "value": "5eaf549a334a346c3e943400c94f79af380a011d881377746a8fd86ae29b6949725de6bc0155522e00d4c1cf71d68f57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448613, "uuid": "817e26f5-8267-49f3-a37f-a7d457e50ef7", "value": "T1B3336C36E029DED0C6560134A4E88F751F03F1C893536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448613, "uuid": "4f32459a-2e97-4d9b-84ca-095ea483d989", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675448613, "uuid": "668c2f76-c697-43d4-99b7-102fe612317f", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675448613, "uuid": "c42fe321-ce98-4f6e-9b5e-bdd413cd157b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448613, "uuid": "b3423028-e6ba-4762-a53a-9bf5e83388a3", "value": "2b8f57665ae9e45c23b7e725c27f1ec4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ed8991-a397-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675410784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410784, "uuid": "9bfd2064-df4b-46dd-9c18-45ab16ce1e2a", "comment": "Malware payload", "value": "680f7e27d155aafb7e8424363e5878ce", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410784, "uuid": "261ac1a9-1d07-45fb-9738-990b36975b2a", "comment": "Malware payload", "value": "482bdfa5f745d0e52fb5020d3a38ba4d5e0661ac8fda60a632cbccf8d5a2c424", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410784, "uuid": "5bbaad76-052e-4393-a911-c3024953346f", "comment": "Malware payload", "value": "b16357cf1c943ad9a062e23fa18e9a7fa7e3057e", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410784, "uuid": "aa8ddbbb-8051-4a07-bfa4-da19215d6afe", "comment": "Malware payload", "value": "fc0e4cdacdb8613a441e22b19d3338ac279d7e8e0950166f3278f6b3a59c260ccbb249c0b4fd3202e5e1c248da2a5d84", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410784, "uuid": "7b1f84b8-9c77-4e3d-a9f5-6ba1608a2edc", "value": "T134B49D036510EF8BE41983F8FEB35D981F47AF59A5553ADB10023B8B3F71292289B61D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410784, "uuid": "ccef9257-cc50-4538-92e9-6bad9a09eebb", "value": "12288:blaFiKXKY02NM0ry+1bp85p1Wrx5GZPNkV2i:sLKrZy3p85nExcZPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675410784, "uuid": "4d8ec398-546e-421f-9d27-2a40d9d39ccf", "value": 531456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675410784, "uuid": "e7ab19e8-39a8-409e-8378-1bcd1033af78", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410784, "uuid": "ce1d2059-5c0f-4574-a4f9-7d37d352216c", "value": "RequestXForXPI.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5830a7c4-a40e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675461703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675461703, "uuid": "e652ae8a-68e2-412b-bf6d-a81e94fab284", "comment": "Malware payload", "value": "93213031d315ba7a8309434bc8063a6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675461703, "uuid": "73e1ba0f-4769-463d-8cc4-1bebbe826378", "comment": "Malware payload", "value": "484c4d458fe33a9a7c0575581f97f8053943dcd4218e4c2bf404a384e0f34fd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675461703, "uuid": "2f924366-4241-4791-a153-f04a8db857ab", "comment": "Malware payload", "value": "b6f8aa5dba4734fc466a29c4c442b151432e4dda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675461703, "uuid": "8d659051-8590-44da-876e-ab5e8e575d01", "comment": "Malware payload", "value": "686d1e70f33a7970999bdff48b05839957d5f914c66ee2cf4b40d1766270486cd3779fc21ab7460cc1e109731387b192", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675461703, "uuid": "9d3ff908-9edf-45bd-a428-8568654672df", "value": "T1C654F1323690D0B1C5BB58749C10E6E5ABBEB431C1B58A137BA416FE4F706D1EA36327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675461703, "uuid": "2d07aa17-c0b4-42bd-ba10-a22c3f111e9b", "value": "11deee92ae37204b8493d8d64f5f1f69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675461703, "uuid": "fef7ae9c-7950-4c01-8a4d-246c703633f2", "value": "6144:DvYZLW2Kd1RYKF7AGZYBGv/Qp83sZ7/p++3LX:DvYZ5KSKVeBGnQpfU+7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675461703, "uuid": "c5a83dcb-abe1-4147-b471-0a5d238dea92", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675461703, "uuid": "00332038-8969-45be-b58f-8d8700518f27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675461703, "uuid": "3fe5f085-e82a-4e3c-9454-297b0ff85cd2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a47e2c-a36a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675391473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675391473, "uuid": "dbf05ffb-c16d-4a75-be7a-8c9b4a78bb03", "comment": "Malware payload", "value": "030a9c431d5e727fa64ec62594c2294c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675391473, "uuid": "7afda9df-dad5-4606-82bc-54bc791e6a47", "comment": "Malware payload", "value": "48778d60d4c68b219a1697868e93444c29a6d5293cdc68910cad6d3711a682cf", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675391473, "uuid": "73ceaa11-f805-46c6-95c9-9b61633477e6", "comment": "Malware payload", "value": "504d31a225a796538ffc5957d2145610ceaca570", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675391473, "uuid": "cbf94d92-026f-4a63-93d2-4293c128bfd6", "comment": "Malware payload", "value": "36a2071b3a777f6b4608715f33079e3749037b09a8af2a67566df202e3ab385ace388075f54a57f66671881c48369d7a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675391473, "uuid": "1e7e28e8-82c7-4fc0-82fb-f3caf6a5e2d6", "value": "T1B82733930C169CCAD0326439497F2789A871CE1E3EE2BB621444DE77C5F34658AD9FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675391473, "uuid": "d91094ec-6c73-49b8-bb57-9df4167156c8", "value": "393216:7YvsJA35z7A79L+n+T1mbgafiubcwZ3bzT9i/zVN2I+TXQBiKpPbNiRSKcsGJP:k0JA35z7c5v5mbBffcK3pi/zVN2IkAIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675391473, "uuid": "f411205a-445d-4219-8f2c-a9206c4fb381", "value": 21502742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675391473, "uuid": "aa5a5fce-5fb7-4aa6-954a-29d27d31b5cd", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675391473, "uuid": "64707b4c-b13d-4270-8034-c1d459f22b80", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af4348b-a37d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675399404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675399404, "uuid": "5772ad21-b1a2-42ed-9678-185711208295", "comment": "Malware payload", "value": "ab456dce4fabb276c7f4302e765fd009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675399404, "uuid": "d5ff9dcf-66c2-4136-89d0-d064338ac4d6", "comment": "Malware payload", "value": "4880de00afbe1f1b80661197925fddcfe6b3841f09627733f28cf3199664a3fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675399404, "uuid": "f38812a1-307c-455d-8b83-8f539570af45", "comment": "Malware payload", "value": "3584de2b8d1a0d4248e72dd03e370a807565d204", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675399404, "uuid": "72c0644e-b08b-4096-9812-31343e398454", "comment": "Malware payload", "value": "9be318fabea8ccb37c0633713ad6ed0f1b648c8cb464cc0c44429acf3751e6de46ad2cc665da7ab74c367ec79742c9f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675399404, "uuid": "613e987e-b685-4317-bf25-32af86af0527", "value": "T1E876331239F682F0D04725318A847F64A978DF8A4C608D7B333E4B9CD5B9D43665F2E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675399404, "uuid": "1988f540-178e-4bdc-90a8-0467bef4ef8d", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675399404, "uuid": "8a210a05-297e-4eb6-8bf5-04d65e0d63b5", "value": "196608:91OvBJvFqFuWR06wuYGg77uBixVwjWC2cvzg29Az0TpraTs4iUv/DnMFk:3OjvYF3R06wuYGgvDVwjp2cvzg29AeKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675399404, "uuid": "a1a3b400-242a-46e6-94c6-1b301b78b197", "value": 7649034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675399404, "uuid": "387cde31-4e9a-45ee-afaf-680ded3fdfd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675399404, "uuid": "b73707b9-8d9c-4496-b332-935c8b8e7827", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51223c01-a3f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675452672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452672, "uuid": "616edca4-164f-4c2d-b49c-ed711d02f70f", "comment": "Malware payload (Loki)", "value": "c4d20feb6dac35e1c9ace1696249bfc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452672, "uuid": "e3819c9d-8218-46fa-870d-d25bb7e0b236", "comment": "Malware payload (Loki)", "value": "49a72b7b19be17369f4afbd539465ab34d7c2d46e1988ccd90e93a5b9dab4105", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452672, "uuid": "75444833-e8a7-4034-ba5f-06be4c92a74b", "comment": "Malware payload (Loki)", "value": "97d801afa8b30d4871d91202db7535fae332fccc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452672, "uuid": "88995bb5-9024-4b4d-98f3-71cfaa474e0e", "comment": "Malware payload (Loki)", "value": "7ddbfcb03f8e21380970a15b76bf7e299b04b26e099dcc28dbb92947ef67176c8d03697dafb72e9549d2de7facdf826c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452672, "uuid": "dedc2d61-6ef5-41d6-99df-f1f29bc86307", "value": "T142F46D6337B099B2F78720B104287A9C6BF17513BE16E2939BB737C06785DB77298142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452672, "uuid": "e362edf4-57c3-4349-ba26-1f20a83ba80e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452672, "uuid": "bd6fcec9-4dba-4185-9b5d-98da847bd15e", "value": "12288:i2hefaqG4yPaHrT1Yr7cNjD5p/+QrCMBiowkoU6Fy2Mxzo3:ioeSqG4yPaH3NDD/+sBfwkoU6F0xM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452672, "uuid": "f310927d-2b24-41b6-aa30-3f095769536d", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452672, "uuid": "6cac35c3-199c-4931-bee4-b594b9265ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452672, "uuid": "17f68a8d-c411-4e36-9124-e51704748010", "value": "c4d20feb6dac35e1c9ace1696249bfc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33efda2a-a3be-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675427282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427282, "uuid": "cfa34661-c6d1-4ba8-84b4-0b1b55a84122", "comment": "Malware payload (RemcosRAT)", "value": "9795f039501486fe4f331200431e21c0", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427282, "uuid": "f4cd6ca9-e756-4c16-ad28-6e51a9c66dd1", "comment": "Malware payload (RemcosRAT)", "value": "4ae1035134ff758e3061a4e823d31d238ce80d6f41128710523617ca54727097", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427282, "uuid": "728e5912-883a-47ab-bfc1-a34904bc4803", "comment": "Malware payload (RemcosRAT)", "value": "55779a037dc572a04ee55d669ba95a1fd4d287aa", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427282, "uuid": "47f4bc14-f164-4a51-9b22-bad1d58d68b9", "comment": "Malware payload (RemcosRAT)", "value": "d797077f508463c068b576b2e929b830ce7fa0defd90a7072467117a938a3d31cba05bc3329e63f42eadcd72b198ac75", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427282, "uuid": "756caca8-04fb-4d7c-b3d0-0c0702bd862f", "value": "T1871533844678F30E1FDB1F6E8C6A47CE477A6B07653665FC758170A0877A33B2A2E190", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427282, "uuid": "44c5f0dc-1e84-4c54-aaba-c477955071f9", "value": "24576:uIl4DdFvrq6BcF9gzqP16Fc5EIGZSXqE7lk0dSaId:jSDdFGtF9g+168Efc6USaId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675427282, "uuid": "dfe29667-153a-4f15-a70e-299f0a3ffad7", "value": 943829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675427282, "uuid": "1d9bb262-2be4-4b5c-b25d-017976b7e409", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427282, "uuid": "80e15515-6cbb-4e62-b7d8-7b45f96f6c63", "value": "PO 001, 002, 003,.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a0f839-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675454154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454154, "uuid": "895c30fa-2d99-4ce3-ac25-de1c0fd6b6a7", "comment": "Malware payload (DCRat)", "value": "a54547df71f7306baa6117be3f4b2de3", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454154, "uuid": "efbadd39-da3c-4a65-828e-4c6ecd013978", "comment": "Malware payload (DCRat)", "value": "4b197407fc5ee2263487334c02db901af46f0ec3991eadf787e598f3ceb8d247", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454154, "uuid": "326eb3bf-8d72-4e3c-9269-c0abff7029c0", "comment": "Malware payload (DCRat)", "value": "9dd51b5d75d82fb4d54fcf01bee7c352e6cf06c8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454154, "uuid": "3cf3075b-56cf-4964-8fd4-6ef7ccc4e3fd", "comment": "Malware payload (DCRat)", "value": "0ff34affd13d2e26f2b7d910c80b150576267185ab3b98c113df045a3166b594854ee0b9974c617ffd8f5d996cd6e465", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454154, "uuid": "1aece95d-1adf-488d-a7be-391be720e5f1", "value": "T1BE557C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454154, "uuid": "2d4f13cc-84aa-410b-bcd8-cac43d97c0d4", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454154, "uuid": "8234d320-3b7c-4088-af48-f887988b7a4a", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675454154, "uuid": "6e571971-ee6e-49df-96b8-2a25eac1dfdc", "value": 1407678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675454154, "uuid": "aa3e30d9-bb23-4d0f-8e85-f3c5d955f9c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454154, "uuid": "156d84ed-9594-44b5-a731-c4da7c473dff", "value": "a54547df71f7306baa6117be3f4b2de3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482b6529-a3b4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675423021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423021, "uuid": "05e07a5e-c68e-4e7e-a376-b83138721b39", "comment": "Malware payload (AgentTesla)", "value": "d0b5157a6912bb9e22bcee4a62795fdc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423021, "uuid": "9b8d8ead-9268-45ae-83e9-6e28f4221b6c", "comment": "Malware payload (AgentTesla)", "value": "4b2fb9cf30f2decd8a519fe93881ff94b368f69c87570060133201ed4925d193", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423021, "uuid": "9583cb2d-c1c6-4406-a8e5-2ee93800c1ca", "comment": "Malware payload (AgentTesla)", "value": "2bbe7f83485ae00a13d25adc60609d84740b6172", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423021, "uuid": "0f004eac-bac3-4162-a7d1-7f75eadfe80a", "comment": "Malware payload (AgentTesla)", "value": "a727e4aed497716554f76e9ec0b84b6b054e2c1b93684b0eef465965ad82db3753d57633a93cca8edd5e419296e26483", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423021, "uuid": "767001b6-5293-42ac-8350-eb9292f51487", "value": "T1C252D090212459BBA94AFE1647354D3B513EBCB50C8B03DEB1236565EECCC0B479CEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423021, "uuid": "47bc7025-c2c6-4c0a-ad31-cff17fbe55cc", "value": "384:JTX+nJN2sJxxzIuSL+cUvVkDTIpo7LFiPU/:JTWRJH7SyDyDT2qV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675423021, "uuid": "0df299b1-fba3-4a32-aa16-a67fabef22b4", "value": 14122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675423021, "uuid": "890d97ee-7274-4c5d-9862-1b6202229298", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423021, "uuid": "86a643b5-3bef-4c92-9562-f1eda1ec7757", "value": "PO 4500022412.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf0bc62-a3a0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675414599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414599, "uuid": "5e47ae93-2df7-4899-b88a-805ac90440bb", "comment": "Malware payload", "value": "8944eff464c214d28068c662d4aab608", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414599, "uuid": "bc0f5dfc-e1fd-4cfb-9292-4d3e0411f5c5", "comment": "Malware payload", "value": "4b30e6ff64e1c2e8c1730778143489a6634c34705bdd2e5effa3e57cddf52907", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414599, "uuid": "d85be0d8-acdc-4b0b-a8dc-225bbd5420f5", "comment": "Malware payload", "value": "119d7a913d041131ecd14557bcb228a58e4d1487", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414599, "uuid": "06de2cfe-4190-4c75-9e91-95f106208ed7", "comment": "Malware payload", "value": "1ce7b556e7696b74b0be9606ba41e1eba50ff9b4fc213964d32d89747b297d36987776ca74d83609078a1894910e51f1", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414599, "uuid": "ce38d9d7-caf1-4543-a293-891f7237a5dc", "value": "T1B3247D05139B45F8D7B2BEF44DD65E16FB369A23562CC78E8F71AEA90C50220DCA460F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414599, "uuid": "6a443925-6701-4030-aa82-b290d8905ac8", "value": "3072:saA0YRw9/WITtTWR7IbNzvL1axhuWt4AJERnyNenUWHCoTCCCCCCCCCCCCCCCCCe:6a9xytedL1Kp4iERBeQvpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675414599, "uuid": "bf5b272c-f6a7-4ec3-af17-5215789ef7f3", "value": 218240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675414599, "uuid": "7a87bdc2-c1ce-406f-afda-9f0f2693d2f6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414599, "uuid": "e3c6e652-3051-4ae8-a5b4-cafe07e57034", "value": "Inv_02_02_#7.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d18978-a3cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675433211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433211, "uuid": "c064418d-0f39-49ff-93da-3b01640f67af", "comment": "Malware payload (Formbook)", "value": "03a12d7c168a1972bc8567a193589536", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433211, "uuid": "9d093f98-3c98-462c-950c-257791cbf37b", "comment": "Malware payload (Formbook)", "value": "4ba33240636533e4f8d9c8825f79f057931566bf08893e5a9b61f4e7a67a682e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433211, "uuid": "327b4c97-f182-4f2b-abce-824a88695396", "comment": "Malware payload (Formbook)", "value": "4e99db6d3634f02ac82ffc0b6cba1e5623080278", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433211, "uuid": "4ead4e03-706b-4b28-9276-54c6e3d5cbf7", "comment": "Malware payload (Formbook)", "value": "8accb0a18bc2fac4349fd6c870e8e9a9084f03f350b971ad1b59b6c5afe51347673a0f041536d7a20b1ed96279b8b585", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433211, "uuid": "e88129fd-6942-4710-8b07-07401be3c752", "value": "T180E4F0C32AA39B7BC9684B31F1B515B477F0593B4811E723FCF432E4D8A5A4A1E32196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433211, "uuid": "239f35a4-b5e5-410b-9f62-770d06e9808b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433211, "uuid": "d64df5cc-7316-464e-a73f-0f2f770ca3fa", "value": "12288:wMjmOVDf3DES1C0MYLDMrrqb6KQQ3+uTTf2:wMlD9CILgWb6KJ+0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675433211, "uuid": "6553d2ee-a82c-4d73-ba80-1f126672c7fc", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675433211, "uuid": "fafd8b48-1661-4825-9bf1-26191992b0c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433211, "uuid": "44238b2f-c240-4382-9e50-97101b0b198a", "value": "4ba33240636533e4f8d9c8825f79f057931566bf08893e5a9b61f4e7a67a682e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11779d50-a3b4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675422930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422930, "uuid": "a8055e3e-ed59-4715-9472-109c59fa06c2", "comment": "Malware payload (AgentTesla)", "value": "81cd8cc5a56d0a912c217a5d904d1982", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422930, "uuid": "ee2e1332-0b51-41bb-a1f9-ae3b7fb874e4", "comment": "Malware payload (AgentTesla)", "value": "4c5dd27fb609ca5a8a53d3051e333f6a4b3e06fb0c3b3e1b3b4022ef1586197a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422930, "uuid": "4a2b333e-be87-4739-a243-7244eb404f75", "comment": "Malware payload (AgentTesla)", "value": "bd5f259955e8a02b11ebb55f80de9878cdd6bf71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422930, "uuid": "5dae51a2-6e37-46c9-bcbf-4729d871f24f", "comment": "Malware payload (AgentTesla)", "value": "e7a0105101eded4b536aad2ee0e0f337276e4647ceb5476edb77ecb8db9ffcf91141e7013870887d5fa4977577e740d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422930, "uuid": "a99c11f2-dbf3-4b4d-a843-a2364dc9be7a", "value": "T10B843F6574C7801140F5B92B6E97FAC29B3B37D98035AEBE12CC1A0657DF981CD223E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422930, "uuid": "6873a9a8-68f1-4fd7-a4eb-7254eea10e6b", "value": "192:fQIov1ndoLdmdPdodmd8dLdNdkd5d6doXdrdSud0dadLdbd/didkdMAdkYdrAze2:flm6Efwgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675422930, "uuid": "9dcf9b3b-7cb0-4840-aa1a-2bec100c0334", "value": 391774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675422930, "uuid": "61fc7e00-f030-4002-b803-529ff26ee80e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422930, "uuid": "cc588005-7f6c-4c08-b578-38056bdf85f4", "value": "\u0395\u03a0\u0399\u0392\u0395\u0392\u0391\u0399\u03a9\u03a3\u0397 \u03a4\u0397\u03a3 \u03a0\u0391\u03a1\u0391\u0393\u0393\u0395\u039b\u0399\u0391\u03a3.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068a89a2-a3c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675428924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428924, "uuid": "2372f4f8-12b0-4767-a959-fa7bbac48de5", "comment": "Malware payload (RedLineStealer)", "value": "89458108aa7bf24a3610b1038af4dbd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428924, "uuid": "0ab53e41-fb1f-4353-9a75-5bb113bf2b14", "comment": "Malware payload (RedLineStealer)", "value": "4c71088d4df1a7c43f0d563634305a8ddce0ebaebaf2df7bcb4d972c55d91267", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428924, "uuid": "ff805927-fa25-4b1e-9c84-e115d6d72a7d", "comment": "Malware payload (RedLineStealer)", "value": "96986ce94f2a2adc2d6d200bb19cf60a6a41dd0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428924, "uuid": "24c27f8f-1d75-4a7a-8fba-a7d07998d5a9", "comment": "Malware payload (RedLineStealer)", "value": "da8df65effa517bee320cdab1b6fe778247f8684a60312661a98fb0bafca797ab16685fea912809d40c84400741491cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428924, "uuid": "e7cfdefb-05e9-45dd-9b20-a1770e05785b", "value": "T1A0B4122275C0D032CCAA51346920DB12BBBD95325575D45FBB6827BD2F30AC0AF6B397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428924, "uuid": "c914509e-c3b9-4653-8945-b18eae679c44", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428924, "uuid": "e1b9ff15-4869-4f5d-a834-35ebbe984e91", "value": "12288:SH8ugFatNmS4mEhDxRQEpuBO+XDKi3he8KXf/g3GwF:ScRmp4mEx7SX0Q3Gw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675428924, "uuid": "091e1592-2de8-4501-b2ca-6d4d305dfdc5", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675428924, "uuid": "0e730fd9-8be5-4f13-af67-e929f6056981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428924, "uuid": "72bb3ac5-2155-45d7-9edb-0e4867769e56", "value": "89458108aa7bf24a3610b1038af4dbd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3aa5894-a38d-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675406424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675406424, "uuid": "9845455e-664a-4fe5-ac5d-46be0b95bc91", "comment": "Malware payload (DCRat)", "value": "5c27b842ad3dc4e7c1f6644937a03476", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675406424, "uuid": "63d104b8-4092-4e5e-aa29-f9c88ba32e1c", "comment": "Malware payload (DCRat)", "value": "4e45355c0819b1eb679c7cdce53a2d3c2c7a637d952d0e87a3cfe69423591d9a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675406424, "uuid": "8a044fd8-e5a1-452c-9c26-eb927b854320", "comment": "Malware payload (DCRat)", "value": "7cfc17b60d86b8ec1257868cb382c5f8c2013915", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675406424, "uuid": "152aba4e-ecef-4a8f-99f7-6d856d745048", "comment": "Malware payload (DCRat)", "value": "e96929fdbc387ade616890dcdde939ec17043da108ff7e3fd77cef3a189735f91b044311ecf2a39233c9014fea4c5b51", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675406424, "uuid": "03a3829c-3d3f-42e8-82d2-ecfc28823cd7", "value": "T1AF657C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675406424, "uuid": "ef49fdb1-dec4-4453-ad9c-21a3eaf81955", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675406424, "uuid": "485faa12-2a91-4c77-80fa-ef6e6283e558", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675406424, "uuid": "f2ede737-f168-4091-9bf2-3bbd328a1516", "value": 1409914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675406424, "uuid": "811a4b7b-91bb-446f-83cc-dfb0dab63c9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675406424, "uuid": "07423f8d-1d11-4419-b64e-76f5edae0e0d", "value": "5c27b842ad3dc4e7c1f6644937a03476.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ccfaf6-a3f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675452923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452923, "uuid": "1a08be98-b914-4791-9564-abf1ecf7a05c", "comment": "Malware payload (RedLineStealer)", "value": "1d4800f767b781a2722b4065b1da840b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452923, "uuid": "4ed9d75f-c0f5-42f0-996c-0b19b3911094", "comment": "Malware payload (RedLineStealer)", "value": "4e926a7ef3f5d7890cf3b890000757c2f79aac161f8359d460b9c9e6383b149b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452923, "uuid": "2d9e4748-8d73-4b12-a928-bc51cf4e56ff", "comment": "Malware payload (RedLineStealer)", "value": "6609cb73985b04a428e882cb62f696fef3f246c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452923, "uuid": "70462acf-4605-4afe-9734-a83014651acd", "comment": "Malware payload (RedLineStealer)", "value": "25fc3256eb62691f5aced1dc6336bff20321e3f4f39e858a6f4e41e1ca5cacc841b0b55b7d4a77c46222f4e3ed8bfa8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452923, "uuid": "8c39218f-8aad-4714-a4de-c3cbafb620d6", "value": "T127D412313290C0B3C577503068A8DB75AF7AF6325AB5495B77BC4ABE9E306C0192B35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452923, "uuid": "d6697bd7-d8ca-4bd3-80ed-e4fafe973a16", "value": "11deee92ae37204b8493d8d64f5f1f69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452923, "uuid": "d6adc556-b27e-4f38-8afa-6d99987ebbae", "value": "12288:IopYivC19Nn5J6UBubFSDg7StGshu9S4rV6x+mCw/h:IAvOV5J6U+1Iu9kxu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452923, "uuid": "07d632b1-6b5d-46cd-8952-eb526b1612ca", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452923, "uuid": "14bf5697-9ad7-48ec-ab3b-d536a32a276a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452923, "uuid": "d6f69992-45a1-448a-84ab-76f278331987", "value": "1d4800f767b781a2722b4065b1da840b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba22ec92-a35d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675385846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675385846, "uuid": "cf2b9c43-b0c3-4884-a3e7-d568353f9e45", "comment": "Malware payload (RedLineStealer)", "value": "228cbd10e51eb31332fc0eb7488b47c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675385846, "uuid": "465703f4-74bb-4351-ac97-ad155b3b7a81", "comment": "Malware payload (RedLineStealer)", "value": "4efb4f9512c3ab9f014214f54299326b535205a2280c838827eb4ab81e4b9a61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675385846, "uuid": "e10c02f9-614c-4174-8bbc-d7c359e308f7", "comment": "Malware payload (RedLineStealer)", "value": "4109404e187d5a63d3e0d8260992f0ac93b2ea6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675385846, "uuid": "f1c7b16e-7c5a-472d-b4e5-fe4a966b6c68", "comment": "Malware payload (RedLineStealer)", "value": "2db462d96ec523ada59eb2734e2500c96861ffd0621aa553c94ebc6f2482e72c171d7ab7aa11fe8bc7e4f9fc9e80990a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675385846, "uuid": "482a37e8-80c7-4aef-85dd-ed03eb2ae048", "value": "T13B94BF426292FC41DA21CB729E1EDBF47B1DF9518EA86F6A12185F3F19B1073E5A3310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675385846, "uuid": "c7f3b56f-28fb-40ae-9840-1f2693f42f98", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675385846, "uuid": "f53da1a1-e469-43bb-884f-793756b3e659", "value": "6144:92kWLsnZo7GAxMgJcjVBszlWwxg5hvYCk3JFVLWlwKwpxXQzGsjV6ptCbNKN:92kWYZv8MScjRwxigd9SleXQzGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675385846, "uuid": "8c85a3a3-e4ea-46a3-a93c-2e24adecea74", "value": 435200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675385846, "uuid": "2fa873ce-16df-4c7e-ab23-6a1c27759911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675385846, "uuid": "eb03f6ae-8087-409b-a26f-e7f42b4e118d", "value": "228cbd10e51eb31332fc0eb7488b47c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1610e853-a39f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675413918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413918, "uuid": "dcd0945f-a57f-40f6-a496-5130d9148035", "comment": "Malware payload (Mirai)", "value": "e9f406785f2b1cdd0e6caa9daf30febd", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413918, "uuid": "fc0d665a-2da0-4f54-8f26-73a67edbe9d4", "comment": "Malware payload (Mirai)", "value": "4fe8dbfa2ac6b96bb14ed7d6f34930a865ccf6b406053c18e78d8a7845659c1f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413918, "uuid": "14cbcc3e-041a-45d4-bbe8-096eaa508c24", "comment": "Malware payload (Mirai)", "value": "a988babdca6b5f051be5d95f7788fd5b2de6b2a5", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413918, "uuid": "0468cc45-6d50-4b0f-8fb7-5cffb4b6fa94", "comment": "Malware payload (Mirai)", "value": "f785340975f99993ffe00529e0f3346d529e34f6927fa3fe7fba249fdcc8132ef3fc627e1024c3f8b190714c4e5785e2", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413918, "uuid": "a434e3ec-5e9d-4878-9734-29ca95bf7d72", "value": "T1AD33280BA58181FCC569C17443FBB53AC876787E0239B1DA7BC8FF176D85E601E28889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413918, "uuid": "0e1557ac-feab-40d9-95bd-d9eb3d69069b", "value": "768:Dbs093tGOHn2PAe6nCAQTGWexrecbwBg4ubt7Itw3/E1rjWb571H7HYOngg:M0937QAe6CAQiWexKg1Mtwc1rs71H7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675413918, "uuid": "b7751857-f346-4ee6-ad83-eab36f2de7fb", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675413918, "uuid": "741e780d-ca0a-4928-92e8-bff1449636c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413918, "uuid": "a8803a77-d99f-49a1-8304-4590c0db5a6b", "value": "e9f406785f2b1cdd0e6caa9daf30febd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "610ecf00-a362-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675387844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675387844, "uuid": "2a85d2cf-f0b6-4698-af84-5a0baa0ea82d", "comment": "Malware payload (RedLineStealer)", "value": "7ae178f4d0825f84851e172ef5718b1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675387844, "uuid": "2be17c65-755a-41b6-8761-b828a6e275be", "comment": "Malware payload (RedLineStealer)", "value": "5038afc9317be5ae2bd3bfeda959b82a085f2b3c52d14df2b76fc09aa3352307", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675387844, "uuid": "397d411a-a2fc-4638-8aba-3bf31814edc9", "comment": "Malware payload (RedLineStealer)", "value": "f19ebecf5fea973803f5a41bb7bfe7c48a5a459c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675387844, "uuid": "17aef2d7-b04c-4278-bdcb-740035d59bde", "comment": "Malware payload (RedLineStealer)", "value": "879a7693de0c667ba719d3ba380758307c23408dfde02589575af3d24f36555b886544d16aa174b71cd71d19769453c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675387844, "uuid": "bf95b161-6d43-4c2a-936f-91ee09f585c9", "value": "T1ED94BF4262D2FC41D625C7729E1EDBF47A1DB9614E787F666218DF3F2972132C2A3220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675387844, "uuid": "04ffe6fa-7513-4701-8ff0-42814635cb8b", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675387844, "uuid": "686c8258-e97b-4694-9728-abe1ae57fe2b", "value": "6144:7hItLzMLGn0XFySOZXr96lbLYuYa3lwKwpxXjV6ptCbNKN:7hIt3M60Vli7uQneleL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675387844, "uuid": "451e2a7d-fe9e-458c-a8c8-61251a5dbc11", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675387844, "uuid": "32b942a1-d8d8-42d8-b718-105dcb2654c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675387844, "uuid": "cae76db2-9c82-43db-85aa-84f1c7f50926", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8867baa5-a3b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675422270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422270, "uuid": "c4b03c74-2845-40f4-b14a-3e2a3e1eff7e", "comment": "Malware payload (Smoke Loader)", "value": "1294919bc03b7c8c837b6bf2417e7a22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422270, "uuid": "5f35c467-d571-4036-9d1a-64caeadf584b", "comment": "Malware payload (Smoke Loader)", "value": "50656c518197fb8c01ad60a0777e6b8e1a2c1a1095e42b3b787bce9e7585d0e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422270, "uuid": "1a0f74e9-65e9-42d5-947c-0d19c8f0ce26", "comment": "Malware payload (Smoke Loader)", "value": "f6abc70a2767ea32cfd4b6bca8a09c66d833cead", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422270, "uuid": "f4a25da8-f7f7-482c-a2c5-43f9d721304a", "comment": "Malware payload (Smoke Loader)", "value": "ed76cc700a64dd2011f848a0791c76155e30888a252bc38ff83d8c7dd7fbda982bad814557a6ffd72a251507e0f84697", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422270, "uuid": "3f0ac7db-83c4-4b39-9214-92042629de15", "value": "T1E814E0327580C073D5B751745D60DA917BBEB93246B9980B7BA807BE6F703E0623A31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422270, "uuid": "501d796f-883c-4481-877d-3376a9f4b1b8", "value": "b65d7d05727ada8b2acd168719f50dd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422270, "uuid": "9cba5b2c-0000-47cf-85ee-9c2e14099833", "value": "3072:undXzFeK80+LI8XpWCm5daS0DeNknoDfsVRFKpd4NLixRFocmsi4o327P2XN:und89LI8Xp32t080fVNV69msi12j29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675422270, "uuid": "070af353-0584-4a24-9d07-a22c7800b738", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675422270, "uuid": "2886d35e-74a7-4eff-80e6-ac2ab6d81e3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422270, "uuid": "cff5397b-68eb-4aca-8a8d-e71b7e2f4e4c", "value": "1294919bc03b7c8c837b6bf2417e7a22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f45dab-a3ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675448605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448605, "uuid": "b586043c-5177-49d8-af52-a43cc7246da0", "comment": "Malware payload (Mirai)", "value": "4970d87ef1864798c8afc4adb243ff49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448605, "uuid": "5b275092-cc22-4076-9973-3885ac17bbc6", "comment": "Malware payload (Mirai)", "value": "50ed6096d5c8f58f7be39ab0ac0dc4ad168e371a95d636256aa39edd50590467", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448605, "uuid": "104c501f-790d-490e-86e2-f76a48e39841", "comment": "Malware payload (Mirai)", "value": "3872565aef236b117e8e75d23433bb7c95089942", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448605, "uuid": "6b8b9007-4826-468f-9e05-74da0b60c3a1", "comment": "Malware payload (Mirai)", "value": "3b4da672e2c62731efb716de93b00d0cf8b0aab1c14d94cc9a3744fd0f6ae72bccc920d174e219d09e0a89ccfd59546a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448605, "uuid": "abd380f2-3259-422b-84dc-2b36e3dad641", "value": "T1EAA2E114BF2882CFC832293555E9E6E61253FC61F2EDCD492940C16FF5633A96434F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448605, "uuid": "f602c366-8180-4286-a7d4-1af70fc1fe73", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaHhib+502F2vwA9dWuMW21bAK1oTh:x98o08kxofBE+ZkXaEbp2F2TWul0c5QE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675448605, "uuid": "5b272ba3-df87-4708-abf9-18de278ddfe4", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675448605, "uuid": "3d41b060-e0ee-464e-810c-5381729c056c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448605, "uuid": "6f38faed-402c-4b7d-9601-c01876c81d7c", "value": "4970d87ef1864798c8afc4adb243ff49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5737a3d6-a3ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675419181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419181, "uuid": "1f0f6dbd-7b97-4a1d-a817-118797c5d582", "comment": "Malware payload (RedLineStealer)", "value": "168487a5e00efa3b275d3ed7b44f027b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419181, "uuid": "3e8570e2-37e5-4efa-9f49-068c9767effb", "comment": "Malware payload (RedLineStealer)", "value": "51a365bc6d01ef96c52a5ac2281374bd1d1c3a04757c3d038f665ffdbef178c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419181, "uuid": "a58e0628-feb6-4f9e-88fe-6a80a243a503", "comment": "Malware payload (RedLineStealer)", "value": "f4d2de6222ef6320ffdf61772f2f1231f7e801e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419181, "uuid": "b7965eec-f514-4046-9812-7fac940e3050", "comment": "Malware payload (RedLineStealer)", "value": "b4ca5f7e181fe14080df3a4845ea54ab921d150d2ab66985c68511fd821521130c73bf5313bcc4b6d3fc85f24199aecd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419181, "uuid": "dc58310a-5422-4f4c-be27-b6e3bb499589", "value": "T13214D02275F0D0B3C4B745305D60D79A6BFEA5315A39850B7BA82BAE4F703E0627634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419181, "uuid": "182bc560-b519-48ac-8d1f-aec8f59fbbf2", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419181, "uuid": "30653e0e-96b4-49e2-a7e5-9eba19414abb", "value": "3072:qwGaXYjeXW8gL2/iBsWqZ5KIhZVR40MfjOcjaqRFjth2PkRbUqw:qwGaiXL2/iBsnWMY9fLjtqMBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675419181, "uuid": "1bd85d5d-9a17-44b3-ac76-01be57174611", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675419181, "uuid": "b8dd2f1b-6e4f-4843-8ec1-abcc93c50453", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419181, "uuid": "3adc9cfe-ae2a-48f4-a976-d03d51c02e39", "value": "168487a5e00efa3b275d3ed7b44f027b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22ec776-a3e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (BumbleBee)", "timestamp": 1675445989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675445989, "uuid": "1e75171a-3063-43e2-867b-2a46391e2e2d", "comment": "Malware payload (BumbleBee)", "value": "a740177df6f2918373d4e6f482b8c2e3", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675445989, "uuid": "1953cca7-9a06-4ac2-b08c-600586222b24", "comment": "Malware payload (BumbleBee)", "value": "51bb71bd446bd7fc03cc1234fcc3f489f10db44e312c9ce619b937fad6912656", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675445989, "uuid": "0b62b626-5c1f-4673-b5c3-f87aefb4813a", "comment": "Malware payload (BumbleBee)", "value": "4501edd7904033cfdee783c03af2df0db935be30", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675445989, "uuid": "9e1e1de9-a928-4acd-a411-92a55a58841b", "comment": "Malware payload (BumbleBee)", "value": "40a8a6b9b726f1122e9294bcbb3db29daa13313b9bfaea7a5f3ca51ba1b364113aebf0f516a37e337d72d167b3197abf", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675445989, "uuid": "f9b805a9-0340-4e59-b32b-b0cb611623c7", "value": "T18E150105E6D60EDED12AC3FB44920135E525F335A510E9BF4A8CB76EED227E14236E2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675445989, "uuid": "d180098a-0d2d-4ef0-85ec-0bd170ea6e9f", "value": "5b5de5739f4fcbaa215d9c878921b5a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675445989, "uuid": "1d22bf39-72fa-465d-a789-fc218db87645", "value": "24576:gYfSxQ6Gjq/v/PQ7fV+Hz9PuYWp9ToAbXjTA+JxN9QS:/fSqovPQ7Cs9FbTTAAbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675445989, "uuid": "d5bfea71-ff6f-4553-b350-040a09114c3a", "value": 924672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675445989, "uuid": "1a20519e-0116-42e9-9e33-728965c34e5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675445989, "uuid": "b17d59c1-9342-4e0b-b8c2-04b644b4d2cd", "value": "sample.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b3eb5d-a3ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675448579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448579, "uuid": "a68d7fa5-a4f1-4f22-93ba-7651a82e9aa5", "comment": "Malware payload (Mirai)", "value": "01fae8cd9e4e600191c1060b7a0f4a4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448579, "uuid": "f527bd7d-abb4-40b3-b8cd-15ada018b555", "comment": "Malware payload (Mirai)", "value": "51edc664637cf8523835d1aff58a8e1f117756279e56e5fed746aee51b5257d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448579, "uuid": "a1ce7b6f-7754-48de-aacb-1890432fd5db", "comment": "Malware payload (Mirai)", "value": "85802eedf36ded8c320768ec23add24e42757ed6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448579, "uuid": "84ea0284-7143-4abe-b090-0df2347e56e7", "comment": "Malware payload (Mirai)", "value": "75dc03ed6389368533ce66f37545727fb546554f3d9bfc62077d7b540974b77eb0f1ad195a731f507c8669f33eb8ffbc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448579, "uuid": "f27dd8ef-3ee4-454d-984f-c2f3b67d83b4", "value": "T1F6A2E11072A32D66E3AD1C3DC9AA8367B9A71BFC80F532766D411520C90D24B3E3CA4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448579, "uuid": "b6216344-c028-4b81-9dac-b2c8b236addb", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxj3giGhymdGUop5hKi:vvQn4j+ZO5fKAlxDgiGs3Uozn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675448579, "uuid": "0850f739-ecdb-4dc7-970c-6fb0fe999a23", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675448579, "uuid": "79fce0a4-74d2-41eb-90aa-e24d61832555", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448579, "uuid": "09086212-12a4-4ab2-87dc-d8c6a6056071", "value": "01fae8cd9e4e600191c1060b7a0f4a4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93d9041-a3e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675442995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442995, "uuid": "4df81d8f-0338-4d8f-9958-11c09b500bbf", "comment": "Malware payload (Formbook)", "value": "944928371d18321fa1e0feba40c0e67f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442995, "uuid": "dca9b9b1-0a7b-4039-84be-59282d5b3521", "comment": "Malware payload (Formbook)", "value": "5255fd7c0d9904892ed2a92ff1d08e73d59012e206c52a6865a6f6cd5f081479", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442995, "uuid": "a578acbc-6c3d-4b85-be2f-45da089ecbec", "comment": "Malware payload (Formbook)", "value": "d86d6ff74cb0e1776556457c6a59f9e0a275012f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442995, "uuid": "2ceeb0e0-8844-4af3-aefe-ed6fbb43cb0d", "comment": "Malware payload (Formbook)", "value": "cd5066d62ab1a729d03befea21794ca742b61868999b4742416e4f5cfa538c1e2434b2e2b0cb9d04cba3affe3f8dbc55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442995, "uuid": "c36aec57-6df6-4cd9-b4f5-ac42a4ebf137", "value": "T11E9412C0E290C9EAFC560B7550375E154D97BE6E2E78A50D0B1D7AA27B732C2102DE2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442995, "uuid": "b9bd8456-18b8-4d25-ae34-c00f20fdf2f8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442995, "uuid": "7638b7c0-c6ed-479f-a524-97cabb1e1145", "value": "6144:CYa64vYwZCfy/X+S87nMYfwM63HriMRwxZPm/2h/Duc3muwNHk39EhcfYUid1O4I:CYqJCfZSYnMYYM67TyDb3KkNEGfNidk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442995, "uuid": "64f6779f-5b65-4add-ac7f-66a17a8d209d", "value": 439486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442995, "uuid": "0dd6b1ea-0f1f-4360-aaab-8592407dafb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442995, "uuid": "b6c20991-3df3-4b78-a50e-e1b27a7a894c", "value": "new_order_quotation_030022023000000000000000_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8c4dbb-a3d0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675435026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435026, "uuid": "a8e9a37a-4f84-47d5-8442-1beadf9bf390", "comment": "Malware payload", "value": "912fdb94e53e6c391e9d2b618cd52779", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435026, "uuid": "82969e6e-f627-46b1-b07c-e11d9b3f746e", "comment": "Malware payload", "value": "525e191a74453bafa190feb5a8417e1752ddf01eda9f992c372f18d42b15d521", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435026, "uuid": "c00810b2-2e46-4abc-a4a5-a96485bad1e5", "comment": "Malware payload", "value": "7681bbbe93ebaf0f15cc56e5c9e08bf17a29ab48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435026, "uuid": "dabb12e7-fb19-465e-954d-ea0d2b82bb4e", "comment": "Malware payload", "value": "60a8414fdeaa5eed915c1799bb6a888b59690d8411cc964449af02ddf375f8d1bea2f23195f176de2ccbdcfab5c15327", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435026, "uuid": "d0912bb8-4ef8-4f22-9497-505e4a07908a", "value": "T160763329F6BC48B1C5A30570A97A7D6FD8768A040E1908533FC234BD0FFF4679A496AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435026, "uuid": "b4d5841f-f1a3-4e3f-8b61-fb1b3accdb19", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435026, "uuid": "96463cbe-8ccf-4e04-8772-5a0a20bdc1ea", "value": "98304:91OWf+gns5QOp+s6PQdj9nwJfdCJsujggr03+E2CPpaHrH/wUFGXXekQsnWOJ6Jg:91OWGgM5+74VgCdpMtk7su8nWOIje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675435026, "uuid": "8a5cd53c-e1a6-409f-9a89-826aec59d049", "value": 7583693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675435026, "uuid": "f3850062-fba1-407f-be9f-877d391172a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435026, "uuid": "2285e96d-34e3-4d3f-8b1d-fc6c3fe006b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71996a3e-a390-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675407629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407629, "uuid": "2ad316f0-b8ec-4310-9959-05ed1d7f529d", "comment": "Malware payload (DCRat)", "value": "47aab4fdd2521513703fe7c43ecffd7e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407629, "uuid": "b4490013-1c1c-4c40-949a-a8db95be566f", "comment": "Malware payload (DCRat)", "value": "52f6739cf13f8ed8e8182c9d775bde3d190a5e5c1a77fa06dbe3bce1729e59b0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407629, "uuid": "4cd9a93e-2b26-4acc-8e06-008aa5e2065e", "comment": "Malware payload (DCRat)", "value": "1a340ab27d4a17a9eb329bcc12526bdd7b1dc6f7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407629, "uuid": "f65517f1-56df-4fd8-87f7-af03fe5ce97d", "comment": "Malware payload (DCRat)", "value": "6ff4fbe2f8087e8845873f3bf5f800f11089884bc7a03e97ea587729d2b741117191571dd4ebd6f48b53d727fee26602", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407629, "uuid": "4a109bcf-73df-4119-bb1d-dc05b88a23fe", "value": "T1A6657C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407629, "uuid": "d323a711-5f72-4aab-b453-084e95c796c0", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407629, "uuid": "7843fe60-a7da-4726-b7af-9541b794cf2e", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675407629, "uuid": "2e4727bc-bc4b-4f9d-a0d2-0e2c617e4d1e", "value": 1409306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675407629, "uuid": "7add3aae-9e68-486a-9efa-15abf5988097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407629, "uuid": "d16c6e94-b902-4e36-ab2c-26c071e8577c", "value": "47aab4fdd2521513703fe7c43ecffd7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c779da3-a3b4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675422948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422948, "uuid": "8641187f-afb0-4a73-8594-03f3a2fdca5a", "comment": "Malware payload (GCleaner)", "value": "a94307366805cf081366a35aeb861c58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422948, "uuid": "39c53bc4-c611-42d6-b5ba-e755ae77ee13", "comment": "Malware payload (GCleaner)", "value": "52fbada06e35bc4398e16639caf5aebc3333eb6ad2c9c132f99da1cfc3242f2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422948, "uuid": "0f10a4e0-51f8-43f7-ac8f-ba33136622d5", "comment": "Malware payload (GCleaner)", "value": "e3709cd804fec9f17b8a3fd9b9e8df27ef38a9c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422948, "uuid": "e0cf0c6c-47c4-4a0e-ab59-b5fa8638715a", "comment": "Malware payload (GCleaner)", "value": "f45d64af67eb2e6515b881bc70dc48ac3447a60f6c6bace7ecd2355e7c63844d086fab70471f9d3a4c4f6f9179ddbe7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422948, "uuid": "80d13901-3feb-4330-9774-3572943b4b1d", "value": "T19AA5334E729BE237E22687784834804B9037FE617D780368762D291E3F772E6741B769", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422948, "uuid": "c96ced7a-13b7-4d24-81ad-3718e6556ce2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422948, "uuid": "b2ae2987-eb96-4fd6-b1ab-74729de4f143", "value": "49152:yglXZ8zhJzPitd52L7B5cvdOG1OKSHLCgv2MR:TlX2TKtd5wAvqKSTv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675422948, "uuid": "5cc300ea-0e8c-4150-9200-20742fc9e769", "value": 2065380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675422948, "uuid": "76360fdb-fa39-4f01-b6cd-dcf878b1f209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422948, "uuid": "16486cd5-1dc5-4152-856b-47d56fc52c19", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6ebe79-a3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675442381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442381, "uuid": "c103a7fd-aaca-4b4c-8058-3b331320dc94", "comment": "Malware payload (PureCrypter)", "value": "09630bba99a5d96a0212a1c43089e0d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442381, "uuid": "959dc44c-c173-4177-a4c4-14a40595d592", "comment": "Malware payload (PureCrypter)", "value": "5371dcbe437250016f876cab055a5cd0b445644b2f937030c1c23d59c1a84613", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442381, "uuid": "d01ba621-4c48-4fe9-a983-400781920c07", "comment": "Malware payload (PureCrypter)", "value": "e28f16ec2e8ccebbb6e5af67c606e18b712bfd22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442381, "uuid": "1bff813d-4e80-46e6-babc-dc4c766150be", "comment": "Malware payload (PureCrypter)", "value": "02f0c8d97d3778102bd7897fc77e2fc1d7e9904e246f4c658d10e202bb51f409ae9e3138c726acbad0a4e4251073144a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442381, "uuid": "61a85b5f-e5d1-4501-8598-49c5c803f648", "value": "T1B55533E3AD3C464F163BB5098179E4B7F48231E8BE7AC89515160CD9E4D238EB254B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442381, "uuid": "50d375d2-4f40-4eec-b120-e231816dbbdc", "value": "24576:gA+aaa/FCt17bad4u09YLvPp3fIX2fAPCW+IkS8kVEKxlF865OPHiAFoxEA05A:zz/FscDWkvPdf0JB+YNSM/OIEA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442381, "uuid": "9db6536e-8599-4f5a-824c-43d5f6e03869", "value": 1281563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442381, "uuid": "6df1dd4d-2948-4516-b93b-cb0fc5d2fd55", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442381, "uuid": "92eadee5-a90e-425d-9f73-fb55e3276a9c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7e825e-a3f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675452667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452667, "uuid": "91820077-0094-48b8-88e8-86ccdf4fa2db", "comment": "Malware payload (GCleaner)", "value": "ab5ab5ef110066f38c29662557496599", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452667, "uuid": "b7e98ecf-e61e-4e1c-b2c3-ad7e1b8e2cdb", "comment": "Malware payload (GCleaner)", "value": "53ac66db6566bbe48f8922874b9b4576ef8b27b65881b37303240b0edd0de66a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452667, "uuid": "e185037b-9b14-4311-9b1a-be1714ee047e", "comment": "Malware payload (GCleaner)", "value": "5cb718f186a9e6e948cedd7ef0249c6a50025383", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452667, "uuid": "200e6091-78b6-4648-a191-b7ee260c04a3", "comment": "Malware payload (GCleaner)", "value": "4a7ef2941b94086200e630ccef51b867e83e8f2f49cca9ab5d36182730a5ee1c7aeec2890f0a7f95ff9e5fd04862e4f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452667, "uuid": "2849c67e-f217-4947-8a16-d206e55abb64", "value": "T1E195336383B259B7D0120A76956D9881C9E9FDF269704A9830AD338C3F7F275BD2E314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452667, "uuid": "7387326c-2b70-4d88-ae5a-63d52e2e5fd9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452667, "uuid": "27380568-919f-4ca9-8ecc-6c6c6209c9a2", "value": "49152:ygnNy2zV2SR0eOdKWZlGu2UXuL0yj8LCgv2MR:TnNy2ESSndwVU+zAv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452667, "uuid": "cf60ef12-0070-4a92-b2a5-d615ead444b1", "value": 2058962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452667, "uuid": "28619e82-7b10-45c5-bda0-961f8869247e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452667, "uuid": "8e0a1253-bc23-4618-8957-89afb0063016", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d70174b-a3cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675433311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433311, "uuid": "2e98b701-843e-47f7-829d-bed7dbeeb9fa", "comment": "Malware payload (RemcosRAT)", "value": "b359f4af5c88b1e237db9738415b7682", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433311, "uuid": "8cfc43d4-4bb3-471c-b0db-af1fe9ec93e0", "comment": "Malware payload (RemcosRAT)", "value": "53ddb9a75bca1115a66745b28086afbd394cef38f8437dda641b1219111df8cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433311, "uuid": "083e2f35-92b9-4eb7-81d4-6fa1dd143f61", "comment": "Malware payload (RemcosRAT)", "value": "d7fa6d87594ea4d8b5740d54fdc204b08f4e9439", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433311, "uuid": "774cd489-039a-4e56-82f6-2ab10f59b123", "comment": "Malware payload (RemcosRAT)", "value": "d95e45a47e9f58f0094ee821b4b3f992631c2668e8aaf0814faa87127b4d57487485ab959b3397dc213818730bf5d090", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433311, "uuid": "04587a8c-49de-47d1-b643-0585d3e3a308", "value": "T1DAE1E625A3FC8333DEBF477658BA63A04374B31268078F9EA8C6510F1E456C64622B70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433311, "uuid": "890930e2-e49b-4bd0-b406-d600c7a07fca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433311, "uuid": "b8f688af-dfa7-467c-971b-426bbdb6ae6d", "value": "96:xtEsKVeCVIP7bLp8LAn5c8aY1ej/kKV+J2qzNt:xUVVIP7bLrEOejcKYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675433311, "uuid": "701e4140-3097-43be-9d24-ce02cff30665", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675433311, "uuid": "205924ee-1e70-457e-9e27-4b8006f8f933", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433311, "uuid": "08736ef6-d5b1-4e55-8cf8-acda84e4ed1e", "value": "PURCHASE ORDER_16096.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec955ba-a3af-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675420831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420831, "uuid": "e60c59f5-280c-443c-92fc-a7d39474f9dd", "comment": "Malware payload (RemcosRAT)", "value": "253fcaffc0bce333e9a417f72dbcce17", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420831, "uuid": "28140b87-425d-4d49-8a1b-b58c30610251", "comment": "Malware payload (RemcosRAT)", "value": "54664bc0840187e3dfd58b4ca22e33fd2a8012d371e700a7fd7ed08ce2df558e", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420831, "uuid": "fde2b30c-e839-407f-82aa-75d4dc00b3e7", "comment": "Malware payload (RemcosRAT)", "value": "1362a42ae1f955ad732c78436b9e94282ad95d58", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420831, "uuid": "d4dfbf74-bf61-492e-9618-aa3679130bc1", "comment": "Malware payload (RemcosRAT)", "value": "c09c072a9ba4f0bd0c038c494492a76d0109af3d7349fcf6b0f3bbbda5c0ee337402734e43d9b07b17f47961f2ae2e23", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420831, "uuid": "90cfb981-dadc-4f29-9a6d-8617c3b2664e", "value": "T15E1533ACE14AD590A7B64E47F3D44F64DE14A4467BB28980403CACBAEE785DE4EC36C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420831, "uuid": "da40527c-3953-4471-813c-0ee0cd931f10", "value": "24576:GMYV+glRCT4euWHC+51dLfT9UsdUdmhzYdMT:LXkTeL1d79kYzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675420831, "uuid": "a1baf143-fe07-4119-81df-7e9e23d41967", "value": 931676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675420831, "uuid": "c5a22db2-ef35-4a93-a4b3-3b22277a630f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420831, "uuid": "dd2b5700-1409-4278-8d62-e75f553a7f6f", "value": "RFQ NO. 01.300.TRGVH PDF.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5ff247-a407-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675458836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675458836, "uuid": "456b2ef4-e202-4ec8-996f-a1787e88a015", "comment": "Malware payload (Amadey)", "value": "b4da88d909e6b22bf480852a32059036", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675458836, "uuid": "b9cc5fa5-5950-4a9f-9ecf-4427b3462b0d", "comment": "Malware payload (Amadey)", "value": "55a1d7e0314e4e1e3a68eaacc8446bad8a889f0297dde42fcdf1ca16971e195c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675458836, "uuid": "6e46b9b2-ea7c-4c1b-89a6-86fdee68bde3", "comment": "Malware payload (Amadey)", "value": "81ed4a3a2485df0adbac164723a362e5f152f8a8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675458836, "uuid": "61c02c6a-5c21-4976-a3ef-6f99fc71a5f6", "comment": "Malware payload (Amadey)", "value": "a2e1d7fc0a2551db22760da5d989fceeaf7589eec45f9d91c45644c6198251fb5c0fc50a2194ba007b01617618e3ed42", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675458836, "uuid": "7b2a1ad1-540b-4756-a8cb-28a2a21e2903", "value": "T17ED4123336E0C0B1D6B651346824DBB86B39F4314E35D95BB7AD07AD9F302C1A67A386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675458836, "uuid": "43f70e5c-17e4-41aa-a7e1-6a0549a75098", "value": "11deee92ae37204b8493d8d64f5f1f69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675458836, "uuid": "0f00675c-d9cb-4ac7-a7a4-b5b239f65a5c", "value": "12288:UvODSa9O59OnlEe+1a12x0jVfVvWCccKqlu7Tj/j1+GZ5YXD:UW/059OnlEN17UW/munj/j1ZTYXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675458836, "uuid": "83fbc347-ad28-41da-b3fa-ffdef6ad07d9", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675458836, "uuid": "358e9d76-8496-4240-8e72-ae852143ee68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675458836, "uuid": "3948425a-6fb9-4d47-8b96-a5b1bf32867f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64923b4c-a3a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675416627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416627, "uuid": "7bb378fc-36d6-4891-9901-0cb6f24cf6c2", "comment": "Malware payload (CoinMiner)", "value": "b9341eca3593111f5a8545e2d4101064", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416627, "uuid": "56512905-1bf0-460d-ba0b-3dc35203dd35", "comment": "Malware payload (CoinMiner)", "value": "55c97066f408cdbdec892b89cf8eca10f48d9566a7bd36767ed0f3e8ed311e94", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416627, "uuid": "afbd1dcc-f8b9-4f07-86ce-03d138bb53c3", "comment": "Malware payload (CoinMiner)", "value": "4da702a31d5a3fa62d71923be4b85be494e62b62", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416627, "uuid": "32925ad7-ffe4-44bc-8662-25b4b421ff92", "comment": "Malware payload (CoinMiner)", "value": "c5bc24d8427c44d903bffed1975fd0ff99055c03113f71e5dfb5e0d3543546297ec47131eb0563ebabd109a8885ddb41", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416627, "uuid": "38026d96-c3af-4f89-8da3-621365f04a55", "value": "T140F5702D3B79EC34E406A6BBC7A285A2D506DC31D923CA1B3509FF99B536F5012F134A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416627, "uuid": "420d2e8c-18bf-495f-8102-361fe09b69ea", "value": "69592e0cf045e2d24989c22013a2a660", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416627, "uuid": "43e8b0de-778e-4266-80ae-936856c38a17", "value": "24576:6qxsO9r2JQraBpA7NblIFX0oQwvohAOzj/zNx9vLcmdgj9e/z0mSlLi:6qSBQaCcXdQwOr3zj9vLcxJC0mS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675416627, "uuid": "535c1a1d-1ebf-48fc-b025-60477ee62ff3", "value": 3566592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675416627, "uuid": "0dd744bc-e21f-4218-9bcd-f3b7ad2cd530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416627, "uuid": "a846ac38-f2d0-4890-8419-67d90c28bc2b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5ae4b4-a3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675442279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442279, "uuid": "b9d762da-6ac4-46df-8f1c-6fc8610829d7", "comment": "Malware payload (PureCrypter)", "value": "ca795b83329ed357fc36aa582897e533", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442279, "uuid": "4868d459-ce30-4486-a23c-fdd97d48ca7f", "comment": "Malware payload (PureCrypter)", "value": "565157cbfb3324ac9e1f84abcb9d40735eaaef4b3d7a83884dad0132c9cf1f75", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442279, "uuid": "f403ad07-482c-4052-a75c-b29d5849a21c", "comment": "Malware payload (PureCrypter)", "value": "9c17e6baa805475fb6e297bd0cc8884897abf5e6", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442279, "uuid": "b706e498-61e5-4e40-8c42-f51fc9892909", "comment": "Malware payload (PureCrypter)", "value": "83a015dc42a278a989e5634873a04999e5ee85d25645f08f82e48303e2b45ba4deb3d953d62d1eb06b0fda2bac0023d1", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442279, "uuid": "824460f4-d859-465a-8a7a-36c26f7fd742", "value": "T1DEF1B415B7FC8233DFBB6B3E98B763900378A70165038F5D68D5A01B6C066D68322B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442279, "uuid": "9e2fc55f-a6d7-410a-a5e7-1c84a703583f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442279, "uuid": "4122fe98-99b9-403b-a323-482dd5c51fb4", "value": "96:istMszkeYx0KfqKXlsZFLQzLALAX5c8aY1LkkXIkvozNt:isdklx0Kf/O/LToEOgi7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442279, "uuid": "5db10306-1526-4c35-827c-8d0ccd21ba56", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442279, "uuid": "fe1bb5fe-7d48-4f62-a6d7-71c481f730bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442279, "uuid": "bc01172d-2710-4048-86a3-908f0170b859", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc40fc1a-a3e2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675443000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675443000, "uuid": "a7dd802c-d4a5-4126-9e99-001d1e21cc22", "comment": "Malware payload", "value": "172761090fc44d17ac1656c4d45d9d1c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675443000, "uuid": "7e60a075-df0a-4ce7-9bea-6394bd9b3736", "comment": "Malware payload", "value": "5684ca4b982780b499b58a8fe7c3ebddcfe854db691f5455918377757cf1ea3a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675443000, "uuid": "7d120d81-f202-481a-a6da-b48b6624b951", "comment": "Malware payload", "value": "5da6c2874a283ca2d30d530f83f9327553036aa6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675443000, "uuid": "80db69da-2c14-4acd-be2b-0acf35e582df", "comment": "Malware payload", "value": "9fae166bc516d8e289cf1ef58b8808f3dcc32958731cf6bb0da40658987b00e2e1c243d79a955235900861ae8ba9a4b9", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675443000, "uuid": "1d04ab35-f078-4f10-b1d9-ab75053de9e7", "value": "T152262351B783C936E5AE427C7A59866A044AFC3187E688E733EC4D0F3AB39C11136F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675443000, "uuid": "fad820f4-e077-4efd-a190-b41b1ecc54f0", "value": "98304:8YjYeATgCr7csQuGsUKb5LSihQsWve0hYJgLDgcRJa4lj9naOPH5a:TAgMcBuYXi2L20agHNRPjcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675443000, "uuid": "0948e14a-3dae-4ecb-aa7b-ee4a26d7912a", "value": 4813312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675443000, "uuid": "4040c040-4145-4e3b-a6a7-69831f7c67f9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675443000, "uuid": "cecd9b50-a498-4620-a6a3-c27d99044999", "value": "Doc_9934422.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca6c2c0e-a3f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675452446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452446, "uuid": "67ea55cc-484b-4631-abf0-e9c903340c11", "comment": "Malware payload (Rhadamanthys)", "value": "3918162810c776247acaff739a0f6954", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452446, "uuid": "d2eb711d-aa17-45e4-a118-b1a940f5419d", "comment": "Malware payload (Rhadamanthys)", "value": "56c14c94190e51ce84326f7d36e9ebcb6415dd5ee62c7852db97fe4a92cecc8c", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452446, "uuid": "ec4e4934-2ebb-40f4-93f4-15888af08823", "comment": "Malware payload (Rhadamanthys)", "value": "d515ebaba41d2a3718552ee257e84de27f13ab56", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452446, "uuid": "9d1d9da9-5d5c-43ca-b737-2597ce7af9fe", "comment": "Malware payload (Rhadamanthys)", "value": "8a4ce843f915e287df63906ff20cc04a7d73f1d59cb01e8d5b12c00af8246ce77d5c2c12243e04c5dd9bcd60d78f9e05", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452446, "uuid": "da5288af-46f2-4f09-9160-65b52d55167f", "value": "T18D75BF4996E404B9D5EA5B7B91D129B6EBB851EDE6323183705730D82CCEBF00CA3BD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452446, "uuid": "ec0a1183-2995-45e2-a7c3-01bef7477b2f", "value": "eb55e8383c5574f7ad2db6dad2bf9e8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452446, "uuid": "09b52687-67e3-4b59-bdc4-0abc61c32fdd", "value": "24576:6lfFyNzDFDWxuQJBUct5Ya22HW99+x81U7U0TMjDAKLJu:6y9Dp8T5GMTqDAKLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452446, "uuid": "e9879ebf-2da0-462a-a084-a2cbcc59b079", "value": 1668760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452446, "uuid": "0a4c36d9-6235-4717-a77c-b12fdbb824be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452446, "uuid": "e1487c3d-dd41-408c-943d-3209282365cb", "value": "DHL Original Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9e81d5-a39d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675413075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413075, "uuid": "c34380b9-ac97-494e-a0c4-2ba6da771a39", "comment": "Malware payload (Amadey)", "value": "99da62d9cef192aa4cc7c4912301f98d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413075, "uuid": "18eac63a-6100-4171-9671-b5c9ffe0554b", "comment": "Malware payload (Amadey)", "value": "56fea109ccc3a7ac6897d0856ad89cd5b6aa9048532102fa15285a184320cb83", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413075, "uuid": "f62e9541-6c52-4166-b409-680785311404", "comment": "Malware payload (Amadey)", "value": "ab565eaf605ecf17a5ccf364b041080e0a3204ff", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413075, "uuid": "a8068dfa-9bb6-467c-8392-d8656b775c39", "comment": "Malware payload (Amadey)", "value": "73871ccd70feac13b7c6d0181a58c0299cb636e376ef767e5ce1223fc48040bdea4f12e98144179384c58d7fc8f1c5f3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413075, "uuid": "82a3aea3-72f9-4720-bad8-8471d698c833", "value": "T11A54E022F5C0D072C5BB10305D20EA596BBEB531597A954F7BAC3BAD9F306E0923631B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413075, "uuid": "5238b2a4-ca90-4851-975c-81a2ae9a4aba", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413075, "uuid": "67b60fe6-6c3c-4d70-8b4d-37d88aa647f1", "value": "6144:Z7eNYLxceb02l5j4iyDzmL7D1CIidK1C1Sm5kYwB:Z7aYF02/Eiazm3UCqbVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675413075, "uuid": "989a68d1-373f-4398-982e-dbc6477cbac4", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675413075, "uuid": "f84835b3-2249-44aa-9b3c-21fc60f6450f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413075, "uuid": "db5cf8cf-d6d7-4c93-ba32-08d5e2ba4399", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3d1c1d-a402-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675456829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456829, "uuid": "0c006815-f8c6-4b48-bbbf-1023cd7f9bc7", "comment": "Malware payload", "value": "32aa12a6a5c0b4ff90a71d3d9b6ef6ac", "object_relation": "md5", "Tag": [ { "name": "1675417198", "colour": "#E1D5CC", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456829, "uuid": "0570b1b5-36f7-4991-a009-bf6ea12e773a", "comment": "Malware payload", "value": "57481b5e5e67398ee364272e3ddd881f5ade02d5dc7d32cbf2e1d3b64806063c", "object_relation": "sha256", "Tag": [ { "name": "1675417198", "colour": "#E1D5CC", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456829, "uuid": "1e072c2e-e770-4b42-83b7-eff4bf853dc5", "comment": "Malware payload", "value": "563f2f52e99879c935ca5e93c6f6c315fb24d365", "object_relation": "sha1", "Tag": [ { "name": "1675417198", "colour": "#E1D5CC", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456829, "uuid": "7660522f-364a-40e7-b591-3c61333fa3eb", "comment": "Malware payload", "value": "6978cdfc725c419b6cfa0566d51e25ba11652bdeb044f185479fe75f30dd75f1d20baed4af43810ae0542fe1e8a57ca3", "object_relation": "sha3-384", "Tag": [ { "name": "1675417198", "colour": "#E1D5CC", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456829, "uuid": "20de5e7d-4387-4420-bcf5-d631d2995bf5", "value": "T1ADF280FCDD6F04804B22DAA1B3426E6A7B3D62BCFE420D54F2663D8C91C2554A186FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456829, "uuid": "ae0961b6-ca5f-4df3-b72d-c228cc7ae961", "value": "768:QFKmzFdScWmbiC/9TUMNDthx66lhke05Q:QFKm5dSmR/9ASJv66lD0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675456829, "uuid": "537e66d9-ce2a-4309-a486-940d4b438153", "value": 36152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675456829, "uuid": "09005fd1-c195-42be-bb2c-d1ae9d645108", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456829, "uuid": "6fc3a1d9-7d83-43c9-bed4-8932448efb53", "value": "Open.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf0f126-a3e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675443001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675443001, "uuid": "434a51b6-c2da-4240-a863-6b8da033a30c", "comment": "Malware payload (NanoCore)", "value": "3ac05bbe35293fbfd0df49ecfb34c461", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675443001, "uuid": "36b87002-36de-4d1f-9b71-e4a97d74cfcd", "comment": "Malware payload (NanoCore)", "value": "576263fb3c88934ebdb0aa6071f3a980710c9dfd2a3d63d09b0aa76f1caac9e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675443001, "uuid": "c5db8235-42f3-4834-ac6a-7227e20a3440", "comment": "Malware payload (NanoCore)", "value": "ee12d93ac5f81036e920bb8c05638aa4e6c1f3bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675443001, "uuid": "32674648-d488-4628-9f73-9212f7ba23b0", "comment": "Malware payload (NanoCore)", "value": "cfd67401bc271c8534ce02828acf2a2c5537562312fd48a1ab9bf61c5b59ab4d411cdc9193c019929943689a150e5a7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675443001, "uuid": "d01cb6fc-c1f7-4e72-b386-11d425994bb3", "value": "T1AD451202BBC695B3D5A3193256753B11BA3CB9601FA58ECFA7E00A5CDA315C0DB317B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675443001, "uuid": "3101ed4a-75a9-4242-bcd1-b47135f68bfb", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675443001, "uuid": "1ca201b1-dfdf-4bf9-aa45-099e09379d89", "value": "24576:9TbBv5rUeTM/TYaxVKPijgGjFwJ5gRn0Bz76hZYBA3pUd26P207:XBvsHB7jQ5Cnq7+ZEA3pEt+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675443001, "uuid": "eec2fad2-7fbc-4c0e-be7f-9cddcb9478cb", "value": 1181640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675443001, "uuid": "94e74c72-ffa2-46f2-bbbb-380267fd199d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675443001, "uuid": "18e0f8af-ac77-4447-a8c7-5b8006abf35a", "value": "004349256789197.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768745e6-a3a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675416657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416657, "uuid": "017e20dc-c15d-4e3b-925b-0465cb589fa0", "comment": "Malware payload (Mirai)", "value": "6eeebb405d06002cfdf06b81dc9f7749", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416657, "uuid": "625598c8-ef04-409e-bb17-04629cb68c0c", "comment": "Malware payload (Mirai)", "value": "577f8b805cb825d2443c9fe28587d2f3038b437ee6740f1c0a78e3ce3ee9c5d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416657, "uuid": "47da4edf-00bd-4fb6-80fd-fcb9940548d7", "comment": "Malware payload (Mirai)", "value": "2a6bd9b93569da37245383a16bf2cfc573c661a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416657, "uuid": "87e41953-f4c9-4cc3-a318-187e178db56e", "comment": "Malware payload (Mirai)", "value": "415ef642329a43a72fa03ac205fa524c3f805eb2b0d4a26e188233e123b952c1c7e69c39d3bb60c6d9ffc5b3158e040b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416657, "uuid": "2034826b-d2d0-4f51-a3d4-d3eb9b3c402d", "value": "T112632A86F8528517C6D416FBB66E50C8375A43AAE1EB3343FD210F143AC694F1E33A96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416657, "uuid": "a29943af-ca8c-419e-9ab2-c9c20886f53a", "value": "768:kuFwdgWI0Uz1s9TBakRNgNBQ9b0I4i6PLsqSoTsRNqGdowxvxG6UJ/+vbY:LmdtITkRuNOX4jpSJdXisbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675416657, "uuid": "b400cd88-6de3-45f2-a2cb-babf0bafacb5", "value": 71544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675416657, "uuid": "4dfb6987-037f-4b09-ace9-376d700feb02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416657, "uuid": "2ee03c8b-ad4e-47d8-a349-cd62deeee2fd", "value": "6eeebb405d06002cfdf06b81dc9f7749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0224e305-a376-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675396275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396275, "uuid": "e2b336e1-fd8f-4dd8-a8d7-ff200c42eac4", "comment": "Malware payload (RedLineStealer)", "value": "15b5e2430a20ca3a97c96259323931e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396275, "uuid": "bc067e93-fe42-4b3d-a74b-e3e3ad976447", "comment": "Malware payload (RedLineStealer)", "value": "57a630b418e3160ed49c7a1ed7dda0f59b69c997b9f64d639382218be4679eab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396275, "uuid": "9811257a-05b4-4bf2-8f0b-44feda8ca61a", "comment": "Malware payload (RedLineStealer)", "value": "282e5a849c213ad3b797f1a14f1ab8d7c7ecc163", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396275, "uuid": "4857a4fb-3128-4d32-b883-37e9351767cb", "comment": "Malware payload (RedLineStealer)", "value": "5ec88263b3938db3f8d924a3f12f4481506aa9b48dbc8f29428157c506745096f59da0c217132988f487b8e134068756", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396275, "uuid": "07038fd7-bdf2-4e80-bc68-90c248cb7669", "value": "T15C94AF42A392FC51DA21CA329E1FDBF87A1DF5918E287F6652585B3F1872173C5A3320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396275, "uuid": "cd2935ee-d11e-4b92-aaa5-c5ce45850930", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396275, "uuid": "949292c3-f5d8-4d8c-b98a-9f4c1f7ba32e", "value": "12288:YInoCaB/Nm38qc2cYOPca63R93t2KeXDleN:Z41m38CcYOPchRj2pDleN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675396275, "uuid": "8823e071-b114-4337-ac9a-382b4156b245", "value": 434688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675396275, "uuid": "7c7a1f63-0cfc-4018-a86d-6b041ea05689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396275, "uuid": "6c31f92f-c4e4-4cd7-87fd-792e27fe693c", "value": "15b5e2430a20ca3a97c96259323931e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49060d5-a3f8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675452463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452463, "uuid": "39e5739e-aa27-465f-b66d-2a2c5a98eb5f", "comment": "Malware payload", "value": "970f06c83b7baae942f57b1620f6a864", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452463, "uuid": "dfaced5d-53f9-4974-9636-42a402c4ec3b", "comment": "Malware payload", "value": "57ea2ba4acc9c5856a08e2e1e242ddb9bd2beb479c38cd0524bc6b2831cd9eb9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452463, "uuid": "8eca3433-54d1-4e43-ba4a-2b89fb083a0f", "comment": "Malware payload", "value": "658bb0706034ff1eaa5c86abd6bd9a74b7bd96c8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452463, "uuid": "e6761898-c026-47c7-bcfd-390f1750c18c", "comment": "Malware payload", "value": "a0bf3dee970d45c6d5659d82bdc8dcea3fa451e7121e8abe3dcd10a8a1626f98fae1da47d83258e4ff61214f376aec7d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452463, "uuid": "e7cd48ab-a655-458a-8e52-fbe30e256b2c", "value": "T194727ECDB788C5D3FA5C24018C3D254E46ACC967E49D92EBEB1B3A08E6D530EE447358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452463, "uuid": "6538199d-5fab-4d78-ae48-b12f6c888edc", "value": "384:gaDmiW7YEz3xZQjwRpa6dhRyAY7rX7Nx+QDBltjfRkMZ8rd4cXLoU/rvE3:hDY/70UDRyAY7rrNx+QDBPtxLX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452463, "uuid": "adf1b6a0-e410-4cad-950d-19400660f1e1", "value": 16496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452463, "uuid": "ad315db1-080d-4b92-91a5-546294cdc2c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452463, "uuid": "a9643751-5bb4-4763-9a10-1209dc2386d8", "value": "RFQ-Q530610.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1987f1-a3bc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675426489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675426489, "uuid": "3ba505d7-29a5-44a1-9b16-10633d08b00e", "comment": "Malware payload", "value": "1fd0bf9bef2badfd6f6061f372e027e7", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675426489, "uuid": "7860010b-743f-45c7-9714-140f30844990", "comment": "Malware payload", "value": "58fd23e02ba5d6ae4b6662f427c047d62ed34eafc4e547aa62f059313de75397", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675426489, "uuid": "5bc213e9-32b6-4096-8670-8c6fe78d2168", "comment": "Malware payload", "value": "4afb7ef6bc94734222024f22c623aba4bbb8bf38", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675426489, "uuid": "b87e7534-18ec-4f1d-a166-3ef67dddd0c8", "comment": "Malware payload", "value": "f7e15a10fe1d37cfd939e5145e2ae42608c85d6b4c3e026cbdc632df9ef2dbe1e8c790097fd676d3b31e652bfbedd4d3", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675426489, "uuid": "6652b395-11e4-4774-afa4-b348bd4d6756", "value": "T152D493152AE1076BEBBF873BD7F66C52A271AA42A521CB1F9246014D4DD0380D7F683F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675426489, "uuid": "f5dfca49-aafc-4c37-bf94-c8764be5c2ec", "value": "6144:2m1H+GLZZmRYCVa/6bJDjUFQ5uB3c0U9lQcUg4yap70nGWOFX0YdXb9pYzjHuS:5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675426489, "uuid": "50b77f10-b8bd-4e69-9f2a-38cee42534ed", "value": 654832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675426489, "uuid": "d1b231a4-f3d7-4359-a282-f2f5a77610a1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675426489, "uuid": "8bcdf478-493f-48bf-9249-87c5d8ce3923", "value": "Legal Notice.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab9c7a7-a3ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675419241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419241, "uuid": "9356b535-eec3-46ff-9a22-29001b2ea4ed", "comment": "Malware payload (AgentTesla)", "value": "3b28693a81f4b8e8bc34a5f3c163a11d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419241, "uuid": "02030f0c-7767-4aa2-9303-ba5f2abb25b4", "comment": "Malware payload (AgentTesla)", "value": "597e90cad10af3bd4de583ac05b15e5697e0a57b7853fb4fca7fc8a0f7acc24d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419241, "uuid": "11a892be-fc9c-4b47-bde0-dbd2bd3a631a", "comment": "Malware payload (AgentTesla)", "value": "48e78c0bd2083959c284224107e83d8d7dbd4edd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419241, "uuid": "71509df3-7ab0-4beb-9117-8bde2ade2ed6", "comment": "Malware payload (AgentTesla)", "value": "7dcd62b1491ddf15527ea33ab392e19298088b30c92015e19ac075a03216bd07414ccd01cc8311010effc4c1639c522c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419241, "uuid": "0532c9e7-786d-4b5f-86d0-411ba908afc3", "value": "T1C403EA9421AC8B33FEAE0BFE14B9659A97F665376010FF892DCDA1D43595B804700B8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419241, "uuid": "5404add9-8d09-4d37-b21f-eb1b0b5fac27", "value": "768:ievZNsOyQ1TxGK+RDYRXsYgHa6t+S2Uqt5RYVMgE4O4v:vNsOv1T4K+RDKXS6++SHqtfYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675419241, "uuid": "1566d816-f186-4fc5-b13e-8d439603be4b", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675419241, "uuid": "64ce1c8a-ac5b-476f-ad77-5893fa10df2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419241, "uuid": "ffe2df80-f914-431b-bdac-e121cefa87e7", "value": "1835DIR231029551-CRE001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388abfce-a391-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675407963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407963, "uuid": "68ef307b-8d35-4b45-9b40-47f0832117e0", "comment": "Malware payload (RedLineStealer)", "value": "66809e9456edf8e28b1f46beedd2b2f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407963, "uuid": "ce8c0a27-7b9b-408d-831e-c83a374eb848", "comment": "Malware payload (RedLineStealer)", "value": "598c10e16aca91f38e65d9a79e4dff53deed8897678f2b6115c19eb26c2a4c48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407963, "uuid": "8513b77a-2110-4ddb-996e-fb8eda0bbf3e", "comment": "Malware payload (RedLineStealer)", "value": "3e4823efb7ac83546dd536944ec313ef7a590379", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407963, "uuid": "f790bf9b-dc9a-4a24-87c6-fc6edd0926a3", "comment": "Malware payload (RedLineStealer)", "value": "d38f4f2ca86f1b9947d6716c74d8df08f015da0937d76cab4227be9e1a41958c2cc3df833f85882ba43870cbe02406ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407963, "uuid": "7451e39c-c230-4214-af9e-918e3dbb4e2e", "value": "T123B41222B4E0C0B2C87945704814E656BBAE743145B5E81B7FA8DBFEAF70BD0163635E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407963, "uuid": "693a64b7-9a62-4fe7-9cc8-5f587e8ba01d", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407963, "uuid": "b64d8a5f-5feb-494e-aabc-d5572062a3da", "value": "12288:07y+4vCay8e6QcPfgYa5OdUBvJ01x5l0fuZfx5Z:0uvCX83hPfbOfvW1XldZfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675407963, "uuid": "c3dc4d2d-b0fc-47d4-ab3d-92e76b7c983c", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675407963, "uuid": "e894ca23-a259-4cd4-9d8a-fcb6ae0de058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407963, "uuid": "7882bbce-eab9-4427-975a-18ac3781557a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35dde234-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675453914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453914, "uuid": "58b5ae86-770f-4d87-b654-03d04da503a6", "comment": "Malware payload (Mirai)", "value": "dddc5bf0298a3e4c62b9d6b79dbf1a35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453914, "uuid": "857e439b-5ae4-45f7-836f-f259113cd42b", "comment": "Malware payload (Mirai)", "value": "59a5527fce9ed5f05e986e0c831e507897160c0e7a5caf65d0bc3b7c502fc7ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453914, "uuid": "1aa93b90-7c0b-4121-92c4-d0b8090ab0a6", "comment": "Malware payload (Mirai)", "value": "f9459ea3d8ca6fa1223392a3dd4030aab9e3a04e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453914, "uuid": "48e048a3-1bff-4785-b59e-e51ee57daf72", "comment": "Malware payload (Mirai)", "value": "67d8c1a0168395c83397bc61715d8c9a3b6c94fbf7c19957909657f3491f46120e2e02dd177dd8ec6e057a4557282183", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453914, "uuid": "5ab8b06d-062b-4523-94db-5f29b0dff69c", "value": "T163631A86F4618913C6D416FBB66E50C8375A43AAF1EF3202EC210F547AC695F1E33E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453914, "uuid": "0e2a9904-86ae-4c08-87e4-e692d4bcda1b", "value": "768:ByDJDWe4Ph5e4Ov8+79Gr8R53vx63nPfauox6WvoNqddcekFktByIelbkNrv:iJDv4J+70y38PCmWvldcNEOIrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675453914, "uuid": "0fc2c262-2804-4279-bcfc-4ed46d41d324", "value": 71584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675453914, "uuid": "4da51f24-7b8b-4b64-ae97-dbb7179bcc8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453914, "uuid": "6de826f9-cc53-4ba6-a265-ac9b24f130a3", "value": "dddc5bf0298a3e4c62b9d6b79dbf1a35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ba7b2d-a377-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675396850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396850, "uuid": "e2acd9cf-3170-45e7-9bd0-6e5de04e5bde", "comment": "Malware payload (RedLineStealer)", "value": "0340aa0d15f718f0fc3263ac7f7cbf31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396850, "uuid": "66f78d34-b9f5-4788-a9e0-b553110c7195", "comment": "Malware payload (RedLineStealer)", "value": "59b079a17dd94169757c463b26210b75e80d471fe127cc07bf34751a45bb8e8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396850, "uuid": "112ddd5f-4977-422b-8a72-2d8b590742e1", "comment": "Malware payload (RedLineStealer)", "value": "129825d737615f0b07fabb9fa607151b34a6430f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396850, "uuid": "dd378628-e9cb-44b0-9249-a13c471e1854", "comment": "Malware payload (RedLineStealer)", "value": "b733b667f39ccbe762d2861e6fa4d244e7da064cb66e6aaf8f2b62b26ab0b5b21058cabd6d0e21c29bc53290b5ec1296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396850, "uuid": "6bee47a6-ecf8-4de8-b500-83f185b37ce0", "value": "T16394BF4262A2FC41EA21CB729E1EDFF57A1DB9514E687F5612185F3F3832133C2A3A15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396850, "uuid": "6abd7ce8-f8e5-4c83-8246-4a1ea7c73500", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396850, "uuid": "5914e48a-93f9-45b2-a762-414f095f6c13", "value": "6144:o1Z0Ln2QLOfgcbY47was638sk7PTli3lwKwpxajV6ptCbNKN:o1Z06QMB7wo3ETl2leu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675396850, "uuid": "6fbf4041-6cf8-4bca-b5c2-ceb13850e206", "value": 430592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675396850, "uuid": "0b334eed-06d6-4065-863b-c615093a0b1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396850, "uuid": "a5d33df0-58e0-45ba-9b4a-f88571d1609c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8b5e31-a3f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675451916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451916, "uuid": "807e973a-3bcf-4681-aaee-6e441e896d70", "comment": "Malware payload (SnakeKeylogger)", "value": "f5e27454d59bf66f15dcde54e6662277", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451916, "uuid": "c0440986-4af5-4d80-9a28-a602e57f880f", "comment": "Malware payload (SnakeKeylogger)", "value": "5a568af629f52a8fa7bb19d8250acd03620ace089f0dd79bdb680fda04d209a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451916, "uuid": "62ce9a93-d72a-4608-921f-22403a8c58df", "comment": "Malware payload (SnakeKeylogger)", "value": "8a46bf976ecf79d799c4c9cf8e136ffd138d75dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451916, "uuid": "6d847f0e-121e-4a85-ae48-33f8fb39db28", "comment": "Malware payload (SnakeKeylogger)", "value": "cb0bf9aad89b747dfd046839d8e73886a7a9beb2e47aaa232b68d3d26f5737769c1eb7d116d4c851eb2bf96a34dab5c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451916, "uuid": "0b638ac1-284c-4f39-8c46-3d6ed07959ab", "value": "T176157D8737B1A8AFE687407144283F986FA071537F4A9213A73739D49B0D8FBBB94191", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451916, "uuid": "0c122a14-46b1-47c2-a73c-e883ee3b2c34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451916, "uuid": "230c7d3b-daf0-42af-b943-f8a690113fe1", "value": "24576:O1dH+Ao+lgPH+ymoE1rd9R/6F0xMpqG4yPa:OPHrD6f+AEHvyWiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675451916, "uuid": "17abba13-121c-412a-8ac5-373ac98090e6", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675451916, "uuid": "9fe7e540-152f-4571-8b76-1567f6b49091", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451916, "uuid": "1043e957-d8f9-4b78-a593-22cb26c35189", "value": "lista de pedidos.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97e8b2c-a3af-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675421037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675421037, "uuid": "81ab3fd6-c777-4eee-a800-555c683a31f6", "comment": "Malware payload", "value": "3a3c037561bf2c1e84e22d80d2053f82", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675421037, "uuid": "24ab7aa1-d9c5-421a-a9c4-f6dd7749772d", "comment": "Malware payload", "value": "5aa30c40e7c57ad818881e70c431fc3e0477a7193ee33ad0ed53df89d5dc172d", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675421037, "uuid": "322b79c8-80b1-4514-b697-96d71691b37f", "comment": "Malware payload", "value": "57f0091341e5f14427c8ab6c8642e17adcf5e6b6", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675421037, "uuid": "f7322f9e-edbd-48b7-9b2a-c745c30657e7", "comment": "Malware payload", "value": "a1f3d253801e29d9346624ab8de9e9bd8178156bd5aca6a237dab1b01bd26bf84ceeaf687dfe0efd9a9a457459acb06e", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675421037, "uuid": "b5506b32-57ab-42b0-8182-d46cb225b817", "value": "T12014F143AFC54D8ADFF676B9185AEE21252BB272726B43EF4E06145C1890B24CC50F9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675421037, "uuid": "28596c9f-c89f-4488-86f1-d6eeb424fb4e", "value": "3072:2bAVfBWQdmUeG33ovY8bhTh45X1mlDiZGE+BjJSoi+CkfssssssssssssssssssC:yAVfBAa33ovYY4x1mlDiZttuw/fwSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675421037, "uuid": "fa2edded-13e3-43dd-ab94-352dc1031b3b", "value": 190696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675421037, "uuid": "df3346aa-a912-4b3e-b8a2-26427192b55a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675421037, "uuid": "2a00cb03-35ea-4156-aec9-346a519486e3", "value": "cancellation.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c053611f-a3bc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675426659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675426659, "uuid": "0110160d-d5fe-4c57-b6e9-1054a0159f90", "comment": "Malware payload (AgentTesla)", "value": "a2837b3e14b14dfe1a923d97de7756aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675426659, "uuid": "ab06278a-8ae0-41a6-a206-987053df6531", "comment": "Malware payload (AgentTesla)", "value": "5b29e10291f21b0ccfc5d5aa23029878e32814c828eaa709737896d63a4336c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675426659, "uuid": "fef12dd1-2719-4d53-81d9-345f9fbeaa69", "comment": "Malware payload (AgentTesla)", "value": "20b5888028113b2d9a2185bcadda12191e73891c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675426659, "uuid": "9b7392f1-bf98-408e-9d27-a9a7a25a2acb", "comment": "Malware payload (AgentTesla)", "value": "4bfaa84cb0fb0699428fbf76f52c9dfa9ea5cb2e7df1d7530d85c0a7bb994abdd86972b68a3bfc70c045d670b18de03a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675426659, "uuid": "178e06f4-4b75-4a44-931b-1196749cafea", "value": "T129255B3E257B07D2E178FA7942E18020F6EC93927313CA98EEE52AD4CF115856ECE51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675426659, "uuid": "3c31d83e-ef65-43cc-9d48-35305315304e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675426659, "uuid": "07ee5d83-4051-4582-a6a4-55afc2a690de", "value": "24576:hlGT7MTyPdLX2tuCAe/ZXR1Mr9+5FoU6A/FnD+QzWSsfOxltKwJ:RGJslz/FntWSeKrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675426659, "uuid": "92f8d8b7-9e5a-4e16-a45f-81f9f817facb", "value": 1034240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675426659, "uuid": "3616cfc4-98d2-4932-9f43-d75be1c3f7fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675426659, "uuid": "6b72af48-e4a4-425f-afac-0ba16405d849", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d42345a-a398-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675410923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410923, "uuid": "aa9b770c-b8c7-4487-9983-da48c46af03b", "comment": "Malware payload (DCRat)", "value": "24cd52d3ad05bfc22e80d0c7474a9ffc", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410923, "uuid": "12c9c0cc-d3b5-4123-991e-50d472b4bfcf", "comment": "Malware payload (DCRat)", "value": "5b5e3d680d17e67d7dc8125762981a95bd5d08bb36d99f7372f1e46230a3583f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410923, "uuid": "5e5ba5b0-822b-4395-8cf1-c6a23c9f253b", "comment": "Malware payload (DCRat)", "value": "a79d22268607a115ff63c05dd2a6c6ebe3197610", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410923, "uuid": "964a4405-a957-4604-a9be-83c649668660", "comment": "Malware payload (DCRat)", "value": "db4cad94a9438caffb4e4e7ed6fa6382f3e0db8edc5564984e84408a54f65b9e2c1f426c3c6a46fbc97c357fdc0b8051", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410923, "uuid": "d885d7c9-ab8c-4a1e-af3f-afa7117d6c69", "value": "T12F657C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410923, "uuid": "ea29e9b9-6064-4be7-83e6-22ce7d9c9c28", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410923, "uuid": "cd2e86f2-5fb8-4e07-9936-37ba22357e57", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675410923, "uuid": "c0fbf070-eb7f-4e1a-aaf3-2bd39f8a7eaa", "value": 1410550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675410923, "uuid": "a3b01bb2-6884-4aae-82b7-c6f57ac6ae36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410923, "uuid": "509f27b8-d280-489d-b518-27cdb99c84eb", "value": "24cd52d3ad05bfc22e80d0c7474a9ffc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1095bdb-a394-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675409480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675409480, "uuid": "75eb15d0-4355-41bf-bbdc-58d3999600b1", "comment": "Malware payload (GCleaner)", "value": "8844a641a84056e6a8f6bc6e6a5d1b74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675409480, "uuid": "93f8ab6a-30f9-47e3-b66c-f35d059f048e", "comment": "Malware payload (GCleaner)", "value": "5bf4d6f2da361e0c3e204a74db171b3611e1d2c7cd46b5f3d8a5882287457948", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675409480, "uuid": "ebd2cfb9-1c2e-443b-a0be-25207c136bda", "comment": "Malware payload (GCleaner)", "value": "d576849bf9b59d3ff5f96be29b207a15c8b028e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675409480, "uuid": "59ffd3aa-798f-4e74-8713-0f1822efc4a4", "comment": "Malware payload (GCleaner)", "value": "9547fb5112e1c8cc9520bb1dcdd19c43fdb2dc175a8d9bbcf3ba161c09e074e783baf627eda942a1aea84de068d5a88d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675409480, "uuid": "75b78fdd-0d22-4979-9d40-3d0b9febbc10", "value": "T1D495338561E4DA79D223AF303AF41710FE27F9A7223622693DDCB78F2F1A2545C25724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675409480, "uuid": "d6e3ad31-a9d4-45ea-8eb0-be02d92581ff", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675409480, "uuid": "14d84fbf-c1ef-4c24-944f-102f8183da58", "value": "49152:ygECH3vny/REmN4ZYpqe37OXFyOparWKTVDLCgv2MR:TEsy/RroeqeCXFVpQHv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675409480, "uuid": "d9ca3e48-81b2-4a0b-a372-1e6ce42b4836", "value": 2041220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675409480, "uuid": "78fdf6f5-ef52-44f1-9be6-4729a60d2cf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675409480, "uuid": "57cec6c6-634f-4d8b-93e4-75b5d609afc4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c1aa4c-a3b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675424485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675424485, "uuid": "08adbc6c-6ee9-475d-b3ee-f8c413954913", "comment": "Malware payload (RedLineStealer)", "value": "23b38355f8fced727a7a51da2d87531c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675424485, "uuid": "b3636475-d684-4f44-b2e1-1169cf3d6c3d", "comment": "Malware payload (RedLineStealer)", "value": "5c5dca2dc8a0c0772521ac9a66cc35e48289361f17935372f4f832b0a78ddda5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675424485, "uuid": "96e5e915-3c39-4458-b0bb-c9b8ead2503a", "comment": "Malware payload (RedLineStealer)", "value": "1f59e02a23079adf2bcfc6a097e7a37186151da8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675424485, "uuid": "306e900b-3daa-499b-bb91-7c8d83b05c89", "comment": "Malware payload (RedLineStealer)", "value": "51a87d246e44072408cdd2b64c9a3f4f628ff0080bbe7b32cb5ed4834b722f1c5ad29ff681da8dbc499721b6176a0723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675424485, "uuid": "1c9442ea-c0ad-470a-b93f-6574c02f042e", "value": "T166D4123231D0D1B0C66B16714C60FABC2B2DE43182759A5F7F980BAA8F207D1993B397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675424485, "uuid": "2923a32a-0491-4cde-a61e-e6bbf5a703f7", "value": "6b1aa8e68ec0f35426270b76446d282c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675424485, "uuid": "975b07f1-3f70-4b58-a7e3-1d5a002df645", "value": "12288:GagGbn/w5PU5nq6irJxtCj6QGpc0OsYF4mYOlOs:GRyI5wnq6iVxtCjedts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675424485, "uuid": "764f38df-da39-4004-be99-a57d0645a6b6", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675424485, "uuid": "980c6e38-d61b-407a-a642-0c6829ef4f47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675424485, "uuid": "89f7b73f-6ed0-4c03-b0bf-9eb2bec00249", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e685f6ed-a3f1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675449486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675449486, "uuid": "73544b5d-bed6-4626-9c9e-db4e1d411af8", "comment": "Malware payload", "value": "a4b0f4acad8bccd56d7612110615fa70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675449486, "uuid": "4e734fc8-51c3-4055-a568-79e37c8ac0c2", "comment": "Malware payload", "value": "5d716c87af9b115e722584f311c48f6e1bee5d926de715001808d73883ced11a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675449486, "uuid": "07f14ba5-2309-4ad4-9220-3ce0ee312843", "comment": "Malware payload", "value": "f1ee746a4a6850cce510a96135626ac050dd7353", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675449486, "uuid": "f6c3a1ab-032c-41dc-b508-6a4a0b9fbb73", "comment": "Malware payload", "value": "1b1cfe20a34fd752a6679d8b02cc5db4a8bbcea1c5ded03d9c0a6a4a8da52f890678313a306ba995e5096aa30a2ad5fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675449486, "uuid": "2f0aff11-c1e7-44c6-8f80-9a87f067824d", "value": "T1587633827DD2656BE206F0F0CDB086C1F2F9DE04CF8880E75F9D7A2D19B6984AB1516D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675449486, "uuid": "5ae4c678-41d6-467f-90bb-baab731f2e04", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675449486, "uuid": "9fa30796-5b22-4839-b8b4-fd41422d5d4a", "value": "196608:91ONGui+6+IgSb1c6iKVZh7dDR0tuuxI2SnfSohsm6vQ:3OJi+6+rSS6lBZatu8SfSGsvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675449486, "uuid": "03206c09-5b5c-4f19-bdaf-ba557f369a3e", "value": 7620561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675449486, "uuid": "339779c4-5cc2-434e-9e21-41a36375ea5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675449486, "uuid": "ebe0f574-1a22-4fa1-9cfc-03ab814b0af4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14cbdd56-a361-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675387287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675387287, "uuid": "af7a0c3c-712c-4c13-8bbe-4a4571c164e7", "comment": "Malware payload", "value": "6534221bc87656ae05f38e1c2d548314", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675387287, "uuid": "e3159216-439a-4613-8cfa-8562ed610294", "comment": "Malware payload", "value": "5f548b67c2aa3b94c8a4bfa92b9753976ec1cf704cafab0823ddfef6ee4e6392", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675387287, "uuid": "1470ca2a-c92b-4249-86d9-98f73d4f5d8f", "comment": "Malware payload", "value": "caee0f6af45f1c0fbdba867a6651a1a5f628847b", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675387287, "uuid": "16926c30-2f89-40a3-8e42-fca7afe01785", "comment": "Malware payload", "value": "343bd46590b60ac34832eda130c911bf149c868476b22bfeed04dc8306bfc0c25fc9c7b4fd042ba23eece9a3be258f40", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675387287, "uuid": "c12834fd-6f49-41ee-b270-812e32866f67", "value": "T18BB49D03A950EF8BE01983F8FEA35D941F47AF59A59179DB14127B8B3F70292284B31D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675387287, "uuid": "811e93ab-1fd2-4e07-ad0d-6a2f9523255d", "value": "12288:hdaFiKXKp02NM0ry+1/85p1Wrx7kaosOK0:+LK+Zyb85nExAqOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675387287, "uuid": "30606ac8-073f-46f3-9b88-189d10e475ba", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675387287, "uuid": "0a739587-10c3-4dd8-9402-888d6b6eb37c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675387287, "uuid": "2c7eaa08-1cda-411b-873a-5943860cacf6", "value": "CI + PL.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61427e4f-a3a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675416621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416621, "uuid": "f5a8f68a-5ba4-4fec-b7f1-57111929aa0d", "comment": "Malware payload (Mirai)", "value": "89595a10601e1b43f049f9e9e0c49d74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416621, "uuid": "7e5f6464-9c05-4acd-a778-df5e24913c1d", "comment": "Malware payload (Mirai)", "value": "5f6a24be649c9a84bd07910fbe7f271a8c3004f0ca7fe437993f8028409813af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416621, "uuid": "941588f9-dfff-42cb-a340-a2ed87dd6f3f", "comment": "Malware payload (Mirai)", "value": "6d952dfdf24cdcf24ed3f3b44969cb22d729d721", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416621, "uuid": "3e948972-a3ac-41fa-afe2-780c8116795b", "comment": "Malware payload (Mirai)", "value": "78f4a6fd6da38a8c506c509702f79c9aa5ab9e60c653ff5a3916dc3800d40c7bb051c91372f537af6383518863fee267", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416621, "uuid": "b038d694-1732-484d-9597-7265ab6e2f88", "value": "T17983E70AFB620EB7DC9ACD7719A2174028CD551B61A97B36BD30C81CB54B64F1AF3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416621, "uuid": "fcb1010b-7f7c-407e-b138-e2b45a7f6857", "value": "1536:6dNBpAuc0/pDmhuPLKZRdgwxhnaFiJ4ZZiqgKQcEsbHrE:6+uTKZRdpxGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675416621, "uuid": "af08f0ab-6dfb-4a16-b9bc-1d062dc14493", "value": 84988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675416621, "uuid": "f93928ef-8ded-44f3-b839-6be044a8c3b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416621, "uuid": "62ae4e3f-9c57-41d9-b092-8df7da3f12f2", "value": "89595a10601e1b43f049f9e9e0c49d74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11aab33a-a3b6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675423789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423789, "uuid": "6e0da7cb-187e-4e37-99c3-1cc222e23156", "comment": "Malware payload", "value": "98c256e2f80ecafc6d9e6777b640d69a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423789, "uuid": "be47713d-d0c1-4369-b7f6-096ad516c918", "comment": "Malware payload", "value": "5f6bddf7f794fae8b52d88d92a680048c1479096255790a29090400a27eae962", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423789, "uuid": "09fa16c1-9809-47a8-9f74-9a521af4423f", "comment": "Malware payload", "value": "44eb993c25f2145a5da8ba7c6dbd0f73680bf709", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423789, "uuid": "9a1f09f2-0a8f-46ab-9bab-d242e661b165", "comment": "Malware payload", "value": "a14052df163a5cfef80a0c3123d801d653cc08d1444d95e10280dac4d9bee85993c1dd9a3c4668f04fb2e09ded1c36aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423789, "uuid": "f14fd119-6349-488b-8556-51bb5200caed", "value": "T121B37370DE4A9016C1817935CBBBC37033209CA866034E0999F67F7BB9FB1151D8EA6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423789, "uuid": "202cafbc-6de4-49e5-8e56-12e8d880994a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423789, "uuid": "e10ef32a-67f9-4c84-a170-f08ea15a33df", "value": "384:ZHV0HcEIVtDpxmogIWmScqu5UqzZoOCBIXIz:b0kn97WmScR3tCy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675423789, "uuid": "46d21ecb-e9e1-4e99-913c-64bf2e4883af", "value": 112128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675423789, "uuid": "d110417b-7573-46ab-bd32-b400528c6947", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423789, "uuid": "fd351ff8-7833-4c64-bdf5-1359a92dd038", "value": "00000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c1796b-a3b6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Hajime)", "timestamp": 1675423791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423791, "uuid": "6b96ca83-eaa8-4031-9a4c-85e94980ba16", "comment": "Malware payload (Hajime)", "value": "380c81fbf2ce56471a9fa2f5f6ddbd2c", "object_relation": "md5", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423791, "uuid": "60e04e1a-8faf-4ea1-a6b7-16f83859f2bc", "comment": "Malware payload (Hajime)", "value": "5f7a1a4a2133ca5811255dc414eaaeaa4f37b025195ae35a91aeb9a04cf652f6", "object_relation": "sha256", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423791, "uuid": "00e0e5e1-1d71-4f13-bd4d-474a01b734de", "comment": "Malware payload (Hajime)", "value": "251af0a336e00ec447c7d9277e4bea133577fa77", "object_relation": "sha1", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423791, "uuid": "0a2d6cce-885a-42b9-a248-65a58c7e945a", "comment": "Malware payload (Hajime)", "value": "f92d8173e89023df169756aa67180da1cc43bc9c6387be1ed9af930e5de622763c836653346df7524bfc731f5322d2e2", "object_relation": "sha3-384", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423791, "uuid": "9458ceca-7b86-4a11-a06d-7bd3a88cf8e2", "value": "T125F0D8F85B846E67D9F421BDD46943612B02C755956BF757901450580C03064AF5A690", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423791, "uuid": "7dad32e2-66cd-405f-9651-fc1f8d968944", "value": "6:Btk/t+l7RY4R1+st8zlxQPibhYmhVH8f/I9glqlZqDQKIqGgZsIvhP:BLey5AxQPiemc/TqlsQKIq57vZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675423791, "uuid": "f8de3170-13ff-40d6-86d5-8773dde1fd1c", "value": 480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675423791, "uuid": "d14cea22-4673-4bb0-9e66-136431494d77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423791, "uuid": "b999745f-197a-4f01-92c3-9ac121bf2e54", "value": "5f7a1a4a2133ca5811255dc414eaaeaa4f37b025195ae35a91aeb9a04cf652f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77521e93-a3d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675435126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435126, "uuid": "7d5b375f-f895-49a0-a2b0-c9d6d5f381ca", "comment": "Malware payload (Quakbot)", "value": "37c3245c8ae6b76f1394210ed66af190", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435126, "uuid": "2e850c30-b2d1-45ad-b91d-018cc939df6e", "comment": "Malware payload (Quakbot)", "value": "5f919b98fe0692407761b9fbc869cfd47cecf3d7386ae340a16f04af4673c2ba", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435126, "uuid": "458c9a0a-ae07-47af-95ad-2f23a071fd10", "comment": "Malware payload (Quakbot)", "value": "040aecd723be3d1660473cf075c641d80f3ea19e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435126, "uuid": "588d4da1-af46-4ff3-b61c-b79720589c59", "comment": "Malware payload (Quakbot)", "value": "0d12d7df19b6b8ef953cdd0559948a9303ee5616718ebfe63abddc5023d8516f27fdf42663e61c191d96193c9adbaf41", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435126, "uuid": "9b2842ee-c48c-4e69-8bfe-f1760083548a", "value": "T12785AD1242CC129AF14D3B78243C1F7FD3BBB7A87B19634E9654B8A9AFAB7D34115600", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435126, "uuid": "52b3f6fe-3df7-4d21-88e6-f6c7c2f35be7", "value": "a3432b773266dde6a100dba767517009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435126, "uuid": "66247cbe-25d6-4197-8926-e1c8d9a4d005", "value": "24576:zrj3nPW3ednWPiT8VTBqcATV8KIyydLXGcq8z+0uaEYmgEJ/tc1:T3nCeCiT8aHxyM18z+XatEJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675435126, "uuid": "5547542b-9681-48f1-9984-a709a6ce3971", "value": 1761280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675435126, "uuid": "1ba86972-e36a-4be5-a4a7-bc6a9299b43e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435126, "uuid": "1d0ac594-0759-4a18-828d-9c892ea33eb3", "value": "49911.dat.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7245aa-a3be-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675427485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427485, "uuid": "5a85f728-8b85-4500-9f29-3e1cc895bb64", "comment": "Malware payload (GCleaner)", "value": "bb658df39c316397e8ff23da5698a59b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427485, "uuid": "fd69a5d0-70f3-4a21-b9f9-e708aeae0bad", "comment": "Malware payload (GCleaner)", "value": "603ede126e02a48da0b39ff5e3106e5d5b62cab412b5bf023c55bc3981858cd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427485, "uuid": "ba368eeb-0831-4c03-90fe-3792a26f968b", "comment": "Malware payload (GCleaner)", "value": "638087506013743454536f6e8ae400e1c0c00670", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427485, "uuid": "ebdb184a-5f1f-4641-9f3f-5a27bf577211", "comment": "Malware payload (GCleaner)", "value": "90478ce882ac4a753a35ffa4a3e044d2dbc6486350fdec8e77bc0ac1f061a7eb4b9eae1848a0e4d319670bda59c47087", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427485, "uuid": "e56a16d4-2092-4cd8-b390-32e6121aa3b8", "value": "T1C1953393DB4EEC77E1917779241A144AED6B6F66293C7362308C283F0DB6979B014F09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427485, "uuid": "658a22c3-f453-4b1f-b054-158a359d32e5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427485, "uuid": "71d85a3c-dbbe-4348-9fa8-04fe3d3fd6fe", "value": "49152:ygx7+9DobYl5zqPEM59CghIJ9d0UwpEycLCgv2MR:Tp+9D5l8559CghIDlwpE/v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675427485, "uuid": "2ac10607-e5f1-43e9-b289-0916750feb19", "value": 2052382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675427485, "uuid": "e26a1f83-9955-4ee9-9502-c19d3ae42f54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427485, "uuid": "1817bd47-7414-417f-a604-53c3af48cda6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f01416-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675453973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453973, "uuid": "4ada4ee7-6f51-41fe-aa31-b58447c820e2", "comment": "Malware payload", "value": "b2b30357747655801ccba79fb7880c2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453973, "uuid": "36d411e5-57f6-48ef-98e3-0c8b374c6b21", "comment": "Malware payload", "value": "607471dca9073b1e7f6601092c9a949284fbe7efead9d36205180dcadf262958", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453973, "uuid": "164f37c9-fdc2-4a6a-bc19-d44c1196fd4c", "comment": "Malware payload", "value": "cfce32db84d6b01ee004dca087ffa55775f16c1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453973, "uuid": "e59e38e1-ca57-4c2d-9963-dec3aa5a39c6", "comment": "Malware payload", "value": "4b4625412886c2e714f9f614a00108479237660de5e8460f929785391a61732a88d7014f722ab5d9a47d9c1fbb29789a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453973, "uuid": "c765b916-a847-44cb-89a5-ea3aba4891ce", "value": "T1006412C97994E87FCC17D03A49598D948BA67677226FE293404362DA5C4FF1B8E1C0B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453973, "uuid": "8f0e673a-2ea8-4a31-8346-37dcfdeefdaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453973, "uuid": "7724838f-df1b-472e-bd1e-0ccecce971d7", "value": "6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675453973, "uuid": "7c045029-40c2-43ca-a420-43d25cabf265", "value": 337074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675453973, "uuid": "7067af2e-42ce-4f82-85ff-32c11787619e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453973, "uuid": "014bac17-a87c-4be6-9a8c-0d9abfa86ea7", "value": "b2b30357747655801ccba79fb7880c2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5eef4e0-a3e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675442989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442989, "uuid": "f5d80c35-4aa9-43e4-9255-bc32074ca548", "comment": "Malware payload (Formbook)", "value": "e93972baf88a612125f843a2d036df02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442989, "uuid": "1ec8680e-6f7f-407c-87c4-280f1bb763e5", "comment": "Malware payload (Formbook)", "value": "60839f78201096dac45fcff102f5c7eb8682b7eb1b36c12b9b997ee41c7d0ced", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442989, "uuid": "d3413cd0-6655-4346-a85c-d03d31457027", "comment": "Malware payload (Formbook)", "value": "372954e625babd330a82e226adb5c19e8eeb9640", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442989, "uuid": "18629c10-8353-4a35-ae08-6f2fe94304cb", "comment": "Malware payload (Formbook)", "value": "4ac45254485551fa510d230d4cc0bd6a5ad4bbbc68da864066abc057af72564b74878c1ac260c5f0f6688292b014324f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442989, "uuid": "f53551e7-75b5-43d0-873d-a1c1eacbe745", "value": "T12BE412107B43038AC91C1072C1DB453403E2BB8FA277E5AD3D866A8A5EA37D5DDC9B5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442989, "uuid": "369854c7-787f-4f16-aa87-7732e3461bc8", "value": "12288:85U+vIg5vP0FBWRHitHdInp44B9L+DCJITkcONusHvm4yz:85nvIDoCt9InpTPzS4cIPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442989, "uuid": "ae467e70-93cb-4cd2-9216-50da08f7e6ee", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442989, "uuid": "19ca42c9-46c4-45e0-b12f-b092f94943c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442989, "uuid": "6ba8aef5-cb78-4811-88c4-8188d9df6a3e", "value": "shipping document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "641a9983-a3a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675415767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415767, "uuid": "2a832d03-e5cd-4eb3-8627-261ce02bd1e6", "comment": "Malware payload (GCleaner)", "value": "231ab6d1a9865bc80a242c6314a1cad2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415767, "uuid": "0d83e7e6-1cb4-4fbf-9de5-de61ca7054ea", "comment": "Malware payload (GCleaner)", "value": "612123704dc68275e51165e075b3b55e30b2923a388916d9ac86f5a95cd87068", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415767, "uuid": "994d51dc-ccbc-42d5-b17e-a69b3df067f0", "comment": "Malware payload (GCleaner)", "value": "272e2d5fc96daed88bafc9e7c7278354e7a5d857", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415767, "uuid": "c656f061-d6b7-4429-88b7-96f785338166", "comment": "Malware payload (GCleaner)", "value": "0f214a0954c8e4eb46bd30f9fa0131441c0cb90d960a22c7002a503f2975843c41ec2faa747272e8f86a33a959923812", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415767, "uuid": "866f164c-c709-4de5-ae99-1cf8b684fcdf", "value": "T1CA9533A2E9A275BAC22287327C30B462AD21AF57367416B4B1ED571D1F1B3F0C40B7D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415767, "uuid": "242502bf-a6ee-4a40-8973-615db80bbaf4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415767, "uuid": "410ae503-0626-460d-8ade-f0c925df2e79", "value": "49152:ygEUUkQSCZznfNhmhmj1Yo0/NsHLCgv2MR:TEUUkQSCZzfrFP0/Av2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675415767, "uuid": "bb244991-8bbc-4f48-a890-25d129321bee", "value": 2000308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675415767, "uuid": "dfcfb0e1-9c40-45b9-83ea-7ac33b99df04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415767, "uuid": "9ccad944-b900-4af8-a534-e7846d645c8b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b1501f-a3ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675448629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448629, "uuid": "5d037436-5039-4370-96c8-3dc92b69f749", "comment": "Malware payload (Mirai)", "value": "3601592c63cc374fac6dc632000b73fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448629, "uuid": "5d6b01f7-326d-44d1-9427-91f2e72cabdc", "comment": "Malware payload (Mirai)", "value": "61fef7843167fe520dee213cb6134665ec34f6a208b7130fe14d8ff8ce8287ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448629, "uuid": "cbb9dc67-4727-446d-8cdb-1b38a37d439f", "comment": "Malware payload (Mirai)", "value": "b7c831cae93dfb3b328a9b7fe09dde25826be3fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448629, "uuid": "ff6a794a-2dcc-4c1e-a3fa-6daf0df2e06b", "comment": "Malware payload (Mirai)", "value": "68ac93ab7b4e57b2a906d7502416fc54d23f29e9855ed8ad060a1cb4ea158d5c97f68e491ac92c7d85de02ece2bd1ac1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448629, "uuid": "c1166ddc-2441-48db-9458-b2d9669b7b3b", "value": "T1B182CF3051AB35F5DBF14431EEEECEC697160BF8D1FC36D226986B78894210261F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448629, "uuid": "af685c95-8fd7-432f-ba69-9edc0ea2d7d0", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaGrhymdGUop5h5lQ:6GV0P6+kom0tVAoNvm+to1Grs3UoznlQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675448629, "uuid": "c1eb7fdd-f2f1-4955-9f7d-81a1e760f0f6", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675448629, "uuid": "0f5a34c9-611a-46d7-80fc-76236047502a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448629, "uuid": "c991048d-42bd-4b62-ba79-a206c9099241", "value": "3601592c63cc374fac6dc632000b73fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78bb74dd-a407-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675458751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675458751, "uuid": "2df61414-1e89-4bbc-abbd-c61c7eb011ee", "comment": "Malware payload", "value": "e9df6a41ca4941817e0da65dd35d6508", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675458751, "uuid": "38979dea-4b73-429d-b3cf-fb307999e91c", "comment": "Malware payload", "value": "627f94066e4429d51827ea329dfc3a2185bf42a2617cbca68e89e3ee4029c48c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675458751, "uuid": "f875ee5d-b82b-4328-9622-1f1abed605bc", "comment": "Malware payload", "value": "d1efb6b9745f5fcf6f34a0e4f7d148133a4289eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675458751, "uuid": "2b822ce8-ce50-4c51-a422-263a5a7c6cb5", "comment": "Malware payload", "value": "ec5426945d6ce1818d6417b67b5f5ec63aedc9182bff7a55d8927a73f47bac94fea4c6dbef629d02d18112ce8a502c14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675458751, "uuid": "bd38b201-9bca-4a83-aec7-561c9141c791", "value": "T1D0763354B7C448FED6428DBC4F184FD2C1A7DF88DA9B856B93BE1A0C583F4D99328849", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675458751, "uuid": "cf43ce2c-5779-4acd-981a-32c996583439", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675458751, "uuid": "2d5a70f9-5ca0-4d77-aa56-460faaf84ecb", "value": "196608:91OTdISgFWHU76tSdBQ2EfgFLfCceIqTMf:3OTGy0WS/QloFLbe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675458751, "uuid": "47434bdd-d99d-48e5-8e2a-9f503f772e73", "value": 7602280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675458751, "uuid": "17ce8c75-a2dc-497e-96d0-832d30563b92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675458751, "uuid": "b5a59587-6a1c-413b-a120-a262f6bff36d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3c9c4b-a3c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675431749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431749, "uuid": "2ea7dfaa-af4d-4abc-8aad-dd1a820cadeb", "comment": "Malware payload (GuLoader)", "value": "007bb22a831c9311c63cb399f527bde6", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431749, "uuid": "78921916-f74d-4023-8d9a-b11c728a51ac", "comment": "Malware payload (GuLoader)", "value": "629d76207addf10691b24a635ebb35de2d8304fdac77f146857727960f2715cb", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431749, "uuid": "a9c50c2b-1def-45fe-b143-50cd347aaeb9", "comment": "Malware payload (GuLoader)", "value": "59da3fe73f9454e065e658363440c5e3ed95f3a1", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431749, "uuid": "b69f2dbd-039d-47e3-a525-be33c724d3c7", "comment": "Malware payload (GuLoader)", "value": "392d4d1a7b408683b455e88732c1486339bce4d1506ab3e9a7c140615073a868d34a074a43ea6fbe8dc83a3e58b64600", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431749, "uuid": "816051c5-f004-4902-ba34-ffbaa1341ad9", "value": "T1BA74231A4FD72B5B03A1D24E2E7CE95C8D4D768CAACD7808D66603D3FCECB5015939A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431749, "uuid": "c78c6979-6924-4019-aa6e-ad9d9084f1b9", "value": "6144:0ZwgRx7lS6qRJMPftNNm0F5UUI3CmkRiItbmMEG7HfXkjpy7r7L+6VM7:OvlNHNNm0WI5PrA87L+6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675431749, "uuid": "227a378f-a0fa-46af-9274-06feda07b685", "value": 358987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675431749, "uuid": "2317f4ef-5158-4abe-8f7a-798e37288565", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431749, "uuid": "82b7a550-944e-49a9-94fb-ec38c97a2ad1", "value": "9018000392.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c13351a-a3d5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675437282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675437282, "uuid": "4f6749c6-165e-4337-8088-51fbaba8fd6e", "comment": "Malware payload", "value": "b2976ce2e2c5c5b27d8b3debbf9a8b13", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675437282, "uuid": "02d2d042-3171-4eb7-bf69-530e3d169368", "comment": "Malware payload", "value": "63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675437282, "uuid": "ce6784dc-5c0e-4c0b-a89d-59629a64b5b7", "comment": "Malware payload", "value": "bfe9021d84030aa584a5bac1f61d44f6e7397d5a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675437282, "uuid": "30c146b0-2656-4c45-a0b7-98488faf8900", "comment": "Malware payload", "value": "4b140a45c60fb6bb673240bacfcb123983a1874aa8709ed83f5351aa36efd35c230a34fd1551c1461e055407d3b816c8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675437282, "uuid": "09fa6b2c-b05e-4fd9-b8ea-d8b7b10ae06c", "value": "T15334CF2AB780DC26C8C6153BF81F01DC36D64B6CE7C6B6093E15A63E72EB4650A7DD90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675437282, "uuid": "e20e66c9-1f94-4fac-a461-b7068252c9e4", "value": "6144:4rzteG07rm7PSfPDLTxSW17ypbsWHzrwUJqeB1+qo4y84Q+xnvf7:FHxTt17yyCwzeB1XoDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675437282, "uuid": "42f615fc-f6be-4473-bd67-9f5becbaec16", "value": 239388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675437282, "uuid": "b3972bbf-d015-4c47-96e9-99f405e2f25c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675437282, "uuid": "7f1e286a-b1cb-4cf3-8294-65f9d4876be3", "value": "63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857.raw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9856c996-a397-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675410700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410700, "uuid": "e22505fc-46f7-4dda-8573-62758b722c6b", "comment": "Malware payload (AgentTesla)", "value": "5c16d73723225aa3c9a0e3913de2dbaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410700, "uuid": "8854db2d-0c0f-4f07-b55e-49e281d0081a", "comment": "Malware payload (AgentTesla)", "value": "63c468ae38acdcc58f53f2bd24533d144259143c46b4cfbfe181bd6296ad062d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410700, "uuid": "f52f0905-01df-4c61-87bc-85b2fdc12c9b", "comment": "Malware payload (AgentTesla)", "value": "0d0eca7a5cf51c2ded9d25ae86e23768651e2864", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410700, "uuid": "329500bf-b485-486a-a10e-1164ab0cb81a", "comment": "Malware payload (AgentTesla)", "value": "f3c4d30141c748828598911ad1093d69f7b68ab91e5668109889e7db1efc3bd6bb7919c3d5ded9de67789d2ec04e57aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410700, "uuid": "36bd0194-3f40-4538-a49e-f0027372138a", "value": "T14E842340A2E1D463E6578F33B9B619670F92BD196CB58F0333347A1DBC316A2AD09F52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410700, "uuid": "51d53b5f-9631-4ea5-89c9-19fd3768a6b5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410700, "uuid": "287ad44f-5a51-4784-bcdb-fab2261db024", "value": "12288:9YwtaxffLGyRsYAMf9P/N3Z+4SIJxbC8sdBWgX:9YwupCYHzp+ZIJR3sdBWgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675410700, "uuid": "d9edccc7-2a0d-43fd-8f71-116b2640b8f6", "value": 405217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675410700, "uuid": "e98cbb21-3cf9-49a4-a422-e3d1073a35ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410700, "uuid": "90fadc61-d688-4e78-b1ec-907ed3c51fe7", "value": "EVP I_287008 O_298659 C_4091 PO_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de1f71d-a3ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675432453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432453, "uuid": "a11fe2d0-a8d8-44fe-9e34-b1b051416f40", "comment": "Malware payload (Rhadamanthys)", "value": "2c4f85aa8fa3237c635bd43bfae6e7f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432453, "uuid": "88602dd0-5b1a-4335-be61-d2a62e528239", "comment": "Malware payload (Rhadamanthys)", "value": "64d1d03c3378be695f30daea3877b732f662fc453dcd03af0f7990467c698a8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432453, "uuid": "c4b6f65a-57f4-4067-b91b-cfb758c73cd0", "comment": "Malware payload (Rhadamanthys)", "value": "87040ccd075a6477b88d8f85d20e166680f8337e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432453, "uuid": "abd3bd18-404b-4f9b-ad8b-0ac6df760105", "comment": "Malware payload (Rhadamanthys)", "value": "d42515d48b659ad03d88b2ccc91bcde6503706e5db4585384df3bdfdaca7e7b9c5fc88039c1552d32540550f5bd00940", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432453, "uuid": "a33bba03-6204-4d1d-896e-17eb359d51b4", "value": "T1EC34E0323990C472C1BB61304C24DB652ABEBA3255B9954F7BB40BFD9F207D1963A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432453, "uuid": "5f641518-c699-420c-a936-90fe1804ce91", "value": "072a8f61f2ea0ff476bece6d90579847", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432453, "uuid": "c70eb9af-0dc9-45bd-9267-02669ff216b9", "value": "3072:P24TtoPB6VnLWrWLK28WZ/p5SA9tKxXh87QRMlM0TL6b0GWP5Oij0rVzgcIKrDU5:P2xQLsWLF82tEX7MG0qby0rBLU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675432453, "uuid": "6e8c5e6e-0e45-43f5-a498-d01862268458", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675432453, "uuid": "1141380c-df0e-436f-b9f4-228b3502f989", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432453, "uuid": "a519452e-53e7-4758-ac7d-b9ef46a24660", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9445bef8-a38a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675405110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405110, "uuid": "33c2bfd1-2839-40ef-a0a5-ba756663918a", "comment": "Malware payload (RedLineStealer)", "value": "88472c005bdfa43a03ef843ab75ec661", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405110, "uuid": "0aab2094-7c57-4ccd-9f5b-9c74ca36c0b6", "comment": "Malware payload (RedLineStealer)", "value": "650ada27b894204248d0af32365b2f400e4a19244293ef54c439d2c54345449e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405110, "uuid": "13ae395a-8f33-4a4e-bb97-cc641c6aa8a3", "comment": "Malware payload (RedLineStealer)", "value": "0e536c0e1f5de122ca22de0c7b164f9fb6368c3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405110, "uuid": "5bcccdee-0be9-49b2-8c56-d50e49289ac9", "comment": "Malware payload (RedLineStealer)", "value": "36b74b611b3a364b2ae8465f3ab27c463899a97a329dc68e9a0db415e1e8076c7ca6c51ede079d7b8052ed6e9730f4dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405110, "uuid": "bc225cf3-6e3b-43cc-9ada-3a381ff6c47d", "value": "T17755337A3CBA54CAC1DBAC7391B5FF46137BB10899121F277CB076281AA0DE75232587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405110, "uuid": "46540f93-436a-4704-8898-d072e4a31409", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405110, "uuid": "a5bd4927-81f0-46e2-a662-cb86e70b9e2c", "value": "24576:Zlf4Qknt/xAfoqRBkXlSlj3mk4a9YUEBg+KWHxLA34penxHQOl+z92HoBqtUu0/k:ZlfpOyf/Q1+j3mkJStQ4GwOlQ2HySUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675405110, "uuid": "d8eec9a8-8d67-4e49-9905-b7f1ea7dc297", "value": 1320960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675405110, "uuid": "8b09d3e8-e18e-4f99-bac0-41e04e99bd76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405110, "uuid": "44cf0466-1e42-4efe-a021-f3c1254e973f", "value": "88472c005bdfa43a03ef843ab75ec661", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a151a134-a38d-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675406421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675406421, "uuid": "1684ef61-51d7-4b42-a0a1-acd5d0462677", "comment": "Malware payload (DCRat)", "value": "28c4a21374394f027160b0f515d9a870", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675406421, "uuid": "f87d5197-0323-49ac-80c4-bf1b1e5ab96a", "comment": "Malware payload (DCRat)", "value": "655fcdf3c2124982b931ed9bc7ec594f33baf8dba1a88444430abc248a76fa88", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675406421, "uuid": "01a884cc-ad65-467f-9df3-8124ab4c8542", "comment": "Malware payload (DCRat)", "value": "bbd7f9af9e1413408fa50f2da5bae471d9f6d836", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675406421, "uuid": "e5ffdd9a-95ef-416f-87d4-92c829984085", "comment": "Malware payload (DCRat)", "value": "1b84889bbbba233acad767fda2fed4307b9f7951b22e74038a9f601b089868cb85f66725db87f90cd7e7335b1eb05c7c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675406421, "uuid": "31e2c47f-93da-4831-b74d-e4d5fcdcd482", "value": "T126657C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675406421, "uuid": "993568d2-e75f-4087-91d9-ec805ed976ed", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675406421, "uuid": "134a32ee-a0a1-4951-8420-b957e3d68db5", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675406421, "uuid": "373c190b-b9f1-46ff-82af-85e19dda2123", "value": 1408828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675406421, "uuid": "8f37aef9-1244-407e-b0e2-cb7c8946773a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675406421, "uuid": "eef59dcc-1bef-46ee-beba-1dc9e30e3f72", "value": "28c4a21374394f027160b0f515d9a870.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81caf8b5-a3f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675450606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450606, "uuid": "89a88a16-7ce5-4c19-ac46-2d882554011f", "comment": "Malware payload (Mirai)", "value": "f7349844b835deaf4893a622edac1f3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450606, "uuid": "a60c3c80-0b68-45cc-947f-d2de2fed934c", "comment": "Malware payload (Mirai)", "value": "6576701edcbdd2dfe2bf7e36a428db41f54824c09401983eee8183a6eab53fb1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450606, "uuid": "c6f43872-9fc6-40aa-98c4-3a32357c7cac", "comment": "Malware payload (Mirai)", "value": "5a7376efff0b13b35ea9414f5c3fb85fd9a286b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450606, "uuid": "90875ecf-7869-422c-97f8-7a4c3c7f22df", "comment": "Malware payload (Mirai)", "value": "006b852607859af895d9f4b75d8ac54f9e36d3b808a1fe642c76b1f80b1afd226685a790f2d042c84da46b42b3756fe6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450606, "uuid": "110e857c-a4b9-409c-bf75-c22a5bf1986d", "value": "T18983E70AFB620EB7DC5ACD7B15A6174028CD551BA1A93B36BD30C81CB54B64F1AF3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450606, "uuid": "8abbc76a-abc2-4bb9-9d29-f3a47c8c4425", "value": "1536:adNBpAuc0/pDmhuPLKZRtOM3aFiJ4ZZiqQaQceIt:a+uTKZRtEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675450606, "uuid": "780b1f25-7f4d-4039-81e7-4e9f4a350540", "value": 84988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675450606, "uuid": "01bbc8a0-4e8c-4878-bad3-6808b599b916", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450606, "uuid": "bc497bf6-97be-4250-9826-b6d80d086943", "value": "f7349844b835deaf4893a622edac1f3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ee4535-a35a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675384311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675384311, "uuid": "68742ecf-5e19-4fcf-9485-253573806d60", "comment": "Malware payload (RedLineStealer)", "value": "06ed7ea570d899163cd1864c5dc93661", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675384311, "uuid": "4bd09159-26a0-40f9-af7d-9e692f40e259", "comment": "Malware payload (RedLineStealer)", "value": "6689dbd112779e3470f50548c4de20d5f9543feaf084635fcabb269c037daad3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675384311, "uuid": "c5d302c4-844f-4a4f-b4aa-67f912f23d41", "comment": "Malware payload (RedLineStealer)", "value": "c1186c6d2120eaf765ba432e194bafc20066b78e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675384311, "uuid": "a3d53f7a-1704-49ad-9454-7108816ea8c0", "comment": "Malware payload (RedLineStealer)", "value": "c03fc9431dd92cd4f75958f55df9f34cbb9724782cb0a6a6d097358a952c4965566cfe50153215dc652b36d8424c0180", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675384311, "uuid": "90115c0c-dc77-418e-a239-28f917e0d3d5", "value": "T1E594AFC2AA92FC41DA11CA768E1EDBF47A1EB9514E287F665218DF7F1D72133C1A3210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675384311, "uuid": "3fe60416-8aef-42c2-9c2c-f7a7cbc8bd5d", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675384311, "uuid": "f555680b-ee83-4fb8-bac4-59ced3f77cb4", "value": "6144:uZFEaLCHLEem1q6HSQh3j8u2lMQPPMG17QotQW8Y53lwKwpx5jV6ptCbNKN:uZFEa2HQemAczz2F17wWT5le9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675384311, "uuid": "27a69723-50d7-4bd2-952e-87b91fd64d06", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675384311, "uuid": "536cfd97-fb80-492a-a769-88b0293b3fb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675384311, "uuid": "57f0eb60-097c-499b-9beb-d512e8d509a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77251e9-a3f5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675451098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451098, "uuid": "532897ae-bc80-4052-9a0e-cca2450f5dc1", "comment": "Malware payload", "value": "2a00f4671533fa98e300038774fd0fd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451098, "uuid": "370ad1c6-8773-428b-aaeb-1ddd068547d5", "comment": "Malware payload", "value": "677e1dbf5c5dd4a56b1ca2bf9ea49282aac207aea31bebb804b0601ae3a04842", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451098, "uuid": "553e690e-1184-4281-9532-f48b51b7be22", "comment": "Malware payload", "value": "c30e74aaef2db02d2d01c25dd96b0609db998e94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451098, "uuid": "3260b364-ce36-4749-9619-a0f6929d3f8f", "comment": "Malware payload", "value": "fa1bda71e83f334aefe779be1b9d2e4d3a5797704487b363fe137aac075f2081e48b45efdb9bef9374910eb1857c9288", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451098, "uuid": "a889910d-e72b-4d07-82d6-2a8697c99151", "value": "T1BC7633163AD681BDC63764324B6A1AD0A2FA835A1E63DDF753C40D6C1DFE061843E78E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451098, "uuid": "3f7a8fa2-0811-4382-994a-0c8cbae21066", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451098, "uuid": "bc246787-31b3-4ee2-8c8f-1f9106ee5a8a", "value": "196608:91OTXCYA0X59uz7/No3+2/UbMUiDTuWYjGzbcq:3OTNy1oO4U48qbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675451098, "uuid": "d6b66d4d-b512-4b4b-8a46-85f95e5e6b16", "value": 7628564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675451098, "uuid": "38d7371f-31b4-482b-bd04-d835e2153f38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451098, "uuid": "1bf8ba0d-2a60-4ec7-8573-8330d612f722", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7798b1-a397-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675410489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410489, "uuid": "7260c942-98bd-439a-9b52-faf8efca95ac", "comment": "Malware payload (Vidar)", "value": "23acf0e9de75b114816e2e6cf9f625b8", "object_relation": "md5", "Tag": [ { "name": "CCleaner", "colour": "#8825D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410489, "uuid": "a47a5c16-a333-4e3e-89a0-7c32855e8a2d", "comment": "Malware payload (Vidar)", "value": "6799039398f64ecaae8d532ce14fd2187e889d18ec9cf14b6d8dfc653a31584f", "object_relation": "sha256", "Tag": [ { "name": "CCleaner", "colour": "#8825D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410489, "uuid": "e7234be1-c2b1-4977-b0ae-d09d5640a1c7", "comment": "Malware payload (Vidar)", "value": "12fe967533fde7ed8f74f9c758add00159458afd", "object_relation": "sha1", "Tag": [ { "name": "CCleaner", "colour": "#8825D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410489, "uuid": "c64f9d7b-d59a-44d3-9468-eb0e23e257d8", "comment": "Malware payload (Vidar)", "value": "e9e6d64cce0e73e44f588f1b92de27945b0f37895c633e041244e676f92a199055521ba6a518a4c166b5fb3098ef15a9", "object_relation": "sha3-384", "Tag": [ { "name": "CCleaner", "colour": "#8825D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410489, "uuid": "ac5f18a7-ac57-42da-b801-4bf9d6c63479", "value": "T1EF65D0563A858D41E2EF1137C0BF0D1867B8D88295E2D35BFCAD323E86F6351A80D5DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410489, "uuid": "8e58dfc9-f071-44eb-bff7-65f7cf392cd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410489, "uuid": "a202186e-b4d1-4b2e-bcd1-5dc58ef8c76a", "value": "24576:96CXsKY13C0cAzsPAUOxltnuXg6YSorFOnUXfRXO7qJ8mn4/yFG3wJIPqO:9Lsf40cIsPAUKx6YdOUXkqJE6JIPqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675410489, "uuid": "411ffa1e-2bc7-44d9-8beb-b7efa572c5a7", "value": 1448448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675410489, "uuid": "7e0fc63b-1f38-4fbf-a2dc-808389966993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410489, "uuid": "1cbddc20-3922-491c-8a40-76b928296a9c", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34382e30-a3f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675452623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452623, "uuid": "9f488518-70b7-49ef-9ef7-5ffb56d0c12e", "comment": "Malware payload (Amadey)", "value": "d4ea761eb69fc423407fa814bd02bc22", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452623, "uuid": "7750a50a-d19e-4b42-bc90-f25d1f64fe55", "comment": "Malware payload (Amadey)", "value": "67a8629cd9f9da34abd9197c9e700fcaf4e6faaf2c47518201510224588246a9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452623, "uuid": "e138f2d3-c249-4f27-b848-219cf5c9a72b", "comment": "Malware payload (Amadey)", "value": "2e48a56cbba661033036d518fa4dcf3fc59d493c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452623, "uuid": "3ea50d9e-0d6a-4053-a8e5-a7322490cb0d", "comment": "Malware payload (Amadey)", "value": "ff2ca41f13b8094b604e20cad77332dffd11ddce45abc3e05c7cb625ab6a216e44f9817f1d7e9d3649c51e671cd52598", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452623, "uuid": "dd0609a3-d205-41bd-ab91-b20a29021d77", "value": "T1CD14D03239E0C072C16B5D344C60DBA57BBEB431467A8A5777A90BBD4F306F1663A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452623, "uuid": "01a6213b-63d1-4277-9b7f-7635986e8fd6", "value": "11deee92ae37204b8493d8d64f5f1f69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452623, "uuid": "d2c926fb-f387-4dad-9292-bbe93ff6554b", "value": "3072:5vS34I+7VSe0LVx92ZDRWNd5TwQtEK0CTCY6Ru1Zb6FpTJ0R94t4FL+UX:5vv0LYRRKGCeYoeipNMoQbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452623, "uuid": "b515277d-76af-4801-948c-3a516224a47b", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452623, "uuid": "2f1bfba1-4747-42da-bfc1-c22613fe7a83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452623, "uuid": "cbeda5d2-72ed-4d01-b25c-55efcd897e8f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960404b5-a3f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675451928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451928, "uuid": "bb0a47cf-d3ff-4439-a527-e083ad0b8831", "comment": "Malware payload (Rhadamanthys)", "value": "a4941ee9a1b4c8363c9b5dfa8b2fc0a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451928, "uuid": "0a65681b-30df-4356-9ec8-2bb3e35a5fb0", "comment": "Malware payload (Rhadamanthys)", "value": "68c1f88ca465c2a423a823c58fa157936edbbe9583ccfb6f4276a51f98921691", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451928, "uuid": "a158e061-3444-4f60-97b5-ea41ef265927", "comment": "Malware payload (Rhadamanthys)", "value": "7c56ac4366207fa0eeb1fa3490a596ec83e99c04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451928, "uuid": "2f961f89-d16c-4a2d-b250-da66e5258107", "comment": "Malware payload (Rhadamanthys)", "value": "e153a738bc87c5a5297f897ea26727d8dfd958451f129311c1721d94b9d033e7f1c8341f22e06538460bdafed03ac2fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451928, "uuid": "6f4830f2-bafc-4e65-8436-1f0c225ba73a", "value": "T1A344F13278D0C0B2C8F751745824E795ABBDB8320579B94B7BA40BAE5F703D02626F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451928, "uuid": "ec563945-85e6-49bb-8afd-9f9d3628630f", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451928, "uuid": "b8327ab3-85d5-44e4-8c78-70479fd183b0", "value": "6144:piHBU7YLZYLbyTn6ZVvHPELvydFrT264xTAmQCw:IHC7YObyTnE5ELvSW6akE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675451928, "uuid": "7ea54fa1-1958-4f38-88fb-99e947787295", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675451928, "uuid": "86e631cd-4ea6-4447-b4ae-fb51940e7ba4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451928, "uuid": "30a12916-3258-4cdf-88c6-1860b566b5a6", "value": "a4941ee9a1b4c8363c9b5dfa8b2fc0a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba2764e-a3cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675433255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433255, "uuid": "bf378aa8-ffee-4906-9913-a04988d12bcc", "comment": "Malware payload (AgentTesla)", "value": "b757c4ac5a46c4e9fc2cf9e924702804", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433255, "uuid": "a50ed444-53d8-4711-a094-d652bbe4d759", "comment": "Malware payload (AgentTesla)", "value": "6941a5420e23e7309cc09e6ffebf847a7c781dbbb726996a2b3d36340d347819", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433255, "uuid": "7c50cf63-33c6-48d1-9a5a-4161da5aa49c", "comment": "Malware payload (AgentTesla)", "value": "27caf0391db69d2b2543a0172747e62a9a6e208c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433255, "uuid": "e243b398-08dc-4f41-82bb-74ae66abcbdc", "comment": "Malware payload (AgentTesla)", "value": "c5435ddde10fc08b8b888e15341e80bcff20d8a6b52c7da662ef8607c17a2cc8fc89dbe843942cb3a0010a55f643a592", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433255, "uuid": "d026518d-6e0f-4652-ad58-b1e7a0c5bcb8", "value": "T1B9C436067ECEFD15CCE286BE0C858FBADD5E74EE156001FA32C8B52968317609FC855A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433255, "uuid": "f2b3b062-0bb0-4a9d-85d4-38a19e8b3d1d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433255, "uuid": "3c2d0796-90ce-45fd-9ff3-13d2646da89a", "value": "12288:CYZ/txeoKFg+15c6qRUbTAg9sSBa04UtUFeJ9/TG+R:CYZ/HeoKC+1KnG9sSp4UtUcn/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675433255, "uuid": "cd322d79-5c6c-48ad-98bf-e0258befe770", "value": 569937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675433255, "uuid": "3c16687d-f421-4811-ae96-345d60d3fe97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433255, "uuid": "819d0300-a17a-4a37-8f60-2ebf629855ea", "value": "Fatura_8486472023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50eb17bc-a3b6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675423895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423895, "uuid": "8e9afb7e-ffce-497c-8458-16bf19cbb49f", "comment": "Malware payload (Smoke Loader)", "value": "412ec72e0e02fc869b1a230a785adfc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423895, "uuid": "d4102421-36b1-422a-b7a4-b63e9a96b21c", "comment": "Malware payload (Smoke Loader)", "value": "6a2db664483b085877c74976191171c7a2c4d7658dc6e498e18f5075b8cc3eed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423895, "uuid": "054f852f-cc7e-46c9-a008-eae317a9d682", "comment": "Malware payload (Smoke Loader)", "value": "5597cec47ec03dcb0bcf90d830040116ef6a7e78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423895, "uuid": "9a42e5d7-d508-4f87-803e-0673c049bd24", "comment": "Malware payload (Smoke Loader)", "value": "6b16b834aa493ccaeaaa34332ebaded7e07d15e9f6a0190f11ec833fca9a6b64a29e0204cbcfe49272b93e5bef0cc70a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423895, "uuid": "a0ab75f0-4d17-45d6-aaca-71144e366f13", "value": "T19914D0323AD0C4B2C56750304C64DAA5B7BFB83285798A5B7BA407BE5F306D0673A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423895, "uuid": "c9a24a5f-5e18-44c9-9605-65d445682dcb", "value": "072a8f61f2ea0ff476bece6d90579847", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423895, "uuid": "f28664b4-4006-4722-9698-85a6e46583fb", "value": "3072:8CnvguGdJL5DgZlX0WVwm5zc2jYgOANp92NBHTnJkSll0y:8CsJLZgZB0p3ADIFtll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675423895, "uuid": "7bc388f4-ce09-4ac4-b689-92d3bb00d679", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675423895, "uuid": "5ade9209-02e1-449b-96df-b4f9f8963d17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423895, "uuid": "42c7aa08-31ec-45ba-9ebb-99e4773b6bb2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c4b150-a361-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675387285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675387285, "uuid": "8bced711-d10c-4e39-b414-72b152364257", "comment": "Malware payload", "value": "d6b05cb82f43223f360f9934b04eef1a", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675387285, "uuid": "ddbd04a0-c4d1-4170-931c-bc02f4b1af6c", "comment": "Malware payload", "value": "6a3ecfad1cca77ad3dc3f5af500c7df7d4de5f246325f6a0c41074b5632bb408", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675387285, "uuid": "861418e8-aef6-4d00-84c6-4bf145dca3c7", "comment": "Malware payload", "value": "d9c6dbeef7ee14e3bec95775de65f1b54c6a8b3e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675387285, "uuid": "f4e21437-cd85-4e0f-8d30-d9f5e4817361", "comment": "Malware payload", "value": "9d16e37c65ed34035ae9f459a2242147dd9a06f8d073a72b245b94cbc68e637f0a609a4e9981574667a75d58e51131c6", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675387285, "uuid": "bfc8c3dd-bd70-48a7-bccd-6dfd6ee75877", "value": "T188516AA0AF2248BC51E9C3746BABC885F3649D4FF103F434B64F725721C16C98DA4106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675387285, "uuid": "09900292-9ae0-4f85-9115-d3199706a1a5", "value": "48:BXLMsQMqWQJSE5IRh1zkw8lrkE3DQXLbJjkZQE63410W3NM749V/yMTpl:1LMsQPXJSEgTww8lrkUoLlAeh3m0GS4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675387285, "uuid": "8602e4fd-5a08-4eeb-87d5-f31f9291882b", "value": 2524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675387285, "uuid": "23e0c74c-d2b1-41ba-a726-88843f3bf51b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675387285, "uuid": "bbb9d263-b58e-4102-a2a5-68b2e1215273", "value": "attachment.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdca5789-a402-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675456746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456746, "uuid": "7d81d1dc-f20c-44b5-adc7-0dcf70059011", "comment": "Malware payload (Mirai)", "value": "f0f418944a18e4ba61bd3fb88ca2e055", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456746, "uuid": "efda1177-2c5e-4808-a6d8-c265d1a60faf", "comment": "Malware payload (Mirai)", "value": "6ac44d9e528b4cf67a0db8bbaec7fd49c1e040cf83532bf6b524293ea683cde6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456746, "uuid": "96b4d9a0-e904-4524-abd0-c4e82779d47d", "comment": "Malware payload (Mirai)", "value": "864670184841209049ed209f2c7b030aa296ca85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456746, "uuid": "8c3c3048-4083-4f3a-9a1f-18d2774afaf6", "comment": "Malware payload (Mirai)", "value": "f7002b1567670db6e7057b4625a5fba01206ebac4f4fc5cabeb9fd7bcbf543cee5aea1c8d205df824cc1dc8d4773c59a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456746, "uuid": "a25a1044-eec2-42d6-a0bf-fef68c807ed7", "value": "T1CA631986F4628513C6D416FBB66E50C8375A43AAF1EF3202FD210F547A8694F0E33E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456746, "uuid": "66f7e850-aba9-4a5f-a5a2-10beaf95b031", "value": "768:LaGwdEWMgUz1s93dakRBgpBUpf0I4i6PLTRSoTgngNqKdg4i7xGCelbkNx1QM:GrdRM/kRCp634j5mnqdMAIx1QM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675456746, "uuid": "826f637b-d413-47b2-99d4-3a395190eac7", "value": 71604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675456746, "uuid": "6cbf6970-6053-4f63-a6f4-2c514cebfab9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456746, "uuid": "d234ac0a-ada4-486a-82d2-41f5df7a81ec", "value": "f0f418944a18e4ba61bd3fb88ca2e055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87436c46-a3f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675451903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451903, "uuid": "1dbcd28d-09ba-4e90-abf6-f0ecb8a82e7e", "comment": "Malware payload (SnakeKeylogger)", "value": "4fe0723986c1c6736623bbb9cd55da94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451903, "uuid": "4a1bd344-143c-4a7a-b0db-885265dc0337", "comment": "Malware payload (SnakeKeylogger)", "value": "6b29a8077738385d528092ddf5cbcad434f51acc3cde6c18975fadc36280f5f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451903, "uuid": "b7ed0673-b438-48e1-bc37-3477c1045682", "comment": "Malware payload (SnakeKeylogger)", "value": "3ec533b9bcc9ca0593c6d5210e32581b85cc531e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451903, "uuid": "ccd23e44-7fc8-417f-ac38-d8de4dc5f531", "comment": "Malware payload (SnakeKeylogger)", "value": "4f096b2d51aa3ffc58a10f152fee4bbe91ad24133a9e18650495743ccf922160afbe93f5e45bc4c1debb67e710fd78df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451903, "uuid": "b81bbc22-dc4c-4329-90d8-51d07b3b16b4", "value": "T135057E9337B199B2F78721B60424BB885BF07503BE16E2939BB737C06785DB77298142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451903, "uuid": "10bd43a5-0194-4914-91c0-a0a3826d5b88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451903, "uuid": "3c088906-96f5-480e-94e7-1cd7555acebc", "value": "12288:ybhefaqG4yPasIK2/Xr5vZQ1YF47BbbyRk6Fy2Mxzo3:yteSqG4yPasvK9vAYF47ERk6F0xM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675451903, "uuid": "1b5b7c6f-c4a8-4350-8133-d03a4dd57ce4", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675451903, "uuid": "a75d83f1-da1c-4e29-9e6c-9bee0fdedbc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451903, "uuid": "3b5304f1-f0d1-441f-9417-dec8f188f7e9", "value": "1lD8ADvXzQl1f7g.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ba1711-a3e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675444041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675444041, "uuid": "01ccfafe-5077-4e39-94a3-ad0587548fea", "comment": "Malware payload (njrat)", "value": "b51c4620a95968f8751524d1b5c5f884", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675444041, "uuid": "4f6e8add-0d45-479d-bef2-6c7aef2d1c46", "comment": "Malware payload (njrat)", "value": "6bd33a93372e7cc45c5cf3c040991830bee9f2be6959f4b764feb7f3873fc458", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675444041, "uuid": "336aa266-2683-4f2b-aa64-025dfca2d976", "comment": "Malware payload (njrat)", "value": "c5b27cfd963867debf8ea8f4b9e1aae8e36475a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675444041, "uuid": "e39ea16e-531b-4203-bf4d-f8252e04134c", "comment": "Malware payload (njrat)", "value": "4cede506929bef568bea6c052bd049b88ee7798025e8528cdcca59423a67f9cba56dc90fe31a93c9865cd44dcd48fd73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675444041, "uuid": "59df98ac-4995-480a-97b0-76a11acc05b2", "value": "T195E209467BA58215D6BC1AF88CB313110772E3478432EB6F5CDC88DA4B676D04295EFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675444041, "uuid": "60ace349-04df-4c6e-97f8-1f8edd96129c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675444041, "uuid": "c1b9edf5-dd9a-40f9-ada7-20af1bfc2feb", "value": "384:E0bUe5XB4e0X7Od+SjgkMeWTgtTUFQqz9xObbc:BT9BuC8Sje+nbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675444041, "uuid": "f5d796a2-4e4a-4d08-8ec2-f2e6cbb9e73d", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675444041, "uuid": "a4d1af5d-ccb9-4280-82bc-c81f39b93c7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675444041, "uuid": "086e0585-9aaa-4c69-9632-ad0b9f45b6f1", "value": "bJy1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01d327b-a3a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675416726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416726, "uuid": "7c932c43-dfac-49a0-9115-8a981e2afc56", "comment": "Malware payload (RedLineStealer)", "value": "53cc309e0642f59241282e0ffc211032", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416726, "uuid": "e6bd1792-f7a5-4fac-8e6b-54795b306db4", "comment": "Malware payload (RedLineStealer)", "value": "6c097555752c261586623f29b1a417a5eaac4e6f5f00b8fbbb99d7d292c17e10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416726, "uuid": "c23d8f3d-b129-4459-903d-245ef48a5730", "comment": "Malware payload (RedLineStealer)", "value": "79317a5da30f9fa912de326de822e35e08d03fca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416726, "uuid": "f2c02acf-deeb-4e5e-afed-aa8a0417b667", "comment": "Malware payload (RedLineStealer)", "value": "533df400628535f43f3640d23e2f8cff20371b82aedcdd22899df0790f0c0fc0920db8f172169d4e90d92d33200e56d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416726, "uuid": "4b0c5cf1-f551-4cb4-8259-62c56570f7de", "value": "T1CB64012235D0C0B2C47741756820D774BBFDE53255BA940B7BEAD66E9F306E09B2930B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416726, "uuid": "17d52aba-8a2a-4aab-8931-9ef9524f4df6", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416726, "uuid": "972c9d10-a2df-4697-a1d4-7351577fefad", "value": "6144:1HCYz1nLOMiLhPkps7zIw2t9d4EYYNoloTTRWTRnoBJg5w:1H7z1nQLhPkpA52t9drXNoeEAi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675416726, "uuid": "69e94ef6-56f1-454d-ad6f-e6bc17fda3b8", "value": 309248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675416726, "uuid": "9ced4b72-05ac-4f6f-a122-e030f70a22a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416726, "uuid": "e0b7ffd9-addc-49b0-9e01-c4d0a0f799ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d127973a-a40e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Arechclient2)", "timestamp": 1675461906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675461906, "uuid": "d15a22cc-66ef-4583-b240-2afd191bf4da", "comment": "Malware payload (Arechclient2)", "value": "46a2823fa46f67aa4f78c8adfbb075ae", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675461906, "uuid": "3111f59c-adba-43ca-9fcb-df13df792a4b", "comment": "Malware payload (Arechclient2)", "value": "6c27d4e9ec99f962e3eb5dae72515b05fb4e8746a2632fd30959789f15a0abd9", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675461906, "uuid": "e8f5b175-3c97-4efe-9495-59729957cd41", "comment": "Malware payload (Arechclient2)", "value": "9b55ac5dd7c64e2c5e0197645031a46c8af32a07", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675461906, "uuid": "289006e5-6c30-49b8-a7a3-8a5ce9159c73", "comment": "Malware payload (Arechclient2)", "value": "059678942275a4e6b9860b4161c9196873e40bb74ab752024e55f94c39f9e0307105028ae0649142fc68532e7771b0de", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675461906, "uuid": "4b56a410-d23e-48db-ade7-abcac8c1238f", "value": "T18BF42350BD5096AAEDB3F3359CA02C335DF889C5A0F38797A081417BDEE5419F506F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675461906, "uuid": "d01c3d62-1ccc-4cfa-82fc-0799e4c34846", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675461906, "uuid": "cbb543a3-18bd-4ecd-a22b-e81e0937c30f", "value": "12288:TM5GM1LpCRe4xCS55uESKFjmTsQ3Cq4cSS0hzo4rlNdPmgHGCwbM3/+EXeyjqgzK:TKnpCRtQSzuRuSTsSEvRWg6k+nmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675461906, "uuid": "cef8a0cf-b91d-4a3b-b86a-903ebc7fd276", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675461906, "uuid": "2c503879-2d8f-4b59-a9c9-792823d15b7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675461906, "uuid": "6e7f3d73-fb4b-46ec-bb20-d0bf31b171e1", "value": "6C27D4E9EC99F962E3EB5DAE72515B05FB4E8746A2632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b53d51-a3af-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675420850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420850, "uuid": "589cb5f4-801d-4f96-9451-b99d1885400a", "comment": "Malware payload", "value": "f314dc3a42f3125ef12c61b01134476e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420850, "uuid": "7d98c9ff-5159-437f-a523-36196eccd296", "comment": "Malware payload", "value": "6d9a57fb6ede0c2878d297c5a4c15c3c39269d6919f7feea70fa7700fb4b2d24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420850, "uuid": "8cbae669-34b4-42a3-a321-60ef24cdce6f", "comment": "Malware payload", "value": "c6adfedee311fb7abfebdfa53b19e73b9ef39cfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420850, "uuid": "03c49635-cf2e-46f3-a187-ee2120ad8ba0", "comment": "Malware payload", "value": "637627f1c84b98a45a463eda01796a076d1b59bd64b33cbeb349801d2cc93efd2bade3e83a2a5c4d27f70370c1c5633d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420850, "uuid": "537106df-150d-4f61-a40a-2d5192c6f820", "value": "T11D03EA9821AC8B33FEAE1BFE14B9659BA7F665376010FE892DCDA1D471957404300B8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420850, "uuid": "2c65886d-0918-41f6-b702-92e264d7117d", "value": "768:HevwNCHW1TxGm+N9erXsgJZnt+AcQqt5RYVMUr24v:/NC21T4m+N9qX/vt+WqtfY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675420850, "uuid": "6db20a35-5203-496f-849b-642acb27abe1", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675420850, "uuid": "925a4b84-42db-4268-8990-f4d11448e8c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420850, "uuid": "a9670256-32b1-4f04-a74f-c46583503141", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e631200-a3a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675416643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416643, "uuid": "eb67cc45-84d2-455a-b18c-1fa52042200f", "comment": "Malware payload (Mirai)", "value": "445b9f54a036a882f319f1e826851370", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416643, "uuid": "41a97bdd-f48a-4afa-8357-a555349a06c6", "comment": "Malware payload (Mirai)", "value": "6d9dbf90a0726fb7278aedc0b607edbbc9226ec675c3d6548d14b97c515a75c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416643, "uuid": "1ee3ab75-2433-4a02-87b1-7333383b935a", "comment": "Malware payload (Mirai)", "value": "7ef69ad7281467de3cdb2bafd147267a8af5b1f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416643, "uuid": "2c405543-2355-44c6-bd2f-ee540294de78", "comment": "Malware payload (Mirai)", "value": "e109b475a2a1c05a9e2d5fbd221991778c4dfd2cfb76ef2cbe8d73e3b2d24caaca619488a9365e3736de92ee7017858b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416643, "uuid": "cb25054c-555b-4842-b1a5-89c02d9a1942", "value": "T198632BC9F123C8B5D94809F63072FAF05F7AD17B612DD983FF604825B882A8577226D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416643, "uuid": "127b8772-bbf9-494d-a0c5-2db767ec021b", "value": "1536:64brI6HqE6rUGJQ+zL93CDxutD7tu5XGXmdyIPM:lbk8qE6rUGi+V3CDYtDsoWXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675416643, "uuid": "ca06291d-6d30-4cf1-a6b7-a144e077c9bd", "value": 67248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675416643, "uuid": "776e9335-6f53-4ddc-a118-04b3de551680", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416643, "uuid": "a9d06585-8bfa-463c-84b5-200b442736c2", "value": "445b9f54a036a882f319f1e826851370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d348823-a3f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675452665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452665, "uuid": "900cce48-886e-4d5f-bf20-342796467330", "comment": "Malware payload (Loki)", "value": "e380cc97a7f713e184f21bc979f921c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452665, "uuid": "689d4faf-5ae9-4d3a-a85e-772251db122d", "comment": "Malware payload (Loki)", "value": "6deffbb2c41517cfcd64d62f5b4c159c5fb88b5157fa44877960c490ff23278b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452665, "uuid": "b27ae847-ca91-470c-af33-b56c4dfe69c3", "comment": "Malware payload (Loki)", "value": "006f05a0dfc17123b4698e616e605fc3cbf91b7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452665, "uuid": "b79f19f6-338c-4ffa-b34a-23e728236a53", "comment": "Malware payload (Loki)", "value": "c0ca8b87dc5741e868da3d9bb52521b6c6c1232ae3eff5fb2250f276b6bdfa6e4a1255b84d44b07e2bb008eeba32b72f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452665, "uuid": "e56d64cd-1ebd-4fa4-adf6-66981dadfb4a", "value": "T1E4F48C9377B198B3F68B10B5142837CC2FE07503BE95A253A77B7AD09B518FBB298141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452665, "uuid": "4bdba6ba-4337-4d4e-aee7-1c5fcfe227d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452665, "uuid": "3220b580-a71f-4be3-b810-fa26290de35a", "value": "12288:H2iNZlSE+AJH6Eq9em8Y0hxyhcMOUBSew5gCX6Fy2Mxzo3pqG4yPa:H1dH+ABQgm8zxVzaZw6CX6F0xMpqG4yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452665, "uuid": "cf73c5da-54bd-42a7-a94d-f867980caa69", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452665, "uuid": "65890e01-e74e-454d-9431-c68ae86ca725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452665, "uuid": "0116444d-f28c-4261-a88c-a7ffef02c074", "value": "e380cc97a7f713e184f21bc979f921c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69896fb2-a386-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675403320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675403320, "uuid": "7e068170-7734-4e30-9efe-116b2a600b34", "comment": "Malware payload (RedLineStealer)", "value": "be03af81590f6a59751a755f26530da0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675403320, "uuid": "f39cfa5a-6889-48db-bc75-2c8db25877e4", "comment": "Malware payload (RedLineStealer)", "value": "6e269f92bc90affcdcfae1e7e2dd8fb4ced133975a4d0513a0cada2cc9537b11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675403320, "uuid": "873dc903-f3c7-481a-b69c-60241f7edb0c", "comment": "Malware payload (RedLineStealer)", "value": "ce51f3a2bf5d310b0c8902116668cb7a73ffe3be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675403320, "uuid": "fc114c9d-d183-4760-af39-0a546589a126", "comment": "Malware payload (RedLineStealer)", "value": "906d816ded780fd5f617070a4b49de0e82e44f5ae438bbe45686287ba390b8c4cedaca9d7cfd5cdac57e6df472bbe4af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675403320, "uuid": "ff2f1973-1262-49e4-aea0-4466197334ce", "value": "T1AED4E14292E2FC41D625C7729E1FDBF87A1DB9518E287F3A62185F3F6972132C5A2310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675403320, "uuid": "e11403c5-135b-4d03-afca-c79e63e4a829", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675403320, "uuid": "0bd6a9cd-2e7c-4c77-b64d-3400231128fb", "value": "12288:uUrR/lkHtiXp0EOZXdBRJqWC4lY4RipeZ7elxKt:rjkHC6NTgWCK/R4eZ7elxKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675403320, "uuid": "3c066c68-f331-4412-a9f2-282ecca029fa", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675403320, "uuid": "06b38d6b-3c4f-4186-bc26-0387129ffcc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675403320, "uuid": "bc685f31-af0c-49b3-b149-058e953e75c5", "value": "be03af81590f6a59751a755f26530da0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bac1bb6-a3d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675436744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675436744, "uuid": "a9719e3b-6523-4c85-8a17-f112b1c1d338", "comment": "Malware payload (AgentTesla)", "value": "722ba0f4ba190bb7ab22ae6236eb9501", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675436744, "uuid": "c0e57396-e9ca-475b-a8f3-0770a96cc403", "comment": "Malware payload (AgentTesla)", "value": "6e8211dc7e987ccd91da62efe3573d983dac1c2244364d3a3f8488f2384f9319", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675436744, "uuid": "9ab52806-15ca-4875-8b22-f77d55dd2a7d", "comment": "Malware payload (AgentTesla)", "value": "25148ea466f13804630caff0fb0ac266940c3f60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675436744, "uuid": "7924ec2c-d9c1-4592-9079-524b1d62e955", "comment": "Malware payload (AgentTesla)", "value": "e1145050cc14f9af997b579d3565a54e21ab046ebbdde96935a04b7fcf7be0be0ee69b682a3f58a2cd1dcf5e4df87b64", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675436744, "uuid": "5abfa383-e4ff-4a40-a456-e2afa51041eb", "value": "T172F3496892C99EDED32D8474D4B01118CEB2D1468217EB9D1EA06CF63F467C7322EB67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675436744, "uuid": "d8436e40-0744-4a0f-9cc3-11d273438892", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675436744, "uuid": "314596f1-e90e-46cc-b60c-56e32aaf6c3b", "value": "3072:zXxIYYP8CB1aPsNCEg4tI65GIH79Yv+7o:1YP/8s0ju5nhY27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675436744, "uuid": "7f17c07a-7e47-48ea-80d0-d54bda1562c8", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675436744, "uuid": "670ebf8f-b0e7-4936-b5be-d5960e1f7c0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675436744, "uuid": "d8655dce-989e-4471-a90d-6418032f2269", "value": "0605ce76-2490-456f-95c9-8fcc77bb067d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444459ff-a3f7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675451791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451791, "uuid": "fba87390-a58f-440c-b0e3-a0b9df6de86b", "comment": "Malware payload", "value": "78d641832aa363800383ca000eeb53c3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451791, "uuid": "52c04895-96e1-419f-817a-d084fcb5dcbf", "comment": "Malware payload", "value": "6e8ab054fa90e5a276be30cdad8102b60e2f6e60eaecef47c9487deca4487c96", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451791, "uuid": "72bcd14f-8fd8-4b8b-a8e7-6957afc0cf90", "comment": "Malware payload", "value": "d7f48815185622fd617c98bf5d9b4131550b7227", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451791, "uuid": "89656eba-c217-481f-8556-163d3187a4cc", "comment": "Malware payload", "value": "5422f24bf5883e02df00020114884ff76d51bec671583078af6ac5f30b0f80ab0c3a001aeb9f9f848a7ea8cdf31d566d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451791, "uuid": "f7a21526-45e6-4131-823e-5bc66af30efc", "value": "T1B6917CBE15D294A8ECA68D3D3F9262EFA0AC41163172B2CCD41DB1716F8D6C980B0986", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451791, "uuid": "b2973a92-ab58-47d0-8e13-a36ff6ce201c", "value": "96:tA32u6TaWJrz+iPvDeD/Bigtw3dJ2HbbO3y9c:23RyBPiDja2HbKyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675451791, "uuid": "c5862c0d-9b64-42b7-b776-aa3e65630a67", "value": 4435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675451791, "uuid": "a5d67ebc-3512-427b-9c84-c31270bdb445", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451791, "uuid": "56ad50d2-40b6-4865-9f00-41db1d44ff4b", "value": "d089b6082b4f5ecf765148ffea5885d8cd81e9e078d69bee786be9e6d60a653f.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c41c53b-a3b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675424290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675424290, "uuid": "8fc73a37-d260-405f-81ed-6a63afce1a8d", "comment": "Malware payload (AgentTesla)", "value": "886d8e7f33bf3dcb5492c2c7d35caa3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675424290, "uuid": "407614bd-5f6f-48e6-bb42-a2ea855ecf3e", "comment": "Malware payload (AgentTesla)", "value": "6ec63392c5d3a0b0f5fbf93ae2ff485deace91f7857f7c3e257aff3b261142e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675424290, "uuid": "8d313d4a-ae29-4246-9f95-826a0b701712", "comment": "Malware payload (AgentTesla)", "value": "6a97fbb1fa75de1b2cd2205424dce51b33519dbf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675424290, "uuid": "655ba32a-ff67-4cad-9ef7-ca4603307645", "comment": "Malware payload (AgentTesla)", "value": "fdfb03d94c181ac7c34099f9fefc3b9520c1080648ee433124f2a174da4a06bce62a317c05f201c6a72fa0373ed37ca7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675424290, "uuid": "76486e2f-ca4b-4084-bb40-c1e887c5c60f", "value": "T1D5058E6337B199B2F78724B10428BA8C5BF07503BE16E2939BB737C06785DB77298152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675424290, "uuid": "7647da85-00e0-42cb-9fd9-db0326ed55de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675424290, "uuid": "9e76286d-0db5-44de-a842-5372b2a65eac", "value": "12288:NhefaqG4yPak6Fy2Mxzo35zRiKRsh8YaRW8uOhkoelbqPKV638bSVDL:beSqG4yPak6F0xMtsh8rAOhkRH63oa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675424290, "uuid": "89cdbc38-f2a7-4d2f-95e3-105416ef4da7", "value": 845312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675424290, "uuid": "a3a316fd-c0e7-451e-98bd-ff7800cf310d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675424290, "uuid": "40c982c2-1fc9-4fd7-9189-59fe4b52b40c", "value": "SecuriteInfo.com.Win32.PWSX-gen.23219.24986", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546bdfea-a381-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675401138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401138, "uuid": "3b760971-b368-451f-8dae-d2ae1b4bc43a", "comment": "Malware payload (Mirai)", "value": "9a142f6a193d401367cff6ff73a28c36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401138, "uuid": "870eb873-95d5-4798-a1d7-3811370be577", "comment": "Malware payload (Mirai)", "value": "6ef992fc31689e5fe3301180e17b79d8befbef896cb824456bc03992cc461545", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401138, "uuid": "a35126c7-dba9-45f5-bfe1-162bda2a0ea0", "comment": "Malware payload (Mirai)", "value": "c6688e9cf39cfb22d223217e155904c675b7fdd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401138, "uuid": "070ebdfb-2f58-4bfd-9310-4af58b875c89", "comment": "Malware payload (Mirai)", "value": "efc062e8d38785a8cdf91b03902da12245b72821139428d9d8c5dfb72bf5a2f83926a2ec6cd50e74c686c895896386aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401138, "uuid": "75225e0e-0f00-408f-bee7-8b70f6d107b9", "value": "T1B9534CD9B4119E7CF9CBEABE88224E0DF821321154931B27BA6BFD937D32194DC52D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401138, "uuid": "55d274ca-05d5-48a5-8d96-ca0d07b83f79", "value": "1536:j0aRfwJ/mebn9ykMBx7l88g1pTGtF5LR5kSF/zlqs178h:jk91y8xpqXlR5Vqyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675401138, "uuid": "0f45ac74-019b-4637-918e-8e925f26f295", "value": 65940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675401138, "uuid": "283ce909-2235-4516-9075-32be9c1a3e08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401138, "uuid": "7b3d6eb6-e717-42c9-a8da-44378c36d839", "value": "9a142f6a193d401367cff6ff73a28c36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76ab6e0-a416-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675465352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465352, "uuid": "d521abd4-c52f-482c-a881-86ddfc3b244d", "comment": "Malware payload", "value": "5bce131850fb29d656a8666d33a9bcd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465352, "uuid": "30434c7d-48e1-46a5-b51d-eaf567b34aca", "comment": "Malware payload", "value": "6f75f9370eed7d86fa31fda3605ab3099b3c25d7fe2b18140dc73e64aed8ff21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465352, "uuid": "d0ca7dbc-f30b-4b24-b865-3d8ca4d99bb5", "comment": "Malware payload", "value": "18031d48378d2fb4dc9b0435269bccc1d5057cf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465352, "uuid": "a0762e0f-2a78-4ecc-a63f-caea9eb777b4", "comment": "Malware payload", "value": "71a0ed0942eadbbd78ee323ca84121d0053bee1f68ebe603fcfcd3712924d2b670497f9c8be7115d90593d7aa71c0d26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465352, "uuid": "4773e33f-9d12-4f39-87dd-c10ec64cc01e", "value": "T1FDF3CF213A90C072C1E54671597CD3E1BAABBD229A35DD437B480B6E3F601C17ABE357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465352, "uuid": "233f7e30-287e-4b96-ad4d-2c35b68649a9", "value": "d8db521c1aabdcc02e1c1d2a0eb59db9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465352, "uuid": "a1bb395e-d4eb-42e0-a0bc-1ccabd473446", "value": "3072:NU5FRhLvcixcQ5a8ITutg+eSwde79yCN5c2STEc:NCLvcr98ITV+3jZNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675465352, "uuid": "d90ec451-ce1a-44f1-a5a2-a3a676af326f", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675465352, "uuid": "9529556f-0ad2-4a6e-95f3-419643f1dcac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465352, "uuid": "d2b46182-53b1-4096-9bea-8ce15ba4f4d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3158a55-a3ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675420221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420221, "uuid": "275b4bda-4571-4338-888a-dda2e65f2783", "comment": "Malware payload (AgentTesla)", "value": "b4ff0e96a0f7dc476a920f485b29c737", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420221, "uuid": "214d01ff-aaa8-4abd-a73e-d665b0026340", "comment": "Malware payload (AgentTesla)", "value": "7043b392f3ad83f2bace70b1ec9b9c7a88aeb8368404cbffa0133fb81a5fe4f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420221, "uuid": "b5b5ea85-2463-4d6f-a0f5-7eebdbeb06d5", "comment": "Malware payload (AgentTesla)", "value": "722f4ec11029fc32470b1f181277ada235f57427", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420221, "uuid": "a9982909-f2fa-49b5-8cdc-751db53ff0d2", "comment": "Malware payload (AgentTesla)", "value": "4a1fcaf13712f95d95204de596e37b2319930fdd7acb156f012161ddf14341c6f02956cbad85f3781e5a046164867556", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420221, "uuid": "e74dad71-efe9-466d-a551-824e2becd115", "value": "T11862CFCA47D0E372FD920EFBBE7F3399811F3F9B9066DAD9AF21020610B11952815579", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420221, "uuid": "eda1d958-c7e0-40a3-bfb3-2080994cf308", "value": "384:wAx3QTkgCVEjGDH4v9FjB6xxxchhBDV16jYK+H98p:wAScVML9hUxxix16jPuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675420221, "uuid": "abb34996-ec96-4c4b-9d3d-48504bef7b7a", "value": 15112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675420221, "uuid": "9e92c5bd-9433-4877-a0c1-58f021dafd25", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420221, "uuid": "304433f4-9b08-4d3c-aff7-4c7ac57412e7", "value": "SHIPPING DOC.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48444a37-a3ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675432470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432470, "uuid": "da2d8f5a-8910-4653-911e-d4207cfb9626", "comment": "Malware payload (LaplasClipper)", "value": "0f0dc329ad25ce537a465ab523da60ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432470, "uuid": "03d28ccb-d7d2-4394-813f-4c967e6c0741", "comment": "Malware payload (LaplasClipper)", "value": "707e8d1989268db912cc9c2fc95c82aac61aaee789ef40aa0ccc52ae14282d5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432470, "uuid": "d623d545-bf3f-4cf6-9a58-6089cfadc48b", "comment": "Malware payload (LaplasClipper)", "value": "5f86758789fb2c5a365c428855aed8782095b2d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432470, "uuid": "0dddb134-7d14-4e87-aa65-d9b1101868c9", "comment": "Malware payload (LaplasClipper)", "value": "8ff0c5ff87584e5bc19c29b7f27e35ef564c848430cda7d8efb3a97b5f522be9a58c0619f7435824729eac56c51dc532", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432470, "uuid": "529033df-647a-4ec6-84d9-270482875d2c", "value": "T1B685331272D1D071D44702356E58EE10773BA83170F29A8BFBA603D69EB1BC0E97D26B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432470, "uuid": "f8ac01b1-6c12-4467-811a-b60dabca7b44", "value": "6b1aa8e68ec0f35426270b76446d282c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432470, "uuid": "6c480de9-4823-48c0-b76c-26d1c7c78e35", "value": "49152:YQ6WSG7AjntxI+q7ieGhGP6lyO7aaMuXrrXyU5KMy:05GkonOeGUClZ37uUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675432470, "uuid": "fd7bc987-3ba8-4040-a715-3e1c5f6aebc2", "value": 1870336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675432470, "uuid": "482277d8-b74c-48e1-849e-4711ab96b5b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432470, "uuid": "98d341b7-734e-40ed-bb05-18d62e530c5a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d80357e-a38c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675405850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405850, "uuid": "292988dd-237e-49f0-a8aa-6133d23c99ef", "comment": "Malware payload (RedLineStealer)", "value": "b27e75867100b7f34b35cf147b7ce92e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405850, "uuid": "7e1313a5-be87-4d48-b81d-e2168d7675b8", "comment": "Malware payload (RedLineStealer)", "value": "7304e4710381b20058acc561ff7a36df7e2ce614e8d8e045452bbfaec9f1ab6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405850, "uuid": "20d8cf8b-5625-43e8-ad85-a95bf9ab6f17", "comment": "Malware payload (RedLineStealer)", "value": "e1b51e321d8a5595cc0382198a6ab34c98924194", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405850, "uuid": "a361f2e1-9f2b-4bba-a65b-5a3053405f94", "comment": "Malware payload (RedLineStealer)", "value": "6f673cd2924aff7460310cf2cc20a951baf1dd7aa6ddc8f22d8fb75438bf568e9aea4870cefd84e6ce930eb64fcef694", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405850, "uuid": "0a0f10f4-3297-4b29-a6c8-81261ef6e4f9", "value": "T1565533A2589DE64AD0AEFA7C9D3315CFC25439F55DAEEB661920CFE410B4C30B9D0AD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405850, "uuid": "a073873c-7e33-41f3-a478-263c52c0c02b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405850, "uuid": "5a8bb3d4-f3ae-462e-8549-4aaa5371d4ad", "value": "24576:H1qOg/vTimfbpDY0aV9+rOL54vwe7r9MCdoavl30Og:zgHGmfbp+V9fqvwe7r9MOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675405850, "uuid": "42355257-dd26-4a92-9e0f-b9e29f359f25", "value": 1295872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675405850, "uuid": "9b419acd-355b-49e9-a406-6084f2d7cb6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405850, "uuid": "6a29ceb7-314e-4cef-af44-99b218e9afba", "value": "b27e75867100b7f34b35cf147b7ce92e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246d731b-a40c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675460757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675460757, "uuid": "b1fbeded-54d5-4630-bb6f-ea535a261dde", "comment": "Malware payload", "value": "0325bf65cf0dd871a2c7a90666ae39fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675460757, "uuid": "e9474d8f-7768-4739-8067-392f64b76f51", "comment": "Malware payload", "value": "74b3b3b9e9be86744083e1e1edfbffd7ed3e45fa82ab7b5800879da1206dbd6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675460757, "uuid": "aaad0a9a-ab4b-4793-92b5-419f95519d5e", "comment": "Malware payload", "value": "61e28c922407cc32cab8dca43e402dbdfc034bfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675460757, "uuid": "c5a8a2a1-8d3c-4c12-89cb-d47fbf1feb1b", "comment": "Malware payload", "value": "1fe58f6b1ceeb142fbf79782de9fe33e31c3430cc610585c64639c4a1ba7e6cf37923ad2f9c10df1ff5325bb819a4467", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675460757, "uuid": "1183e9ae-353d-4116-bb9e-746c1ac514f3", "value": "T12BA53309F5404077E9094736652DD95AE83B7E1962BC729B20AD732D2FF33A52C223ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675460757, "uuid": "6ce55ac3-ff7a-4e0a-a01b-3601f4c2ac21", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675460757, "uuid": "4005c708-da6e-4e20-b242-7ff2fb229c6d", "value": "49152:ygsq8x9amzyH0z48KMBqe5dEHA1gxJ/A6A7j1R2FLCgv2MR:TsRx8mzyHmpKMsQdEA1kf8XUv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675460757, "uuid": "24587674-cca7-4825-9a65-20ed344a8ee9", "value": 2082577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675460757, "uuid": "fc37358f-2b88-451e-b265-bc659ee55b45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675460757, "uuid": "807fae1c-ae66-4ebe-8218-0fca6ccaa36c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1cc55d8-a3d5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675437399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675437399, "uuid": "1142cbe4-c37d-4fdd-933b-b38c2bd5b418", "comment": "Malware payload (GCleaner)", "value": "b28b2e7db9917be4a1dca49b3e84c9d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675437399, "uuid": "17500088-5bad-460f-bd3c-e2ee14bbcff4", "comment": "Malware payload (GCleaner)", "value": "75c8cb0176acd498eaacc08ced4aa6731e31e6ca063f6d2f51d57416b0ddbfc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675437399, "uuid": "80adaa48-b46b-4087-92fa-0b5d55d9bdbb", "comment": "Malware payload (GCleaner)", "value": "4abe87966119630ab944644da13b45d4b7c10142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675437399, "uuid": "a43fadb8-db12-46f2-ab04-3245340ffdc7", "comment": "Malware payload (GCleaner)", "value": "3589926005b945dd1dd77375bfe5cea80d2a24306ff14557b277c32dbddee9d8d7316e58fde59c0df5f51805b25435db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675437399, "uuid": "b3a84d31-7688-4b3b-a38c-0c07eb21775e", "value": "T14CA53320FAA681FAF213A4718E204D42FD679E8F34B4094D31E5761E4F271E1F89EA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675437399, "uuid": "d84467fb-f4bb-4074-8d60-72b3590864c4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675437399, "uuid": "e25999e9-7d86-4b41-8ce1-b06797d1979a", "value": "49152:yga2NbMag0Qiz0k/dWVPwsHv5b4UB6wRts2kUBjmgLCgv2MR:TxQrXU0k1WCsP5bnRtsXwDv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675437399, "uuid": "e9bba6a6-5cd4-4ab4-ada2-cb0c2278a5a5", "value": 2069500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675437399, "uuid": "6263da2c-a0ba-4dab-ae37-b4d4c0a7f710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675437399, "uuid": "8b6f33f0-9097-4753-8be3-7115185d1164", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a906b13c-a416-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675465275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465275, "uuid": "dc68e736-2eb4-49d4-b7eb-bc8413926b76", "comment": "Malware payload", "value": "6fee00bc9f4245528cbeee523504402a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465275, "uuid": "9c7339b8-b887-46d2-b047-afaa9e9a54c1", "comment": "Malware payload", "value": "75d02aad45d5e2770be2c1bd88f2a33225127a167ef704604800ba3db71e63b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465275, "uuid": "a50a3f24-3f37-404f-b2ff-4bbd4bbf80fb", "comment": "Malware payload", "value": "99d35c9d356bddf7372596db1cb2809ebea31fc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465275, "uuid": "75979bf3-d13d-4146-b4db-91d6721a3b31", "comment": "Malware payload", "value": "b59f3913505a28cff3aa344f7e78f52e7f26be8466869590a01f39daf88264f44ee4ac7c4973257c86cebd9c34f07719", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465275, "uuid": "fcf5f559-6fb1-4051-930c-8f12c041d55a", "value": "T155A5335321959933E1631A364C36D6367BB67F282B3A3114F16DA31D4F2B6D03C8D3AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465275, "uuid": "6f92b2b8-aed8-46de-81dd-950e641ecd55", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465275, "uuid": "25369b7f-4191-4699-8f93-bef78bce1172", "value": "49152:ygCyPUi4stmkQcGW5mp+oOU6g7murDJeP1zQLCgv2MR:TTDdQKVoOU641rDJY1sv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675465275, "uuid": "83c13811-d13d-40f1-aa25-e2f706cd2599", "value": 2080578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675465275, "uuid": "cf9592a9-f5d7-4ab3-acba-aef457336388", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465275, "uuid": "5eac3ef3-7454-4170-b7c9-a2efc990fe83", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee03572-a3a1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675414872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414872, "uuid": "b7f8bf3a-3ced-4b84-b371-a1644acf0789", "comment": "Malware payload", "value": "f5415395c336fa46e275270cbf8c1ab1", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414872, "uuid": "b53b5690-20a7-41b3-be52-19d23fdd9619", "comment": "Malware payload", "value": "76ac1e659958f6a0ccecf6031c47a762787abb31a00a0807634437f1f79a1992", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414872, "uuid": "731388fc-d4d3-4fee-bb7e-13525163a154", "comment": "Malware payload", "value": "cab2a12a0619ee21edbf960acca204e98a817950", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414872, "uuid": "3130e7c5-8245-4290-98fe-c5ae3eab420d", "comment": "Malware payload", "value": "80076325e2835f9961ca9f83e1261ba840a2fd670ce97402cedebd75123403bf5deec18db3ea58498f52446b5bfb4bb3", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414872, "uuid": "e001b871-60fe-4fae-b09e-7fd60f351565", "value": "T1F3E3D1323AB886C1C3B42BF25ED6BF09692FAE1723571B1E53A5921F4E90244DD04F4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414872, "uuid": "fd08174c-ad92-4771-ace3-3f8bc71ffc03", "value": "3072:+8bAVfBWQdmUeG33oEkIrrJFxeau3r4vuWt4AJERnyNenUWHCoTCCCCCCCCCCCCs:+0AVfBAa33o9krJeAz4iERB7g9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675414872, "uuid": "23a8e2e7-1d66-4496-89b8-45cb4004e46a", "value": 146112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675414872, "uuid": "d3fd2850-50ae-4baf-96c1-9ffdd164a9aa", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414872, "uuid": "eb6000ab-9a55-4f91-a92a-ec0b53d4620d", "value": "cancelation.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d530f7e8-a391-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675408226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675408226, "uuid": "d12471e8-6ee1-4bb9-9abc-b6a87a71e79c", "comment": "Malware payload (DCRat)", "value": "7d809932c2ef777a41c0a34600f1ea8b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675408226, "uuid": "d0d4d576-03ff-45ba-85c6-56c7bc0233df", "comment": "Malware payload (DCRat)", "value": "777ce6ec721c1596e7bdfda1852f82c6e4745dec4809a301b5f1f4a48f792b6f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675408226, "uuid": "bedfe26c-b198-4c7d-aaa2-acda4c3d8d22", "comment": "Malware payload (DCRat)", "value": "7ab0d8490dd900d49d7873475aaebdd3ad3deeb1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675408226, "uuid": "f28a9d00-a4c0-470c-a3d1-4fa58234e767", "comment": "Malware payload (DCRat)", "value": "2b872680fb05da5866c13b049426ae2ec3a915cc4a70f89c17cfc3310cc6af34b9463557f3038291b4c3dec6895d9bd0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675408226, "uuid": "97ea5f5d-77fa-4073-ad35-cfcf25d67526", "value": "T1A9657C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675408226, "uuid": "aec750d1-9eba-4429-9097-c073aba3f497", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675408226, "uuid": "89798643-18f2-486c-a0e9-9e716e44b5b5", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675408226, "uuid": "7a35ea61-f2e8-47d4-b38d-cf8aa651c72c", "value": 1408720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675408226, "uuid": "b47e3f00-edd9-45d8-bb4d-ada9b3d8d816", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675408226, "uuid": "bf9fe14f-05ac-4a74-a094-5794130e2042", "value": "7d809932c2ef777a41c0a34600f1ea8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786be41f-a396-11ed-88f6-42010a9c006e", "comment": "Malware payload (Dharma)", "timestamp": 1675410217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410217, "uuid": "26643666-602b-427c-8c39-e46a09e138a1", "comment": "Malware payload (Dharma)", "value": "471eb92980c6e4cd3ec28272f35b9ab5", "object_relation": "md5", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410217, "uuid": "eabccc47-df37-4840-b0f2-a8ddeb3c1998", "comment": "Malware payload (Dharma)", "value": "77da9b22f28c92543d9ac281469390cbd5e442a59f7ad6d9034d9a7f490ac3fd", "object_relation": "sha256", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410217, "uuid": "8bb3eef0-45a9-4791-a4b4-7f6cc9ff181d", "comment": "Malware payload (Dharma)", "value": "aaa7bef7a33385827c91de8d4550a995717a4f06", "object_relation": "sha1", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410217, "uuid": "a029f8fc-d6ae-435d-8bf1-97536c2f2d79", "comment": "Malware payload (Dharma)", "value": "4cef9a0c01ef22e83875e2c740b41d239f115cf434d04c3bf4bf6e09c94310731c218813b64ae1af10f3ee8d6dcc9f08", "object_relation": "sha3-384", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410217, "uuid": "fc7c7544-fd66-4dfb-84aa-5ff322feb18f", "value": "T116938C29D831C036F8A300FECBFA56FDAD644B10130795D797C05E59AB865E6F932A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410217, "uuid": "636e7470-2abc-490a-a578-3cd1871f78de", "value": "f86dec4a80961955a89e7ed62046cc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410217, "uuid": "369b679e-d26f-431f-b573-582975c70e51", "value": "1536:tBwl+KXpsqN5vlwWYyhY9S4ArjeeEHHHXi/5vqQTVjT+O:Hw+asqN5aW/hL9eeEnHC5SYjT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675410217, "uuid": "046051ca-4e79-4e1a-aa8f-b2d0cd049b0b", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675410217, "uuid": "3a3b8363-84d8-4cef-b3d4-481e438ecf01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410217, "uuid": "2f727a5e-fb6e-4032-9f15-0bf881ee0913", "value": "2023-02-02_471eb92980c6e4cd3ec28272f35b9ab5_crysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5c225d-a3fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675454541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454541, "uuid": "06eafb60-9db0-4724-bb1c-46030eab6c62", "comment": "Malware payload (PureCrypter)", "value": "f383d1763dcdc1e2067ceb0a8a991e4c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454541, "uuid": "5d5f39ba-f695-4fba-90c9-c812497371d3", "comment": "Malware payload (PureCrypter)", "value": "7807253caffdfc2273c16860e7bf893d835d9ce2c2c2dd65f4af9552e8e2e398", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454541, "uuid": "36658670-bd18-4b78-86b3-173910be1c6f", "comment": "Malware payload (PureCrypter)", "value": "65a5ed134615d4b67c058776f65379d0d7f0b124", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454541, "uuid": "f67c0e67-1eda-4666-9f3f-52d76cb93cd7", "comment": "Malware payload (PureCrypter)", "value": "835f622c889b949a2faa5ddde08627bcfa9c6e38ec234f437b017ecdf2db4851d8304d1df94c6d1f3397907079fc692d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454541, "uuid": "4b66b64f-ff64-4c66-b463-784d19a7de18", "value": "T124C5170373F38EA2DBD81737D09B2F1903A486542263F30F69A533661D533B6A6956CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454541, "uuid": "46af0dbf-763b-4f39-8d9b-d8ca8c2d6af7", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454541, "uuid": "b76e3ad0-97f4-4ca8-8327-b9f7bdfa81b5", "value": "49152:aZ7qZPNQEcqo5Ay5sQSR4cJ6beTLH9gAG:glEAiHeQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675454541, "uuid": "8f6f77e7-b255-499f-853e-d3012ec9978a", "value": 2607104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675454541, "uuid": "05983034-f018-4f3d-824a-08ffe39a33a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454541, "uuid": "77142974-7481-458c-aef6-03261a6de401", "value": "28d54c2eca152e4b9724f8c1f4a4ac81.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87abb3a-a3ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675420257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420257, "uuid": "70a99917-f105-4e0b-989d-001872330cdf", "comment": "Malware payload (AgentTesla)", "value": "26e2a12bc4a5adbf87613666c703307e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420257, "uuid": "ea730331-b46e-4c28-b827-6d4f96eaf32b", "comment": "Malware payload (AgentTesla)", "value": "7809c8c2d8ea1d5e50906fce70ad1b5a20856de84804185efab50582a00dfdde", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420257, "uuid": "c6e16202-e69a-4c00-a0c5-61f387af8be3", "comment": "Malware payload (AgentTesla)", "value": "b094289038b68e032a6d081738a18c5a63c37d7e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420257, "uuid": "c9769ac4-2bbb-44d8-a54a-bb3739144d87", "comment": "Malware payload (AgentTesla)", "value": "eaa42ef84722bf779d5507f5a7e97b73f365da28faa78160b9a9d79461e266aef6362756f5a6bacd02f0999de596ba73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420257, "uuid": "35e098e3-4501-4919-adf3-e510c349da50", "value": "T17B62CFCA47D0E372FD920EF7BE7F3398811B3F8B8026DADAAF21020610B11952C1557A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420257, "uuid": "8fe61542-5bc8-4891-aec6-ae5fd5f4ef3d", "value": "384:yAx3QTkgCVEjGDH4v9FjB6xxxchhBDV16jYK+H98P:yAScVML9hUxxix16jPu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675420257, "uuid": "caa5bcd6-97d5-4406-b8cc-dabddc2ccae7", "value": 15110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675420257, "uuid": "342322dd-09c8-45c5-bd59-22a0b6eaca46", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420257, "uuid": "8cbdbf22-ad7a-488b-96bb-0361916436c5", "value": "UNION TRANS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c2cde0-a3ab-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675419206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419206, "uuid": "9be00874-3e29-46d5-89c3-d33a24dd5067", "comment": "Malware payload", "value": "4a100dc648cbccfc1960d13541c9c395", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419206, "uuid": "68673c37-e42a-4008-b0f2-9120eb67b428", "comment": "Malware payload", "value": "78a9e31fc211d1ea36393b0fbe8e8b3c18544855c374699d6bb51520766fb44e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419206, "uuid": "f3157a62-b7f8-4a39-ba49-c8507446a4a6", "comment": "Malware payload", "value": "5683143fd0dcd763ee601c9cd4b397da8d263610", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419206, "uuid": "ccfb3990-ad7e-4473-9dee-51ffb32a4752", "comment": "Malware payload", "value": "d5a034ff35baf948454fdbb4b70b6979966176bfd7a64907f88fe3ee8d0fc9fb42dd382f6a33d9bccc8f7a3b8d7830ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419206, "uuid": "9e8484e0-8626-4252-9446-bd5026c4c70e", "value": "T1DBD6339559D792F8C9C77970AA1B9ECF32FA11F65A814C30E8C54AC2B7F5EF93402182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419206, "uuid": "914f7a02-7ed5-4708-87f8-51ee977a347d", "value": "24bff06826129533a09ce490c5fe8ff8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419206, "uuid": "864336ac-c6a7-4d63-9ccc-f93aa4c6852d", "value": "393216:3+UkDN3oYrdvMc5K1bPSi9AMdnEFSNpoZFrT:3tO33r75K8sdnEFSXoZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675419206, "uuid": "3b4dc897-9731-4d92-9990-e12c1bf1a550", "value": 12780544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675419206, "uuid": "6fbb6df8-6d75-42a4-a829-45555d83a85c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419206, "uuid": "97637df5-5e47-476a-9355-a3396dc5ad2a", "value": "4a100dc648cbccfc1960d13541c9c395", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ffa94a-a388-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675404068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675404068, "uuid": "00cced74-29a7-4c06-aa48-7200322bde23", "comment": "Malware payload (GCleaner)", "value": "d7ecdd6198a2390ceeb7050da685e582", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675404068, "uuid": "c784193c-96d5-47c7-8eb9-485cb1e5f58e", "comment": "Malware payload (GCleaner)", "value": "79679b1de141fbb079a86b0c962b9482119a47bf398212e482774ed821b25aad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675404068, "uuid": "c4ab7efe-fe63-42bf-8e46-ffa0c32d8114", "comment": "Malware payload (GCleaner)", "value": "fb822db23527516eb53991bc9e586131e5e9fa0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675404068, "uuid": "739eeaca-f407-43ad-bf7d-4bd3eeb4f995", "comment": "Malware payload (GCleaner)", "value": "88377bf1d9e366101506376f8fc2b47de57c7c56da61b4672428fef6d662056c6d2161f05aa1d366e57a94934d76bb45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675404068, "uuid": "88ffebae-045f-4ced-8b05-5341554e6bb4", "value": "T141953385A1E11833F247E77965218814DFB37A6C287C0BE171EDF2168E272C0BD5EBA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675404068, "uuid": "1527379b-540c-4f17-a67b-0d7d9d3af3c9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675404068, "uuid": "8a39b867-bad7-4ca3-8df3-38601624c164", "value": "49152:ygobycXs5uBEWAqgC9TH5NeipZxaI8EB3hGa1/LCgv2MR:To3pBEigC9TH5Nei4I88/1bv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675404068, "uuid": "76c76e1a-84e6-44be-94d1-4b4249bfc7b7", "value": 2009270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675404068, "uuid": "d4ed41a0-f3a0-4d4c-a391-deb452618819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675404068, "uuid": "f80edd91-9d42-4a7f-ac29-4fe34421d007", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d7eea93-a3f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675452746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452746, "uuid": "d6adebb6-7133-4f72-9e18-66f5086b0bfa", "comment": "Malware payload (DCRat)", "value": "014fe145a9d6a1a94f5e1950dc3580ad", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452746, "uuid": "450ae41d-fafd-4401-9a2a-1c2e4410b13a", "comment": "Malware payload (DCRat)", "value": "797934da336f36e3e80b71e2d48a5ed7453d27394868cac609989ba11f00c734", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452746, "uuid": "4e999fa9-9209-4905-85ba-109eaf716b59", "comment": "Malware payload (DCRat)", "value": "f05af2022c03559345c1ed3a38021f50600f7c8f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452746, "uuid": "69d0e5b0-6f9d-4998-a49f-b0695f41ea0e", "comment": "Malware payload (DCRat)", "value": "f2baa7b0c7157d99ea1dd09407f347806240b53a9526fffba592e97a395e066f0cf2c003cc2e772e5804d9d6161211fe", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452746, "uuid": "6834f882-671d-42ca-8a45-16b8608380e1", "value": "T1F8536B013798CA65E2AE4AB4ACF3560146B5D5772002DB4E7CC404DB6B9FFC64A236EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452746, "uuid": "cc5d562b-6c18-4e7a-bea6-45fa06bc2d90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452746, "uuid": "7eb23ee8-cd4f-432a-bb2b-e67f2576e598", "value": "1536:NhjExLDRwQuNMXbmaeWs1ljNhhYZq9bbHyqKRLbQGZZVclN:NhjExLDRwQuNMXbreFlzhp9bbHARL1zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452746, "uuid": "4588257c-a606-42e0-8e8d-cd1ff5eadab9", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452746, "uuid": "9a27d79e-bc96-47db-886c-60632d742f0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452746, "uuid": "7696b0dc-2bcc-497c-8e26-30e6935509b6", "value": "fh5BWZAg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35617105-a3af-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675420842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420842, "uuid": "0803d7d7-efed-4438-b8ce-cf45c2beef46", "comment": "Malware payload", "value": "eda76c1943ef9a85f6bc751a1da8c71c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420842, "uuid": "6c21c564-8167-4b44-95d0-72a3e40da112", "comment": "Malware payload", "value": "7ab40b2c2064c64ab89d8115c8e4340ee17c149a3262f51583b90838651a9f2f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420842, "uuid": "8ffdda6b-325a-4a0b-bef1-6151a441810b", "comment": "Malware payload", "value": "a9ccfcb206b6aaf58aa7fc0e0fdb782f16d5c14b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420842, "uuid": "f80a8c22-adc5-411d-baf4-e9fc61121686", "comment": "Malware payload", "value": "b9b5ec0d7fbd4460b094d758459c590b31e896d0ac3989369a2cde9fc7832184b3f4a430ef05caa1da77a3292cbaf287", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420842, "uuid": "0bf67fcd-cf50-4bc7-a8ca-2a09ca5e35d8", "value": "T10A62D071D61C20F9DB009BFFCA2264C98ED176548CF03CAFB6007056B9EBE1656E2B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420842, "uuid": "eac86154-675e-4261-a8ea-05fa72ac6810", "value": "384:ZTPtNthiBMqXUQcSgcNFOrXa40gZvu/C2K+JJU9j/AZ2Rs:Z5yMqXncpyShZvuquZ2Rs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675420842, "uuid": "53f3592a-4626-4cbe-9a77-e513b43650df", "value": 15123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675420842, "uuid": "831470cc-26fc-41b2-a9c4-5c56351f9329", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420842, "uuid": "8dd142e9-6741-4140-bf48-0db17ce26049", "value": "PURCHASE ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c49d8403-a37f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675400467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675400467, "uuid": "8dfed724-c0ca-481d-be18-2058b20d1aa1", "comment": "Malware payload (Amadey)", "value": "638dcffbaa967e595e37d925de30fa4b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675400467, "uuid": "2b4a1c5e-ab06-4175-970f-5c186373ca4d", "comment": "Malware payload (Amadey)", "value": "7ad82b4a34926b1a128cfe58fbf18503be6ab384244384c9e7b5cbad798669b9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675400467, "uuid": "f9013ad1-9ae6-4386-9bee-48b104116de5", "comment": "Malware payload (Amadey)", "value": "affa21fa63065f935c2f5581a4942ffc887316ed", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675400467, "uuid": "bc9d9ab5-7ee6-4322-801c-aa9e9950defa", "comment": "Malware payload (Amadey)", "value": "f023f789a4aa003cbed860dd8393456d5c067fdef41e82fddcd90a6a40dc4855c3a317b07dfaab57d40688832e96100f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675400467, "uuid": "864f4f15-d7bb-45f8-b5db-4d16135325ef", "value": "T190647D02A292FC51DA21CF729E1EDBF87A1DB9914E286F66121C5F7F19761B3C1A3310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675400467, "uuid": "a1cc4c39-126c-4a1f-9c40-ac883ed74c6b", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675400467, "uuid": "3720e023-36c5-4973-8301-204d6fb6d259", "value": "6144:6/u7Lj6LgzJbxESVjvwXaC1lwKwpxhH0jV6ptCbNKN:6/u7P6s9xEGjIXZ1lem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675400467, "uuid": "92552c54-ddb3-4307-88e3-c32f0fd81218", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675400467, "uuid": "cda3d6f7-3c85-446a-89e1-d2c6648cc629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675400467, "uuid": "f372d5c4-931a-4776-8c5e-331354162af1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e15ca40-a388-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675404133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675404133, "uuid": "cf609bbc-cc79-497f-8133-1c0f7c87857e", "comment": "Malware payload (RedLineStealer)", "value": "7adcf29dabe8e554670524f3aa6c7fbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675404133, "uuid": "299c5b22-45c2-4940-bbb0-9f6383f6e51d", "comment": "Malware payload (RedLineStealer)", "value": "7df73e8505e716f18264a2216aaeeaed4e956c1d6f4992fb25b2a23daa0a3011", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675404133, "uuid": "ebd5fe6e-76e6-4164-82e6-5af4113618bc", "comment": "Malware payload (RedLineStealer)", "value": "9d04845fd2deeb77bb7a2df340cfd8764f7faa9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675404133, "uuid": "9e5e3507-e759-4b05-a98f-63409fd0ab88", "comment": "Malware payload (RedLineStealer)", "value": "672c6eff4ef5501325a0fafaf7fdc54e9efa693729f0c0f09e3a39c18179160723a5048f2051acd2afb8a91f682dd201", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675404133, "uuid": "d974c3b3-7f7c-4e42-8ff6-b01e973d6a57", "value": "T1966402327BD0D2B2C56781704814D3A1ABBEB43246BA9C4777A81B2D9F707C16A3735B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675404133, "uuid": "290c15c2-a09c-405e-a996-1bad54421e98", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675404133, "uuid": "39e1ccb1-ca79-4eeb-a7c9-523e596b0cf9", "value": "6144:oHCrqLtCLQnc/467YkutFPuztXeSInUlD1wIw:oH4qkQnS19ztOSIUlDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675404133, "uuid": "4cc4849d-2ccd-44c8-bf69-152b90df1962", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675404133, "uuid": "bc5bab89-a9cd-4c2a-a659-bce4c3a98b68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675404133, "uuid": "dd427d34-6e6a-4b98-8432-b0f1d383ffdc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f9a4ffc-a3e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675443650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675443650, "uuid": "dcd87002-1b97-42d5-a905-d411dc2df4b5", "comment": "Malware payload (RedLineStealer)", "value": "b32b10c8691023d9eeacc86c57677de4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675443650, "uuid": "4a809ce4-8625-40dd-b594-3c81183d09b2", "comment": "Malware payload (RedLineStealer)", "value": "7e9f64cbb0cd22706f8e8dc5366f191be44ec6bff5803424c758096a6216cb73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675443650, "uuid": "3f2772da-dd31-4d71-848d-75f4d0203185", "comment": "Malware payload (RedLineStealer)", "value": "db527f54661d549631a1dcdb07669fdb7034c7c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675443650, "uuid": "95cbfec9-0530-46c7-8bc8-97f5845fb6fd", "comment": "Malware payload (RedLineStealer)", "value": "51b6c6ff78bf3f833d5bb50f1ecca9fdf18d8c8769ed20731bcd3d02632950d16d493bed6744b8c871fe6511d79b7094", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675443650, "uuid": "e6ccaa39-6d2d-415e-a8b7-00a1588dfa69", "value": "T16664F1223640C0F2F5B625316424EFA5AA7FB53145B9C54B7BA51BBECF302D0A72538A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675443650, "uuid": "a5daf225-8460-4849-bcc6-77dcafa49595", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675443650, "uuid": "adc5c902-8d51-4796-b1ba-04aed7619518", "value": "6144:ACLX4BLg+R3t4Ta0thxNMgD5PfqdsYBab:ACDqJ3ohQ9d7BO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675443650, "uuid": "d2e8ac14-dbe9-4589-880c-3da3b18a1979", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675443650, "uuid": "cf95e046-402a-4c90-84c6-e25ff10f37b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675443650, "uuid": "35dc5c4e-be0c-4ae3-abd8-89232cabb347", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7f23a0-a394-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675409530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675409530, "uuid": "2c2c270b-3e08-4e67-b06d-8d31afc1e0ee", "comment": "Malware payload (Smoke Loader)", "value": "46dfab7095051e939cdd2a42fd936efd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675409530, "uuid": "cbca45c1-83fb-4872-828b-5f9507f3268c", "comment": "Malware payload (Smoke Loader)", "value": "7ea6ef5dfd7b75113822e800f1dcd8bd421a07a853a9a72493e2a700ea7dc572", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675409530, "uuid": "a85187d2-bf1c-4f5e-9853-bcc1246523c3", "comment": "Malware payload (Smoke Loader)", "value": "7fbc4f97338ec85710b1dfb0a2a1aad5be5dac15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675409530, "uuid": "c0f7d1e9-e466-4238-ae7f-4c23ddfd4edc", "comment": "Malware payload (Smoke Loader)", "value": "844d6a367710660f0cc9965ed077944a766841ffa59a77ff6f944e0d6a0828ba6bdc7f85e49fbcf26fca040562425b93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675409530, "uuid": "a9c84c23-9cd2-4dfc-8340-36c1e0eda371", "value": "T1D954DF2235C0E072C5AB51305D30FB98AFBEB530567A954B7B981AAD9F303D0A73635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675409530, "uuid": "07836b06-a035-4949-b9d1-32608345dad8", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675409530, "uuid": "e3d020bc-8f5c-4c32-a808-7fa88b06c9e5", "value": "6144:G7eIJALxgebUGVfqE0czzXHO8A4TJvHwP:G7tApUGwE/zz1AAxHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675409530, "uuid": "eb259652-39dd-4616-9dc4-8bdf66111a92", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675409530, "uuid": "920ebf69-bca1-4b25-bd62-8efc6e05ac3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675409530, "uuid": "fcda6a65-68a4-490c-8da6-c5d7029a8a46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4ee464-a3a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675415383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415383, "uuid": "417ce9cf-c56b-4bcf-8719-da34b50ccca5", "comment": "Malware payload (AgentTesla)", "value": "5c13f9053987fed1c42cbcbb765391f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415383, "uuid": "8e34ad84-7fc9-4878-b9f8-f90e81938e63", "comment": "Malware payload (AgentTesla)", "value": "7ee6d644993e34adf930f7b8a90e01f14b9eb047fb972f8a1448ffc85e5ec3cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415383, "uuid": "ea34f180-f7b9-4ae6-a5c0-8aae9c9eb89a", "comment": "Malware payload (AgentTesla)", "value": "c0d83315d4e5fae0332f3fcde5b0ca16d363710d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415383, "uuid": "9d6dc317-6969-4d4c-919e-7a6dd200789a", "comment": "Malware payload (AgentTesla)", "value": "b3e1fafee85851a11cfd1b569c47f2a79e2ddd0b54179c4fae1fe2d36ce13b7087a9913c9b2cfee34ffaa6dfc056a3c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415383, "uuid": "65514c91-8176-44f8-8593-8c678c25dbd6", "value": "T115D433D2B5D7AB76D6D8854B1DF4583E48802B0CB33876C8D4D38BD370E482AE9B90E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415383, "uuid": "e7499312-c8f7-4031-9f49-334bc6d8d5d3", "value": "12288:Mq0h6tCMwgJcTQRf4zqOcQIYjMC3LiN87Xz9T0Qb0n4QJMk4LnT:j2MFcURlO+Cbg8dwQIJzcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675415383, "uuid": "158015cd-d638-4063-a64c-f1be3db57fc7", "value": 612682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675415383, "uuid": "8db12d49-d127-4fdf-a110-243d6ea8b1be", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415383, "uuid": "c6210a41-8e69-46b1-9c0f-979c0b25fe24", "value": "Invoices last shipment_001222896.PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d95691e-a38b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675405341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405341, "uuid": "6c70d7cb-6b0a-40d0-88e4-178d2db378e6", "comment": "Malware payload", "value": "695b21a6c212659132036546f0aea74c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405341, "uuid": "1e9b3f5c-3a8e-4dd6-bf15-59bf3e9b89d7", "comment": "Malware payload", "value": "80e35ccffd09b91e2efc6f921b8fcdfea20a718f5aee6468a401304a12645b0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405341, "uuid": "8ebfa252-c988-4bbf-a1ea-74dcb5191837", "comment": "Malware payload", "value": "074c7cae21cb2bf2db9d0b7c3203e3033ad4096a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405341, "uuid": "b21900d8-4d37-4e00-97b8-0417e8e74815", "comment": "Malware payload", "value": "e5a72a57dd442127e724c3272c60e5dbbe82d74147c44617a7bed5a23c224d1ab9f64149dc2b147a890ec990c9f0ee1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405341, "uuid": "2d0c3a58-bd3b-4622-b048-210ba5ce5b98", "value": "T19F7633257BD488B1FB80483309605FF59E41E27C6E609D2B7FC68D7C2EADA564F0EA14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405341, "uuid": "fef76fba-f4fc-4103-b68e-b68e4d3768c9", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405341, "uuid": "25295f27-8db5-461c-b881-c90e89e51afa", "value": "196608:91OiCBQr8/vVkYD0LZeVLqhhJogjl3G6iaWEC/4vEINA:3OIAdVoLZeh12W6iWlvrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675405341, "uuid": "a5248fe9-1b79-4f93-8b05-3e680b83605b", "value": 7638213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675405341, "uuid": "5ed11929-317a-49f0-a3ab-2d950438eb2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405341, "uuid": "796896ce-e0ff-4004-9b77-b1c3ac2daca4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce28aedd-a3f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675452022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452022, "uuid": "aa69d319-fb90-436a-9e19-487e02fc5052", "comment": "Malware payload (Amadey)", "value": "5b7e0054fcebbf4c8c6b028f17804511", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452022, "uuid": "74a75eea-98ba-4b53-8fb4-ef364b5c232b", "comment": "Malware payload (Amadey)", "value": "818de0f6b23c024b38e2bb6162dc9dea3a6e3b99610a26c501a65a3e6bc18f17", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452022, "uuid": "4d01d54f-451d-4d6d-b51c-9605584d0371", "comment": "Malware payload (Amadey)", "value": "367efdf55d0bf3778e4fc0b3446cc3e3c59251a2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452022, "uuid": "6b850027-c947-4017-ad49-bfb2d3a89c21", "comment": "Malware payload (Amadey)", "value": "df5ed70047f383f024f1234250c5cefbe7905cdac4c1ab475d374bd839db9dd778f4854552753a96ecc75fce4fa6bcf3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452022, "uuid": "898f1c35-03d6-42ea-886a-8754aa04c46d", "value": "T157D412233A51C0B3C72724708820DB696F7E72319A7AB86B7B6C17955F326C0767235B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452022, "uuid": "4dea9ca1-ebdb-4f17-b060-016e76b975ec", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452022, "uuid": "05600a33-020d-4324-91b3-af2d09891808", "value": "12288:IeWAXD/vRilXPDFqxyhUmw+3Wrqm8NzR5ze8:I8bvI1Ppq46+QUlVe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452022, "uuid": "84351a2e-e5df-4677-822b-80c4143c1db1", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452022, "uuid": "522101f4-35b3-448b-ab35-b27f1c2b91c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452022, "uuid": "b687491f-8034-4c85-a896-06d4624dabf4", "value": "5b7e0054fcebbf4c8c6b028f17804511.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88ff10d-a3f8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675452416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452416, "uuid": "9727546c-9a06-45f8-88ee-5b01dcfebc53", "comment": "Malware payload", "value": "7e36982c75239f565136fdd6e01dce35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452416, "uuid": "8ab86720-e29b-478f-980a-e01fda58ccbd", "comment": "Malware payload", "value": "856e63cf7753fa8a126d3809e53a5a536f7897879374466010603611d5159e26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452416, "uuid": "c7179ebf-4fc9-446a-9e1f-e21c9d86da4f", "comment": "Malware payload", "value": "9cf9abfe81f3cd3c8c62c30033d006e43dbe26c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452416, "uuid": "c38ff674-e337-420e-844e-30f4081659da", "comment": "Malware payload", "value": "0d37b11cf0fa4fbe0fe417d785feddcf33c4a7a0d1dfa368a579486fb2be9e855129a3c49968b4f9c9108f482b5f1093", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452416, "uuid": "84422013-f609-46bc-9946-f95e705f5aa9", "value": "T105553314E139E439ED90B3310DADAEAA5DE74F56D43827439FDA711E6FF3280462A342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452416, "uuid": "677d487b-a499-492b-a8e9-ddec8b6d9989", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452416, "uuid": "709e24c2-1d8b-4f9e-a799-37adf8eb5024", "value": "24576:0/AiplNkNoj6gPaORBPfCgflzQgqYPGX4XyuoHd1ZoEG8fv5nw+:j0mejXPlxK1dX4AHdPoErnJw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452416, "uuid": "00d3c526-d9ea-4cf4-a837-1fe4378c5aad", "value": 1363584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452416, "uuid": "60da67bf-be11-4927-9933-2b1f8bc49abf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452416, "uuid": "85feeb28-be10-48a3-a653-70967e1277ef", "value": "Ticari Hesap \u00d6zetiniz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f677da-a3f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1675450094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450094, "uuid": "04839d6a-83ea-4d81-8441-36f14d495287", "comment": "Malware payload (Chaos)", "value": "c680593188c6b21d3fe3c214d7fb8480", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450094, "uuid": "bb62eded-db07-43e0-9585-616d7d02b9a8", "comment": "Malware payload (Chaos)", "value": "86aeb60a8a1a49aa824660bdb85b512c9181b9e2050e9ee019d7969099d165d7", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450094, "uuid": "0e50d24c-ae13-433b-b3c8-c49b6c75d7c9", "comment": "Malware payload (Chaos)", "value": "86cd997f2297d64a961c2590db04fc0538b108bb", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450094, "uuid": "6af55cf4-2598-40cc-aea7-643351b0d133", "comment": "Malware payload (Chaos)", "value": "a25680dc020d0f7520a20cbc5efbd0a9a8dc3f48b086187acf6f795831fdb9465d65876125d2fbbede0398bbbd429c7f", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450094, "uuid": "90cfeda7-df02-4120-bf15-48108f8ee45a", "value": "T1F3B2B5086BFB4939F6FF2E7C987210545775BA92DD3ED74D188A004D08E7B8C8952F62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450094, "uuid": "ba8da585-bc56-4934-b865-1b35f811ba68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450094, "uuid": "7ca8e039-0f48-4d46-95e1-42e6dfdd5e7b", "value": "384:7Ap3MLWHn3kI3fcSxlR2Wp2lSMYWJ0r91Czxb5geo:7AJn3kIE69pcyq0r9ixbeeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675450094, "uuid": "a3be33fb-0794-463d-8fc9-422169765cc7", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675450094, "uuid": "2223c988-99c0-47b5-b8a4-360ef3560f3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450094, "uuid": "08574f7f-9a0d-4990-95ee-b1eafa418a37", "value": "2023-02-03_c680593188c6b21d3fe3c214d7fb8480_destroyer_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36d68b1-a3ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675448568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448568, "uuid": "9b79bd03-1e35-41a2-b7a9-492f0aaa0d89", "comment": "Malware payload (Mirai)", "value": "c740c02d260625eaa8665d08694d9d01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448568, "uuid": "e6b33f5d-6f3a-4aa6-a703-173aa390f7d9", "comment": "Malware payload (Mirai)", "value": "86dd3db7339aaed97e8e395ffecb2392859787b78193cd6180ca81138277675a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448568, "uuid": "45b8e6d6-2974-4afc-90f5-688260fb4a2e", "comment": "Malware payload (Mirai)", "value": "2edd5f659aff1d8fc70d221dd893f26ffb89bff9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448568, "uuid": "cc86bfba-2492-46dd-a6d0-fa61489ba632", "comment": "Malware payload (Mirai)", "value": "116fdb456e27987057f0aa7a51e14817222f3f6bef0afd3b1458bf3f106474260eb38dddb0fe7f785a89a67221e88b6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448568, "uuid": "eb777778-4278-4e08-90c4-26a1071f5c26", "value": "T18BB2C0CDA0543484CA4D7C7C678D4A664F6CA1C0BAEDCB16E354CE9473BAA4F345D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448568, "uuid": "c74f4430-b8e4-4a22-a20b-be6526823188", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBp7ZqSWvX:4QlS07FUXqIYSXQKqudqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675448568, "uuid": "4f380f75-7480-404f-8b4f-883554107343", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675448568, "uuid": "a4f49b61-18c3-4af9-b954-ecd3c8360823", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448568, "uuid": "09a9445b-f208-4a0d-a525-aeddb353d50e", "value": "c740c02d260625eaa8665d08694d9d01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c1dd7d-a402-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675456538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456538, "uuid": "ad0198cf-d99a-43d2-99f6-94910f9c6a1e", "comment": "Malware payload (NanoCore)", "value": "373dfd91476ca6648beeb235d30cf54f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456538, "uuid": "34e956d0-d93f-4b56-b6bb-5a09f6418837", "comment": "Malware payload (NanoCore)", "value": "86f42645b20ddd4fd363bab53bd0a6c3ea69dac332b403e975837b71e3f57126", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456538, "uuid": "10535904-fff1-4e2a-8750-2b7f71224594", "comment": "Malware payload (NanoCore)", "value": "ea13a1f8343bba2d074402360613937325b5c32d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456538, "uuid": "02c5ba4e-53b6-42df-9b3b-6f498273b929", "comment": "Malware payload (NanoCore)", "value": "c08b14b29ea206172fc119d2a576581c4c391ce6395b29ebcb9c56636d6ebf0e29ad9f5c7c49f7b104add50f0616abeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456538, "uuid": "382b89a1-3f4d-4e93-b8e5-00c4a28cc034", "value": "T12754CF1277E1843EE2AF4939146186A2873ED5E29D93FBDF26C8157B0F213D04A175E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456538, "uuid": "20e38f35-06fe-463e-9078-9002021df96a", "value": "12115494f2c86ccfa8a7bf3471dfac33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456538, "uuid": "4de02e61-5287-48a8-b742-1a4262443484", "value": "6144:BCteODDmzKRgLV6Bta6dtJmakIM50MJSftp3:Be3+XLV6BtpmkKcX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675456538, "uuid": "4e760be7-0c77-4279-b1f8-cd58cd30a926", "value": 287232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675456538, "uuid": "7e96bb38-96ab-46be-bb57-8128fbad02f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456538, "uuid": "54537a6f-9182-4655-97ae-baee8ad628f4", "value": "373dfd91476ca6648beeb235d30cf54f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35499718-a3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675442317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442317, "uuid": "5ea15f88-f3a0-4e38-99c9-1367615ac0f7", "comment": "Malware payload (Smoke Loader)", "value": "23eea6abba8ff3b87d8f542cdb0739a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442317, "uuid": "c9625122-15e3-4930-bd55-4112038a2a50", "comment": "Malware payload (Smoke Loader)", "value": "88036dcba6b0288bebfbaa31d9dca33f1e0df4b98eb4cbf40d1c3954d8d0ad6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442317, "uuid": "2599d28a-9383-4043-89a1-0c4e1bc88346", "comment": "Malware payload (Smoke Loader)", "value": "edfa84c0819940e9f3bcaddd540252fd6e1d2010", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442317, "uuid": "057c6278-bb89-4de0-b40f-826ff92e2c7a", "comment": "Malware payload (Smoke Loader)", "value": "2c2cfceb3fb93f280725029d0ef818716b803f5f87b3c201cd2aae1a84011d037487a52f2a0685c613bfa46dcf6b601f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442317, "uuid": "db1bd7dd-fc8a-47d7-bd21-ac7b7bd4ead0", "value": "T11614D03236C0C0B2C66B05305870EB656BBEB8315675993B77A81BAD8F343C15A7B35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442317, "uuid": "ef1de6a7-3610-4388-8350-24c11b208399", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442317, "uuid": "4512a3c9-7c79-4755-af2e-21f6209d7256", "value": "3072:JevcKu/tn/wL6dDH8zqWco5af5/YgOlvSpo15T2f+44mS6X5njG:JeE7wL2H+qff5wvSp+T2GLh6pn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442317, "uuid": "daefb2e0-8ec0-40ad-b3b5-364ea26b53dd", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442317, "uuid": "59a9a809-cc65-49fa-b25d-d9bc32fac95c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442317, "uuid": "14afab88-11fb-4743-912c-fdc5b06d2ee0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1993cf1-a3b9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675425373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425373, "uuid": "751134b1-838f-4eaa-92b2-ce767f03616d", "comment": "Malware payload (Smoke Loader)", "value": "99417e730fc3dc190824642e532bd42d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425373, "uuid": "3a160847-e090-4440-ad05-d196973f6dc0", "comment": "Malware payload (Smoke Loader)", "value": "88354b37427492c5730a4d0d8576c612ae355dcbddc8e3260e1aa5e5f429909c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425373, "uuid": "5773d6a4-1249-4af3-b594-3bff0f965d9c", "comment": "Malware payload (Smoke Loader)", "value": "9b78893e55a46b7d747edac28057379b024c0b84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425373, "uuid": "daaac76a-38bf-4346-8567-40760497a76b", "comment": "Malware payload (Smoke Loader)", "value": "623339e3059a8ff2f66a000004a01485edbe043c833b6dd87e713100cac748aa3f225b553324e3522a308fc47a077ecc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425373, "uuid": "53560569-573b-4459-ba45-8cb044a9cced", "value": "T1B014D022F590C072C47A25304C34EBA57BBEB93186798A4B7B6C33BD5F706D0663A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425373, "uuid": "9fe453fa-8760-46cb-8626-b86fa7c8b02c", "value": "072a8f61f2ea0ff476bece6d90579847", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425373, "uuid": "4f11ac4f-3ab4-4447-b4de-4acffa633ec4", "value": "3072:VC5iDH+0oXLhj/C/lwWBG45QooEdY7O3WtVNd6xvuoTS9Bqz:VC7XL9/CtwzBOYC3WH6GoTS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675425373, "uuid": "2b28eb44-eeb1-4bad-b2d7-9c772d324bb2", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675425373, "uuid": "60413597-db20-4d8e-9c7f-9d13c3779b5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425373, "uuid": "2850f278-9bbc-4b8e-800d-a262e4740888", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f1d2d5-a3cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675432787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432787, "uuid": "ae89b4c4-68ed-4da9-874d-3f39564423d4", "comment": "Malware payload (Amadey)", "value": "974e0260a9afb7e6b4f8e6bd3195cdd6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432787, "uuid": "cc1e6118-283d-45e5-bbf6-77103d1a0169", "comment": "Malware payload (Amadey)", "value": "893b40ff0e8576eb9494a9a21e4752f4764d6a66133af24dae839fcd57aff2e4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432787, "uuid": "b911d8cb-f6aa-48fe-8cae-ab970cf54556", "comment": "Malware payload (Amadey)", "value": "61cb10f2621430eaee5957d18105a7a0eaeb5f55", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432787, "uuid": "2f9c8699-ae04-4b8b-8c0a-646a7d6a9fc9", "comment": "Malware payload (Amadey)", "value": "5f5e90af4e3742fd686d7f3dd4cecb7553c8221cc3c93679af84973d9a7ee6531f61a139984f2f7e9d149be9ce71b79e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432787, "uuid": "a3e087ef-6f7e-4156-9cc5-b504c688d3d9", "value": "T1C0B4123235D0C072C57A54705868D6346ABEB9327635C65BB7B90BBE8F20BD06F3A316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432787, "uuid": "017378ec-ad60-4407-bd44-ea72ca486b66", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432787, "uuid": "3362fb0f-1f03-43a3-855e-e13033f0e817", "value": "12288:keETvYNoxjz2ShOl5tF/Zxs+eS205jyol0xvNofJa:kNao5OlrF/ZC9b0WZNsA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675432787, "uuid": "6873d2aa-a7fd-4226-843d-4bdc5a9b7ca3", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675432787, "uuid": "bb81865b-81f0-4996-94eb-1f3a3104472e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432787, "uuid": "677a9a93-faa4-4140-9a9c-8b9ac9633feb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d2d606-a3ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675447385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675447385, "uuid": "ba24dbd3-3afc-4cf1-8a01-0950790cc9d4", "comment": "Malware payload (GCleaner)", "value": "245b4733150cd18c3daea962a4caf79b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675447385, "uuid": "b42853b1-2273-4b6e-87dd-2e0850fc853a", "comment": "Malware payload (GCleaner)", "value": "8a73255aaf5fa28a39833550ff97df2d25400d731f90517a835c6e5d0a24cc60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675447385, "uuid": "339e9de0-5f1d-431d-aca4-00b0328b3091", "comment": "Malware payload (GCleaner)", "value": "86e17671fd67756ccfcd4f1dddefac34e750931e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675447385, "uuid": "4cfde957-2941-4f8b-b1fd-52ccc224ff18", "comment": "Malware payload (GCleaner)", "value": "2f32850ad2d111978a494b2c70aaf2ebcf84d2fae0f6751e10eff3ca193b94e8f227f92452521b9ce6081678b5413d07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675447385, "uuid": "775e9530-0f2c-4df9-8337-fbd09e341e0b", "value": "T1FEA5336BA070C636ED8292355A952582DE377D051AF8C1A4300CF94F1F3BADB2C5EB67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675447385, "uuid": "56a4c49e-47ff-4a67-8c54-ca4f56498ca7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675447385, "uuid": "5688895d-2a51-49c8-b418-38cde130bde6", "value": "49152:ygfhnLa7pbtSwe9EHsvHnWn/CAVLbIlYh/QxDvGhjBLi9Jh7C0Gx6d9GhLCgv2MR:TtqyoHsvHWn/ZlbOsQx7K9AJFC0o6KvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675447385, "uuid": "a7a1ee49-06ec-4141-ac2a-384d51db73d2", "value": 2087853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675447385, "uuid": "37feb975-f58d-4630-8fb4-9bfb73f16609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675447385, "uuid": "a733af3d-bcde-4814-babc-88af58fa463d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4daa007f-a3a5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675416588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416588, "uuid": "63cf802a-c64e-487e-a8cb-755975661090", "comment": "Malware payload", "value": "dff15fc0aaca429db20e6c2f0b2657a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416588, "uuid": "904a4025-ad1b-47a9-80dc-3629f53d8da7", "comment": "Malware payload", "value": "8a90ed2c4b126c5e1a664ef34785c5d8d927571522b0feb5c0520d74272d8fbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416588, "uuid": "9230c8bc-fb34-45f8-b72c-fa9db5e37f17", "comment": "Malware payload", "value": "ea9b41c698134f5d2fa62fd84888281b79d5264f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416588, "uuid": "522a5c1b-adbb-4cd9-8872-1c3e8b288446", "comment": "Malware payload", "value": "cec8e9c950af675b41799fd23f040dd373ec1f8424cf1f142e3f72849bffe2027ab85efe1926f980e48282fdaa17a488", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416588, "uuid": "82162246-6276-45ce-815f-8eb8f05df950", "value": "T11C7633A132D6CDB1D943397147D56FFAD0F4FBFA0B2169273280145928B80AFD27A762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416588, "uuid": "d41f540a-acfd-459d-beed-5b62a0406e72", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416588, "uuid": "58f98d7d-d89e-4f00-bbcb-018065b63ab1", "value": "196608:91ObRN0FbA71OK8TEpRPLrlbJfllJLXp9vjTHwTN:3On0e0/utlHLXjQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675416588, "uuid": "b7de9d46-fbab-4fea-9afd-420ce04bd786", "value": 7600028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675416588, "uuid": "1222822c-9a2c-481d-8169-597277b9c042", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416588, "uuid": "213c768b-77df-4181-9e8e-42685e2a7b85", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e751d2d8-a405-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675458078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675458078, "uuid": "d40aeb9f-dea6-4831-a32c-a76821e12613", "comment": "Malware payload (RedLineStealer)", "value": "907e797e894625c9b6a125210e0f2716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675458078, "uuid": "8d6b5137-2ab3-4f65-b0ee-b34ea5a6094a", "comment": "Malware payload (RedLineStealer)", "value": "8addf8deb4101c163a7cae1a0ceca836de4b9dfd3f6c0bf369c14ecf70452d13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675458078, "uuid": "3e357a85-9f4f-408c-8353-8384e3497076", "comment": "Malware payload (RedLineStealer)", "value": "c13aa01f4e36699770289751ee5055d45fc76cb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675458078, "uuid": "0c2f0c48-5e70-49a5-8a9c-4a1eb04a69ae", "comment": "Malware payload (RedLineStealer)", "value": "88f5fd6d195c8f8f864f84eabd56040a7220f5eb445f6a29c5e723d93ac3ced310a31d5ce5139bf67025fd574385f3da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675458078, "uuid": "c6882c30-a770-46cc-b671-cd71dac60ef2", "value": "T10154F1223680C472C5770D346C74EBA5A7BEB8305A798957B36907ED5F303F0AA36366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675458078, "uuid": "596d07b7-860d-4b31-9a6e-e7cd5719e37b", "value": "11deee92ae37204b8493d8d64f5f1f69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675458078, "uuid": "5848d77f-a18d-4dae-8cc1-bfd4bdafaae5", "value": "6144:Zo4QLkffchbcbO/vJlicU/4sD0oVvpM7mssLZN07TUv:Zo4QefTQicUDdv+6C8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675458078, "uuid": "04fe8abc-97cb-4a3d-b9a8-2da14874c6ba", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675458078, "uuid": "d4851b45-a9ba-48b6-bbcb-1203704774a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675458078, "uuid": "80d4ed7f-aa89-4cd5-aaa9-45be2539b0d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7940302-a3fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675454562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454562, "uuid": "938acd04-61c9-4035-8abe-985f1fb88421", "comment": "Malware payload (PureCrypter)", "value": "1a3bf975841f302ee537d343e85d1593", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454562, "uuid": "4ab15565-d477-42d1-a014-90eb4dfc25a6", "comment": "Malware payload (PureCrypter)", "value": "8afdc764c281ab58feea32532dd5e116c1ea7caf532af95a46a2352b188e0402", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454562, "uuid": "be6c4489-34d7-4dda-8d8a-46dc2a0c5c88", "comment": "Malware payload (PureCrypter)", "value": "93aaf7cedc7b270e992fa309e51bda28182bd8d0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454562, "uuid": "9d9bcdec-fcf5-46ec-990f-3473c1914f36", "comment": "Malware payload (PureCrypter)", "value": "ab7f8193f147393248524ae5b04e0d97e8af4b82a8981a2a44005ef474b95c275bf8dfacd2fe267d39f67e6e1397a758", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454562, "uuid": "a9fc9c78-ae2a-4e74-8778-c1f0183afb70", "value": "T1D0C52B0271D28E71F70427BBC79B642407618B966B13F39B39ED033958033B66A6D6DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454562, "uuid": "492f68ba-7517-4f0a-99f7-1a7a6d919e49", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454562, "uuid": "69394c2e-d239-42be-ac3f-32f67239ae06", "value": "49152:QIm8637Wlxjcv79C1FQinndzBDk8ilI/ew:QIm86anD5F/ew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675454562, "uuid": "62078b68-fec2-447a-90c0-a335bf266bcd", "value": 2622976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675454562, "uuid": "b4d213dc-8bc8-431b-82ce-0c01d2e9fe52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454562, "uuid": "ce352b0e-7abf-4562-94bc-510ac109f03e", "value": "1fbb38a076974e7096240433fe11273c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab5cc28-a402-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675456822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456822, "uuid": "aef376a7-784e-41d6-88b4-0997e69918cb", "comment": "Malware payload", "value": "92d8874c9bccf6efe5794d190c6f0aae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456822, "uuid": "3da81165-d194-432b-bd13-2892aa9e53b6", "comment": "Malware payload", "value": "8bb65de7a3ac7c7cdf84ff44b3e09ea54ed7e38dde63a886b4c04321dcfe2402", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456822, "uuid": "8bd1f71e-373d-4fa8-a596-511d72da9297", "comment": "Malware payload", "value": "644a860909f12dde66cdc9e6e1fb574f5114a106", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456822, "uuid": "28578b17-4b1a-42c7-9ab7-8417ef42969d", "comment": "Malware payload", "value": "1974bc0da0249b85289e619080b7b451f1dbc11643bf31d4d7934386284a978bb381d43c675e152247802241164725d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456822, "uuid": "5e98944c-3336-471b-a5d3-e0b19dfa2527", "value": "T198F4EF057A4B8165C2F152B0383F849047EA3D7A2BE9DD1E394AF78B06FB39145E5E83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456822, "uuid": "4211ec94-4af9-46e5-a181-b41f204d96f7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456822, "uuid": "57a627f2-0dea-47e1-ba50-1160775dd5b6", "value": "12288:VQi3pRnv6m6URA3Phfgp1hf39Wkv8xwJiWt6uIn:VQiZZChh4pdUMic6uY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675456822, "uuid": "b6a81a01-7e4a-41ac-b7eb-d6e06a370cfc", "value": 776416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675456822, "uuid": "9723e853-ad6a-4be5-8f2b-1b10b1380382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456822, "uuid": "b1e96099-b8d5-4127-a005-e2c10716f414", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c8a3e3-a377-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675396865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396865, "uuid": "5e082dcb-9a16-41ba-93f7-877702315904", "comment": "Malware payload (Smoke Loader)", "value": "df255232d861da945a5903b5a4f83222", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396865, "uuid": "756c8f53-9295-4705-ae9d-3ffffa6a0dee", "comment": "Malware payload (Smoke Loader)", "value": "8be684f68d659590b3aa13a877dd646f611affbf08c218040dea88f580044e20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396865, "uuid": "85a0ed99-0db5-4a8a-be97-f8d6e1bfb5ad", "comment": "Malware payload (Smoke Loader)", "value": "aa152c3b5fdc1dbb9ebf13f657eb8ecb80570499", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396865, "uuid": "b8af1f0f-905c-4a9b-aa7f-5ef3bf94ca96", "comment": "Malware payload (Smoke Loader)", "value": "a51045bbf2258080ee48a6a19e39806a1d0ee77a545eef65b51634d7230d7e3da1be47520f2216313c981bb8110472a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396865, "uuid": "1bdfafad-1750-4da0-99f2-57136a66a969", "value": "T1B3648D426292FC51D621CA728E1EDBF47E1DB9518E686F7A12185FBF1A73073C5B3220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396865, "uuid": "65346c80-0e2b-4e73-9d2f-6bdf6a940855", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396865, "uuid": "a3d2c90b-3d54-41c1-b1a0-2fd8fda5c8be", "value": "6144:Y/BVLaNoxRn93mj2DJZngisAuly8FxlwKwpxAVjV6ptCbNKN:Y/BV+NZ6JLsd/nlew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675396865, "uuid": "1990f5a8-b5a0-4495-b922-cb7336e2a46d", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675396865, "uuid": "ec352558-e3ec-4781-aaed-515cd4390ad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396865, "uuid": "09823175-04d9-49bf-b81f-598ad9b9d410", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e340486-a3ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675432480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432480, "uuid": "40ad9f61-14e9-4eb2-8bbd-b9442933f2ff", "comment": "Malware payload (Formbook)", "value": "ea0406dc2d0cfd68f8620e462406a819", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432480, "uuid": "41aeead3-8ec4-4b9e-a882-9121f388d117", "comment": "Malware payload (Formbook)", "value": "8c86c2c68e14eef2ac6a63da35633b309ef75e7f818a6bf935e56471ed5dae53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432480, "uuid": "c4d1bdbc-22d4-4c62-af10-6c3479418d02", "comment": "Malware payload (Formbook)", "value": "aca8beb5b8055efb907e600f0ac51160aee5a548", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432480, "uuid": "6d518384-e9ff-4906-9041-f6b99a0922d0", "comment": "Malware payload (Formbook)", "value": "847eb3cfafc5c19496e07106ce010e6299956261c7ab0e3bde792bc41414f6515428c37f72194709f36ce558bcaa1cf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432480, "uuid": "f19e2acc-91f4-4b64-87fb-735ea4d223b9", "value": "T1F284E0C5F94084A1EC2A5732197ADD321A577D7E50742A1D3BCE3E3B3FBB4A2A419903", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432480, "uuid": "ce032477-224b-47b8-9c34-b256b245351f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432480, "uuid": "3a87d214-8b06-4528-a86b-0667381fe7b9", "value": "6144:jYa6yIgee0WsmHcrkflbDpIHTsxLB047a/wlz9POTaZX7UWzkaJqxB:jY1gAFmHc6YgHh7a+pOmX7UyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675432480, "uuid": "3aa82450-0d41-4677-a0b8-2ab1eba8fd68", "value": 394096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675432480, "uuid": "3cea3ec6-e904-4925-b623-272e99800d89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432480, "uuid": "4f47379a-f517-4d20-b5bb-45140e63fbc7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39856b59-a381-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675401092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401092, "uuid": "72db026d-b0e0-4e36-9f60-10a986974756", "comment": "Malware payload (Mirai)", "value": "f9161dcb62c2b24c0f8bf7761811ebc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401092, "uuid": "23e56e32-90e5-433c-aeb3-a4f7a11e0e5d", "comment": "Malware payload (Mirai)", "value": "8cb8472c803c9b51f7a8cee66a4632252a681bfba3cad58b341b88a8f5587143", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401092, "uuid": "2a1ab1ab-5c67-4341-acfc-9be984337308", "comment": "Malware payload (Mirai)", "value": "2949fc476e7c2b2aaa6aceab7abe453d2ce081ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401092, "uuid": "34c3d898-1205-4dc2-9fe9-ea0b6768bfd1", "comment": "Malware payload (Mirai)", "value": "826830bb65861a6848d8b98afdbf08aaea54f83665243a49b3496e5c65eb2f0b4816bb64a457e375a22647dda538b1a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401092, "uuid": "492307bf-0913-44a3-bd65-78792777d392", "value": "T161539DA5C4B8BD99CF69927CB61488389723900564A33DFAE742C796D00BEECF10D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401092, "uuid": "0449a2a6-f223-437f-adf5-801edda48e91", "value": "1536:B/bivQhunGaiwt4gpuFosvXZxwaqUfs3rBktd1UYjC1P2:BjiBGhGp+XZxtf+d21UYjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675401092, "uuid": "90b2d050-c9bf-4691-8fe7-18defd58b7dd", "value": 64360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675401092, "uuid": "ee7ca703-0907-4aaa-8c7d-7ec8d4d8eea4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401092, "uuid": "99976396-ed60-42d3-9393-979c49f2550f", "value": "f9161dcb62c2b24c0f8bf7761811ebc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52809271-a3c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675431629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431629, "uuid": "f9ce1e2c-da3d-4750-b4d0-b6357174aef1", "comment": "Malware payload (Amadey)", "value": "b7ed5a4ceba71ed31faed3fb3529362e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431629, "uuid": "2ef21d35-b1e9-4199-8598-546a3bd25217", "comment": "Malware payload (Amadey)", "value": "8d63f51739135790cb67f73b4ce60712d58f84f9eb86a2dab540c4655b8b8406", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431629, "uuid": "4dd74c32-318e-4d8a-98f4-e9f23ed50dbb", "comment": "Malware payload (Amadey)", "value": "7701e6b80f53a1a33e4acf83d6c5a7503fd6d3b6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431629, "uuid": "067e6424-a264-4816-94e0-c065cabd3a1c", "comment": "Malware payload (Amadey)", "value": "d86647f392d45601288786c9772743acf1f702dbe5c70127f696f7e2cba31bbf835279235f44ef71024f9936d221444a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431629, "uuid": "f28fb1a5-cbf4-4d71-82b1-9705f3bf3e35", "value": "T184B412227790C4B2C3AB6030ECA4D765F67E283055B6558B3B984BBD8F70BE0673A715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431629, "uuid": "2e9c8ae0-1539-4823-acee-7142cda3b2dc", "value": "6b1aa8e68ec0f35426270b76446d282c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431629, "uuid": "f566d1ef-33e3-459b-9882-69c990c75b78", "value": "12288:9a5GQPjI/lm2ffTmh7O2FvFlG+/KwF1Q:9QR7wlGlZ/DF1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675431629, "uuid": "bc468547-51dd-4706-8a61-32effa2e0954", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675431629, "uuid": "ef408020-97c4-44c6-afa1-34626ccd5a8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431629, "uuid": "39102c4d-c742-478a-a26c-f674ce8c60b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ac6ab3-a3b9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675425410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425410, "uuid": "b32657cf-dcd5-497a-bb31-86d0be4a5e5f", "comment": "Malware payload", "value": "b6384a5c7230eacc3fc194eac586aff7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425410, "uuid": "d52d8d26-928c-4cb4-82ee-c956b515809c", "comment": "Malware payload", "value": "8df71dd0d5860c4c95b1b42416ead887b2ef1c02226600213b82faf673ec1a7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425410, "uuid": "6af99844-d3c2-4c4c-b9f6-6504d7c116cf", "comment": "Malware payload", "value": "747a93eb10a4a2d5a6e6a9ca7bb90bee370e1e27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425410, "uuid": "a3636d42-6bc0-4b37-a0ed-3814ac6bf8dc", "comment": "Malware payload", "value": "2b1ed342e3fd30845bd05e022abcf978549f6c64996cdb49d5d99340e645f948614bb13d690a05feabda70e178ff2877", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425410, "uuid": "087cf085-7d14-4724-84ca-f99abbff733f", "value": "T1F77633233AD5C6B1DD5279B2C9404FE8A3F5C3252F25DC9367F845AE5C3A42A8027E2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425410, "uuid": "34552dcb-863b-49e2-ad60-4e36d0e64f3c", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425410, "uuid": "251b1b13-4d4e-4580-9ac9-f2f7cdc11ab7", "value": "196608:91OVQTcWwmRX8K7G3aehWK4sAXYIyhf6Tz/eouXKgGo:3OwX8Kw5has0YXhSTz0XKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675425410, "uuid": "b783de4b-42e8-47c2-b32c-bcd6ec5e8b4c", "value": 7587747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675425410, "uuid": "a3ad7958-4cf9-4f94-9b46-852bba0b8bda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425410, "uuid": "8534f56d-2ddd-439c-9884-489ce14b9df5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd46e9b-a381-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675401046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401046, "uuid": "c1b5e735-4a04-46ba-a8be-aaedd6752f7d", "comment": "Malware payload (Mirai)", "value": "c5983ae3f219b1a8cb5908c5382ed0c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401046, "uuid": "27cef951-12b4-402b-af0b-bc9aea54616e", "comment": "Malware payload (Mirai)", "value": "8e05f98205bcc091aee0735003b41c7d8ea9e1858be4538befc1748d4c07087b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401046, "uuid": "bcdef0c9-00fb-45c2-8200-667d7ee9736f", "comment": "Malware payload (Mirai)", "value": "e4c28d7b0b9142e5fc3d4d82097b01c90bc129ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401046, "uuid": "ddb28ca8-f166-43e2-8368-6e5e2eddd3b4", "comment": "Malware payload (Mirai)", "value": "fa6d768fdeface08d77e8893c0929d74be31c78ee10007b868052299439511f9b2d7d80eed26055f8047a5b9a47f00d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401046, "uuid": "139737a7-6cf0-495a-9433-49904ae9a73b", "value": "T112C2E021274EA435D3F050B8C9A0819A65AE4B9CD1DFF2267D440E2C79A691F71FCECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401046, "uuid": "fbd817b7-af4b-4ddc-8da2-e3730a1bac1e", "value": "384:qdk751FK5G+8qsM9poBAYYKN3gB6OzKRHMAyEZjvX4qw2HA7sxShymdGUop5h5Nv:qy75KMu5z6sOj4qSJs3Uozn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675401046, "uuid": "777e387f-f2c4-4fe5-9d1e-92026dcd3cc6", "value": 26296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675401046, "uuid": "85310716-1887-43ec-80dd-d63973cf044b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401046, "uuid": "a794d444-8609-4c7a-9a56-0719079cf7e3", "value": "c5983ae3f219b1a8cb5908c5382ed0c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9c10e6-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675454085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454085, "uuid": "84b638ac-d045-40f1-a18b-50a1783357fa", "comment": "Malware payload", "value": "c4cbfc607768d6594e6460b8628fe4f9", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454085, "uuid": "1dacfd0a-f065-4ff0-bcdf-059075042df9", "comment": "Malware payload", "value": "8e422eb6de1fcdd6128e051b3795f80819695bf57147f6c250d0096fa3778c10", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454085, "uuid": "43cc70c5-624c-4a6b-ac4e-24f6c23fce2a", "comment": "Malware payload", "value": "4b1a57449576e8e2039e9ee7ea4a564d01c3b87d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454085, "uuid": "9f845565-779d-4ceb-b5d6-567b6cffd915", "comment": "Malware payload", "value": "2fafe09b014887a239d4b15366c4a6c33db89bf4605fb2a8805d91ebb476454fe099c2ac77906f0198b02e1197ff5e7a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454085, "uuid": "33ff25b4-d863-42fa-b38c-40947c70d3ef", "value": "T183F09E56AD2BCD8C9677D87681F6EE08F2D7412200466B0AB7EC88876F38367C6C5092", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454085, "uuid": "a85a0350-ad58-4166-894e-de3e3ac46e9b", "value": "6:8o6mks6X6pF2T0hIXhAF4NqhdF4zIWysnyvtxlu3UzV7naqwoMaM5MWXb:8frmF2T0hIhihH4nXngju3m7naqsaMSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675454085, "uuid": "690c2f51-a33c-4b00-b443-0b0889127343", "value": 526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675454085, "uuid": "b19185d5-abd6-47bb-abd4-4f2894ace2c3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454085, "uuid": "460a52e0-1fdc-4050-a2f3-3efe99ea0b66", "value": "c4cbfc607768d6594e6460b8628fe4f9.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57acbe91-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675453971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453971, "uuid": "d9bfc8ec-69d6-4658-8124-ef52e4ba1d37", "comment": "Malware payload", "value": "ecbd2db08796ada0483955b29a6cf787", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453971, "uuid": "7f3dd303-88cb-4fec-963d-47d96fd244ff", "comment": "Malware payload", "value": "8e64c074c098eb9c1f5f96812069706a192c939c1439311bf5cc7c350c5d5ccb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453971, "uuid": "04d9b422-2235-4869-99be-af1d16004b1a", "comment": "Malware payload", "value": "d2d1442a32af23a0c8e1f7dfd7b69a63e750b60e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453971, "uuid": "657b2bb2-aae7-4f58-8f0a-99ee67b5c95a", "comment": "Malware payload", "value": "827b3fbb947780ef4bb42f44ee2a466ffeb7361a930ca9800181ca8e4f7d10b5ca8c09d376fd26420a27d86f801ad490", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453971, "uuid": "3be7d07b-d2c3-4df8-92ab-fa5ab80e001b", "value": "T14D06E14BB2B8019CD567C13DCA176707E7B174552310ABDB17A08AAA2F23FE517BE324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453971, "uuid": "a3a7a62b-ae66-49d6-abd9-18cea88ea48f", "value": "49152:QpbB0l/+d1c0RIJvGZ2anYqiGNjiSZTKAzkltDhTCcVX8saTtWycadNYoYW4IETc:QpNFXNuSZTKA0t9FFPE7YVrsk9N8ivA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675453971, "uuid": "80f02cfa-da6a-4f70-b94e-aa0726e40ea5", "value": 3750177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675453971, "uuid": "b7379e08-2791-4743-83ee-4d4e476ab047", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453971, "uuid": "b1cde893-6c14-4bb4-9940-87901cf5e009", "value": "ecbd2db08796ada0483955b29a6cf787.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2caab02f-a35a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675384321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675384321, "uuid": "e7f5c48d-2862-4499-991f-c8f8ea0606e4", "comment": "Malware payload (Amadey)", "value": "4e3356863948d4eee074c8b1b8782a9c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675384321, "uuid": "e265a952-7c73-420b-ba42-fe556962ddc0", "comment": "Malware payload (Amadey)", "value": "8e7b2c3f9b59d7f0479bc61638eda5d9594e56b09b329f83dcc8110c76f0e0c3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675384321, "uuid": "c8f8876d-51e3-4521-9bb4-43dcbd99bbbf", "comment": "Malware payload (Amadey)", "value": "d630968864ea2bba3541d994fe5e04a5675ebaa8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675384321, "uuid": "70bbad7e-88a3-41b5-b667-87f5badcf380", "comment": "Malware payload (Amadey)", "value": "d32ec402ec6cf5d75a69813f03a48d7fa32c3a55b6c98f3b0dace175bdc22a01660f2c7cda72109a2c524add237e9b5d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675384321, "uuid": "f68108da-6f97-46ec-bafa-2e37dd9aeb20", "value": "T14C647D82B2D2FC41D626C7728E1FDBF47A1DB9518E29EF6652185F3F19B2072C5A3210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675384321, "uuid": "e8da33dd-d6fa-4c7d-9fca-62c1ca81bef1", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675384321, "uuid": "d6558b64-c2a3-48b8-92c1-b814b6d83f50", "value": "6144:5CgdLq0BLTWORSEEA1Sk2wlwKwpxOkjV6ptCbNKN:5CgdTBaWSk2wlef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675384321, "uuid": "77265863-640c-4191-a301-e2b5f687f7d6", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675384321, "uuid": "b2488bca-42e8-4a21-98e7-ceaea6cef2a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675384321, "uuid": "4e9d4eb5-b0da-454b-866e-e66198d04f1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344c16ab-a396-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1675410103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410103, "uuid": "be6d3c94-9ff9-4d99-bdba-65a89fa390f5", "comment": "Malware payload (Chaos)", "value": "078c6bd7d00a5659627cc3705877bb5b", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410103, "uuid": "650b251e-6cdd-4886-8c72-cd350af6fbc1", "comment": "Malware payload (Chaos)", "value": "8e7b4b201a8972142b560c663e92b8808e08c23c7859c00190201b5d6e85b037", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410103, "uuid": "f98bfd16-aac8-46c7-88d5-21caf4e5b28f", "comment": "Malware payload (Chaos)", "value": "643c4592a4c9f8657643da9ed926a4cb978ea176", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410103, "uuid": "d068ca73-4d76-4bc2-8bd3-123e98b4b2d6", "comment": "Malware payload (Chaos)", "value": "639a1ff982c382dae27cef660e2479a1384bac1d1fc947df71826af6a24c3ccc5dcaf12340e3d6fdb96af81f6ce3b39f", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410103, "uuid": "1aff0de9-b747-4b29-a22c-603dc0e0d1cc", "value": "T14634FF2429FA501EB1B3EE7A87E8759BD57EB6763703545A20A1034B4323D439DC3A3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410103, "uuid": "5b69d01f-c482-4722-9f5e-913fa21a6a8e", "value": "3072:Yo7osar9TDsbvMydgJ0AeuXjn7YCzfa60tRc0hBDkU0acqCg/1j7gdbQmSF:mr9TYbwVnRt0RPhBDdrcA5mSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675410103, "uuid": "7994424b-c7d7-4b6a-8841-f4de4082bb95", "value": 232339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675410103, "uuid": "29d2b8ed-81be-413e-bc2f-4a7f458b1516", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410103, "uuid": "c7589393-c781-4b67-a356-1b240c0079f6", "value": "2023-02-02_078c6bd7d00a5659627cc3705877bb5b_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be24fe8-a3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675442301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442301, "uuid": "60cf877c-64eb-48b1-91d8-662d839a1441", "comment": "Malware payload (PureCrypter)", "value": "8008b1c3d4681d0dfcb746edb5f96295", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442301, "uuid": "65ed6074-f339-441c-bb4f-a0c305827c7b", "comment": "Malware payload (PureCrypter)", "value": "8fb167f74d045e986cb8ba378126fc812ef4709ff31b29e7536c20fa26c63833", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442301, "uuid": "f32a15c1-82b3-4403-b0aa-690b19069f6c", "comment": "Malware payload (PureCrypter)", "value": "e8bc051285ff1aea290432cff9c4ee2d4f666f60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442301, "uuid": "ef1fcadc-27fe-4f50-a96f-ccedb10d7a16", "comment": "Malware payload (PureCrypter)", "value": "d2fc128d17f29c3db1268bc376d7ec04dcae2bdfc8cb54f4bde6c7ce05c274af51dd8a3c8acd953549333675fa306bfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442301, "uuid": "1361284f-0227-4791-b0be-92d341cc9c87", "value": "T1DE4533D9E700A67FBB3D8B53D8F549620A2743A4DB60C423C9F6D570A65C38D3A294EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442301, "uuid": "e8039290-7332-4d94-9d25-c1c13428f5bb", "value": "24576:4oBaBtoBAe2s1u3zbBRgC9K0FNrF+01DXIXTYJaczUGygdEfTdrE9uk3fHHD:4ntoBAU129K+FldIXUJDzvVdE7i9uIfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442301, "uuid": "ea70c284-40f1-4a58-97bb-9a6d6e17924d", "value": 1278171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442301, "uuid": "9409a2bf-1620-4f6f-860e-ff3d6483f7ef", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442301, "uuid": "40fcba4c-9aac-4e3e-9aa2-ef0d730d7fd4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c4015b2-a397-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675410626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410626, "uuid": "0e5e1a9d-9517-4a44-a203-de228ee15fd2", "comment": "Malware payload (RedLineStealer)", "value": "b4f48b9cca284baab48895108cbca541", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410626, "uuid": "037976c6-793d-46fc-bbe4-c2920b707a33", "comment": "Malware payload (RedLineStealer)", "value": "903b60f5bce15b6dbff35ec37ef0ef8f159f6120de1559b869a747b2ae149639", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410626, "uuid": "c510dbdb-8029-4fa7-bfc4-177b54fddde0", "comment": "Malware payload (RedLineStealer)", "value": "3972060a464b9a1777901434a97dfc1526e2af6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410626, "uuid": "806808f9-7dc7-403b-ad2e-28f4ad9b91fd", "comment": "Malware payload (RedLineStealer)", "value": "067040f3e39d9e7f0e42af3cad19eda4b689ba53d5267471c9ffc102085fc029c8fc5657dc4f207e9e258803b3a65d03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410626, "uuid": "98f43f81-f187-4126-b92f-d8a08ef05836", "value": "T1DF3412057B9BA578DC05A2B428C2C51CE09C33AE94F78BAFFE24D1758D0596F0AF9394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410626, "uuid": "f6c0f9da-2136-44a5-bf48-ae55473f58b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410626, "uuid": "ea415e48-4bc8-4509-9974-461580bc4368", "value": "6144:UKrSPfJNluG11oxrjWv3StV1C5WjKOqhWXKKRRoFD4U:TOPftOm3SFEYqerRRkcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675410626, "uuid": "eee32ece-16c5-4c70-b6ce-e85a9c518cb7", "value": 248320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675410626, "uuid": "82883260-2fe5-40fe-9746-23b9e8403826", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410626, "uuid": "bbc69662-c289-4a23-bdd4-48b32037b762", "value": "b4f48b9cca284baab48895108cbca541.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07869727-a397-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675410458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410458, "uuid": "975f615e-ddf4-4ac5-92d4-aab6b1741cb0", "comment": "Malware payload (Smoke Loader)", "value": "a446d1372a365a1d59bf68fbdb8f5af6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410458, "uuid": "534d83c1-51ee-44c5-b544-70cbb1f2530f", "comment": "Malware payload (Smoke Loader)", "value": "90988c815a0d7bca3e0e8cc3ebde74d55e3eda874687ed7b92bb3528c2745d57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410458, "uuid": "26ddf9d4-b335-481e-8656-3ffcec04ed1d", "comment": "Malware payload (Smoke Loader)", "value": "b832411ea49bc2e87b1a950acf716d4c65f34075", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410458, "uuid": "23f1ce0d-c053-42be-b92c-32bf04b866d8", "comment": "Malware payload (Smoke Loader)", "value": "0dd28ff1a3ba56a8c96f6d4cb5f331e90a48b6a81041b37f656c86a8617aa98a8509c30ff113fdaa0f87cbf7d8ec974b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410458, "uuid": "99234376-3b22-4acd-9465-3e0ac59e5ce6", "value": "T10B54D02139D0D072C57B55304920EB99ABEDB930097AA84B7FA827BD9F707E0973531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410458, "uuid": "959d8934-fa5f-4ea0-88a3-f04c615d38af", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410458, "uuid": "39f0a6dd-a156-433e-9823-193bb0dc0226", "value": "3072:sHqXjNetbVnFLYM+VnWRaR5CxaiUIozR9FsGY67ACAZMlw:sHqUFLYM+VnkaOxaiU19e+UCAZOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675410458, "uuid": "5b2e066c-02e4-4211-8b9e-0d6df0a3dbb0", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675410458, "uuid": "4d0cdfa3-2ddd-4ea0-b5d3-5ac266d71e4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410458, "uuid": "80ac4b25-8081-4aea-b98d-591f28af5b53", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6515c34-a359-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675384229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675384229, "uuid": "8d5a7466-8f3f-46a2-9112-762c371ca80e", "comment": "Malware payload (GCleaner)", "value": "e3da4495f09801d51b8fd0467a403f9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675384229, "uuid": "4542567d-1a13-456c-b8b5-ce8d1b93fe09", "comment": "Malware payload (GCleaner)", "value": "90cdaad59ecb71c5925bad117c160c6262f3e7cbc88700ab36201f00bd969d18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675384229, "uuid": "92276259-15e3-480b-a0c5-0392af0714ac", "comment": "Malware payload (GCleaner)", "value": "19fd0cea707e227a9322372cce684fb263b41bba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675384229, "uuid": "b5d262ad-a47f-4c02-a1a2-8db71c756636", "comment": "Malware payload (GCleaner)", "value": "b35f8e4a86c3e2e604b84ae8e1cfdfb98f2366be5d0042a928277cf906a988900cbd1fa5a8f2add6f5ec8381aa1a044f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675384229, "uuid": "b9c4527b-77a1-40a8-a233-ab57a6f973cc", "value": "T195A53317928D8437F0978B779E3A7251EB966FB238E8C606741EFA4A5EB45C01C503CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675384229, "uuid": "1b78e650-a98c-4f11-ad95-7e3fc6b6fff0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675384229, "uuid": "c307e14b-f6d5-4f4a-b253-f4b03815f121", "value": "49152:bgcwTQIxKFwYBQymZTN2JPijjh8YbFP9bWLCgv2MR:ccyxFWJPMjWYbFVav2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675384229, "uuid": "2a5c808c-7438-4e6e-a9bc-2f83f86d24ee", "value": 2100043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675384229, "uuid": "dea24ef9-a3f2-4ed0-8ac8-643c07c91a73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675384229, "uuid": "ad016896-17d1-49ca-8dfe-707f959a5088", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a78cfda-a3ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675434273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434273, "uuid": "71b83491-82af-4dcb-9b8b-24b666ff49c9", "comment": "Malware payload (Formbook)", "value": "a068387ad447a41aaaa0c62957959b70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434273, "uuid": "2acd3332-0361-4ec7-9b9b-ba92c1d661db", "comment": "Malware payload (Formbook)", "value": "90e16db5eeb066ec2cd74747e124e37974c75880be093718bf90e7de86e73d1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434273, "uuid": "ee32fa42-939f-41b3-b337-88d1d49600dd", "comment": "Malware payload (Formbook)", "value": "4912d60ea2aff90059eadde3d64f7a530bc2b3bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434273, "uuid": "e7867b25-adee-47d8-9ce6-b8cabcf7853e", "comment": "Malware payload (Formbook)", "value": "3219b5b42471ea7c40f05c40860f52277ab727a4cf472e73865f8bbcdf5325c68e5ed70b85e27c92d43ef856d4c055e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434273, "uuid": "b2fc2249-3501-4193-b934-92f639b678ce", "value": "T1BD641208FDD4C02BF6A11D31AD7A1713BDEAC7162EA46A5B13A12B5CFB70B819D4C361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434273, "uuid": "f159bfd7-051d-45cd-a745-eaec98fb5e89", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434273, "uuid": "c8417d88-4166-4dab-a343-daf7435f3a14", "value": "6144:vYa6bxkZgB+kmIeievNSZgLY6RsuTZs/A12JKgqmJXT:vYJOemIe8CLHXZso0Agq+XT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675434273, "uuid": "bb215101-fdbb-489c-aacf-7f18ac529fdd", "value": 308854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675434273, "uuid": "111a6296-10b6-4cf3-80d4-445b7a91afb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434273, "uuid": "9e6548d6-3dc9-4f50-96c1-3c1311627802", "value": "90e16db5eeb066ec2cd74747e124e37974c75880be093718bf90e7de86e73d1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd62406-a3b8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675425042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425042, "uuid": "284c7da5-15bb-4440-8eca-3260ee51ff6b", "comment": "Malware payload (Smoke Loader)", "value": "5f12ec84f26e3b42f5faefd6d98f55f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425042, "uuid": "6e049f84-d891-46e9-b0de-b9257cc7c6cd", "comment": "Malware payload (Smoke Loader)", "value": "911f782875fadb4acced0ff282a43fdbe7b5769213d29c3454bf5e7f37019060", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425042, "uuid": "c875d2b6-83fe-49ca-95fe-2ec3bd859a99", "comment": "Malware payload (Smoke Loader)", "value": "866b790923d49b969f6ae9b465ae64be14db74cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425042, "uuid": "a75686e2-066f-4d70-83d1-92114d4ec349", "comment": "Malware payload (Smoke Loader)", "value": "8dc2bd79374bcd0a05ccfca68165e71242b506ce83e72243c7fefbb9f1b45778b1c05294b5d11649cf95f820b5d538be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425042, "uuid": "9cd5f4f4-f769-4564-8503-577c83da4acf", "value": "T10314C0323A80C072C6AB35304C63DAADBB7EB931D67495577B5407AE5F703D05A3634A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425042, "uuid": "21a85ab7-5f53-4d57-aa50-c16819809499", "value": "072a8f61f2ea0ff476bece6d90579847", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425042, "uuid": "d9f45423-692e-4353-9808-f97c266968f8", "value": "3072:H2o8uVTLjLcTDWH0nOWJvQ5RycLu70JdkpT6bYIzXnqJV/kCLWVjrhi:H2cjLiDWUnOryH70Jke7GJVPaVvhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675425042, "uuid": "c1fc8ff1-378c-48e4-beb0-aed9db17b506", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675425042, "uuid": "e52c9643-1406-4968-adef-8ee41ce4dc7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425042, "uuid": "2e8f39a2-cfa2-4fec-af7c-79aba5f2a508", "value": "5f12ec84f26e3b42f5faefd6d98f55f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281b6ecb-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675453891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453891, "uuid": "d22724b3-a486-4180-a14f-b4db0f2b54f8", "comment": "Malware payload (Smoke Loader)", "value": "0c6dcffd11859aaf6b5013f13479579a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453891, "uuid": "7dd7c61a-aaf8-4f24-8091-51c63a85e26d", "comment": "Malware payload (Smoke Loader)", "value": "91771c60412e06e8057a051502c45554b7ff66ab283b7e82065d863eec5d94c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453891, "uuid": "b224a76d-774d-4bf0-90a6-ce08e563e7dc", "comment": "Malware payload (Smoke Loader)", "value": "125201541b44bfccc2605e9570eea0b105c91e4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453891, "uuid": "9dccd616-f2f2-43cc-883f-58d96125428b", "comment": "Malware payload (Smoke Loader)", "value": "8a98e1fb3931798a1623a448fbd134974f0bf7d0f8ad64e1c771cb1317f68dab2363beabd25f42ee88bd028453957338", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453891, "uuid": "5a3598e9-7de6-41a2-8ff4-04144ac1d095", "value": "T13A14D0327690C072C6AB14308C21EA657B7EB8305679895F7BB807AE5F707D12B76317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453891, "uuid": "835c2dce-03e3-4bdf-bb9a-b019a787fc4f", "value": "072a8f61f2ea0ff476bece6d90579847", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453891, "uuid": "588013d9-ad11-4a6b-95e5-6b84e7ebf7aa", "value": "3072:Wuj4vKJcCLfGkeiCGWGm5gYkfTlzR59mEa7rdsH0DWiJXZRy:WuKCLOke1GTYkZwOyXZRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675453891, "uuid": "ce2e216b-cc22-416c-9c48-af034a32cc8a", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675453891, "uuid": "38eb12b5-adea-4ea0-8f63-cd5d2484eaa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453891, "uuid": "3ee5cdf1-fe1a-4402-9a9d-6b73e5caa8d1", "value": "0c6dcffd11859aaf6b5013f13479579a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fabcc621-a416-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675465412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465412, "uuid": "e743af3c-36b7-4981-841f-7cb2b65f4067", "comment": "Malware payload (RedLineStealer)", "value": "dfc7508b5bb94eb15e670dd29c1588d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465412, "uuid": "087b40c4-3f1f-49f6-95be-7d05fc5144c4", "comment": "Malware payload (RedLineStealer)", "value": "9224893af823429fa3a34a4bb15da192531c4a17725ef79fbff3842fac8c7165", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465412, "uuid": "52e61b5c-212d-4f74-9e83-f3ae93ee060e", "comment": "Malware payload (RedLineStealer)", "value": "a9343fc196a2dabbc94e5690aaabebc6aa4b2bcc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465412, "uuid": "fa560698-efc7-4c6d-ac3d-49a9f11dd0bf", "comment": "Malware payload (RedLineStealer)", "value": "058b7c48ad23520f1e235492faff7548cd915275e9aededaad6083e962e1c561c08e19d0e1dfcc27a9beccb60f9027ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465412, "uuid": "358830d5-15c6-41a2-b249-16185e6f9572", "value": "T18515C706F2AADDC3C3290B31D59DC6D486F4AE40964AF75698E41FD76413F2BEA02C72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465412, "uuid": "99930018-d5d1-45af-8291-e04a445b2011", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465412, "uuid": "1a450a41-6c80-40c7-a77e-505441ac840b", "value": "12288:RgWKS3f73zvLHD/bpubCT2Q3jW0EtQ9gkuwxD6ULYt0+Wpz1M6F:lubC13YIZbYtKz13F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675465412, "uuid": "de7e2151-db4e-4671-a0d4-9927169efed0", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675465412, "uuid": "0efede7d-819c-4917-af78-8ca0841b44ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465412, "uuid": "f83df7bc-1e3b-4a7c-9f62-ce602160cda6", "value": "dfc7508b5bb94eb15e670dd29c1588d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4212ce6b-a3b5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Dharma)", "timestamp": 1675423441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423441, "uuid": "c6a4dbd9-d6d8-4997-ae7d-3172a4880227", "comment": "Malware payload (Dharma)", "value": "b88f005719f4f25f113f749464a28a17", "object_relation": "md5", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423441, "uuid": "415550ea-186d-4267-b1d8-721d1c407517", "comment": "Malware payload (Dharma)", "value": "92390d8b7dd99a4b03af59b45763c706d5df368761ce9706236e3dac4f9a74e2", "object_relation": "sha256", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423441, "uuid": "ad87dfe6-21fb-435a-a4b5-db6e579413cf", "comment": "Malware payload (Dharma)", "value": "65b517db35d9f63146077002836c37602026c642", "object_relation": "sha1", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423441, "uuid": "34386726-afba-4ccd-ad22-cf6132b63af9", "comment": "Malware payload (Dharma)", "value": "00922a4651de01ce6b2f3968e2c3508eff39c5e830380fba53de54008d627eb24e3e111bf3f322577dc27c3507caac59", "object_relation": "sha3-384", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423441, "uuid": "5eb4537c-9694-403c-ba69-a10a33238aad", "value": "T158939D29D431D031F4A250FFCBF65ABD9D684B212307D4DB97C02D89AB869D6F932632", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423441, "uuid": "34ef5987-1f02-48a2-80ca-859f72ea7995", "value": "f86dec4a80961955a89e7ed62046cc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423441, "uuid": "cdd06a9a-b345-440d-af38-6ecf1552ea1e", "value": "1536:mBwl+KXpsqN5vlwWYyhY9S4Az+bB1WEZ+/MXi9Rq1P985Ff2QlQpSzUkl:Qw+asqN5aW/hL1+t9Z+/MXi9QP985F0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675423441, "uuid": "db21ca95-8ac4-4ca8-be84-234269485baa", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675423441, "uuid": "4b2c23d8-0f9b-49b0-8269-52a93bd0c2bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423441, "uuid": "94f3bb21-4bcb-43fa-b865-7ef90dd83951", "value": "2023-02-03_b88f005719f4f25f113f749464a28a17_crysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f96c9f5-a3d5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675437154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675437154, "uuid": "fe6d5884-4334-46d3-a21a-6b0f35d2d464", "comment": "Malware payload", "value": "4caca51500a828bfa9ef1a506bd27ad0", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675437154, "uuid": "d716f115-909d-442b-b197-8f2fc4e5e2bb", "comment": "Malware payload", "value": "92a36c0e89ff4dbb3f9f6449c62b4540feb2d8aea247e5d3e89186b119346161", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675437154, "uuid": "4975ae11-4c6e-4f3e-8469-63aab5a1355a", "comment": "Malware payload", "value": "acde9254792e323e6190e3b14305274a8e87aa77", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675437154, "uuid": "9723cf6b-aa4b-41ad-864c-64ce44bc1dff", "comment": "Malware payload", "value": "c231e2b119adf10d7e2f2bd2ddbf937cd5e3c2c1190ef117874edeaa97af7dd7e6fee623b2bcf9d6b14dbe933984729b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675437154, "uuid": "1525a20b-028d-4211-a11b-660c120a884e", "value": "T1C2D423379997D61315A97C0BF8F16CF18541A0A913E9347FE92C6AD93C8ECE805DC42E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675437154, "uuid": "aa039121-1f58-4aaf-bf4e-0a46500f8cf0", "value": "12288:WOYWzly6hbtb6AmDO7jugM03iKhlEY6qWhCSb8BySgqx9A1r/aVNUU:WXWzl5bVqK/FM0yKhlt85Sb0rC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675437154, "uuid": "256c4c3d-be65-47fd-b51a-3a20dc4d740e", "value": 622598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675437154, "uuid": "cebb1a99-f1d7-4ce4-b037-b12217a49987", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675437154, "uuid": "c13cb3d6-b7f0-43b6-bd99-f9de076b54a3", "value": "bill.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4997fa-a402-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675456740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456740, "uuid": "c6844ed2-1fe1-4e47-88ad-d4cb1f1c1d5e", "comment": "Malware payload (Mirai)", "value": "1799f2bb2ef0b022edc70279c0e8f636", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456740, "uuid": "4e7ba9a6-b1c9-4fac-b2bd-d25ed27318af", "comment": "Malware payload (Mirai)", "value": "92b79904eb5383f70b532611eb4f6578d8af66445af71cbd5de2a119d69b2431", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456740, "uuid": "30db7cdb-36f9-4231-8e7a-7bc40d7bcc16", "comment": "Malware payload (Mirai)", "value": "a1d751425b76516f084485cc3a38e4d61a662889", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456740, "uuid": "cf4ed7d2-ff1a-4792-8ade-954f7469793d", "comment": "Malware payload (Mirai)", "value": "3c9f85f1d50947c54436d75d84b6e529d1d68c6d3155585d2e7b3a3e91dc6bc7b758ec7ae92e28a410ed0a8da5a6d0a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456740, "uuid": "fab06001-e4d4-4350-bba6-6039462bcaa8", "value": "T178631986F4618913C6D416FBB66E50C8375A43AAF1EF3202FC210F547A8695F1E33E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456740, "uuid": "d476a638-b51a-4f6d-be43-eb4247984676", "value": "768:ddDJDSeU7h5e4SD8+7JGrQR57rt63nPfjuox+W1Nq5doqMFyxBygelbkNx:fJDbU1+7oG7EP7iWydoheeIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675456740, "uuid": "702100f1-ea40-429c-9a6d-f1698a3198f4", "value": 71604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675456740, "uuid": "767bee5c-aa14-46d6-9e57-3038fc0f7bd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456740, "uuid": "db107586-2a6a-4b43-b5de-2b9772f4b26a", "value": "1799f2bb2ef0b022edc70279c0e8f636", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15d67f3-a3f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675452484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452484, "uuid": "774e0096-2146-41ec-8576-8bae2ad9fa6b", "comment": "Malware payload (Formbook)", "value": "49f59d4ec7a9e3a85fdc940d9e6425ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452484, "uuid": "1221a025-a5b0-41b7-a3a6-428ff1515e84", "comment": "Malware payload (Formbook)", "value": "9409e367a0c9bdead66274f114e20c752c57723ce730c715b5f126f37ec1964e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452484, "uuid": "47ba63f0-ca5f-493e-86e0-a2685953c64a", "comment": "Malware payload (Formbook)", "value": "6f7758cc69c8d41abd8827f581d30a4627d59da8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452484, "uuid": "bd067c26-feea-4066-97dd-075322bff73d", "comment": "Malware payload (Formbook)", "value": "b69e38171d66b8663b3fa0d54216e995456233ee730fd9f77e970c7ff0afe656cd36630f8f0e71ac5674fa4376b0fbd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452484, "uuid": "8b54d050-46b9-4978-aaa5-ac71ca3736ec", "value": "T1DF9412C9BA6BCB47D2D20830EC2C367A4A94DB033067DE176F2C476DB4666529B1D363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452484, "uuid": "1e54ad4f-0686-45ad-860d-96238bf66814", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452484, "uuid": "7937f7f8-898f-4c68-9a15-7913aaae9165", "value": "6144:+Ya63HE8nHJS4l/jptmIcJE1x+dLePsOWsKrJwCHe8IaE:+YVHXnHIejJ2L4TWsKNfHCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452484, "uuid": "74e5579c-58d9-4158-b54b-070965d94e16", "value": 414098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452484, "uuid": "4a586aa1-4593-45f1-bf35-b8511f8529c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452484, "uuid": "79b757cc-7ab6-434e-8efa-a23eac139c6f", "value": "HSBC Account Statement 03FEB2023_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da41de5-a3b8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675424856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675424856, "uuid": "a76a8bbc-fa26-4c57-b70d-e8e252387731", "comment": "Malware payload (GCleaner)", "value": "0851486479c92ab4c099433195e8ac9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675424856, "uuid": "05a44c5a-98cd-4e4b-9833-c66030620698", "comment": "Malware payload (GCleaner)", "value": "958b144c619c24636dc2ce5595e74c8d12e0a08feb18ce2957a2f8b288ab1c53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675424856, "uuid": "96297902-70d1-4d2d-b8dd-764466c22a01", "comment": "Malware payload (GCleaner)", "value": "69f97a5346b14c272e2bbfb40c9a6041dc088c11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675424856, "uuid": "4a247f19-f278-453b-89b7-573e1fc7019a", "comment": "Malware payload (GCleaner)", "value": "8d13416627ad791d4f85981d6d231ddfc5579c63afdbbd41a7b3702dcd8f22735e91d0fea8b756705a7d17d23536f831", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675424856, "uuid": "4ddcdfb6-be3e-4cf4-9cd9-b709f5f91ffb", "value": "T1DF9533CBBB919437DE0B8F30D5371441A627DC9DB3312B1A206D7A2B2D756A098CE19F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675424856, "uuid": "134350c7-76ba-4b55-a8d8-f2738349f8a1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675424856, "uuid": "5b7fe04e-824c-4757-8a51-d3152cfbb9c9", "value": "49152:ygYI7cpWi+aznEs4SPw0DqxCNUhyB3LCgv2MR:TYJH+aAZSY0SAUmv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675424856, "uuid": "407902f6-e46b-403a-aad9-2ea8bb194efa", "value": 2020314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675424856, "uuid": "9d7cfb7a-6563-4177-9554-f46064ba5625", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675424856, "uuid": "3cff00da-f327-4257-b8ff-a22ab3805da7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a916ab5e-a3cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675434780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434780, "uuid": "ab6e0859-1c9f-4d02-bc89-29f04fe3634e", "comment": "Malware payload (GuLoader)", "value": "387a788b4496a7a2dd00fef7829b2212", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434780, "uuid": "e9af80c4-ee57-494a-b0c5-d9db64195b7a", "comment": "Malware payload (GuLoader)", "value": "96f053b92d1825fe7c188503eeacc68894d653944e303aea7414abe9cfce6a9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434780, "uuid": "801a1aef-0f0b-4716-8450-d4bf4feebdef", "comment": "Malware payload (GuLoader)", "value": "aa82c573abfca91cd01562291c2661d76ee43adc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434780, "uuid": "2ce16b23-8fdb-4d3f-9414-82122d793be1", "comment": "Malware payload (GuLoader)", "value": "16d37e899f32af2d70dc9f3ad314d4e74562c37041af4109c291f775761a74efec8e0a799557eb31115b2e72dc361e2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434780, "uuid": "cebcfc3a-dd82-4615-8851-9d0b135c8727", "value": "T14C2401912AD4E076C1691172CDA3BB68E374ED1E7C32878773243F3ABD70292AC25597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434780, "uuid": "41c63efa-9085-4b92-93f9-d78571cd54b9", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434780, "uuid": "e69947c5-f307-41c0-801f-d21530d0fb90", "value": "6144:9jFoDTDBuPoUEga8jyGYf9LPHiZfxvWaUwpjWJc4B0ChHIF:LODBSEhGO9LPExOaUEMB0CY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675434780, "uuid": "e5a94d08-48ef-41aa-8334-d78b50db32bf", "value": 230179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675434780, "uuid": "1210adc3-f5fc-479c-9ca8-bf1760085bf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434780, "uuid": "5fe5bbff-fbc0-4f7e-99d5-015ea9e6ea7a", "value": "96f053b92d1825fe7c188503eeacc68894d653944e303aea7414abe9cfce6a9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e80f50-a36c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675392280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675392280, "uuid": "5fbcc0f8-de7f-417a-9297-b1c0b690fdad", "comment": "Malware payload (Smoke Loader)", "value": "2756652499e37911422abfa94c6ca5a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675392280, "uuid": "f42cd9e7-ed83-4bc0-94d1-758a555eb353", "comment": "Malware payload (Smoke Loader)", "value": "9769412727355afacbe12462bf964f8f1f509ef80ed52783f1fbad5b3cfb8983", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675392280, "uuid": "ef9a4376-d12f-410a-830b-be675a936db5", "comment": "Malware payload (Smoke Loader)", "value": "f23bc88a56894c14f749668f83192d3a18011dc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675392280, "uuid": "8db3b013-53f9-4b03-b53f-18f477b33dc8", "comment": "Malware payload (Smoke Loader)", "value": "934f7179a3ddbe8133349d72c3400693a43bbd0f5b67ad62dcb262d70cf5ab3fea5c7196d2ebc3dbd68214ca76dbf3fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675392280, "uuid": "099ac8b5-549e-4863-9dce-874f9d53201f", "value": "T1AD648D4262D2FC41DA25C672DE1EDBF47A1EF9914E686F6E12185B3F29B2073C5A3310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675392280, "uuid": "62115451-7f7b-4c75-b9fa-4c05e9a085bc", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675392280, "uuid": "a46b05da-1d65-4cec-a7f8-15d6af50cc9b", "value": "6144:xR+KLa1Lz3+ZcrnlwKwpxGZjV6ptCbNKN:xR+Ku1v+ZcDleg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675392280, "uuid": "9ab32351-b87d-486b-83c2-a8c4c205e1ad", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675392280, "uuid": "0e09ebc0-4df5-420c-897d-d090f1dbe1b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675392280, "uuid": "01aadac6-b104-4113-acb2-a2299e9da941", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c26695-a3bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675426888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675426888, "uuid": "a0a19b58-e7dd-484e-954d-9fa25b4d5d0c", "comment": "Malware payload (RedLineStealer)", "value": "d3713110654dc546bd5edc306a6e7efd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675426888, "uuid": "debd9683-28d3-4b37-96f0-8c09f3075a01", "comment": "Malware payload (RedLineStealer)", "value": "97bfa0bd9f3b382280f67839c650a3d7be16aa31f124810f3a9b9559e34619c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675426888, "uuid": "6eff2b21-b90f-4c1c-a5c2-7c8669a57914", "comment": "Malware payload (RedLineStealer)", "value": "db266e554e96098584bcbb29aa2774106a7e90bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675426888, "uuid": "9e648817-31f4-4581-b090-b4860b0b9563", "comment": "Malware payload (RedLineStealer)", "value": "c6a93f0d079fd57f9f918f3aec15fbd4e24d6ba4ade9fb4a46e31da7652255578e7fc8b46455abda949dbec95c186aac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675426888, "uuid": "44266e94-6c75-4492-bc85-7688f1098aa5", "value": "T10F4523C12CFD29A8FD3A6B7358BA3A47802E3CFD4EB582A80510D525E6328F116753F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675426888, "uuid": "50dc4881-8bb2-4ce9-b8da-93d6b2a8c284", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675426888, "uuid": "7eddd16d-fbfe-4e98-bc0c-b16342de6f3c", "value": "24576:Yw03rS2BK40yMVrs+JBe0pw0H/bap4p16SM7RdkZu3svS/oUfsD:barS2BKOM/JBeYJfFP6SMdd6aRfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675426888, "uuid": "7a19b75c-8cf5-4341-8f1d-d2b0dad6b412", "value": 1262592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675426888, "uuid": "1ab3dc4b-894d-40b2-89b3-728f1eeee57f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675426888, "uuid": "b21df89f-3274-495a-8ce3-f4facc9dbe6b", "value": "Lcovlccdxd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a9f43d-a3f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675451129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451129, "uuid": "9b4167e9-4919-41bd-ab05-9228d95d7141", "comment": "Malware payload (DCRat)", "value": "268c2e7768781323eec48ae7d2ce805d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451129, "uuid": "18c1d2d3-8b1f-4ee9-9b8e-f9791b21eb9b", "comment": "Malware payload (DCRat)", "value": "980024e8c13ce835dbfa28f8eea51e701e36b1a085061445d14f7f4e87a44e50", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451129, "uuid": "b2840d9f-25ae-4dcb-9648-fd97e106260b", "comment": "Malware payload (DCRat)", "value": "871970eef6d4976f96f0a42371880b6dd9f21e52", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451129, "uuid": "5785eaa3-51f2-4999-a82b-72e0789416b6", "comment": "Malware payload (DCRat)", "value": "63aa2704089d0244b982c8a0ab7ea9e14a7c871ad860f988b3e2284f731df8ca0e6eb3d30c4929b6fcb9219e113ea891", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451129, "uuid": "fb118267-c878-46d8-856a-4c6af8de677c", "value": "T1304518023A46DE02C06D163BD9DF487807E8AD417AAAD71A7E5F336D69113A78D0F1CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451129, "uuid": "c8de4091-dd3f-4225-a686-577abe71fe7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451129, "uuid": "52a6ae86-e030-4a6c-8f1b-68256dc68409", "value": "24576:ee3J09QcGtD2F0Wpq0Ld7UT29cENYaK2q5aj+4:MF2CTK2q5ay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675451129, "uuid": "d0f32ca4-5bef-453d-9766-a4c58a4cb924", "value": 1220608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675451129, "uuid": "437aaebd-1012-4c2d-bb70-5505995ef083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451129, "uuid": "6f043a3a-fd72-4541-888b-f653fb240bf8", "value": "HEUR-Trojan-Spy.MSIL.Stealer.gen-980024e8c13c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54797bc0-a3e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675443658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675443658, "uuid": "a0899a33-3da1-41ba-bda7-bbb00d2906b2", "comment": "Malware payload (Smoke Loader)", "value": "0ba63c76c005d3d74c3c14596e0aca48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675443658, "uuid": "ee949f98-77e6-4314-b921-34137bb4db25", "comment": "Malware payload (Smoke Loader)", "value": "9851c9db2dbd85450ea34555de4ddc7c04561072dddcc0eec1f2b063abb4a524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675443658, "uuid": "3501513b-5cc9-4391-85b2-246cfda64aa7", "comment": "Malware payload (Smoke Loader)", "value": "be6877360e84701c61489deb85c407b6bf69d042", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675443658, "uuid": "aeff08b7-29b0-4d18-96ff-a74e87b8f0e2", "comment": "Malware payload (Smoke Loader)", "value": "0f46a4498ea38cdcbe20c6a461a6ad575248291662aea07f15c01c95154e8a833c41953dea95db65cdf4514c0fa0c1e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675443658, "uuid": "1009ba58-ee3a-46c9-a690-e337bab32421", "value": "T1E014DF323580C072C5BB55305820DBB57B6EB83255B9995B7BB837AE4F703D16A3A30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675443658, "uuid": "827af919-53a0-43e8-b12b-8b3f316c9c9b", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675443658, "uuid": "e8e95be4-7c09-453f-bc3d-675f92cdb31d", "value": "3072:zesw/MQcMgxZQLWflFVvW4y5vi7RG8Gn6cO9pMaIAl94SYExmyr9rb5/:ze4rZQL0lnvui7RPUZO9OkH40xmyV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675443658, "uuid": "319e0977-817c-433d-a0d1-32180065bf44", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675443658, "uuid": "43ec80af-8269-43b0-88f3-a0abf7896e64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675443658, "uuid": "18ec6f0c-d245-49ef-8c26-9081e8ee9e2f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ca8172-a396-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1675410102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410102, "uuid": "5d1cc9d8-9ae2-426c-bd05-aa2d4a13bd6a", "comment": "Malware payload (Chaos)", "value": "71c3a6f87a5c67593fd199a0fbc146bf", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410102, "uuid": "476c234d-bee5-443d-8c2f-99a7990bccac", "comment": "Malware payload (Chaos)", "value": "98e6fe0dfa72dfd322bfbddc7bdd6813f339fc3d88bccb2dbc2ed6cb487b90e4", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410102, "uuid": "dbc37900-a00a-4f2d-aea5-aafa818d5c27", "comment": "Malware payload (Chaos)", "value": "30dd047751e21b57f6c08a56b21580f44dd9f437", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410102, "uuid": "f9bcd90e-25e3-49c1-9ecc-6c195b4f4914", "comment": "Malware payload (Chaos)", "value": "ff0040c5b57410b795629a7c3031c2d118bb0ebaf0bdaa3e2e8a673dd4de197f45ea7facb4724744765e5a94f9bdf7c7", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410102, "uuid": "e1cc9d20-eb3b-428f-a65e-3e2fc659d706", "value": "T1A8B4CD2429F6501DF1B3EE7A87E8749BD5BEB6763703546A30A1034A4723D439DC2A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410102, "uuid": "bb5e069d-658e-4628-bdc4-d08f457124cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410102, "uuid": "c37fc523-f8a0-4fe5-a7e0-9706faf4d0b4", "value": "12288:Xw9Rt0RPnRrcA0Sqg9bIFX7O5rBVOxZ3:0aVDbI5Or4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675410102, "uuid": "c3d6a81b-735c-407d-82f7-60696608eaa8", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675410102, "uuid": "00a87c93-2f45-4b14-b1da-eb460adf5f38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410102, "uuid": "af40469e-5196-44ee-8c69-59d7470adba8", "value": "2023-02-02_71c3a6f87a5c67593fd199a0fbc146bf_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2ebe50-a40a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675459911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675459911, "uuid": "4b3e82c8-3984-4eee-8397-84e95c8fd3bc", "comment": "Malware payload", "value": "9256cc034d23ebf4e2b5d4170046af4a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675459911, "uuid": "ff6f7ae5-0515-4da0-987e-8591e58be861", "comment": "Malware payload", "value": "9959f8caad193775bd19f8a5c1534c0139de87a1b9ecad86156f0e21e55212eb", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675459911, "uuid": "c6521456-3466-43e7-bdf1-22eb66afc092", "comment": "Malware payload", "value": "db1b771860da6cb1bb3c76e85a094fc420407bae", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675459911, "uuid": "bbdd11c1-6e9a-4dcc-ae38-3f2472db8df1", "comment": "Malware payload", "value": "31ae82b673a224b8ea983afe75d5a286c802865a89e0affab9def11db00acb8ff4bbe41414475b287d999a365a7e8d52", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675459911, "uuid": "b575bd0d-0773-44d5-8a11-03cdb5090c18", "value": "T1BB15E00372C5C137D4AF02312A5BC355AAB9FC708522C517A7D5B60E6EF2681EA673E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675459911, "uuid": "9af81764-d063-4ba1-9915-0294c2a74364", "value": "24576:WCwbaYGAM9fpCFrv/t2S/HJTEl3S2shd47qnp4bz1JSVENo6LPNg:WCwbaYGAXv/kS/HJIsa7vbz1YESc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675459911, "uuid": "b1187493-552b-4b17-b77e-1158d7c2e8ed", "value": 923648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675459911, "uuid": "c67cb424-d850-4e1f-beb8-45f284c0c797", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675459911, "uuid": "4d82a283-afdb-4348-bd7e-34c514fa035c", "value": "setup_contasimples_ohlIvcRpz5gX7lOo.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f2535a-a40a-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675460139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675460139, "uuid": "ac3996c2-07e1-4d8c-aeaf-9d8c743226fc", "comment": "Malware payload (njrat)", "value": "4a9c842b53210edb3e5c678744aa0078", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675460139, "uuid": "7b168389-fdd7-4fb7-b88f-fc3c00df07c0", "comment": "Malware payload (njrat)", "value": "999f83d6ced5d222849cfebc7867adbf5c91f40a674663dabe6d83e7f66075ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675460139, "uuid": "5021b7c6-9b04-4208-8955-a6f895a41318", "comment": "Malware payload (njrat)", "value": "cb050009d0ce9d6cab3cd8c1d58b7140206c9f95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675460139, "uuid": "187cbb33-c2b1-41fa-a967-1f9f35f2c750", "comment": "Malware payload (njrat)", "value": "bc478dc6ca9a2c71fd0280ec52b752c514153f5939cc9c41d8fa03bdbca8d6b3b98ff8d2fea1f784ea441820f35e364f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675460139, "uuid": "f963d63b-0774-4114-b3e1-57c5d548836d", "value": "T15773BEC63FC942BCD258F27E474BD13C06F69E152AF29F6955C8A05F0C93E8C7981626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675460139, "uuid": "69a6ecee-36d5-4d1d-bf92-21b2417b84ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675460139, "uuid": "bc7f83fb-7fde-4574-b07c-cfe9275988b0", "value": "1536:uNrVCpP67HSPHPWlbSsHB7DhFz6JsruPwgNZT5G8CohqoykVJ37:uIP6uHPWlbLpz6eT6N5G89hqoykVJ37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675460139, "uuid": "f30e35fc-83d1-4f0c-86f3-cdcfba39287b", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675460139, "uuid": "7633d27a-f260-4a0a-8739-6432ee51d3b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675460139, "uuid": "28a7201f-1aac-42af-a81a-576c1910bc46", "value": "999F83D6CED5D222849CFEBC7867ADBF5C91F40A67466.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d226793-a38c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675405823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405823, "uuid": "cb374be9-f165-4074-93cf-d9d938f85b73", "comment": "Malware payload (RedLineStealer)", "value": "4a30e0902a18a721120f9c95970495c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405823, "uuid": "141a3808-6b97-491f-a290-a546cffcf6f6", "comment": "Malware payload (RedLineStealer)", "value": "9a05f1021284e27e2213e3b90515dc72414cd142c3ea7e19955cc80e20c4e931", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405823, "uuid": "1b198baf-f6f7-4f49-a399-80b6235515ca", "comment": "Malware payload (RedLineStealer)", "value": "c2fbc8e548c31bd2d3283cd499d31e6e27dc758e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405823, "uuid": "634aead4-5ec7-4c2c-a9e0-ab9d28e607ff", "comment": "Malware payload (RedLineStealer)", "value": "b88929c4413212bbfb48b7cfe0d222c9df122ef864af324673b30c0d4b33f17500b7e5ece834c17a88d7e7037647e807", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405823, "uuid": "9ad0e0d7-a508-47d5-8f38-88522969b63e", "value": "T1D5B41231F5C0C672C9B64070A934FA989BBAB8314635C91F3B7D166E5F30AD1A77A306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405823, "uuid": "47e75dc3-ef02-4197-90a0-a504b961e651", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405823, "uuid": "91a36cc2-5e07-4bbd-b506-c1928a1d01b6", "value": "12288:L7K/GbN7Uwt5G+T5/NoZesoClwyYIhMp6qkA3cyFp:LWWNj8a5/NotbevIupeA35F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675405823, "uuid": "5330e48f-3f51-4952-91ec-64379ef819ee", "value": 525312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675405823, "uuid": "ab98414f-d52e-41f4-a8ac-8143b31b830d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405823, "uuid": "b0a9564b-8d6d-4ae3-af08-3ddbc07cbc58", "value": "4a30e0902a18a721120f9c95970495c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d156e4-a3f8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675452466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452466, "uuid": "bd05b40b-2042-474b-b182-0d14bbdb2e19", "comment": "Malware payload", "value": "7a657141ba917bf9c24cebf1617f068d", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452466, "uuid": "02206825-1f95-407f-a4c1-8fb40105fa20", "comment": "Malware payload", "value": "9a1822f8d2cd1d3a14ebeeaa4cb188cde2b36446e7f5a189aefd91d0a86db8ee", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452466, "uuid": "3c0e1f43-388d-4d6f-97b6-eacfe8dd7d97", "comment": "Malware payload", "value": "260a9dae4e9b63381cb1f104e60b3b03ee638e61", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452466, "uuid": "e7d8a30b-a311-4b82-adb7-8e6a9f7a7919", "comment": "Malware payload", "value": "1d5fb54ed84a7f46e2a1f145b13eac85f961d910195fea3fe5686d032c55264905798e614527632ea3365802639e6a5c", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452466, "uuid": "6729760d-7f2c-4f63-b328-9c3d3fd941f8", "value": "T195B49D03A560EF8BE41983F8FEB35D941F07AF59A55179DB14127B8F3B71292288B20D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452466, "uuid": "f391a763-6d7e-449f-aef7-d780c06356be", "value": "12288:YPaFiKXKz02NM0ry+1yA/SUgV1WXpkLK8fXfG:NLKAZyTaUgTwpkm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452466, "uuid": "5f703ceb-cca3-497d-8bd3-f22f9a83c810", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452466, "uuid": "89e27e07-a261-4b4d-9adc-97d38f4738dd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452466, "uuid": "95806f7b-808b-4d76-a3e5-868f24ecb3dc", "value": "P.O #306078910.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e548190-a3c1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675428696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428696, "uuid": "44220801-86ff-4a0a-a2d9-08e77b3bfc13", "comment": "Malware payload", "value": "8b9b9a84e6b0df45edf30c1a8e175c72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428696, "uuid": "808661bc-f1be-4a5c-affd-3832e7d98182", "comment": "Malware payload", "value": "9a52a97fe2c63dd83fd38b55c8c2753cc84fb4fce3bc9f1bf441b3cafe7b4648", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428696, "uuid": "e3132bd3-641d-4553-bbba-e2b6b592fe2e", "comment": "Malware payload", "value": "97351e0beba5f9dc38efd42aea8251971027c3a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428696, "uuid": "2ea31d70-4fc9-4550-aa74-ade59cdcd4a8", "comment": "Malware payload", "value": "20557847758ba1fec5ddaec5ed5d526390383ff6d61193a1096024b72d89963488463c70f9ec77d99ca954c813a9b647", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428696, "uuid": "8f8f382d-276d-4ad2-a820-977ec4bcaf6e", "value": "T1EE76331771EA46F7D2100831A108BF79A3DCD04419748C2B7BFE255C2EB9A81C66FADE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428696, "uuid": "d37730d3-e937-47b9-b5aa-da16b811d7ee", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428696, "uuid": "c271bd26-ce42-462a-90f0-30431be1d172", "value": "196608:91OioROv+ExbboMuRaA15690+E8bRvtQ+TDRNA+p:3OioRO1xbw7/6964vtQEjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675428696, "uuid": "8ce292f6-15b2-4d6e-acfe-37d6d3655392", "value": 7637924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675428696, "uuid": "3838c261-f91f-4229-9def-8bf38c4624b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428696, "uuid": "93ea3b68-556b-4380-adbd-2bcd8da54a0e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44db319f-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675453940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453940, "uuid": "9c9a5fd2-54bd-45b8-b152-cb886293122e", "comment": "Malware payload (Mirai)", "value": "aed6686a99934b6a022b91e787c0b1f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453940, "uuid": "b763ca8b-fa89-4905-a99d-fc3f7355839a", "comment": "Malware payload (Mirai)", "value": "9a7bb2d4eb4c19fc6fc39475a8538305815ca01226102e4d2fcf63a7dd1133d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453940, "uuid": "651295a6-348d-4ac6-a9f2-ee6f9001bf9c", "comment": "Malware payload (Mirai)", "value": "0f25be6c528f9200e43ae3670e277220deaa8b17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453940, "uuid": "a845f806-77f1-4f2d-bf91-79b6ac9ccbb0", "comment": "Malware payload (Mirai)", "value": "d573e8c1ec307f6fcbbf720cdb76d6b34cea354221bb45eb7026ad8d89ff6ee2760962ee68ba1d1ec4944a295861c942", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453940, "uuid": "c5fb1b24-dec3-473a-965a-d955ee937e2b", "value": "T1BD631A86F4628513C6D416FBB66E50C8375A43AAF1EF3202ED210F547AC694F1E33E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453940, "uuid": "10185131-c75e-4aa2-8f0b-2eeab0b762b1", "value": "768:rq9wdQWAMUz1s9L5akR1gVBIVT0I4i6PL0bSoTkJNqedIQ8HxGKelbkNrXQM:Gud9A7kR2VGH4j8aJduwIrXQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675453940, "uuid": "2a888e2b-ae90-415c-bc04-1098899adfcb", "value": 71584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675453940, "uuid": "59fef1b2-9349-40cf-87ea-07c50e5c97fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453940, "uuid": "275b3b46-01c7-4318-bac1-0a85a2ab3ff8", "value": "aed6686a99934b6a022b91e787c0b1f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84513f77-a3a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675415391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415391, "uuid": "88188bc1-ea1b-4e3d-a394-d400ccd54cbc", "comment": "Malware payload (AgentTesla)", "value": "2180db94e549613ffb5d785913dd1f9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415391, "uuid": "d2cb0658-b2b1-45f0-8dbf-a82327159de2", "comment": "Malware payload (AgentTesla)", "value": "9a7f1462051ff7afb4f0221178371fd54e0d0f92e7dfc65adf3dbd40b87e9ec2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415391, "uuid": "92c141bd-4da1-4d8d-afb9-5cb0e6620c06", "comment": "Malware payload (AgentTesla)", "value": "cc9a1c2cfa2c08894faa685873165a5e535f5c0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415391, "uuid": "47ae9ea0-0e6d-4acd-805d-c3d320cc3d46", "comment": "Malware payload (AgentTesla)", "value": "17ef269ec8d19d13f185629243bbc11dcfdf1c8912ccda5c1ee4c64691dada575196cabe1f859b2d6726c66721e6ea6d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415391, "uuid": "6a122d8e-623d-448c-8a72-5dc6d4891652", "value": "T182250739257517DAE334F73042E14021B6EEAC43B723E859ADA67AC54F319817ECEA1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415391, "uuid": "f5d0f2c4-fc60-4df3-9888-b222444aa1e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415391, "uuid": "8a344def-e96e-4086-9a3a-d93a8a655427", "value": "24576:BfjseHKNTn7tunA+/kSYIMfmBmbLU+E46T2iHTwd:kOfw6Si8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675415391, "uuid": "862ec301-98d2-4f67-ae0e-1b2a25d5c362", "value": 1016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675415391, "uuid": "cf6d921b-e927-49ee-87b9-07672114dd31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415391, "uuid": "c2c74d60-643c-4d28-9f09-4e08b7688484", "value": "Invoices last shipment_001222896.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43408e6f-a3b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675421725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675421725, "uuid": "e883862e-c3ce-4be0-a353-bf2e137edf94", "comment": "Malware payload (RedLineStealer)", "value": "1d5c91e93d5daa882ea28c5e3c985018", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675421725, "uuid": "70204ed1-93fc-41d4-a017-0652b1e59b75", "comment": "Malware payload (RedLineStealer)", "value": "9ac4be38637f17483f3b54a09a1a5af0e753b394546621337c7dd1d3613f9b45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675421725, "uuid": "5876a891-1218-44e3-97b4-761911a69354", "comment": "Malware payload (RedLineStealer)", "value": "385c2c38d59c7b55a8d12bd99ad417de50dd7da3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675421725, "uuid": "ee0eaa7b-f8ec-49df-b84e-90a35762f7b9", "comment": "Malware payload (RedLineStealer)", "value": "9cc5faf093ab9f4a4e705f462cb64d4cb761769773ee23edb64b184979a9ca859145cecad35c2439aaef98b234ecdd8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675421725, "uuid": "2dd7eee8-4cb3-4df5-9bd6-a854cffa9ea8", "value": "T1EAD4023239E0C0B2E567D5306468EAE9AB78FA3221748C5F77A416AE8F307D11637357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675421725, "uuid": "160ccfa7-803f-4529-b0bf-e393f7dde29d", "value": "b65d7d05727ada8b2acd168719f50dd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675421725, "uuid": "51d52a80-4261-4ac7-99a5-6aedc3cc784b", "value": "12288:/nmWQGvhT0qfqcEtOTy9IRJqzHaIGBUTx2UhE/yq8PAx5BAQi:/m6vB0qfMOaWe7GGx2ojIx5B5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675421725, "uuid": "8e62bc0f-951e-4051-8d22-75572b8c6c98", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675421725, "uuid": "28689f1a-3267-4457-a962-173dd11be98f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675421725, "uuid": "fadc550c-422a-4c5c-9d8b-c5a841133c8a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77793645-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675454024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454024, "uuid": "bc0d410b-dc18-4e54-aca3-fc83a283d273", "comment": "Malware payload (Formbook)", "value": "c5a33bf3ca462a3a45a67376b46eb029", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454024, "uuid": "571db28d-c20a-4c95-81a9-a2bb78a1f7cc", "comment": "Malware payload (Formbook)", "value": "9c1292869bf34d5077f8f2bffd19ff671a0dcd996734c3d8af1e484cac42d80d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454024, "uuid": "03300973-f906-4774-960a-91ec4f9428b3", "comment": "Malware payload (Formbook)", "value": "15201e64ce9f4a599366ccf367469caf1757b172", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454024, "uuid": "6f59497e-ebd8-47ff-a714-ceb604c85546", "comment": "Malware payload (Formbook)", "value": "d4c9fc80c8b4c41a2f2862f14a7ca89854ccaa8e96377bad12c59c8c180ebc1dc23fe01abcbafeb7e7b71341238cfac1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454024, "uuid": "4133ee50-ce53-4259-b762-609f56ffc03f", "value": "T1B9058D6337B199B3F78720B20424BA885BF07503BE56E2939BB737C0A785DB77294152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454024, "uuid": "24693e9b-5992-4962-a58f-e7ba3d1be226", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454024, "uuid": "e49176d9-9161-42ab-b704-f119d4a5354a", "value": "12288:ithefaqG4yPamxizInTXpnqy29GbD0kEC3XoI6Fy2Mxzo3:i7eSqG4yPamxmInbIy29GUxmh6F0xM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675454024, "uuid": "f7674ccb-1868-4fba-97d3-8ae86a8f62f9", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675454024, "uuid": "6aed7105-8cf0-4326-a05c-8e7c3827465b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454024, "uuid": "00f2e7fa-b17a-4e8a-874e-9f2ed5bd9c04", "value": "c5a33bf3ca462a3a45a67376b46eb029.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4aa1e62-a3d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675435310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435310, "uuid": "ecd7aaf7-a779-4e9b-a376-abba5eb51848", "comment": "Malware payload (Amadey)", "value": "a1b1aec598e6dab645fd21a01a28fd3d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435310, "uuid": "0178a1bd-1e73-42f3-88b0-39947846c952", "comment": "Malware payload (Amadey)", "value": "9ce711ce86d019fd21b9edfa2ceedb58ac7a027bbbcb51b4b021d3bc96ce85ef", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435310, "uuid": "a073ffb2-228f-44d1-abc9-69ed4a72c2bb", "comment": "Malware payload (Amadey)", "value": "4d671cfe982967c5d667d381964c5041b7c446fd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435310, "uuid": "44c66cf8-5031-4f9c-820a-b838495a7889", "comment": "Malware payload (Amadey)", "value": "2a27cf7bba2f5407332ef69c3d4ec773090f5b45b31e50dacca516f28817041616df1c9452b7b30d505923808ecf6e50", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435310, "uuid": "7dce65be-107f-48c4-a941-4ff5f72a9eab", "value": "T1F8D402323AA0C475D59A51B00420E7647BBEB9313AB9991B3B5813BF5F312C49B3739B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435310, "uuid": "12514f97-b9ef-40b8-a9e2-0fbef2a05736", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435310, "uuid": "a027dba6-e99d-4ebe-9830-e94f88fd90c5", "value": "12288:sesAXD/kIESXiOgmOz786zmR1AXY0L+5Lk/CgH1411Jq0:sObeSXtgNHtk1zDZkaS141W0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675435310, "uuid": "2a7e37e8-72cf-4201-8a4a-e004296769ec", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675435310, "uuid": "27682394-7190-4e5d-be9a-c7d3f8a49f9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435310, "uuid": "4fa4e0a7-c822-4953-b40e-e03e6587807f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94022042-a375-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675396090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396090, "uuid": "cd84c4b2-3166-4a20-b855-be02bedd0477", "comment": "Malware payload (Smoke Loader)", "value": "df95b4fa8c0c519a873ba5b09fd8cbd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396090, "uuid": "3c4fdc00-ead2-4142-bb52-221ec7800639", "comment": "Malware payload (Smoke Loader)", "value": "9ce9dffd37ec53a9834ca8176c8c8515cb6882fda39afa9dc748f427541b7922", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396090, "uuid": "42d63a87-fa78-4dd8-9c5b-cb42ecc667f4", "comment": "Malware payload (Smoke Loader)", "value": "12b5643484f637d777c33332f25f234e1e8a18a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396090, "uuid": "d39c8d5f-0eed-4044-b6f8-2f9a884840b3", "comment": "Malware payload (Smoke Loader)", "value": "e25dd6f7f0a3310ac69b15be6af2da7f6f72ac3679a478936baa8a4b94be9615ecc2bb0c463e6b85d714b36b562741ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396090, "uuid": "1b954e56-563d-4090-ab81-73e2b23ba11f", "value": "T1E8646C42E292FC41D621CB728E1EDBF87E1DB9518E686F66121C7B7F1A72173C5A3210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396090, "uuid": "d6e8cd45-e995-4c26-b0f7-119a6bf0567c", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396090, "uuid": "8092e11e-fec1-4adf-95c2-f96843f615c1", "value": "6144:d21JLjBonxK0aMdn6N+oNlwKwpxMbF1jV6ptCbNKN:d21JfBsxK0aHzleMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675396090, "uuid": "93887613-8fb3-45d0-aa8f-5eb9bd296ec3", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675396090, "uuid": "3f88a4b6-bad2-4a4e-958e-30ae2b6eaf13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396090, "uuid": "814bbea4-b164-458a-99fa-ebb700bec734", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb054666-a3ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675419429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419429, "uuid": "f7693e7d-0b59-42c7-895c-950deeb66737", "comment": "Malware payload (GCleaner)", "value": "2715012b6acae850af7a413e87ae78b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419429, "uuid": "262a3314-ca42-46c6-9645-6efc45287692", "comment": "Malware payload (GCleaner)", "value": "9d2300e2ba6d3b004a574f25b40b30f72ef24246857c36f4292a564a7dbbc06b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419429, "uuid": "ecc43263-a577-433d-8063-443b07bd5313", "comment": "Malware payload (GCleaner)", "value": "eb48021d04a48343eec65a9f34d1ab2cea464e65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419429, "uuid": "5b0af664-455c-43da-bd2c-93ed0adfe2fc", "comment": "Malware payload (GCleaner)", "value": "4af75931345da981fad2be50000b466eb6c3190a3dc6fafba70b3d51d179737b84f737d6aa2e5763b2ce54e37cbf04d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419429, "uuid": "08f42920-9462-420f-998a-4b75355ebc3f", "value": "T14795331A0AA78138E1018DFCDD915344AE19BFA668321527705D338F2FB2FE5714EB6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419429, "uuid": "5953ba2c-552a-4cab-996a-d7f4f94fe478", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419429, "uuid": "f5a49751-b2be-410a-ad0e-c2f8225713d7", "value": "49152:ygOdHdcI/dGy9jnMLdH2I/gU10ryDvS88ytLCgv2MR:TUHdcYb9jMhNgU1bzv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675419429, "uuid": "5fbd1a86-37a5-4733-a320-bb844a1500b2", "value": 2051669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675419429, "uuid": "532ee8ea-43f7-4fe3-9665-7a156e5a910b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419429, "uuid": "0f390946-9e74-4dd7-8c81-6c6e8d51271f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be9a0640-a402-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675456721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456721, "uuid": "57e5b2a1-0144-4d4a-957d-a993a5891746", "comment": "Malware payload (Mirai)", "value": "0c99abf3314b9207c1952ba42bc912cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456721, "uuid": "8078d6ad-4808-4edf-886d-44d2b5b08d5c", "comment": "Malware payload (Mirai)", "value": "9d5106cea59a24ecae0c333f4d0375a2993e98642d11d65deccb1f400bef6ce1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456721, "uuid": "64b5c636-c53f-4770-b2d9-4d2eb676f1b5", "comment": "Malware payload (Mirai)", "value": "dfce565e9c6ec55ee97db3033fc93e58df326ac4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456721, "uuid": "ab7e3f13-602b-45a9-81f0-7b1c1f5d6ed3", "comment": "Malware payload (Mirai)", "value": "be00718581dcddc45a3c77f1c88969511b89e7b7c02c4611ccaffbd519ae55f5c66d38946c6a87e3299d6b61851d9187", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456721, "uuid": "bb8175fc-f595-4064-b904-b531ee9c4354", "value": "T1C2830C0ABA318FADF75C867553B38A605A8C23A776F1D141F51CC9002E6074E296FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456721, "uuid": "b7a4c4c7-153e-4595-acd3-675a3b5b0a92", "value": "1536:ig3nOjqiBGORUHsBMhM7ppZ/u81+pmIxG5:iUOj3BGORRBo2O81sY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675456721, "uuid": "cbf3f369-c278-40ee-816e-2b7a7ce70096", "value": 85052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675456721, "uuid": "c7f8d292-7f35-4c33-8d46-601b95e957ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456721, "uuid": "92ad2b97-48f6-4b8b-a385-d870d070dee7", "value": "0c99abf3314b9207c1952ba42bc912cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8b31fd-a3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675442329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442329, "uuid": "439ebf9f-e0b3-42c6-a324-1a02b55304a6", "comment": "Malware payload (AgentTesla)", "value": "3a2cb25aaad103526621d65417bbbae2", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442329, "uuid": "44c27606-957d-478f-997d-b2cae42741fa", "comment": "Malware payload (AgentTesla)", "value": "9df08396c2e40b7ad647f56a6441a309996dd3b6ac40cb5944753c9fee5a38bb", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442329, "uuid": "936e8f0d-7782-4816-a165-ce7023bb39fd", "comment": "Malware payload (AgentTesla)", "value": "4a4e2464d0fb09c54d0500436813a7efc66f5fee", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442329, "uuid": "37084c83-a1a6-4b0e-a467-2812d08e18a0", "comment": "Malware payload (AgentTesla)", "value": "8d264f58f068280ed9e863fde410d5e16b8b8ee3903178b7f1a4eb3e71d5f22ad880f2a4f9a9b27d4dcdc9b4e1241560", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442329, "uuid": "d0e25548-01cb-4cbd-8e6f-7b3414c1c812", "value": "T178058D6337B199B2F78720B20438BA985BF07513BE16E2938BB737C06785DB77294152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442329, "uuid": "6af15b39-ee3f-415d-b402-2fb765598e7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442329, "uuid": "821c48ae-6f17-4643-b48e-f39db131ccb2", "value": "12288:ohefaqG4yPabNny1gaDpP7oMNlkrMC4nQ7c6Fy2Mxzo3:eeSqG4yPab9yy+P7oEyiQY6F0xM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442329, "uuid": "82099a92-6092-4eec-93f7-c5b7984f1ca5", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442329, "uuid": "3216db0a-7244-4691-ae90-48675fbb00b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442329, "uuid": "1d616dd4-a2c3-418f-ab91-1d40dff5864b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f32c7a-a402-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675456733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456733, "uuid": "513a0b1b-d4e7-4f8f-8cce-e3fd514b4822", "comment": "Malware payload (Mirai)", "value": "22c680b5c4e7be7db2e1387149d43ccc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456733, "uuid": "b6149754-83fd-4f20-828c-96db9d5e0254", "comment": "Malware payload (Mirai)", "value": "9ea71dd89eff6ace2c3fbd2319fe89aebbedf7ebc68bb9c51275199c1ebb9b6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456733, "uuid": "aa86b0d9-06d8-4c10-bde1-c2d56ddeadbb", "comment": "Malware payload (Mirai)", "value": "0dc229854263d7599a6030056e5b9124f6f03395", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456733, "uuid": "0ece467d-6691-408d-a511-76f1fcf8450f", "comment": "Malware payload (Mirai)", "value": "59b197a5928d6848752a90d18f3003f87b6acd69208b950b5169f80ad52cf38f58cebfe223d2f24b7b9727cc78fc53dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456733, "uuid": "1dc6f69c-dff0-40b0-959d-4eba9edf1a03", "value": "T1AF83D80AFB620EB7DC5ACD7B15A2174028CD551BA1A93B367D30C81CB54B64F1AF3CA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456733, "uuid": "ab6c2673-ed2a-4177-ab2f-937a4dc07710", "value": "1536:YyrNBpAuc0/pDR9oDtKbnk0japG+VRKZrnfSKCwbCvfIx:YyloJKbnkNLOr8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675456733, "uuid": "c48ca03f-6704-48f2-b7bf-9f7423eeb2cc", "value": 85532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675456733, "uuid": "4b39f0d5-5a33-4e6a-a967-886c0070fdac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456733, "uuid": "d08f0efa-3efe-4a97-b5df-1e4365a066f7", "value": "22c680b5c4e7be7db2e1387149d43ccc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40fdb5f9-a359-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675383925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675383925, "uuid": "43d1b6ba-ae27-4400-bfac-9fe9596c0870", "comment": "Malware payload (AgentTesla)", "value": "1ddbee13f5f0ae486f0ea02b27d6b619", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675383925, "uuid": "d49a4292-3401-44ec-9daa-8d4f36d879dd", "comment": "Malware payload (AgentTesla)", "value": "9f9d6352b659e8dcb3bd0c467db1dcced6cc87d9ed991c906d84eb576f610207", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675383925, "uuid": "bf57ef6e-adf1-42f4-9cca-bd725c7fd0fa", "comment": "Malware payload (AgentTesla)", "value": "c3ae0b27eb9c41b53db7480ae2189efe0bc18566", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675383925, "uuid": "8c8944bc-64dd-432d-8fdf-7c507aebf7ae", "comment": "Malware payload (AgentTesla)", "value": "c09c75cde9cf142425d0aae23cbbd2281ee5bba7dd369783a48b4156a0213fa5a6508e55968a13447a4c544d58118e8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675383925, "uuid": "dc0d4c20-4802-486b-a816-c46ad0a1a55b", "value": "T1A015A13D18765696C374F93182DA9020FEDE60836343FB3D99EA96CC5B015867A8FD38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675383925, "uuid": "f2e415de-c4df-4d1d-ab6f-e2fc96962117", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675383925, "uuid": "21a586f1-3ae7-4207-834f-bcab3598ba35", "value": "24576:7jseHKNTn7tunA+/kSTeKIiWO1doXYXq1ZcrH+w7XG:QKrWO1Ovgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675383925, "uuid": "db76171b-ff85-4705-8fa1-a19d7e162f32", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675383925, "uuid": "a0bf63a5-0a37-4981-82ab-aa35a8f5fe55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675383925, "uuid": "d7e3ecec-b087-477b-9bea-66097e17e9ac", "value": "P.Order #432646.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d258cf41-a3cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675433561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433561, "uuid": "588e28fa-475f-405b-8fbe-6545666b8487", "comment": "Malware payload (AgentTesla)", "value": "745cd1c0d634761f772399394dea5592", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433561, "uuid": "6d07be77-1ef4-40f6-b413-962a67a2aea3", "comment": "Malware payload (AgentTesla)", "value": "9fb87f7f5f15f6706b0b832d6382a43c6cf325b857af0332f5ec9f1988fc233a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433561, "uuid": "93ac1361-941e-4b32-929c-4879e2efd477", "comment": "Malware payload (AgentTesla)", "value": "59ccd7290e2a5469f09d3c95ad63875750410a69", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433561, "uuid": "54345437-480d-4305-b5b8-f32866f64295", "comment": "Malware payload (AgentTesla)", "value": "e42f9304b769c7132dbcc800cf78b78b1dba1572a55bd5645ea477f6452d6cf15391a0f156a8e82e3e17de7be9346852", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433561, "uuid": "e59e3eaf-2458-4a21-b8a2-915b2c98cea0", "value": "T17003EA9821AC8B33FE9E1BFE1479659BA7F665376010FE892DDDA1D43595B800300B8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433561, "uuid": "a474bad9-86d8-4c80-aecd-ea318eabafff", "value": "768:eevuNS3G1TxGG+tNOIXVYxWgr/wt+lwqt5RYVMAz24v:wNS21T4G+tNBXViDQ+CqtfY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675433561, "uuid": "0c34077e-9049-4f90-bc72-ae8ce66930f1", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675433561, "uuid": "cbe11277-32ac-4beb-9fc8-86ecad46c2af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433561, "uuid": "f839ba62-3a5f-482c-8000-32e095db0800", "value": "kIZkIsqBSq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d27c54-a3fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675454523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454523, "uuid": "0b8e1175-1140-4d93-b578-a09c9b68334a", "comment": "Malware payload (PureCrypter)", "value": "b0f795a3e55c48f038e4a5d31cd77171", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454523, "uuid": "7efbe606-cc33-4c17-a114-2d82373b8acc", "comment": "Malware payload (PureCrypter)", "value": "a05759a606f754ea7315225ccd542774734962fc343d43cc9607db110e7956ee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454523, "uuid": "ff95eb9c-dfaa-4fe6-ade9-8e6dbbf7873d", "comment": "Malware payload (PureCrypter)", "value": "e6e190703f53787efe3b8ec5c5435cde5b9c21bc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454523, "uuid": "f4081350-2863-4bcd-8a6e-c59aab9f40f7", "comment": "Malware payload (PureCrypter)", "value": "6429177b29de025741fe6f5b081c97293c51921d0b5408d9934612e0bd71286f99879628a3b1bc08047d33b329df9860", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454523, "uuid": "0127c757-1ef5-47c9-bbee-e0d1346026a5", "value": "T1E0C54A02B1F28EB2D798273BE6D6A8210361D7113697F30B395513755C233F86A49AEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454523, "uuid": "69570e3a-6359-48f8-b3f6-18da7123da13", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454523, "uuid": "ad905446-1b03-4dff-8a3d-81e4ec7ef8cd", "value": "49152:SPiC/ffGsM/z5aWQeDq+NtWLoXxrc8cqC:SPiC/fffyzTq+NEWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675454523, "uuid": "17bbabe5-33d0-4c49-aea6-45200da54d11", "value": 2606592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675454523, "uuid": "68ce36eb-3915-42ba-9656-6999e01821b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454523, "uuid": "b7307952-cb92-464f-92e5-f0ff674ee1ad", "value": "3b17cd66110ad93010d8d1b837cf5bb9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad84977-a3a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675415536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415536, "uuid": "df460850-6b7a-4691-9478-5149257be0f8", "comment": "Malware payload (AgentTesla)", "value": "0b378b173618c2b5652def43c60b034a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415536, "uuid": "ce28cf3a-fdd9-49b8-a0be-2ffa1449c722", "comment": "Malware payload (AgentTesla)", "value": "a063b8a55c4ee1bee4f58ff27b312459b80c8895be0addaa069809a9eb7a1036", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415536, "uuid": "393b38e7-e4c4-41c7-927b-0a013e05688b", "comment": "Malware payload (AgentTesla)", "value": "4533932b64395641bb9918c778dbe1c908caaaf1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415536, "uuid": "b871c9b3-aa9d-4a7f-b042-01beb70c0c76", "comment": "Malware payload (AgentTesla)", "value": "12b9b081dfa9f5cec893718ac6824744aeeba71a54651a8d2e9a0cc21dfe4c80d12e3ca66b0912a2aa3aaa975021cfe8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415536, "uuid": "3f722655-bfea-48e7-a31e-bd4525c566e7", "value": "T13525120173838B08C50958F5C2D7462849F3A79BA9F7E55A395C8B9F0FA33A1D9887CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415536, "uuid": "d29ab543-9cb2-456e-8d37-ce6710fa0795", "value": "24576:TVgSJ8E3TR7P8jRmK3mE8uO8Mw+4UwiZNK6Q:TVgSJ8ESRmJluO8MhoWEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675415536, "uuid": "2ab26651-64cc-45bd-af50-b0821f1054d0", "value": 972800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675415536, "uuid": "7ef7d18b-a675-47c7-803e-68a4236becbf", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415536, "uuid": "a3986242-b53c-4172-a29f-e13ed5b5bdb0", "value": "Fedex_AWB.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092f5a30-a3b9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675425063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425063, "uuid": "7ab66680-6ed5-4efc-90d8-316d67485370", "comment": "Malware payload (AgentTesla)", "value": "c0b086ea1753b821bab5615fe90ee215", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425063, "uuid": "e6697d0a-eeda-4d52-a03b-c81f889c2a73", "comment": "Malware payload (AgentTesla)", "value": "a146acfa60d74e1bba11363ac6df213b4428f642dd17b336660d87198ebdecce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425063, "uuid": "28f00ea4-003b-46f4-9eee-72d8c9e5e1ef", "comment": "Malware payload (AgentTesla)", "value": "4f049dd47e5d47c5e6486c38c1829b7a37a7bfa3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425063, "uuid": "16be9078-52d4-4237-8b8a-c58c4623fcb7", "comment": "Malware payload (AgentTesla)", "value": "842b7c16f297ba671b36ca3388cd0abd367e860e94d0d29ecf0e82e8df9b6db4651b85052c0f1fbd6a6551ff6e680b39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425063, "uuid": "c9e9a34d-2f7e-4703-be57-9b467c111a5f", "value": "T1FE058D8377F198B3F68B00B50428378D2FE07543BE95A253A77B7AD09B519FBB298141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425063, "uuid": "87a65e3c-e934-4819-af4e-c7c9c519846e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425063, "uuid": "25432fc7-8063-404d-b5f3-3e7b9407dce0", "value": "24576:u1dH+ASIWuP0AOSElsHo6F0xMpqG4yPa:uPHrSIWNAO/uWiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675425063, "uuid": "1892a70e-5b05-47ab-ba27-7748e781938b", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675425063, "uuid": "54f936b0-88e1-4f54-915e-a7971000b60f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425063, "uuid": "ab7820f4-0c86-4c30-8935-0bc7dc351934", "value": "PO-000001306.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d40a0a-a3bc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675426754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675426754, "uuid": "13ab3fb9-c459-4b6c-8b55-25f325ed507e", "comment": "Malware payload", "value": "cf631283622d45a84bff1049b1590185", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675426754, "uuid": "946e48f5-1e44-4eb2-8b7c-e0256fedaace", "comment": "Malware payload", "value": "a23ba2c06047c80fe581b35dfbe6bc080233f74c73ab85e69fd130630f0a6796", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675426754, "uuid": "a729618a-f529-4306-a1ee-27b18447f800", "comment": "Malware payload", "value": "13ec978ab7af402a0d9c2f38e3bd6f7f4b3c9eba", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675426754, "uuid": "08d3fabb-7519-40a8-9dab-6e79ebf27e49", "comment": "Malware payload", "value": "cf53496636797903b2fc410b33209191db55aa49d6d4b1a4cde4011816e888adbbbeb08e0abc916e95701e079e38097c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675426754, "uuid": "ceee0bf3-9beb-4702-ad6c-d36b57c08e2e", "value": "T19FB26E6D034BA8FC9663ECC88AD5AC57FB74872A492CDAC49F30FEEA241157894F550C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675426754, "uuid": "fdf995a5-ca4e-457c-ba7d-ef291e2aefa7", "value": "384:Jg6IkBCuliwCxzN68nfjSu5SNn8HSGQh013DrU/xfzL0ATUQNBoNCD:JPqjRR4h0sPuQNBo0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675426754, "uuid": "373ed8dc-8d1e-4408-a30d-912d18c7e701", "value": 23728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675426754, "uuid": "72de8072-e6b4-461e-9f4c-c60546702e86", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675426754, "uuid": "1861e60e-5503-4107-bc55-051b0d364a96", "value": "Open.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f106885b-a3b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675422016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422016, "uuid": "ae19bfeb-8146-4c18-96d1-d6bb63173498", "comment": "Malware payload (Smoke Loader)", "value": "39fbf144b7c12fa3a56e49ec90eccae1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422016, "uuid": "45e04c49-8fe7-42c5-aad7-3bb59503aca3", "comment": "Malware payload (Smoke Loader)", "value": "a29d4d08d285b30c058868747748dccfb5561b2c2ffe42218c83cca6575d7f95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422016, "uuid": "7ba21157-ee33-4153-895a-5d425806982b", "comment": "Malware payload (Smoke Loader)", "value": "dd9d142b908fe4211f3323b22b891915bda06c98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422016, "uuid": "82004a9f-af51-4ae4-91e5-6609ac025afc", "comment": "Malware payload (Smoke Loader)", "value": "c467ba0fc638999305c4e6b09fcd922b0c0e67c5f2c5402fe894c76160c81c88aff50c184344f03d954b5e26fab9b2e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422016, "uuid": "e21d6b3a-1885-490b-b63a-34086f59cb0c", "value": "T10414D03236C2D072C46740709830D6956BBEF9326A795A1B7B982B7D5F702D0263B35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422016, "uuid": "a9a27eb2-2151-457f-8323-4a2cce03f398", "value": "b65d7d05727ada8b2acd168719f50dd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422016, "uuid": "09e3d4cf-3f45-4539-b29b-267372e68265", "value": "3072:yn6XwPKqL3ULoMzvW9q5PlUjGolx5Kevp3kfuPjaEfOMXN2:yn66kLoMzv4G6jzlx5Kevp3kf0jKM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675422016, "uuid": "e064dd80-bf05-4017-b7f5-59975a857d8a", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675422016, "uuid": "1d95adac-12ce-4aac-bd7b-2f4039b10bbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422016, "uuid": "267d93ed-2a4d-4a55-9cff-5295ff976709", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c6705d-a404-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675457454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675457454, "uuid": "01f08926-c603-43ca-bf95-cf3de0264874", "comment": "Malware payload", "value": "045a37c8e415f9dc2be02d271a8d7565", "object_relation": "md5", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675457454, "uuid": "80763805-bfdd-474c-85f3-e83ac9e4b379", "comment": "Malware payload", "value": "a332c95f8835586e8ef999805fe6dbc2e4962eaf361e9cf8ef365485efbf5bd4", "object_relation": "sha256", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675457454, "uuid": "72ea23b5-6ac8-4785-a953-dd7957507f83", "comment": "Malware payload", "value": "5472593f8c5822b2620898c9d4dd0f6d84a39873", "object_relation": "sha1", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675457454, "uuid": "30577f56-aa4a-40ef-b03a-cc846fc84fb2", "comment": "Malware payload", "value": "e490975cef32cde81fc23566af1b0b1a2f5296a829ede60a9a6e1def69bf6a84a8c7340923afb73134896698c8287a2b", "object_relation": "sha3-384", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675457454, "uuid": "bf9b170b-b203-498f-bc4c-ad0d70bdab2b", "value": "T150D533077B74B043E2B7A3900F84FDB899807A77928BDBD47EE566774E5E1481120BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675457454, "uuid": "42a436f7-92e1-4367-8f37-df066fdfc806", "value": "49152:fBKJuxVuLnjHMXzwjRmbzJJUuIqaX9bKhA8FlgYxRjjRWDNyKdfndX:fBKsxILLiombzXaX9bmSwHgDNyGdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675457454, "uuid": "7e2ed998-00b0-4f43-bce9-086b291c51e7", "value": 2907373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675457454, "uuid": "0d95ee32-2d8f-49b2-b86b-1d43aede7bf2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675457454, "uuid": "46f49fe2-b43e-44be-8514-7acb2dcb86fd", "value": "PDF_200220233156154648848333.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9dbebaa-a3a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675418514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675418514, "uuid": "29bf965d-7027-492a-a547-64dfb04160fc", "comment": "Malware payload (AgentTesla)", "value": "f345b0e91a292dbda6c7a963ca3c666f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675418514, "uuid": "0e6ab0df-dc20-4dee-a921-8240d0b689a7", "comment": "Malware payload (AgentTesla)", "value": "a33ed3835b27606cac12b9cf329e128b2d8fbe1e7c513fc9bfbcbf6596d5c56a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675418514, "uuid": "e17085ac-93bc-40e4-b03b-c44e3a943d17", "comment": "Malware payload (AgentTesla)", "value": "9f1ca0ff1f3c0c2f178bcd47740fcc79cdab752f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675418514, "uuid": "98b7e21b-3859-482d-9c46-02c1a2d563bc", "comment": "Malware payload (AgentTesla)", "value": "6fb114c6e4283964eba84dfa76001942a9aadfdf568d728a304af3f3f2321fb696cdede8b593c8afd732b45b3d715319", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675418514, "uuid": "f9b2e887-1115-4fe5-8746-6c9a1cd60696", "value": "T1F0059D9337B1A873F68B10B5142837CD2FE07503BE95A253A77B7AD09B119FBB298141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675418514, "uuid": "f512aa28-8918-474b-90e8-937febe736ac", "value": "12288:a2iNZlSE+AlRvX4d9hpmtOe/VdFB6lZvLYu4NCVVKgW6Fy2Mxzo3pqG4yPa:a1dH+AlZ8hpyVd2gp96F0xMpqG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675418514, "uuid": "38368f78-2fe2-42ea-b5d4-1dc7085ad9b6", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675418514, "uuid": "44b8efec-ac9c-490f-b67a-8a499bf8d34e", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675418514, "uuid": "df7ca227-ceb2-4425-9f7d-9857beb70ff3", "value": "shipment airway_PDF.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761be403-a396-11ed-88f6-42010a9c006e", "comment": "Malware payload (Dharma)", "timestamp": 1675410214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410214, "uuid": "6bc8d942-8701-4cfc-b455-3c8aaab2b249", "comment": "Malware payload (Dharma)", "value": "4377cec046984f87c73603d7c85090d2", "object_relation": "md5", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410214, "uuid": "38fe0390-6243-4e50-bd97-92d2e941fea4", "comment": "Malware payload (Dharma)", "value": "a3435ff11b5afc8bd891fdc1977e1a70c65830aa2a80438c6320e3fae7c2811b", "object_relation": "sha256", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410214, "uuid": "8c195adc-9752-4e3f-8ec2-9e65b7d57b5f", "comment": "Malware payload (Dharma)", "value": "c7dbed949bb7332b03fc09266edc1b0ec864976a", "object_relation": "sha1", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410214, "uuid": "2e20f3ce-6d93-4b3c-88e7-fc94268aa903", "comment": "Malware payload (Dharma)", "value": "fe65fee221d4e2a3b98ceffa139e233a59112d22196c3dd33f2d73fe41286bafa4db763a686dd97cd3cbaf4293320947", "object_relation": "sha3-384", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410214, "uuid": "7cc81790-3836-45a7-81ee-19fbb488595b", "value": "T10F939D25D821D135F8A350FFCBFA8AFDAD645B201303D0D797C05D89AB869D5F832A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410214, "uuid": "50d9fa19-d273-4131-bda8-be27a4b1085f", "value": "f86dec4a80961955a89e7ed62046cc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410214, "uuid": "747a4c7e-6a99-4343-8ce8-1c39bc9c3759", "value": "1536:tBwl+KXpsqN5vlwWYyhY9S4AMVweCnjYofhkbBgGvpo1mWGGA4MbL4:Hw+asqN5aW/hLo1CY2h6gx1m5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675410214, "uuid": "51aec5d6-2e3e-4ea6-a398-81b97fed30b7", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675410214, "uuid": "34e9d6c6-c02c-4efc-a8f2-0dad0060eda2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410214, "uuid": "b49aecf2-a7fc-4fc8-b69c-f69483e8939e", "value": "2023-02-02_4377cec046984f87c73603d7c85090d2_crysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5808806-a3be-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675427527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427527, "uuid": "688eb3a5-34f5-476c-abbc-727beb615812", "comment": "Malware payload (RedLineStealer)", "value": "8a9192000d7072852fca4367cc39e47c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427527, "uuid": "c3c9546e-f612-4f84-879e-984fa8acb8ac", "comment": "Malware payload (RedLineStealer)", "value": "a35fe253c0f82283f94c43d4aee2e0c41336edf8e3ca9530efd4f16a31f60cb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427527, "uuid": "ebc244b8-3625-4cca-926a-22beecb8c757", "comment": "Malware payload (RedLineStealer)", "value": "fcfec3e99d72bbd6747067391f017b580456d2af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427527, "uuid": "f42f1a8b-000c-42d6-ac04-121123d467bd", "comment": "Malware payload (RedLineStealer)", "value": "8daa260ee6cc68b778d8f2d131dfeb31e626aa20dd267e7bca4ac6534ac7352eeabef57b86a82759da11ec3dead50b65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427527, "uuid": "66dc698b-6355-4bf3-b095-7cc617c18395", "value": "T12E64013235C0CCB2C57700714864EEB5FB7EA431157A9617BB983BAE8F306D09A7635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427527, "uuid": "76f8ddf7-ce81-4120-b55e-f997502cad15", "value": "6b1aa8e68ec0f35426270b76446d282c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427527, "uuid": "a848f559-cd20-4f5d-bc13-0249581ff90e", "value": "6144:CanAL3Ha4TnqoPorBxY/34XlnZlDocp+hY0oziaZl:CanAm4ToN04XlbUq+hY1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675427527, "uuid": "f2cbb7a5-0e2b-4714-8b2e-29c732e697e6", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675427527, "uuid": "547090dd-a3cb-49af-81bd-ec8a65897ca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427527, "uuid": "9c1a1d88-f763-4763-bd84-5013ecc12dfd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9f27cd-a381-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675401101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401101, "uuid": "11e68648-1105-4f4a-b691-6c3608ca2a59", "comment": "Malware payload (Mirai)", "value": "d64353685c425a78f3c20ac1ae00bc99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401101, "uuid": "5bb7403f-7550-4c5c-afb3-b7e6cc6c3498", "comment": "Malware payload (Mirai)", "value": "a3ce18ca09dd6b4bafcb4556057a87b2744f01921db6420de192a93834607495", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401101, "uuid": "9e179a7b-d384-4204-a289-8e4dd73eb045", "comment": "Malware payload (Mirai)", "value": "6a29decd90f4ebd087cfa5983117de9c5709fb85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401101, "uuid": "a4e73e59-a3a7-475f-90ed-1baab25612ed", "comment": "Malware payload (Mirai)", "value": "d84afd4d50e9b644c26b861677aef520568243bff6414da27079f9950cdd58ccc1b8824dcd1ef25a00200b4e8e617e50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401101, "uuid": "5d1d6d13-8d77-4c78-be7c-40b745407346", "value": "T1BCD2E054A7E1D8B0DFB4433EEE7C4142225713BBF8D8BAEB15948D58B64C207E739286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401101, "uuid": "6f072fe7-4b12-45af-afc0-631ad643b428", "value": "768:9FoxdX+IoMKVUfzaP1urxIGyYUzpzAhDxZgLs3Uozv:9F2+IoXVeNIlzpzAPzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675401101, "uuid": "32640c9d-7a31-4d91-b4dc-8e167196b96d", "value": 29960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675401101, "uuid": "37f4e381-b21b-4e7c-a89e-cc407addbce3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401101, "uuid": "dd7b2b07-7b1a-4b9f-beb4-583584c7e5cf", "value": "d64353685c425a78f3c20ac1ae00bc99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df8eb25-a3f8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675452129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452129, "uuid": "e537c867-7645-40e0-bae1-6614209d6e82", "comment": "Malware payload", "value": "94ccb92b775297f357670abd1e6f754b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452129, "uuid": "e67b01b1-6c18-4f59-ab8c-91f51b003e60", "comment": "Malware payload", "value": "a4c3028eddea3f36439b4b4aba7c1511f7b39dd0a92f38a282968d259d8e3286", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452129, "uuid": "e1b5e72b-7791-4994-9651-c565cff324cd", "comment": "Malware payload", "value": "50a9d6f7828c193c965ff9c5df8bc290b06122a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452129, "uuid": "3f2c252d-5477-4119-9eb1-162a640a2214", "comment": "Malware payload", "value": "dc7e6baf23bbc8d0eaf6c696ede303a1b3455af30501350e6e157c3c38291fae8a211dc11eb319d98aad57a6d66c412e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452129, "uuid": "b97c6637-d180-4307-a178-e24f2edc66bf", "value": "T165D2B61337BC8726E57527B95CA2C2800F75AE276854FE5F68C530BE1EF27008652B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452129, "uuid": "7344e4a1-e99e-4ba1-978e-00b206b44f15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452129, "uuid": "e312d2c8-73cf-48fd-9f48-d01dbba378de", "value": "384:bUpQt9rSl/xAaKRgJ6SoIrkvwKwq6u/oB:bBt9rwdCAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452129, "uuid": "ac766607-8511-4db5-988a-8b73fd43edab", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452129, "uuid": "eb33a894-507f-4232-802f-a20d8abbb7d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452129, "uuid": "7a926753-2151-4833-88e3-1b322f2e827f", "value": "94ccb92b775297f357670abd1e6f754b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f3e21a-a3f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675452111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452111, "uuid": "8e0173ce-96cd-452b-9f64-845ec8251996", "comment": "Malware payload (RemcosRAT)", "value": "2b8f487213f3da1f42779e22d7b02d1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452111, "uuid": "68682ecc-4282-4a41-9ab3-d04006405db9", "comment": "Malware payload (RemcosRAT)", "value": "a4da37e92ca54c8851ad144fba875b61e2018f69bbe43b11926d8f8d831b56f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452111, "uuid": "53df6a39-e36f-41bc-ad92-c4b1583d269f", "comment": "Malware payload (RemcosRAT)", "value": "77c96429d6facbd1900290c9cbfed378103b8e01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452111, "uuid": "c1a726bc-e6a0-4f57-a0ea-c94cf5252b52", "comment": "Malware payload (RemcosRAT)", "value": "2d045c572d23f350d4cbe862b64b6573c8f51b64b8c8218661a6584a5ef09bc655d34a9f2c82b4628d0c812243a96977", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452111, "uuid": "7cec637b-55bd-4487-a2ea-1aafcc1a90e7", "value": "T12FA4AE01BAC2C072D57524344D2AF735DABCBC212925597BB3EA1D5BFE30190A72A7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452111, "uuid": "c2846942-cf4f-4738-af13-00f0e72187a5", "value": "b1c8f7572a6db205362528e88fd3ff32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452111, "uuid": "f3c0f66f-1521-407a-9e76-a0aa2b9633cd", "value": "6144:GGqPd7rxgdfHD0Tnt5eh+4CwineHvWyBKxrw/5ttwAMS6NZ0sAOZZ7QX3cUiKRq:GGAxQj0bTe04CLneHvW9rwbxs/Z7WRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452111, "uuid": "1bde9ec2-6077-470b-9181-6d7fd369209c", "value": 486912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452111, "uuid": "44cc3825-66bf-43bc-b65b-a2362d556abc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452111, "uuid": "99a97c81-e854-4557-bfbf-eae8504aeb5e", "value": "2b8f487213f3da1f42779e22d7b02d1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c320177-a39e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675413472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413472, "uuid": "aabade98-447b-402d-a29f-d7ab3e6879a9", "comment": "Malware payload", "value": "c1f44040372e82973d1506399339316b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413472, "uuid": "6a841966-7e8b-43f4-8655-a9e0f542e938", "comment": "Malware payload", "value": "a4e1b002d9b2c01e57bcc80c7bad3f94b8b699bcd330cfe115e6f98a1a9d0f11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413472, "uuid": "5d262e5a-e995-4306-a822-1fb58be61b3b", "comment": "Malware payload", "value": "17f2580f27b61f53426e1345c44b216eeda0c2d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413472, "uuid": "6e470309-4298-4f75-a4e1-234f06fbbf93", "comment": "Malware payload", "value": "abfdaf4861facb28de9ae5b4cf8277a56df7a14ee9a812638c76270c4e1a4a8118154fad7e0b9741a449ee798dc53332", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413472, "uuid": "e4f19b84-8b52-4b80-8c0a-0ac3b2be933b", "value": "T17D76332475F18A7BC25346354D2C2EA4E743F2A04A2EDE373F8A9626AD75240C056FFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413472, "uuid": "c9d25c8d-314a-4766-b545-52f4c4f19648", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413472, "uuid": "7cd82ac5-9a50-447e-8aaf-1866226521c7", "value": "196608:91OMBDgjCrMbGm4DTVQbi85LlGB3T3d1Dp80BAn:3OaDeCrMqm46bi85lCzd1F8QAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675413472, "uuid": "ac0b15ac-4522-45df-bcd6-d883e94a9a14", "value": 7596438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675413472, "uuid": "1b35be50-e440-4dd1-b487-1dcbad9c8696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413472, "uuid": "9d0a1ef3-1e4c-4318-8289-b96c3130d0cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8fbab2-a3c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675431028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431028, "uuid": "c812b44a-83df-4c51-9000-c5dc8c8fb84f", "comment": "Malware payload (Amadey)", "value": "7c4839ee00f401bbe78e3d6d496c9583", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431028, "uuid": "cfbb3ca9-b1c5-490a-bfb7-1c5c800e777f", "comment": "Malware payload (Amadey)", "value": "a4fe3556df2c97ac621eb7238d0d44441f715ccfe9168eaca80f59ae425f14c4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431028, "uuid": "1510325a-308f-4199-8ccb-ddfac9889c97", "comment": "Malware payload (Amadey)", "value": "035e5fde3d26bfc5d771780ecdf54f9c0685b702", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431028, "uuid": "f70ebda5-cc51-49e3-91ea-e90bf65100a7", "comment": "Malware payload (Amadey)", "value": "fe5c7e9282bcf441cb5141153dd484b228c46d22728a8cee432cd791ed01122e50c70251d3553d1a709347018ab35b8f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431028, "uuid": "eb8cd3eb-0990-40ce-baf4-73945555a3cb", "value": "T18814C03232F0C072C57B14349875DBA57ABEB9314674E94B7B98C7AE9F302D0663A346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431028, "uuid": "705def8e-0e3b-4fcd-b41a-22bd06e53241", "value": "6b1aa8e68ec0f35426270b76446d282c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431028, "uuid": "3f14fd12-2ed5-450f-aa13-fd23500b9237", "value": "3072:taiurdOpgDL1Z6bjuuWpPQ5nyVYztS+GstN1l7vsXBeXVKkEB:taagDLD6b6uZSYgHs1l7sXBsMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675431028, "uuid": "844a7a38-3d81-4ea5-8b9e-27a7991148f7", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675431028, "uuid": "c2307d6b-4395-46b7-862a-4314444eb1a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431028, "uuid": "2dd297eb-efcd-4e9b-8e49-d6b3dbe31df8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ad0b16-a3df-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675441561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675441561, "uuid": "89992196-f385-4242-99f9-f4b8893aabaf", "comment": "Malware payload (RemcosRAT)", "value": "19a51c4f5f6bdd1af134ccd5f535adaf", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675441561, "uuid": "1ebf7284-b423-4a8e-a827-345093e7f4a9", "comment": "Malware payload (RemcosRAT)", "value": "a59981dac2a9c88f824f3d63b2f0a57366ffac57100620f686e091b39155122e", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675441561, "uuid": "1e784be3-0fc0-4c2e-b381-75c849b5bd57", "comment": "Malware payload (RemcosRAT)", "value": "f685dbf3ff1b04467a4d64b3d8c288a6e869124a", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675441561, "uuid": "74d5bbb1-a153-4ac1-b873-e1e0d7141cbd", "comment": "Malware payload (RemcosRAT)", "value": "37c4877ba86b5442de13a97cace959a23a6d79cfbb4c17a4df3a6328fdd2ace8478a16e2df9b377f3d821185eae85bd7", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675441561, "uuid": "eee03e1f-5d0c-4d65-9852-0c04437b5985", "value": "T1DEF42392F7DB3348FB956BF1EB0E75C424AB54B7A05788F823651AC4AC78344A5C43B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675441561, "uuid": "67ce262e-ba05-4a24-9396-657e3ef461b9", "value": "12288:llwpVAcUE2IfXbmirqwxgDF1LiGt70MbZncgH30I4:llA6cUE2+aorxMLiGW5gX0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675441561, "uuid": "d364279d-c97e-4747-be81-3c0369c7c293", "value": 743598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675441561, "uuid": "207b2e4e-a008-466c-99bc-dbd1af6bf16b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675441561, "uuid": "48cac235-86a2-4e33-b388-cecbf5c0b13b", "value": "Invoice233_passless.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f12bb4b-a3cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675432911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432911, "uuid": "a7446213-8235-4167-b78f-2385c562d60e", "comment": "Malware payload (GCleaner)", "value": "7746d3c72c53d8c7edb098b992483e5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432911, "uuid": "643a471a-d59d-4076-895f-a1d56e5e3cc5", "comment": "Malware payload (GCleaner)", "value": "a663f14467779f428b8476d5fe7670cbb67ea97ed3d4b1310c01b3cfaf313d3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432911, "uuid": "df0b5af0-b227-4899-9374-bab0a5f0ee75", "comment": "Malware payload (GCleaner)", "value": "d09e67dd2a3e87d0dd651316cc86d72fe7bcc92d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432911, "uuid": "bbcdbe2b-7ff4-41bf-89bb-29c2fd525030", "comment": "Malware payload (GCleaner)", "value": "5e1f7997c25a52ec636ee3d795a0d9b4d0aa2987295f38bdcbffc583531cdccaf23aebc1f6fee322784fab09b3aa1dfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432911, "uuid": "cfef7311-6744-4998-8778-215d57d00e83", "value": "T1DDA53343B4F18731E2330E3A2F62D7196A87BD7EA5708313755E35A91BAB154F093B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432911, "uuid": "60a430e6-aabe-4afc-b80d-df73f1eea239", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432911, "uuid": "2dec754e-62ce-462c-b3b1-ea8c6a7c4586", "value": "49152:ygmo6pnr7/K97bdbKuDcw3D2/efNLCgv2MR:Tepnr2931KuDcw3oGv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675432911, "uuid": "8a8aae53-45fb-4df7-92b1-3f9851d11ec8", "value": 2073061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675432911, "uuid": "59be7ae8-52fb-426a-b097-800e294f8264", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432911, "uuid": "74660ef9-53d4-493a-866a-0287ce18dfbd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a31aea-a3d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675435261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435261, "uuid": "19334973-a830-4110-8b55-ffe93d04f217", "comment": "Malware payload (AgentTesla)", "value": "056dbac271b4b97fac9016695f03be29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435261, "uuid": "390d7198-9e31-4da9-afd2-6d8e2f53bad6", "comment": "Malware payload (AgentTesla)", "value": "a67119e6131f2cf27b28044e3562d04abd86b62bcebbfa8ed7f4ecea90682f2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435261, "uuid": "62e99e3c-4a6b-4689-a4c4-3c32ed125343", "comment": "Malware payload (AgentTesla)", "value": "f2b1dd5d709a7e606002f1b2a0cda30e07d1635b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675435261, "uuid": "4d8612d5-51c7-4d11-b5cc-777ed8fabcbd", "comment": "Malware payload (AgentTesla)", "value": "1f7c096e05129fa66ea1c35431e420b49975ac46fca727738603a7496f8642f1cee0f6d8dbba64c795243b66f9100d94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435261, "uuid": "a773fae8-476c-4002-a929-cf34e1490e1e", "value": "T1A1057D6337B199B2E78720B20434BB885BF17503BE56E2938BB737C06785DB77298152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435261, "uuid": "7154dd58-6286-47be-9f38-ce4e0e043435", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435261, "uuid": "3817bea3-bbec-42a1-804f-60bbd52a703a", "value": "24576:keSqG4yPa46F0xM64kLOBLHK4FUgmaFq:ztWiFkLOBLHK4FUgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675435261, "uuid": "ac840b7d-0419-4c68-aebd-379ff18ff959", "value": 838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675435261, "uuid": "5f60887a-237e-4e0a-8b4b-9de163258355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675435261, "uuid": "16c3c0be-a368-40b1-8637-888a9be24aad", "value": "Msconcepts.............PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a54c19b-a3ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675420153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420153, "uuid": "03cba3bd-5b14-48f4-b691-c8c51acd06ba", "comment": "Malware payload (AgentTesla)", "value": "6f3aa0c84065767d7ac02d0e3fe7e6c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420153, "uuid": "65f44864-c28b-4c04-83da-43ae128685cb", "comment": "Malware payload (AgentTesla)", "value": "a6e4e9e9cdad0dbb9bf69e1008db865523d8635031016100c3ac4358e2a0486a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420153, "uuid": "55856062-4e9f-4459-be4d-fda3c981a321", "comment": "Malware payload (AgentTesla)", "value": "9c5eaa76156d8afd84d53a6b506cf92b678548a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420153, "uuid": "28571ac9-a654-42aa-a180-f220d0ca8c9a", "comment": "Malware payload (AgentTesla)", "value": "7cadf4cc5dd3856582ad4a044a3d692e04101dd2450c334062180e9599928f42e73562008f7cfd5ccf9f1b49ce22944e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420153, "uuid": "1e7d8ac2-f724-401a-b461-19cdaaf7c4db", "value": "T1A962CFFBF17C60048ADC47F76BB57A5D939E11C073EA69B4D90B7C3706A00A41467754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420153, "uuid": "45e51bd1-5b5d-4b27-8386-936b36fe58bf", "value": "384:Ao2jZRhoaLFuuK/DGLSBuSZFQglYLCwnXqMA+9f:Ao2j9xuvA8rxwXL/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675420153, "uuid": "28139eac-4467-4cc0-8165-47c4aab07d4a", "value": 15141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675420153, "uuid": "b3f8949b-3205-4260-96ea-e227efcd7c8d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420153, "uuid": "65f8c49b-b465-456e-a961-6e3a9a9d94a3", "value": "S O A -[8363037ED].zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b5057f-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675454151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454151, "uuid": "5951b3ce-7a33-4c57-8675-2cf5b08fbc2d", "comment": "Malware payload (DCRat)", "value": "a751f7d10db17ba91f129b58e4d71420", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454151, "uuid": "e6cfdb5e-e50a-4b65-b3de-2589dff4d2d2", "comment": "Malware payload (DCRat)", "value": "a78a1c44768afcb0fa1f18834ee723aa34401d7c81f53968d95709c11b2c05d9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454151, "uuid": "198e8af4-d458-4205-ad22-6c06eae40b6e", "comment": "Malware payload (DCRat)", "value": "bcb6b9e97ebaaa40ded2ef30152e04a683925256", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454151, "uuid": "065249a3-1697-4815-b9cd-2417135dcf9c", "comment": "Malware payload (DCRat)", "value": "e321e1763c56b5476c258f4bb945cfe24bc7df009d0410e4acea094ae216485d87feeded3601956ea149da20f8f5e6c1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454151, "uuid": "5307ef8d-d9d5-4c85-85c1-9f0534420858", "value": "T1E3557C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454151, "uuid": "37296dc8-881e-40c1-bbac-0ed67ba8ffac", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454151, "uuid": "6ee17fcf-cf6d-4f62-9e9b-0198e9e1e21b", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675454151, "uuid": "79bed7be-2936-4431-8d8e-8b4e67dc3f59", "value": 1407821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675454151, "uuid": "954be96c-17c7-4674-a5cd-5aae48dbc49e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454151, "uuid": "1cc07160-cac3-4b18-9300-0195c3bf6f14", "value": "a751f7d10db17ba91f129b58e4d71420.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0a4912-a3f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675451380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451380, "uuid": "92dccb5e-157c-40af-b9f3-8821d0a37fb2", "comment": "Malware payload (RedLineStealer)", "value": "2a50691f326acfc3ae3487f32b2542de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451380, "uuid": "10cb0dad-a2ba-4fb3-a7dd-29d2f7b487d5", "comment": "Malware payload (RedLineStealer)", "value": "a81acede145ff96f350705bb9a028dafdf5ed27643ef05aabf3af0ca61d5af65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451380, "uuid": "c65ecde1-b4da-4ba5-8325-7a76331900a1", "comment": "Malware payload (RedLineStealer)", "value": "c2507b7ef40fdd02c536dc1d3ad673946605bd5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451380, "uuid": "dfdb01c7-e786-48be-83ae-7e29478d1e14", "comment": "Malware payload (RedLineStealer)", "value": "4315c81a3cdf8886cdc6cb9c8e235bc750424d8e73119f2cbe8cbdd5c82265b2d021486739f11a3e6f65d2dbfdfad3a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451380, "uuid": "e4fa743b-2d86-4b30-b71a-1860cdf3b3ca", "value": "T1A364F12233D0C072C66A25704C24EBA5ABFE78205579D8577BDC17EE9F702D05A3A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451380, "uuid": "dc71256f-64cb-4ad9-bd03-9fd0d7cc9405", "value": "11deee92ae37204b8493d8d64f5f1f69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451380, "uuid": "41d7d975-676c-4054-b62c-6da5ce1e0e11", "value": "6144:boFLNtZJ1pTlZ7dfjQmRyfwxwtm9Bg8UKyXMJ:boFDZJ19lhdfjFR4wZ1s8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675451380, "uuid": "cb12c795-bf61-419b-a4fb-8c70cba1fe58", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675451380, "uuid": "d55b81ef-bc10-4947-ac56-72a77730c279", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451380, "uuid": "87458d00-d346-46d2-bca4-a8e26b71a457", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf450851-a3ca-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675432670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432670, "uuid": "f2f073e0-3f0e-4555-9dac-2eab51b2042b", "comment": "Malware payload", "value": "aa62ab3049058d69b3b747bab1d96f16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432670, "uuid": "de528594-8c84-408d-bd10-eed2e69910a3", "comment": "Malware payload", "value": "a84e584df7da0e434a9f3e6cefc08566bf01e5f285b76fbf5c5ad609c97c0482", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432670, "uuid": "eaf78bc4-831f-4939-bf42-a7313d8a2e7b", "comment": "Malware payload", "value": "bb2c883cddf2f152eb160c888405fad7acc70e37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432670, "uuid": "215ac8ba-0556-4271-973b-1f54de2f7271", "comment": "Malware payload", "value": "f54a1b26f355c4458a195ae0b24224937c640e2e07a1b4b7a93a6eb008a69983449728bf842346e3bfd943acb7a7aabf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432670, "uuid": "c418ada7-cd26-4448-aad2-106059e899a8", "value": "T1AA7633A17EC6C1B5F0C10A37819A3B9F62F6D339480588FB239E8D2C55BC755C71ADA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432670, "uuid": "29c116da-1058-42c8-bce5-74e8176b457e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432670, "uuid": "ed7e8851-265d-4cf6-a458-759a8c3a685a", "value": "196608:91O3dDmTaxFID1IhP0Buz5SOPqpxRkMUyh99x:3O1aax6OP0BrOyfWhyh9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675432670, "uuid": "ef50eaf6-bcfb-4853-afc7-a059694310f6", "value": 7639064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675432670, "uuid": "02a273a0-8897-4881-9e30-0eefeb6a3e2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432670, "uuid": "ff7c9182-fb61-4d93-b1a7-4dde15f1bd53", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3fe127a-a398-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675411284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411284, "uuid": "a6d331cf-b22c-480e-93a2-99b74f993736", "comment": "Malware payload (GCleaner)", "value": "307b4e0676ef3c7e9068c89ceb16b5b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411284, "uuid": "06ad8599-d7a9-4300-9874-e4a079ca601c", "comment": "Malware payload (GCleaner)", "value": "a8674ded41983f51be7ee80e61d5f42746f7052aaf9faad34c572fedcfcd203c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411284, "uuid": "bc818d23-bbe5-4573-a5d4-4b9f59270f7f", "comment": "Malware payload (GCleaner)", "value": "eb9f814de44be3581f9c7a12e642dd9a04b98409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411284, "uuid": "fb6becb0-914c-46fe-bf0e-c4113916b7cd", "comment": "Malware payload (GCleaner)", "value": "0f7618637aa82056b790b0ca0b4cb10ae430c87c532000ca0cf1fc81bcf7443a503ba629d7c5d328cbd8a5326fa71051", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411284, "uuid": "4a89a98b-f7ec-477f-8da5-9c7b3f785930", "value": "T1E5953350A0B38D35D7A2C7F466585500BC1B7ED32AB793542A1DF28D0F3B2C8A66B74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411284, "uuid": "3ea0584a-cb41-4993-9494-703430f09e37", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411284, "uuid": "051f0264-908d-4d4a-bec6-44ce7b207b40", "value": "49152:ygjGD09aF6uW2TovLUdVey2OVMqJLCgv2MR:TyD09aFLXcvLUdYsv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675411284, "uuid": "65ace9ac-e7bf-407d-b9da-d17d9d08c0cb", "value": 2035543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675411284, "uuid": "20367fb0-f4f2-43f6-8cf6-f320123fb66f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411284, "uuid": "3ab1cb5e-9d21-48a2-a2f4-f09cadb141aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8078a003-a38c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675405936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405936, "uuid": "7f0ae7e8-bca1-4cb3-b7b3-d5840dc1df69", "comment": "Malware payload (GCleaner)", "value": "94aaa2d67bc3a0330e658de855668f19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405936, "uuid": "d19346cd-8693-4179-88ce-2b2b7b2412ce", "comment": "Malware payload (GCleaner)", "value": "aa0050b9c8e62c7d2a7c0df0bc5a99b666815197c00ebe49efb12c0d584c40cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405936, "uuid": "3115cc93-47c0-47f4-9fad-e710df2a5e62", "comment": "Malware payload (GCleaner)", "value": "2854d070d49d824cc7677aa07d527fc0688188a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405936, "uuid": "145e4b36-2ec5-4f5b-91a2-f302cedd3322", "comment": "Malware payload (GCleaner)", "value": "2c51bac668864ec7b327aaa084f738678eb19962fa0a8ad3610c0ecdbcb385a18828d34f03382c0a936f703d92e0b121", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405936, "uuid": "59964a57-0f82-4bac-aa53-a61e2ab0ceee", "value": "T1509533F136C3907DE00386325C34A5524EB36F7624309669B97E1A1B37679C0BD8DBAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405936, "uuid": "b2e738d2-ccdc-46f8-8264-0774d7093d2a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405936, "uuid": "cf1e2192-65e6-42d8-a835-6c25214d9a1c", "value": "49152:ygbPwIrnWgxQOmkIdhYPZs4cANtLFrwT0YVLCgv2MR:TbDrpQYtPZjNtWv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675405936, "uuid": "9148da43-cc85-4f42-801e-9a4278f64642", "value": 1998274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675405936, "uuid": "87b1861c-d0dc-4603-9033-b59a7cf227f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405936, "uuid": "0ccd6b8b-e2ee-4783-b671-c54e26ffb541", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3af83e-a3f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675452420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452420, "uuid": "f9e3d1d4-6232-4c74-9c32-d2d2a7eb4cdc", "comment": "Malware payload (AgentTesla)", "value": "6ad7259d34775f49301409f67dc3927b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452420, "uuid": "2493af4c-2fb0-478c-8240-7f4eb8eae715", "comment": "Malware payload (AgentTesla)", "value": "ab1b148fbfb5711529360d1dc07d2e278d970d489acb4e6150928e23a635223b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452420, "uuid": "a63ea3f1-d894-4c31-831b-4d34fab8bb3c", "comment": "Malware payload (AgentTesla)", "value": "157e5da03305d85ce5534d2a85b3b6226ccac69f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452420, "uuid": "fd088cc2-35b4-49a4-a111-ff83bc553a85", "comment": "Malware payload (AgentTesla)", "value": "0811a9ea49c9cfd0865f11bb23607b21246d2559b3bbce09f33c8422d2b1fb773f79e59543721f117235504a75858dc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452420, "uuid": "0380195e-b566-4a5f-a0e0-2c5188fe19a5", "value": "T125158E6337B199B2F78720B10428BB885BF17603BE16E2939B7737C06785DB77298152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452420, "uuid": "bb8cca00-576c-452d-b471-2190d8f41caa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452420, "uuid": "8ac16daa-decd-40d0-bd86-f86fd5e26361", "value": "12288:RhefaqG4yPaw6Fy2MU4hU8AJ5NMxxLyUswJD3HlC7qKSuN0Zzo3:HeSqG4yPaw6F0+8A/RUscD3FUZUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452420, "uuid": "72f61ba7-0046-44f0-b359-23b5a30edede", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452420, "uuid": "dca14760-e33a-4222-91f6-bbbfb350e3eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452420, "uuid": "89def066-2ee3-435b-9ea0-546b3e950c9d", "value": "FEDEX AWB 6356475.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f054336d-a3c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675432323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432323, "uuid": "183b29b1-c063-4963-9427-191439957ef8", "comment": "Malware payload (RedLineStealer)", "value": "51cf11131f7f1c0d44ddd34d2c7c537f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432323, "uuid": "c4ed49db-0ea3-4b8c-9a70-72244bf18824", "comment": "Malware payload (RedLineStealer)", "value": "ab2855972bd15807b4622643931f43a7217a38a1e81fb858ed22e7d1a5a3bbe2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432323, "uuid": "357ef188-5b4e-43fa-81a2-6b3092e710aa", "comment": "Malware payload (RedLineStealer)", "value": "d50261f98da4009be430fb0dc71d91fbe914ce77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432323, "uuid": "b8ae4b29-999a-41e8-8f35-9508ef41f83b", "comment": "Malware payload (RedLineStealer)", "value": "08f5fa6426bd88d65095707c067274066825259ab281135b2aab097e505c1b049f6411a3b717a4b26f57589965317425", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432323, "uuid": "912359db-18ed-4e9f-8a3a-16a63909afeb", "value": "T1FBB412323590C476C1A7A9708890CB392BBD7430A437D55BF7BD02BA1FA2BD196F9607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432323, "uuid": "8ff0cbd9-d3c1-45c8-a8ed-59a02ed74946", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432323, "uuid": "4392cd1a-a59e-4c8c-a159-4196140715f8", "value": "12288:meZkdEv+mIkPnC8Efy5YAJUR3oBY+hQtPU:mfG+mIYTEfEJlCtPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675432323, "uuid": "419ed2b0-58eb-4db4-888e-8859488f5a4f", "value": 523776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675432323, "uuid": "5c265e3d-4b43-42e8-b3a6-1243d5d7ac9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432323, "uuid": "b5219f24-2663-408c-ba9d-5508ce0a32d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef7ec4e-a3e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675444669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675444669, "uuid": "8e26d3e5-2906-4ced-924a-fec50afcc69b", "comment": "Malware payload (Formbook)", "value": "e55a4c63dee272cff7945563b57d5757", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675444669, "uuid": "602f4aa6-f5ad-4f5a-a12c-147e86a2678c", "comment": "Malware payload (Formbook)", "value": "abd3046792867222fded030b98f31825475714b16ba00f1aa19f2943ca99cf76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675444669, "uuid": "b7cc6036-5876-4631-8086-29a73851ba6e", "comment": "Malware payload (Formbook)", "value": "86d1d332a5f8f9cd77cd232bb4d900ee4af1073b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675444669, "uuid": "77481a30-504f-44c2-99c8-94a3d30f9b80", "comment": "Malware payload (Formbook)", "value": "45aed53f0f8d3b3ba895fda984dda0492f0938a715d6e013836c98a0f59457753494ed60daef8b610ac9e2857209f568", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675444669, "uuid": "688b2aa2-b5e8-42ab-a229-5e881df2fad9", "value": "T12D254980B7B04461F89A06B41038FAA81A3E3C5766F5D12E1AFE3D9377736B7E154E12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675444669, "uuid": "157b9fb4-d3bc-404f-bc47-7d09b48f6304", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675444669, "uuid": "b53180b4-1dc0-4eed-8b23-70b1a3fcbfa1", "value": "24576:reAa1r8nkHavgOyc3eWINpffGN88GVonXIw6Rrc4N34/1q:r61r80avgOyc3eHNpXM8loqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675444669, "uuid": "a8c2e59b-94ec-4744-8db7-7a92dcf0d724", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675444669, "uuid": "f55e723f-e19c-427a-a0ae-68925a1d5bd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675444669, "uuid": "a4c82b65-a629-416a-bb23-1c395daa84fc", "value": "FOB Shenzhen price for its MOQ.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf887c9f-a38f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675407330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407330, "uuid": "457d01ca-d3aa-4ba4-9760-dfb5782216eb", "comment": "Malware payload (AgentTesla)", "value": "5acaa24c5a115003f5833bbb9b175d61", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407330, "uuid": "da1db562-bea9-48ae-9e5a-83f808542706", "comment": "Malware payload (AgentTesla)", "value": "ac3bb4fb231f894a3b028a696211dd9ec91718ae8a677e328077beca1ca0baf9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407330, "uuid": "a6fe6a37-1981-4511-b294-051e76d436d8", "comment": "Malware payload (AgentTesla)", "value": "72094cc184a5dc1b96594e2e66a9c09f6d7b997d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407330, "uuid": "8f469dbd-eb4b-447c-ad5f-eb40f68923fb", "comment": "Malware payload (AgentTesla)", "value": "90f083c3e056ade124ad510bce9b336367d31b1ab7d4b7dbb3f58e977305df095b9e60ce815aa1988b110ede70b9173c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407330, "uuid": "e372bbe6-264f-4d04-a935-ae2fcfd0a700", "value": "T11DF23C1AE79F02A48F911273171B0A89A6BDB73EB3505571746C933433EDC3D4266ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407330, "uuid": "a6faa846-97fd-4677-aead-4121430d6f3f", "value": "768:NFx0XaIsnPRIa4fwJMwjWaY20rnJRwBT/oZ+B6E1J:Nf0Xvx3EMwC5t1E0+B62J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675407330, "uuid": "9fd166ad-1b16-4304-a542-bc00fbc1636f", "value": 34379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675407330, "uuid": "2b4e99f8-2948-443c-93dd-e50d801a6359", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407330, "uuid": "c8206f40-98d0-4ece-bbf4-e2e614363946", "value": "20230202.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021b4676-a3da-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675439225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439225, "uuid": "3a7c0d7f-df6b-477b-a468-e210903b1b03", "comment": "Malware payload (GCleaner)", "value": "afbc790deb20b25e7a59cc71a70d6d6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439225, "uuid": "ce2116c9-f269-419c-ac71-fed9573d5b94", "comment": "Malware payload (GCleaner)", "value": "ac461fd18ed3d8bad461b6a255dac25d4d2311844d4105ef6a00939b6ca1122e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439225, "uuid": "8ef3ba43-db32-4223-ad3c-78e52b68865e", "comment": "Malware payload (GCleaner)", "value": "de0878f1f1d63002a62dcd1cc72332eff8328935", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439225, "uuid": "004be1af-3678-491c-8113-3463bf785adc", "comment": "Malware payload (GCleaner)", "value": "a7b53467c484db9f6b646c23f8b3da0a9803c0dbf4bcfabd75a73beaadff4ebf8ee430e22445494ef44f441a173d93f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439225, "uuid": "68dafc00-d881-49bf-9f26-edc0038811b0", "value": "T1CE95334FE779C27BD2D2DB78C531190769BEBA3125311B88376C7D0B2E66248650F3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439225, "uuid": "65e909b9-e04e-4801-bc5d-9db2ac2b8ec6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439225, "uuid": "d0e2e10b-9976-4a5d-ade9-9ac727f48d3e", "value": "49152:ygCO/hVZ0RFoYEd1GskJ2P1ncTLJzZqBdZNCOfkyLCgv2MR:TC8hYRFoDGJ2tcTd2jLcav2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675439225, "uuid": "b8052699-b74c-4039-a96c-6394d251d4e0", "value": 2030923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675439225, "uuid": "3657145f-53f2-4136-8313-e683115e96ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439225, "uuid": "a83e9fcb-051d-48f7-9f82-6f936ffd5b10", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d1b339-a3be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675427532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427532, "uuid": "f9cac018-d2e5-4c24-99d3-d77294223161", "comment": "Malware payload (Smoke Loader)", "value": "8b7fb31f5919634b6cf2db391003b97b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427532, "uuid": "ffe7fc4a-a2f3-41dc-907d-11ad4a823a67", "comment": "Malware payload (Smoke Loader)", "value": "ac80f4eca2002eddeb247e6ba179da8adbb7df3be93ea2f19bc46e11d00390ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427532, "uuid": "5402a45f-4ad1-464c-98cb-1e501ae37efa", "comment": "Malware payload (Smoke Loader)", "value": "76f98e3864e6b708f3df2a4b8c0cc5d4906b5820", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427532, "uuid": "53f936d3-67dc-4c91-9165-ed83e412303b", "comment": "Malware payload (Smoke Loader)", "value": "2d5594ed0c846d41bebc9315ff6c5b56140a199c791cd7597383cdfc07c024d87e45c2f83902f3c51c7b3b6b03ac7174", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427532, "uuid": "27763ce5-15fe-4611-839e-441ee31ef23d", "value": "T19614DF3239D0C073C1BB15305C60DAA9AB7EB4314779865BBB6887BD1F317D06A3639A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427532, "uuid": "6703caad-68e5-4f41-a921-f5088459ebc8", "value": "6b1aa8e68ec0f35426270b76446d282c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427532, "uuid": "6240729c-700e-4c7a-8e0c-d78ad279f99d", "value": "3072:rabzmSnDxDLzTjeMqDWJlp5Isgbu5LDIsg1HQos60ffY1Fcavj:ra+SDLPjePDxvO6r1Fcav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675427532, "uuid": "7194141d-94ff-46ef-b743-b0c3d6c9a2a4", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675427532, "uuid": "809a1d6e-e901-4d5d-8d93-01f42c6745ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427532, "uuid": "5ce9091c-a07a-47a2-a777-35a0b0d7c061", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d523378b-a408-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675459336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675459336, "uuid": "0e2bbf8e-d705-4427-8aa9-996adb280381", "comment": "Malware payload", "value": "3b65d06edafd3a569055c9d85502d19a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675459336, "uuid": "c637e37f-b643-491d-9ed9-aa75a59ecd6c", "comment": "Malware payload", "value": "ac9d563c6e52413c83b931ccbc1715b743965a983bc4e89f260519e224000bfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675459336, "uuid": "8a8410f7-de14-4996-a81e-4c60422a9686", "comment": "Malware payload", "value": "6d1a36dfb97865d24d3421bffaa88f1cfa1c1c2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675459336, "uuid": "4928e869-c459-4be3-941f-9945b1ff7354", "comment": "Malware payload", "value": "6894bf1d8a832a57d9a4ef05ccb3e49c0105e4453159ca8497e872a3ff25220b1a67aab9541c0ec9f5c869f86b7cbae8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675459336, "uuid": "ecb0ab3a-cf7d-411c-9518-ab3bf4dac236", "value": "T159F501736348CC78C9557C34C39AAEF297576C74EEDC072B3385BE0A3932A856D62849", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675459336, "uuid": "0f6c5444-c191-45fc-ae29-165ea5fb66b1", "value": "5e2e334cecee9b450f48fa99ae5ef401", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675459336, "uuid": "dd116708-cbe1-461c-a380-f72958fcb6c7", "value": "49152:D7wdfIY9+onw4bxa0AAO3Z8YiOBDnXgBP8Y4aKzLx8egVoWPo0QuY1Aj4yI9MDx:Ds1IY9+kbd4D6qaI8Zo0Q7CjiGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675459336, "uuid": "960eec95-e7fb-4d11-a8f6-007e7c0d419b", "value": 3529392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675459336, "uuid": "a3a54808-7dae-47b9-a865-f8bcedf0ae6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675459336, "uuid": "316b2316-9d2d-4850-bb23-cf72cf59bb8b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20bedb34-a391-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675407923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407923, "uuid": "2d828eac-643e-4dd3-95b8-709f8782236c", "comment": "Malware payload (DCRat)", "value": "408a1bd349271d1acf8b3a1b6d072c72", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407923, "uuid": "69332b5e-394c-4b29-9f01-8aaa59891cfd", "comment": "Malware payload (DCRat)", "value": "acabb7c4bd038dd75dbebaf4a0ad4cc0332dba080394d485f4071c31f8f1469a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407923, "uuid": "a22f235a-e08d-448b-b778-fa794d4857ff", "comment": "Malware payload (DCRat)", "value": "4a22af6864e17264779f572f7c2ce635cdd7f672", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407923, "uuid": "159c0f28-4925-41f5-a10e-df4d3d1fb556", "comment": "Malware payload (DCRat)", "value": "c4fc28c516eeb399cc1412ab371f966b3305d1ffa7332b466129fc91be0a31cc4ba47688aa8d8026e960465407cc4659", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407923, "uuid": "7b42bc8c-0c51-4913-bb11-ef51da717a1f", "value": "T126557C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407923, "uuid": "36a00bf9-c290-4649-bc99-2133be2c0fda", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407923, "uuid": "3179148b-a265-49c0-8d03-0a27f6f2018c", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675407923, "uuid": "cb4f686c-f325-4e8b-9385-ee2fa6637cd4", "value": 1408447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675407923, "uuid": "f0f457bc-7ea1-4369-8d0d-a00e615e1c22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407923, "uuid": "5758f854-d6ba-4b1b-9343-e92f9224e98f", "value": "408a1bd349271d1acf8b3a1b6d072c72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8ffd7b-a392-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675408672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675408672, "uuid": "7852c20a-d7c4-4507-be21-dfdb12cd101b", "comment": "Malware payload (RedLineStealer)", "value": "cd7ee7a99ca42119744b7412d0488fa9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675408672, "uuid": "b2885afc-7dce-42f9-9102-2b1d2379acb8", "comment": "Malware payload (RedLineStealer)", "value": "ad322d1fada253d07e90d48b5c9e7ed6a0fcd12bcc2648df015464da59e66ef0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675408672, "uuid": "edd7195f-1eab-4033-a587-0918f0f5f69d", "comment": "Malware payload (RedLineStealer)", "value": "734f91a23a1589d19deb6910607145f158f8f478", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675408672, "uuid": "a5c2146c-72b3-4e7c-8444-5dde0537dec4", "comment": "Malware payload (RedLineStealer)", "value": "ad4a3a10bf485ddfadcfd54ad3d9061703eb7633e38dc05a4c2ab5020906694ceb34d0269fe7675b423771aa47d145df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675408672, "uuid": "a411f278-0da9-4656-9cd4-32a4dbae5dac", "value": "T1AB5533368B25ADBDE3ADCB7001EE90BF4587E310F7016447F063D4BA6856DC3AAC9994", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675408672, "uuid": "7f0a7f37-aa64-4bbb-a108-90555e662331", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675408672, "uuid": "75ab6c19-5402-4d30-a989-8f2561ba0032", "value": "24576:egG1BJHjCU9WxVR364yaBb5HlS4ZJZduLUxOdzUqeO1Gh2d36GMJ:dG1v9oX1dyc7JZdu2OaedBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675408672, "uuid": "da46a02a-00cf-4580-93a8-4b437d6cc0c4", "value": 1298944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675408672, "uuid": "ee560241-610f-4738-a7b0-b9c029b671c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675408672, "uuid": "45b3e510-e760-421b-8f93-ddaa92783507", "value": "cd7ee7a99ca42119744b7412d0488fa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a9c575-a3f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675452632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452632, "uuid": "d6afe2f8-183b-4130-8754-4787823b9808", "comment": "Malware payload (PureCrypter)", "value": "e57521f3e773d3c5ad50b9030ea186c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452632, "uuid": "8ac0ae11-d860-48ca-b8f7-8016a4fe6ab1", "comment": "Malware payload (PureCrypter)", "value": "ad8cf8c639b31a53b4a9f86f944dfd143c4b622e8d9d103f3efc58d788bd4f27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452632, "uuid": "ec4d235f-cb34-4abf-aa65-8be477336634", "comment": "Malware payload (PureCrypter)", "value": "47671c547d1f7a1a3f1eb4a0245497f70c0db61f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452632, "uuid": "b1cb3f87-7d64-435c-940e-185d8b76d8bc", "comment": "Malware payload (PureCrypter)", "value": "6462335845261d273c1b3925c12cb5ea26a20aed816062ed17ac007fa5c8d76a3f545fab4945744748a4517e6e7d7431", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452632, "uuid": "6fb9aef0-f48e-4cd9-8e5d-c27397600ab2", "value": "T1B916E125229C91C9D17AD03DC9864AABE7B57C429324D7CB05A0BDA93F336F56E3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452632, "uuid": "e3de858d-9ff7-4c52-9fcb-5a63e8b73f9a", "value": "73f4f6b0816ebeb37e57311ea1622caa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452632, "uuid": "35c53cd7-c90d-4093-9577-f4c547772c72", "value": "49152:Vv08Ro21Buk5/xgX1s2eXF4lzFUJD+StpClQXAFo4658AgN8:teO4I/xy3Ks6JD+oule68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452632, "uuid": "8509e18d-633b-46b0-b8fd-677261118acd", "value": 4083101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452632, "uuid": "0bd9e68b-f702-433e-8bdb-23ad8141aa09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452632, "uuid": "168f9fc0-e8e3-4703-8ab6-99953e1f97cc", "value": "e57521f3e773d3c5ad50b9030ea186c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8dd5ab-a365-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675389337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675389337, "uuid": "0847b2f8-050c-42b8-b83f-358c6483d955", "comment": "Malware payload (DCRat)", "value": "b3b13de8c0861f6780fadb3455717007", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675389337, "uuid": "391ebf62-a0d6-4b4e-a13a-531eddc97935", "comment": "Malware payload (DCRat)", "value": "ae2510c657fa4f60d9b4e5ee021b4c544920b2c6cfa498704f8e0099543b46cd", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675389337, "uuid": "de6f6b1a-8e52-4b60-abe4-b431c3855392", "comment": "Malware payload (DCRat)", "value": "c5b8c536354ba11978c8715d8a08a73d7663ed36", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675389337, "uuid": "9ddff814-95fd-42a7-926a-47e5319044a2", "comment": "Malware payload (DCRat)", "value": "ef9924a254c2c659e55891e11a620b3af1d81e2f6cb96c74ee24c18b8930376beb2a918431923da23e3b19bd3d6dc28d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675389337, "uuid": "2f07bcdf-2185-4422-a0f6-cf6c6aa6a363", "value": "T13F16F1417E44CA52F0181633D2EF49884BB4A9517AA6E32B7DBE376D15223973C0DBCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675389337, "uuid": "19b41478-b421-42f7-9485-b9571ef60a0f", "value": "069407361307fa34b23ade96ab2d8363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675389337, "uuid": "879760f8-02b6-46f8-8604-692a865422a4", "value": "98304:mEfURaSLOoBP+2E3N+SorQzjXaDWRTbE865n39YDCkw:mEfUrqokBRfXaDWR/65n5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675389337, "uuid": "41d62976-5c00-4691-9ab4-e39bacd8f694", "value": 4090027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675389337, "uuid": "a56cdcb3-44cf-4be5-a8ee-94a572f518c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675389337, "uuid": "70273e87-1996-4e61-bdfa-d3688047634a", "value": "b3b13de8c0861f6780fadb3455717007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a280471b-a38d-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675406423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675406423, "uuid": "2a2d9a9e-2906-4e63-8e85-d0177ef0d807", "comment": "Malware payload (DCRat)", "value": "2827416d93e2a7e3dadcb3e1dc769596", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675406423, "uuid": "790f489e-3f4e-4a80-a460-a778e165ff0b", "comment": "Malware payload (DCRat)", "value": "ae9e9907092ac66c4bdb0c244eb015f381662fe23d8bf42c45e669c5c4ae3666", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675406423, "uuid": "1595c09a-d827-4147-9b3a-c0eacd3d12bf", "comment": "Malware payload (DCRat)", "value": "10c9f163fd161953ceea50922050824378edf306", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675406423, "uuid": "8ea0efcd-7f8f-4c62-8d1f-862595d55e9a", "comment": "Malware payload (DCRat)", "value": "7f5c2cb05e1e131d271fb078daa09a10087a4896678889649876a8416501360c81b64d99da0b4981365eea112b8245d2", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675406423, "uuid": "d0653567-962e-4629-af66-37f789c3c735", "value": "T125657C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675406423, "uuid": "09f14aa0-065c-4dbd-9358-3e3eafaa304f", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675406423, "uuid": "82440e05-e2a9-4fb8-b73f-00aae81eeea8", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675406423, "uuid": "793a6841-80f8-4622-b7d4-037e8ccdc988", "value": 1410155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675406423, "uuid": "0a2dde40-754d-4d54-a85c-2b30f2efe794", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675406423, "uuid": "834328de-bc54-446d-9d0a-4ac2bd1c08a5", "value": "2827416d93e2a7e3dadcb3e1dc769596.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96e8b5a-a3bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675427184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427184, "uuid": "939e4426-b9c6-4f93-a371-05f09d8c4840", "comment": "Malware payload (RemcosRAT)", "value": "a2ed6ebe9a320464660946cd8b712a4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427184, "uuid": "38a81a71-6eb7-4a30-a23c-fc8ecb6b18e7", "comment": "Malware payload (RemcosRAT)", "value": "aecb74252f3ae4e3d912c1983de70c06ac29c69b287b31e45d29fbee0ccb5772", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427184, "uuid": "dccfbd11-bd28-4bfe-9f68-7125c28ec9bc", "comment": "Malware payload (RemcosRAT)", "value": "b82fd7fc19665c17bef8f198b35cc867b990b322", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427184, "uuid": "d5589005-9382-4821-9fae-ef48f41d7ebb", "comment": "Malware payload (RemcosRAT)", "value": "c4f240753f2d26cfa0b7c82b1cbac8f0231ce73edc7c79720d74c2e8fd429c24bcd82258582c4d30829e3d1b2823dd63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427184, "uuid": "e9109bf2-1f87-44f3-bf95-22f108594f92", "value": "T15F35BFA337B095B2F78720B10438BA885BF07503BE56E2979BB737C46785DB77298142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427184, "uuid": "2d7afc4d-1023-4bd3-b992-3943b1f015a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427184, "uuid": "eff128cd-ef3d-47bc-b65d-04beb34beaa3", "value": "24576:seSqG4yPahfXlKdDxt3rJb8tyxD99PihBT0EKlV6F0xM:LRfXQdDxxeEK7YNyWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675427184, "uuid": "d18dd7d5-5d1b-4f99-8494-d9b0ae45154b", "value": 1149952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675427184, "uuid": "cc131767-4406-431f-a3f2-32f7a3d71341", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427184, "uuid": "6ba44417-a350-4344-9c6d-7e0311d20f23", "value": "PO 001, 002, 003,.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3a51d5-a3b5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1675423434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423434, "uuid": "99362717-9af7-438a-80fc-3b8064419128", "comment": "Malware payload (Chaos)", "value": "e471def94fe9426c09ab28be21e78254", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423434, "uuid": "c61e7326-c7d7-4580-aa3a-013bfc57b1c5", "comment": "Malware payload (Chaos)", "value": "aee45cc2540d49a28e765c30f1c4d0b853c1a74ea2260bd7614ece8e54c3bcb3", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423434, "uuid": "41c47e61-c663-46e9-8d51-cf87e6479c7d", "comment": "Malware payload (Chaos)", "value": "7b92a06775650264543768ab7ed9f4efea176e27", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423434, "uuid": "992c91f9-a8e0-439e-983f-36e172c24428", "comment": "Malware payload (Chaos)", "value": "6ba9825eba306d2cc4612fb32ead0a4c6d7dbc5c04d67d76be34fefc6bee02b9a3837d2952483e0053d9d8097c26d179", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423434, "uuid": "3b6164e1-3f9a-4727-b6a9-a63ae9bd9c45", "value": "T138D3E50567B6592CFEBA5E382972515D8336BF52DF28920C1B997C4F3832FF88811762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423434, "uuid": "10207873-2e39-47d7-b1b1-db7167c2a36b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423434, "uuid": "88d69c35-e874-4ae5-aee6-703af6c27879", "value": "768:qtqo2nkhhWzpacgyr9GknSeixPegFH4MkaL5PEs:qIo2qhvcgyr9Gk/ixFH4QL5cs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675423434, "uuid": "70fcb24e-0b89-4d51-90a4-53b15ff7197c", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675423434, "uuid": "6e268402-1f8a-41b2-821b-095c4ee5c5ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423434, "uuid": "dd94f753-331c-4da2-8d3c-c7337398db5e", "value": "2023-02-03_e471def94fe9426c09ab28be21e78254_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05ccfbe-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675454174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454174, "uuid": "eab776e6-e0b2-4d53-92c0-beb694d05ba0", "comment": "Malware payload (RedLineStealer)", "value": "6150810b4e431d83eee91e479ca2d066", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454174, "uuid": "843e4b5b-193d-4af2-a2a3-579c0ba61c4b", "comment": "Malware payload (RedLineStealer)", "value": "af7d617cb4151d5e372d775b98fa96038cd317d1bf73bee6481987bdaf0aa1fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454174, "uuid": "23760124-e8c0-4982-b91d-5bd29085323e", "comment": "Malware payload (RedLineStealer)", "value": "743a3c7a2807a5df285bae8fa8151e6c182945dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454174, "uuid": "44aa65dd-75cf-45d3-952c-f9d90aff2b29", "comment": "Malware payload (RedLineStealer)", "value": "451d90fbdcf06d370c93dd006eb42a19da105ff0e5709b64a066819481e6219b56a55c8a8350f2e4d44b5531992f4481", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454174, "uuid": "9bb9f48d-2056-4fc5-890f-c4820762f039", "value": "T1C574F152E7E84073DDF51BB42CFA03931A36BCB05DB4826A2791A99D4DB3684683173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454174, "uuid": "506c89b9-a0b4-413f-bb7b-5c632eb96a1f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454174, "uuid": "3e07977a-8d87-4141-a29b-b315cc31a54e", "value": "6144:4hEN7+Lp0yN90QEyh7FDDiLg3bhhQrD8kUgLzx1lXcV3mixJyJj2LM:4G7/y90sVVWLche/mGtmWiO5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675454174, "uuid": "98dbfbf4-cad7-4bc5-b1a5-fa180bf5637f", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675454174, "uuid": "082cafd2-52b9-44e6-8dde-7a50fa1b11dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454174, "uuid": "e49be7ee-3ba2-46aa-a267-6363c489849f", "value": "6150810b4e431d83eee91e479ca2d066.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee6d861-a3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675442333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442333, "uuid": "a8e6235b-f7ce-475f-be8d-7dbf5c172059", "comment": "Malware payload (PureCrypter)", "value": "28d54c2eca152e4b9724f8c1f4a4ac81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442333, "uuid": "8ef03125-8219-4aae-bba2-459cf8c98aef", "comment": "Malware payload (PureCrypter)", "value": "afbc5769749789d5023b455a1d6c185bbbfb657434df2da87512eae401027d2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442333, "uuid": "f40ead1c-6916-43a4-b96b-1436179cdc16", "comment": "Malware payload (PureCrypter)", "value": "b4b85d4f33d09d290e68760343cf819a1b88769b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442333, "uuid": "e9059ef5-2746-44a0-a9ae-84485469d952", "comment": "Malware payload (PureCrypter)", "value": "1131a352f9befda6db330abf0bb83f9ac89e238f17305b74460700f0a297588881708b827e6d936a1cd6a06a95557306", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442333, "uuid": "fae63634-963c-49a8-8a7a-033603b7541c", "value": "T1CE553334C5C6CEA225E6EB1ED9387FE585CF5C3E6A7D390090B8FDA9948A4D13DE5800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442333, "uuid": "7e57844f-c40b-44a2-9e80-d9d89852c97c", "value": "24576:tB8BmbZcfSA0hs6ZpJxg1nhytyhf4BNMhOa59bLMF6YKHQi8cUyRZzoIlgKI0Nf:38BLfOVZJsnhytyh2yhOarMF6jXRJgKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442333, "uuid": "4d1b0ac3-9aec-4f01-a900-87930894d8d0", "value": 1297070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442333, "uuid": "0dc8a80c-15c7-4a43-833e-d6c2c1683d41", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442333, "uuid": "e7e40ae3-8580-4c99-be44-2b1a62496cc4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f28a0b3-a3cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (DDoS.TF)", "timestamp": 1675433368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433368, "uuid": "02f539bb-328d-4273-a89c-58a3b42c59cf", "comment": "Malware payload (DDoS.TF)", "value": "2b26042b91b316ac627c937856d8b4fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DDoS.TF", "colour": "#278C8C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433368, "uuid": "1a5cc1ee-815a-4bb9-a68d-3c10a007914f", "comment": "Malware payload (DDoS.TF)", "value": "b16935619829aee2c245cead7a71b59dbe9b7992c313d71c558049fd48833e4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DDoS.TF", "colour": "#278C8C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433368, "uuid": "501a0c83-9999-45c3-955a-6706e540d3ad", "comment": "Malware payload (DDoS.TF)", "value": "815325a46b8d87ed0e3bb21cc84fff36f6346fd4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DDoS.TF", "colour": "#278C8C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433368, "uuid": "29ea069c-cd3c-41d6-84e8-e11a4bc5ff32", "comment": "Malware payload (DDoS.TF)", "value": "bd02cb4ea6d5adbae50f279070695818f51cbf0a29c12488b09a466012833d216008b93c0a438617509561285f950872", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DDoS.TF", "colour": "#278C8C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433368, "uuid": "52eaec9f-1579-4e79-b259-c33d2f07fb55", "value": "T1C3359F9AE746D9E2E1A30576029FC7F60231D1360103D6F7EB48FAB87862B157F07266", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433368, "uuid": "6661c9a8-511d-42ef-9f95-dc2179a2e46e", "value": "24576:RsqZhvnhHXuhshNjm3Bp6gDgR16lwzBWa4wwS49TrHg29XE/PCroyUkNR9:PhvnhHXuhshNjK8AlGWaoXroyUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675433368, "uuid": "373cdec1-6d67-41e2-9cf4-8de0caddbb8c", "value": 1058408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675433368, "uuid": "12b9a330-b4ca-462a-813c-ce0dbef0662f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433368, "uuid": "03f2401c-5500-40ea-ab1e-5edb7aa1f43a", "value": "2b26042b91b316ac627c937856d8b4fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ac6885-a39c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675413010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413010, "uuid": "028707d1-4471-4d5b-b681-3e472df0820b", "comment": "Malware payload (GCleaner)", "value": "f5e8af47700912856b5970c49a86c26d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413010, "uuid": "a0bc3a35-10ec-4b01-ae06-1614558b7c41", "comment": "Malware payload (GCleaner)", "value": "b169b7fcce041b90cb29ac6e08e95f67b52f3cf65e7940f32cfda5fcd2ecaafc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413010, "uuid": "5a4a27ff-4101-441d-94dd-37dd36f067c0", "comment": "Malware payload (GCleaner)", "value": "bfae6656b23bb63f2fa59adfe55bbebd54393c64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413010, "uuid": "fc060609-477c-447b-aac9-99509dc51afb", "comment": "Malware payload (GCleaner)", "value": "c3b2e6360eb87ea7e555bdb9915b2b0ed8f3ee649dc634e3a6ca4a5cf271030e07c9cf39ceddf5b4e1dbf2f7d6146394", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413010, "uuid": "ec6cbf0d-37c2-4833-b3eb-dcfbdf4ab6d3", "value": "T1FAA53356D5B75A73E120A634B7255342D0B37BF72CBC9640310E79483B62BB1E09EB3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413010, "uuid": "a520a4d6-0756-4a1b-bbdf-3eb28b5b95f8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413010, "uuid": "fc5bb263-032b-4e3d-b000-0b1a5c9fb39d", "value": "49152:yg4KKPRoiiK5wtA0OsgJ1EUXzt1HpPRzuy78jF+uxgl+4WLCgv2MR:T/KPRoiTqtgJ15zthWy4jLgdGv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675413010, "uuid": "33c41c59-8251-4aca-a47f-c33a1a4fdad8", "value": 2084332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675413010, "uuid": "27e02aa3-d0be-4425-8000-4d53d688f8a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413010, "uuid": "bb9f22ee-b5d4-4f04-9772-12a6002d966e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5936297-a375-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675396200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396200, "uuid": "597ad686-5413-48a0-a255-b2c030f14b19", "comment": "Malware payload (RedLineStealer)", "value": "cbb049cf29d595d8f53fdc2998e08daa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396200, "uuid": "f40c63f8-09aa-4aea-94b1-37795e6934de", "comment": "Malware payload (RedLineStealer)", "value": "b1e4d72e54e778a132ec963b38ade6911e59564cdb86f860b35105445cba0587", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396200, "uuid": "4a043e57-cc32-46d0-9a9d-040ad4ffa276", "comment": "Malware payload (RedLineStealer)", "value": "d6ac44023ef0389d510bd5ea9661fc598fd9a416", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396200, "uuid": "6850947e-a7d6-4f48-aa9e-88735f44bef8", "comment": "Malware payload (RedLineStealer)", "value": "49dd6e6c6b8393cec75c9f4dea31e02df28f36b3520ac57f03a56b72bbf152bc6d12dc758a16ca109a4ab408aad91b0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396200, "uuid": "510f2f35-954a-476d-b1bd-916c0de19604", "value": "T197D4E14262D2FC41DA25C7728E2EE7F43AADF9904E286F6662189F7F1571073C6A3314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396200, "uuid": "eef67ab5-6013-43d2-a81e-a91131200278", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396200, "uuid": "3726d8c5-fd9e-47bf-85be-266349ef6755", "value": "12288:8N6BEfuUay0l2eAE0KKNIPHeCR7PxnupWEnbrk57/rnu6oKsY7ezt:oDJayiAYK6W+pnTEnPQbtV37ezt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675396200, "uuid": "dbc985c8-f86a-4ab1-a437-b0173bb79aee", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675396200, "uuid": "f5163e03-fece-4d76-99fe-4d1c7b690ee3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396200, "uuid": "f2d9fd61-2b4e-4b83-ab69-bd9b1aabfae4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46722e0-a3e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675442987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442987, "uuid": "4726478b-5e9d-4c19-a520-282bbdd2c08e", "comment": "Malware payload (AgentTesla)", "value": "b4f735e0ca393fb81079dae67366322e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442987, "uuid": "7dfb7818-d998-474f-90e3-474a6408b807", "comment": "Malware payload (AgentTesla)", "value": "b20b9c9e9c7f56cb42dbe69bd6ee2ebc6b0a883594e61e9f03ca55d557332a03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442987, "uuid": "99495bf1-2964-4dcb-b727-f75ff7b6333e", "comment": "Malware payload (AgentTesla)", "value": "7490690e9d2a2e0ad3fb7b1623760ad1447cb4b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442987, "uuid": "86ac7dc0-ada2-4ce9-af0a-00c0b3f42e50", "comment": "Malware payload (AgentTesla)", "value": "5516e09ed3d8b3c70ba5a57060f92538fcfdda9508c9562ad5e01b966dfb54bcc0728371a7a4bf28e5901506d987ca3d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442987, "uuid": "10f85bb4-ac2b-4c26-bce6-516cf94ded38", "value": "T119058E6337B199B2F78721B204247B985BF07503BE16E2938BBB37C06785DB77298152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442987, "uuid": "8178778f-26f4-4903-ad5e-47f8b79081d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442987, "uuid": "74f574df-5eef-4a1b-85b1-da3b547c40c3", "value": "12288:ChefaqG4yPaYcvz8hg8IJkbtXM5wmoCfX9b1Y6Fy2Mxzo3:8eSqG4yPafg28XMy09y6F0xM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442987, "uuid": "5fd3a02f-ad60-41a0-af99-418eeecc0095", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442987, "uuid": "c8972b4e-1890-4a04-a661-1dfc95fa0182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442987, "uuid": "cc468995-7919-4e6c-9a87-549c1b7055f7", "value": "\u03a0\u03b1\u03c1\u03b1\u03b3\u03b3\u03b5\u03bb\u03b9\u0301\u03b1 0843.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843f8de9-a3f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675451898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451898, "uuid": "e29a850e-1b25-41b8-99ae-b88da3db6b44", "comment": "Malware payload (SnakeKeylogger)", "value": "7ebbb7ce1d4d11b8a7b77e23b52a1d29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451898, "uuid": "2e9f1e7b-d5af-4612-850c-423e71abd602", "comment": "Malware payload (SnakeKeylogger)", "value": "b2bb771a614c21fc44edd716d4c194efae9f63a63458ccc9b1554fee712acf2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451898, "uuid": "9af21dc4-5abe-4722-a236-98b5b15ab74c", "comment": "Malware payload (SnakeKeylogger)", "value": "36b645b0afd95c4650b32cbc2f11b35f6a38d7d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451898, "uuid": "729c71f9-7800-43e2-b74b-c0294e4d867e", "comment": "Malware payload (SnakeKeylogger)", "value": "7347cec35ba011026c35bbaf464ccacda40e040339b43fc1efb4349cdcd14cc8bcd16de7c871c6aa2cf30ede5f1c6457", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451898, "uuid": "760b28ea-8ce4-48d7-a64d-a2c959bec8ba", "value": "T1FF056C6337B199B3E78720B104287B8C5BF07513BE56E2939BB73BC06785DB67298142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451898, "uuid": "38a9fae3-a142-4a7c-9f6c-9e5a3852855d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451898, "uuid": "cf1f4a55-f42e-458d-a5ed-bfc59ee21884", "value": "24576:iJeSqG4yPab6F0xMqqt20j4ihjdEyqtBzwTLr:iCuWiqqYk4gX+Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675451898, "uuid": "a36cc984-08bb-4f86-bd34-f8fa85bc10d3", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675451898, "uuid": "30d2bdb4-ad84-4207-a2ad-86c4d70a943f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451898, "uuid": "c875408f-7086-4f76-9995-7976c7831212", "value": "7ebbb7ce1d4d11b8a7b77e23b52a1d29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06eced81-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675453836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453836, "uuid": "096a537a-9218-45ab-93c2-ea8e4f6d42f7", "comment": "Malware payload (Formbook)", "value": "977c08465156ce304148addf3ded1f95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453836, "uuid": "0ae11370-579e-4903-a863-498177b2c31a", "comment": "Malware payload (Formbook)", "value": "b3938532376b8d895ba266de98386155798e984764ea778c43a842a3124ccfde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453836, "uuid": "2570c808-215c-4e60-ae11-099a336da74a", "comment": "Malware payload (Formbook)", "value": "129c499bd4480a940c781c527b246bab9f5a5c8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453836, "uuid": "c8ee4b63-0e44-44b3-ae50-09ce72ee6dac", "comment": "Malware payload (Formbook)", "value": "c490966c70a3e91695c0ab857a3f681993488e46c27013ee645d702a991bcc9a1b7c4633699dd8220153e8fc3d010915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453836, "uuid": "a1bb181b-2191-448c-ae98-0c5e16b32ef2", "value": "T131058E6337B199B3F78720B204287A885BF17513BE16E2938BB737C06785DB77298152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453836, "uuid": "711b8c72-1519-486b-96d6-961ca0f846c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453836, "uuid": "c46ff6e2-8c22-4bb4-9488-76577ca8b496", "value": "12288:eNhefaqG4yPaLrDYEVz4gqBGfLoRD+QqfR91lq6Fy2Mxzo3:ebeSqG4yPaLrDY/ELo1KJlq6F0xM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675453836, "uuid": "dae80e3a-852d-4e1a-96d8-eac4b4e8d796", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675453836, "uuid": "3c4c071f-22c6-40d3-949c-18301fda867f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453836, "uuid": "b2ea8b93-5583-455e-b77e-885922450c69", "value": "977c08465156ce304148addf3ded1f95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d821f656-a3f8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675452469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452469, "uuid": "271f0e33-13d4-4ce4-9f56-3b654a7ea956", "comment": "Malware payload", "value": "4399815af56868f8cecbb0737fd42c3d", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452469, "uuid": "5d87ef71-c82a-41a0-a94f-be3c3ec900cd", "comment": "Malware payload", "value": "b3a8c4c505ea3dc87be0418e739e67f97ea0f64145d62da58402d6932f169a3d", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452469, "uuid": "ac1da80d-9b40-492f-8a05-5b6d4ffa8a0c", "comment": "Malware payload", "value": "fcac84d28a413455ec5d12ac04948bcf999d6e87", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452469, "uuid": "3923db56-ab5e-4c86-b41a-018f0798e629", "comment": "Malware payload", "value": "e0b2ff7c106623120e4ae630ef21943fe6160b778714a471f9a9dd86ec69d3c14838a6f7345b77a35b5c210235f6a7eb", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452469, "uuid": "5c573067-81e5-4974-983c-923b8d8b67fb", "value": "T1B3B48D036920EF8BE01983F8FFA35D981F47AF59A55179DB10127B8B3F71292285B21D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452469, "uuid": "a9a393c3-405c-42c2-96f3-e892aae9ab4f", "value": "12288:LYaFiKXKv02NM0ry+1z85p1WrxOLzPGYYcO:JLKcZyv85nExOfGgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452469, "uuid": "becd5885-2864-4a40-8b71-24910c3e0b3e", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452469, "uuid": "21a71e98-6adc-4e7c-9f52-998b3dac45ac", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452469, "uuid": "85ad9005-bf97-4820-a422-591d4e34a5cb", "value": "MV Oslo Eagle - ETG - Additional Freight Invoice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82c6cac-a3ba-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1675425840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425840, "uuid": "5a5bcedf-f845-48f3-82d6-267cc74627a2", "comment": "Malware payload (AveMariaRAT)", "value": "f572ae87c44905e75b14fa196de9932e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425840, "uuid": "437e3df9-b48d-46d5-aea1-a459a79aa3c6", "comment": "Malware payload (AveMariaRAT)", "value": "b3c339a0e13194b34de853362f3695d29d244a476d6b5beae254723e8798c868", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425840, "uuid": "015408f8-15c0-48a6-93ac-12788e1c37a0", "comment": "Malware payload (AveMariaRAT)", "value": "a8c9b264a990d19f91f5ef41af0c6e47a8af4670", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425840, "uuid": "0ea5d3c7-9bb3-49a1-8961-ecf47052e269", "comment": "Malware payload (AveMariaRAT)", "value": "b8097181a153de6da4a84a9e3afdf96627e06217bb18cb956fdb528134f19e2f3b6ca413f4f2b20da05dc21e63727e3c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425840, "uuid": "4412c9d6-904e-483f-9f1a-bc37cb866fb3", "value": "T12264D0E0F290D69BE8778572D9354AF126547CA6EADC2A0B32C43F0DB4B61416E1F363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425840, "uuid": "5163fdab-09be-4d8c-80e1-3d1c495ab5b1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425840, "uuid": "2954c53b-e409-409f-b536-2bccd93e2df6", "value": "6144:wYa6cmJFsRWNBjtieZhsrxkuiG3WJNsCENg7Jy/WrusO:wYXjtiersYGGJzN7EeruV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675425840, "uuid": "d66d4bb1-a3d9-471a-8e8f-d44eb7ea7f04", "value": 308889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675425840, "uuid": "acb8e2b9-fdcf-40e0-b9b4-07d64bb5a84a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425840, "uuid": "00d9ef11-b7c2-43ae-8c93-d523c5f2673a", "value": "b3c339a0e13194b34de853362f3695d29d244a476d6b5beae254723e8798c868", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6bbb47c-a3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675422885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422885, "uuid": "dde97c67-ef53-4511-a692-bb8848f8a0e1", "comment": "Malware payload (AsyncRAT)", "value": "b5a86443a6f683b275a06edb2ca79e86", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422885, "uuid": "3f387199-f4a9-478d-a811-8d6aca1f81c2", "comment": "Malware payload (AsyncRAT)", "value": "b3d1d312b9fb579640acad50a9591b7876c75e9dbf9df4d9f9a33575ed659173", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422885, "uuid": "dd54bd02-e359-45c3-819d-4a1002087a62", "comment": "Malware payload (AsyncRAT)", "value": "9b1bd0ef29dbc70879afd22d27f38abdad6cfb4e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422885, "uuid": "605a9275-5155-4fd9-8261-a92fed59cd29", "comment": "Malware payload (AsyncRAT)", "value": "c153fb5b1a9aa9b6b539b2cc11101ab677b63764603bfd2e2409aee1efaea2ed55ceaa38d5bea8d674ad5c0c2694f051", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422885, "uuid": "f0544caf-7bb6-4c1c-815b-876f3365a9b9", "value": "T11533F1587FF8FD6E42AD5FCAC11A9B4A528CB456536243F3AD9827080D327301DD4EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422885, "uuid": "097c6007-d24b-492d-a3dc-8fd7b2ce31fe", "value": "1536:PirsqeqGdIY/GlpGO7/gr7/WiNIdU8nT3vAmj:19qrnLgHp0UUT3Yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675422885, "uuid": "8f38a026-6d56-48da-a04d-563a901ca018", "value": 50730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675422885, "uuid": "e03771d3-1749-4602-8417-b1be8c5e45c9", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422885, "uuid": "33db2d49-df70-4573-909f-f41adc5569f1", "value": "Invoice.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056bb1a2-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675453833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453833, "uuid": "68dc7978-69f2-497d-8960-9dd19480b96f", "comment": "Malware payload (DCRat)", "value": "77d60690345aa72408380bd49b086c4b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453833, "uuid": "c4ac467c-e5a7-4d0e-8a53-f5d7e5fe6a71", "comment": "Malware payload (DCRat)", "value": "b4103834242cc164c004c18caec7f96b9e21cd32e976a4c19777fea6c9039758", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453833, "uuid": "9a09d800-8b52-4d2a-9410-8ce3a5e55585", "comment": "Malware payload (DCRat)", "value": "303df3ad7dcd16c92db3e9a6c219ba68ae3b578a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453833, "uuid": "0e6225bc-705e-4b09-8dc7-672008137955", "comment": "Malware payload (DCRat)", "value": "12674a94d51ac501a4771208d235d62c3ced27439c00181f12ba706f153155c9876ad749e73e7bbe966beb5de342e7cd", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453833, "uuid": "b59a99fc-893e-46ff-a5f6-b174d0ed9c0e", "value": "T1AE657C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453833, "uuid": "5aaae56b-cc8a-4495-9511-452a3741d43b", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453833, "uuid": "a95b264a-d895-4036-bf82-9768e139aa1b", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675453833, "uuid": "831233c3-eabc-4a0a-9bda-2d9a2ef5898c", "value": 1409485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675453833, "uuid": "fbee38a7-a044-460c-9df0-d5f7f3c7ce13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453833, "uuid": "4778a518-ea41-4acf-9028-8af53592ac21", "value": "77d60690345aa72408380bd49b086c4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7ff9c7-a3f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (XWorm)", "timestamp": 1675448723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448723, "uuid": "4584282d-851b-42e2-95fb-be19f157f32b", "comment": "Malware payload (XWorm)", "value": "bd5d0e34444ce843ceaf89e3d043689b", "object_relation": "md5", "Tag": [ { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448723, "uuid": "3cdf2e6b-b6e5-4372-a4b4-27476797da19", "comment": "Malware payload (XWorm)", "value": "b4dd3e93356329c076c0d2cd5ac30a806daf46006bdb81199355952e9d949424", "object_relation": "sha256", "Tag": [ { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448723, "uuid": "d36f0759-d8f7-4533-bbe1-866a309076de", "comment": "Malware payload (XWorm)", "value": "48ca53702e02f4e3e1c5a3af765909dd3496ccde", "object_relation": "sha1", "Tag": [ { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448723, "uuid": "a3abe876-5208-4b20-8a5d-f19f70612d43", "comment": "Malware payload (XWorm)", "value": "1c1981ba37bb4ba1ecf5efda87d8d71a3bfb610736c214b610c945507d8c5335ce0ee727652087bf090d7733189ce723", "object_relation": "sha3-384", "Tag": [ { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448723, "uuid": "51b43271-1391-4e32-bd5f-ace847d27a66", "value": "T183E51136CA31BCD4871C3700A7251CAF21A96557D3F74E28CB162CBA3D72B52EF65988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448723, "uuid": "fe429873-44fd-471f-8312-4e8ef9f0ca09", "value": "49152:zY1wOeTfeinwRg0Yd0YtWdR2++BqkPiblNmBZOqsHtL3rdyW6JKHINYMpnkq/3+k:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675448723, "uuid": "70ea30af-8be7-4c8c-ab69-f15f380e59a3", "value": 3145161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675448723, "uuid": "8841a44e-ed94-4872-8ead-5ad34fe88f8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448723, "uuid": "529605f6-df43-4347-8e3d-0319a7c69a6e", "value": "transfer.sh_get_44Y2u7_gh.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc3921b5-a3f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675451992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451992, "uuid": "10897773-d76e-4b40-a795-47d02fab1f75", "comment": "Malware payload (Smoke Loader)", "value": "0d7ab2dcc17796570efba7777005a384", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451992, "uuid": "34876a2f-1c2a-4e14-ad8a-8baa23ead8cc", "comment": "Malware payload (Smoke Loader)", "value": "b4e2ade8adbc6d1929061425d4e4ddcaa308b5a11df15816f93c95dfb0ce2a3d", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451992, "uuid": "41a31d4a-9105-40d7-98e9-f98b83c3f93a", "comment": "Malware payload (Smoke Loader)", "value": "11544fe61557896c15e852fd5e4009e0533240f3", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451992, "uuid": "42d75af3-c7e8-4617-8050-2dc76a511757", "comment": "Malware payload (Smoke Loader)", "value": "2b51bd93e6b64dbb4b6a8255e817612fcc9e9f5a6088ae8d666fde9a65afbd3a30941b5f2bc5851a93839ce3d00291af", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451992, "uuid": "4f5b0cf0-d344-46c0-90a5-fb41ab389ba0", "value": "T116648E02B290BC58ED328B72CF3EE7E4795FBD508E5967761314AA1F2C711A1CDA2325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451992, "uuid": "739f445e-c6cc-4dce-944b-4c50969c061d", "value": "64f2017133017378e6738b9a4be235bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451992, "uuid": "75ddb4ca-1079-4c46-b784-cc776b808ca0", "value": "6144:i0SSL7YOmtN+WqSWDRBE9/CJTk637eQfnd55LWB:i0SSnYroWt9CJb7d55L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675451992, "uuid": "4b3ad7b6-29e0-4f7f-89b8-052b186aa109", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675451992, "uuid": "29b2825b-9382-4c64-a66c-a93986f367b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451992, "uuid": "01a73cfb-c877-4202-b696-7fc695825144", "value": "0d7ab2dcc17796570efba7777005a384.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603af2f7-a388-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675404164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675404164, "uuid": "6703633f-10c4-4ed3-a7bc-8fa1ae0f2cdf", "comment": "Malware payload (Smoke Loader)", "value": "7c41e23869ad6d84d35d307829307bf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675404164, "uuid": "65dbfc25-8a43-489d-96bf-1eb339eba2b1", "comment": "Malware payload (Smoke Loader)", "value": "b4f4befdd084abed9e8cf34e64ed1fa1cdb6b3a6e5e27f5454ca37aa62b23946", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675404164, "uuid": "02ac1ea0-0e95-4a6f-94e7-7345a56e39e8", "comment": "Malware payload (Smoke Loader)", "value": "3bfab107523065b5b2014f964d5751584378e26b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675404164, "uuid": "0214e0b8-8271-4f07-b77c-696c6adda798", "comment": "Malware payload (Smoke Loader)", "value": "4fe6511d381ee3aa370202a0b4f220f8eefcc0c0381d9a92c3daeae7aa932ad706fd8ea2b7e164a9acf00fcdd63ff741", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675404164, "uuid": "57464b59-a091-4b3c-9993-de8df1173a4b", "value": "T12214DF323680D4B2C5B741709D20D3E16BBEB431C679994BB7A80BAE5F702D1673A35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675404164, "uuid": "743a7eaf-ff5c-40b9-b898-c6f69339b25e", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675404164, "uuid": "2a6b1a7e-fd2b-48fc-ba18-271fff1bdf65", "value": "3072:A7TX0V4mU9JLm6TOW5h5vTi3gxpz01PgOd/gpsoJaB790euvwbyrHXw:A7TRbLm6TOc3i3gT24Od/eskQWVQyzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675404164, "uuid": "c647e489-b8c6-4e19-80b0-fe03f528261c", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675404164, "uuid": "5e5a18e3-a28b-45f9-a05a-e97e80a9baf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675404164, "uuid": "a5bec029-e860-40b6-9668-8290354931db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328ccaf7-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675453909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453909, "uuid": "925ca4a6-221a-4bfc-9341-9ffc029f525e", "comment": "Malware payload", "value": "9b907695dd7cba48819a0a5a00b4d5d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453909, "uuid": "a71a980d-319d-41af-9e8f-b1e3b67072f2", "comment": "Malware payload", "value": "b62d5c96174044c23ad520482bb21257b76198184be7fff9c6d44d47b7aa41c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453909, "uuid": "4c139916-4cea-4c82-a04a-cc4eb07e1b45", "comment": "Malware payload", "value": "aeea47187f227ea956406e32326208e9e66b38c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453909, "uuid": "ccb9d99b-54c4-4001-9d52-4a62d192407e", "comment": "Malware payload", "value": "7676f96b62d374751db3e933f68dd5d84e153e267cf1741299d62cc4275a04b4c34505bf249e509b5a3620405cec286f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453909, "uuid": "8da4082f-413b-454a-905d-0c9ea18677ae", "value": "T1686412C97994E87FCC17D03A49598D948BA67677226FE293404362DA5C4FF1B8E1C0B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453909, "uuid": "97bf9b32-ffdd-4930-8ef8-2dcfd038ce78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453909, "uuid": "fd85a479-d4c8-4d05-93b2-3edcca8cdbf8", "value": "6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675453909, "uuid": "36a84e9a-890c-464a-9d90-bf63b498ebea", "value": 336679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675453909, "uuid": "540486ec-a14f-4483-8f75-f55bd9310c3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453909, "uuid": "c2289d6d-15f8-44cd-9d2c-4eb26f0bbcd1", "value": "9b907695dd7cba48819a0a5a00b4d5d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93edc7ac-a402-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675456649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456649, "uuid": "6f9b02c2-1d26-428f-a14b-fa107bef408b", "comment": "Malware payload", "value": "31fa6ed6749f46357eb741fa6bba490b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456649, "uuid": "9029ee79-e997-4902-b4cb-9e3532732a87", "comment": "Malware payload", "value": "b631817f4edf8e8cd0def4435817f7a966c38c8aa12335310958104d28ebf35a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456649, "uuid": "85cc19cf-c93f-468a-9e2d-29f27402b953", "comment": "Malware payload", "value": "c06681505e4791168b82164809ff46b4cfc91d8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456649, "uuid": "4ac23acd-0f90-4c4c-97a1-6175a686186e", "comment": "Malware payload", "value": "be0fad19baa528f89341d6a057056043141c94e14d8cf0b2c0a226b947fad27035a1a212164b48ea84d421799ab98290", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456649, "uuid": "15c6723f-dbd8-48b7-8aed-a462e3c62035", "value": "T19F76337076D24976E16198319AE0BFDEC023C9E25B308CB75B56DD1A2C7D0D880BAF9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456649, "uuid": "162571d8-3ef9-4b80-8539-439e04ccd29c", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456649, "uuid": "ca8cfb8f-8b21-458b-9063-e20da2f40915", "value": "196608:91ODluywp/Dgms/dEFtZ2kQzdymxCVeqLFjo2jOhi6C2+Cy0:3ODcJOmc6j2kQzdLxCMql1Czny0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675456649, "uuid": "f76b2620-b35c-46c5-8ad8-ff3ff0779180", "value": 7619284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675456649, "uuid": "8245e28e-9a5a-4134-8add-7f5b954a0dbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456649, "uuid": "da2eb533-5313-4fa6-bd20-e4c632c63d15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "695e4e75-a3a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675416635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416635, "uuid": "c23c353d-f166-40b6-9594-bb3de7395761", "comment": "Malware payload (Mirai)", "value": "14340032298f129fe01a6da3d1162cd4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416635, "uuid": "88e3daca-fc7a-4472-976b-b13af91cf4a9", "comment": "Malware payload (Mirai)", "value": "b644923caa36a79a2142617ce4ddd84f5e6cf27fdd60224657ed3906fcfd0c82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416635, "uuid": "13ea6d3b-8f8c-4832-8199-77fff7251930", "comment": "Malware payload (Mirai)", "value": "33e0a2faf255ffdb36948199205850cc71001cc8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416635, "uuid": "222cfb60-ee8c-4265-883c-ab580735f876", "comment": "Malware payload (Mirai)", "value": "18b1fdcc574bf6eaef22ec38b8c3458d7e19abd3098984341e89b479e6760b44bec28c1a5bf9a0e4c833ab7337dde005", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416635, "uuid": "5ade10df-466b-403b-89e5-f171f78a7f73", "value": "T13C830B0A7A218FADF75C8A7653B38D60564C23A736F1D241F55CC9002E6074E286FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416635, "uuid": "86d116fd-2b09-42d3-82ec-4a84a38571ca", "value": "1536:Zg3n+jqiBziWUVsBAIvetWjZ/uH6Mp8sbuH:ZU+j3BziWvBFBEH6Oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675416635, "uuid": "ca52021c-4052-43d9-8f22-4b78995aed1f", "value": 84988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675416635, "uuid": "d71941a7-92e7-4f6f-a407-375364434e28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416635, "uuid": "2fe3f8b2-372b-435b-a613-973fcc4fc1a6", "value": "14340032298f129fe01a6da3d1162cd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44383e08-a381-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675401110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401110, "uuid": "803c5074-e0ad-488f-8792-36ecccd06099", "comment": "Malware payload (Mirai)", "value": "ae96aefea7af5aa9ea40f1759d186dcb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401110, "uuid": "3d9dd809-d8d5-43f4-8956-b847e2b0cfa4", "comment": "Malware payload (Mirai)", "value": "b6b385dc84f44f964b4919f639d5dd4b9a386ede7887cf8e992b4280cd04420d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401110, "uuid": "3653da7a-4098-4cd8-b48f-eb014fe10059", "comment": "Malware payload (Mirai)", "value": "cf3a3aba58622949ffd291b43f6830dea5f7acdd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401110, "uuid": "167e686a-1a7e-40f2-988b-7eb3ec9c0bb1", "comment": "Malware payload (Mirai)", "value": "11f8b766ff848b4a1724e9f4351ad5e9ad00611997ce8c01b316fd267c14aaa71bd398ddb2e20380bbec492e85fc1791", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401110, "uuid": "21c0d8bd-33e6-4b9d-aa14-b10964715b2e", "value": "T14AC2E1B1D10A8EF3EF7EE9B44A41DDE27FCA039E2852D8D260586B1607B253955009F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401110, "uuid": "104863ac-c74c-4972-bb5e-0b9296648d38", "value": "768:z9xqNa7PqLefxslATOTIAA6Q7dHGKKdPBKp0+OwpvI4uVcqgw09D:iNLaxsl8X6+dDePQw54u+qgw09D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675401110, "uuid": "e580bfc2-6a71-49b0-a3b5-0e4781173856", "value": 28280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675401110, "uuid": "eddb4438-0a88-4cd9-94d9-bba6dc7dbf8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401110, "uuid": "b0db35ab-4a36-4fc6-8322-5c69466c3089", "value": "ae96aefea7af5aa9ea40f1759d186dcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e498b01-a39f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675414066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414066, "uuid": "83360433-c942-4250-b79a-c45106d44aa8", "comment": "Malware payload (Formbook)", "value": "4b9e1c214b84496cd6b66ee6683f0e7f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414066, "uuid": "2919f025-6f86-4d5d-8102-bbebcc68f57e", "comment": "Malware payload (Formbook)", "value": "b6e783d585552655ffb33260ad474b6b61435ca97e0ba1f9ee719b800b21a4b2", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414066, "uuid": "0f84ef0b-2f4d-4527-b0cd-152b636915d1", "comment": "Malware payload (Formbook)", "value": "198099cbde3653d8cc1348b5e6f3b60d3a6d81c1", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414066, "uuid": "5f257f84-fec5-49de-bdb5-f1d536939988", "comment": "Malware payload (Formbook)", "value": "c333794e3fa162241879508077408f6b3a7b465eda70a512e116a0a7f051d128efd2e1504df8b2a00bf1f86f274a7714", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414066, "uuid": "382901ac-a04e-49e6-9afe-0ae619345939", "value": "T1FEE433C6CB840C360D84C89AA674A7793FC5EC9595591B30F83F3761BE9B51A3F1238A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414066, "uuid": "a7ff244c-47e8-4c60-99f9-739e92ec2609", "value": "12288:U8i6T8g0gfb61AAka1M95bGyoqUQs760UZ8RWl1HiAK029Fkwokm:UIT8gzb6flHEUQs760PRWl1hSFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675414066, "uuid": "62626fe5-bbdb-47f5-a167-5c84115fa452", "value": 687134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675414066, "uuid": "16f9d91f-e2ec-4620-ad8b-5f99897e21e7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414066, "uuid": "37d6241f-4819-443a-a377-7af04cbadd81", "value": "DHL Notice_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67231bd2-a3c1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675428657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428657, "uuid": "769af135-1d34-4bfd-bc70-f8fa24fef15c", "comment": "Malware payload", "value": "d00809352f35b326ff96603b9b8baf3b", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428657, "uuid": "124fbd60-f243-4510-92b7-cd0582d16447", "comment": "Malware payload", "value": "b9080762697def380660f61a5f9dcdf0cce6aa4c62139f154cbbfefa18626930", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428657, "uuid": "44e9e0df-5207-4cd1-8475-2a2fdf34aaca", "comment": "Malware payload", "value": "4709a7b97e431d8825d37a97749a959b0f3f24b1", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428657, "uuid": "bdadbe7e-cb71-4f21-94a7-4b615bba4395", "comment": "Malware payload", "value": "6ebfa0e45f324712c5c6876455618c77299ca89a8945ea6e333520315add09576aed5b1b76b9f84561786165c3b00a04", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428657, "uuid": "fa992629-48a3-4927-b9b9-47a7982e4fce", "value": "T15B547C05139B55E8D6B2BEF44DE29A16FB369A23552DC78F8F71AEAD0C50210CCA460F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428657, "uuid": "002d3bbe-da53-414d-aefb-a48f2c9c5a5a", "value": "3072:CGaA0YRw9/WITtTWR7IbNzvL1aVhuWt4AJERnyNenUWHCoTCCCCCCCCCCCCCCCCK:CMa9xytedL1Cp4iERBLV9yH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675428657, "uuid": "f40b8881-b031-4c43-b28a-ecba46137bfa", "value": 284504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675428657, "uuid": "2bb0a1b4-5d4f-4e5d-afca-ab8676a45257", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428657, "uuid": "8aca2ee5-fc9a-4c5c-8b0d-32207a22dfbf", "value": "SCAN_02_02_#1.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2c4c84-a3fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675453576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453576, "uuid": "d1f8a7ce-29d3-4ee7-bf70-8451dfa4bc60", "comment": "Malware payload (GCleaner)", "value": "1fa43a7fec375ff866e71dcc45bd4f3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453576, "uuid": "24d4b810-a33b-4c01-ac36-387f3b3a7f9c", "comment": "Malware payload (GCleaner)", "value": "bb940ae243461350773d9d8a9e0a4f447c9030cd661e0bdfc519855c2a1ad5d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453576, "uuid": "480ad46f-7349-451b-9b82-0a527b2516de", "comment": "Malware payload (GCleaner)", "value": "7f89b17de4dd98dccf80da2f227941e1ea440282", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453576, "uuid": "488c66ed-675d-4262-9a71-c569b5d60208", "comment": "Malware payload (GCleaner)", "value": "6c8e8c0cfdc9dc12eb78d97df3e8e5033a1c269284a1af439f637e72a3a3735baa739022c70c506f3575f889e6c287de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453576, "uuid": "b5b3f770-2408-489b-a234-7ac330a653f0", "value": "T18DA5331662B3873FC271A63095354033AF7B7DB3D9A06B11321C6A8D1F63B916B6E325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453576, "uuid": "9e5bc1d1-495d-4836-b970-0b5f6756acec", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453576, "uuid": "2b8a21d7-a4e6-4402-8892-cf24e37c244c", "value": "49152:ygtZk9XBQK8Lk1KfIIMLI6BKXWq4xmGEv3KweS92eiHNxcP/oSLCgv2MR:TMFBN1fI6AtGEv6W92eiMP/o6v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675453576, "uuid": "d9ed8670-d300-4946-be32-d2bbfd655f08", "value": 2065349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675453576, "uuid": "1a5c9932-1674-465b-8a79-a671c4872a5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453576, "uuid": "638f44fb-63d2-4d5b-9355-f50f7b7691c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9308e6-a3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1675442306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442306, "uuid": "a2641a7e-c761-47f0-a721-4748f2963ca9", "comment": "Malware payload (DanaBot)", "value": "623b0aa79d1a8121f21e2fd5d4a4f2ff", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442306, "uuid": "efd74be9-e34e-4016-85d8-d72dcbafb02f", "comment": "Malware payload (DanaBot)", "value": "bbe0ef5e3c8395e0408887b03a82bc3c45be04e6fa3e5bb1dc5aa970119a7791", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442306, "uuid": "ad250821-82b1-4ddc-99a9-2450cc2c035e", "comment": "Malware payload (DanaBot)", "value": "a1ad370bf954b27178fb685774ea5a00faf50dd7", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442306, "uuid": "b5abade5-6c4f-47ee-957c-03e8cfa96dc7", "comment": "Malware payload (DanaBot)", "value": "a96fc8cc9ba82ad340fd8c886aae8cc802022f9fb93a55f42d5dd11c2c65c52d5ee9ef2beb4df86201d7cbd681ff80ae", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442306, "uuid": "a2f52da1-68ac-4712-bdf6-d278ef59134a", "value": "T16C0633363285D4B2C853DEB0AC9EEDEB9BED167886704A1F3E6214F41ED87C01369716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442306, "uuid": "08ea6b50-661d-4fa1-b658-e9d875315d31", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442306, "uuid": "2aa4c347-9843-489e-befd-eb0aa16fa1f0", "value": "98304:MawdEB5rizyoDvOrv6D6lnv9frJCQWApp:M3SvGXD2mDwlfrJCny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442306, "uuid": "a1fd3de6-f292-46fb-9595-90d2fab673ab", "value": 3795456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442306, "uuid": "26071274-5ddd-407e-82fe-48915ba79c99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442306, "uuid": "5071b159-327f-4306-aeb2-ee075f24ceed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bbded5d-a3cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675434516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434516, "uuid": "f289b28e-da85-4a90-971c-8f4060cad6c2", "comment": "Malware payload (Formbook)", "value": "0cede59d6b35470f434612e6f9edf537", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434516, "uuid": "acd4683b-e978-4db0-9418-8c6ffb8647ce", "comment": "Malware payload (Formbook)", "value": "bd09a540380532e512b757fdd8758d6c81c248b54da5fdcaf3d1a6b813b808af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434516, "uuid": "a8ae7c09-6a7b-4235-8dc2-ffb37a6ad187", "comment": "Malware payload (Formbook)", "value": "2c1611e2b9e0c470f4626ba6cba78c95ddc58418", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434516, "uuid": "ce9375f3-d4db-4208-9bb8-39831bfbb308", "comment": "Malware payload (Formbook)", "value": "af40b4ecdd6a2aec8113042a2be3863bf7e3c9465dc7d5cb176466a3dbb5c00af57b693670cc73c64592c3d25179ca8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434516, "uuid": "fb9984ef-56d7-4646-afa8-09ecb6575c88", "value": "T17954120A1AB9C473E8A51EF04A370551AEFBFC1646189B1F57800BAFB632350F66E774", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434516, "uuid": "0b8da147-172f-4f43-b60d-da094ba9b62c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434516, "uuid": "2dc226f9-99c3-490f-b775-0e3960a88c01", "value": "6144:vYa6NjnQR0dUXq/PURCA/QEILhJUhDwqciu6Fs1b2LoK0g95ThG:vYXjncbXGPDxLhocq/9eb/KZbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675434516, "uuid": "d93961ea-6ed3-4cfb-97c2-2044894b3fb9", "value": 297816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675434516, "uuid": "284b3451-5e9a-4d24-9e93-205908f7cd9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434516, "uuid": "1f2754e6-680a-4663-b2ac-9a94209ed88f", "value": "bd09a540380532e512b757fdd8758d6c81c248b54da5fdcaf3d1a6b813b808af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055d3b84-a356-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675382537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675382537, "uuid": "fa7fecba-5d29-47bb-922b-42121dae5f98", "comment": "Malware payload (RedLineStealer)", "value": "5053e768c65b528396e53ae8ec181c4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675382537, "uuid": "aa4ecb46-72ac-4288-bc38-7fa8a9ea5a0e", "comment": "Malware payload (RedLineStealer)", "value": "bd367c0b495bdaf49adba791decda194c55a5403880a152ec113c7e61fecbf8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675382537, "uuid": "b1ea1ded-62be-4559-8e55-fec2895f2795", "comment": "Malware payload (RedLineStealer)", "value": "f53250c26cdb5cc58347e0bbc5a820f1bb1e263e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675382537, "uuid": "59c016de-3b52-42f9-a73a-097eb98c781b", "comment": "Malware payload (RedLineStealer)", "value": "cffe2806637c07eb57d682c5ad3a121b9841e214a8230706d25dcf6cde061daff58722a392b8ea32ae964318c54a5ede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675382537, "uuid": "9c838107-cf49-4311-b487-4cbc47922562", "value": "T18C94AE4262A2FC41D621C7F28E1EDBF47A1DB9518E686F6E12189F7F1973172C1A3390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675382537, "uuid": "a511046b-7b2f-4e26-84da-d735981658c4", "value": "2ff60b2f756b6533c2643b340c02a5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675382537, "uuid": "4050fe3a-b3fd-466a-a669-693a69a88363", "value": "6144:3xvAL9OfhSnbkJ73nOu2XRNUS5p4F8fERNjEp3lwKwpxhg7ELjV6ptCbNKNc:3xvAwfsnbkh3nO7RyP8fERxEpleyCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675382537, "uuid": "b724f522-903b-4755-8df9-d66ea5dad357", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675382537, "uuid": "cf0aa48e-a961-4516-99f9-e7291ff408c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675382537, "uuid": "556b266f-dac8-4597-ac67-47d39dcd75b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de432b9a-a3f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675452049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452049, "uuid": "7f9167b4-6f73-4727-abb1-98ffd8c59c8a", "comment": "Malware payload (Rhadamanthys)", "value": "227eb8918a067c8c06505e165d641fac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452049, "uuid": "d50e49da-c82e-450f-976b-537c70769cf3", "comment": "Malware payload (Rhadamanthys)", "value": "be2d86da86df489ac16c9290fd39f4b4bb577c328466f7d366bf2e1e439c620a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452049, "uuid": "c95a09eb-879d-401d-bbfd-c6ec7a95f49b", "comment": "Malware payload (Rhadamanthys)", "value": "263bbc9d6d2c256eca49f31203cecb652d354587", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452049, "uuid": "e4c3b6a2-8695-46a7-be5f-d7768c40df5a", "comment": "Malware payload (Rhadamanthys)", "value": "e2bef3b18fe74abe9f321529f2972ae5913984d5b232f1ad61abaa33d3cee8dfe27f20b5f27a91e676c4f6ec4c1b9c0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452049, "uuid": "0e2361f7-5740-481a-a064-a4d3f01f5fca", "value": "T1FC24E109B2D18878FA9402325D748E7315FE3B6B4B30CB97776C0986AE712F5652A3D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452049, "uuid": "d4fb82bc-6265-43dd-b307-75ba612242fa", "value": "ab41656c48706f1fda9fa72f84547ff3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452049, "uuid": "bdb58dad-2701-45f2-abd4-bc2ca7e2bd31", "value": "3072:jkfcpRIUg/18+G8m+6Sx0WJ0u0/5URvtz7BokhtyhN2YNj9UXezE5yVRhpuI5:jkfcNklrEPyT/BvyhN2YWh5kr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452049, "uuid": "fd85b473-1a7d-407c-a738-a00483ca1252", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452049, "uuid": "c92d448e-b924-440f-96d1-89fb5b1bc68e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452049, "uuid": "1d2cee2a-e900-4181-9a7a-b5ad963cd241", "value": "227eb8918a067c8c06505e165d641fac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3084055-a3f8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675452460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452460, "uuid": "7d6fa719-fdb0-47e4-b5c9-6bc9c2e9a617", "comment": "Malware payload", "value": "f53e4cfb805331be00dd14b717f75bb7", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452460, "uuid": "bcca74d8-fe6e-44ef-aad4-0d63a77113b8", "comment": "Malware payload", "value": "be718646e0fc33bf6db2f3e059f382f0e38820008cf6c60e8f3137c5e3e8fd9c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452460, "uuid": "03e8f179-2615-44b3-855d-a5606a1400d9", "comment": "Malware payload", "value": "ca9a73e09e056847c8e0231d342d46662b745c6c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452460, "uuid": "e3647c00-748e-4a25-8511-5f1a1e2873b1", "comment": "Malware payload", "value": "05026908c554541822f11878cdaf52a6ba94d8b4eab52b66a9bd1105fd47d2414a86ef42f3faf2723730d3fc67d3f263", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452460, "uuid": "22969415-d0e6-4204-88c0-849b309f0948", "value": "T1CA72D7033E2F507CA8B797A33A1BE81EEA3352E79120441478DC49DD7F711AA96B45EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452460, "uuid": "46f3b309-95cd-4107-afa0-42d04b4d3479", "value": "384:r/vxLZP+AgWSNW4xfcO0kBKynu3bAbkcVh4rVoWMOKmA26EYYItwCwN8z:7FJgNNx30AKynuL34h4RoWMOKmA26EY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452460, "uuid": "1db9d616-80cb-4063-9f9b-e4c792f409c8", "value": 17516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452460, "uuid": "e03e71a2-6908-495d-8c41-5628ed2963c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452460, "uuid": "711c6bd4-f51f-45e1-bf62-d880db9ed964", "value": "vm-support.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14dffea-a3d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675436485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675436485, "uuid": "b5b798b3-ddd0-4aa3-9098-bfc2047810f1", "comment": "Malware payload (Smoke Loader)", "value": "710f79529746c4fc28219171ed41b1d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675436485, "uuid": "11cbd853-bffa-481d-b34a-dbfa5694fff6", "comment": "Malware payload (Smoke Loader)", "value": "be7706c33531007347b877345117deef942d23da1549a3d7414e4081d0dff8a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675436485, "uuid": "6f157971-136d-4960-8465-27d2c7861d4b", "comment": "Malware payload (Smoke Loader)", "value": "19a56210d1ad0698f34ca273467606954483c2f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675436485, "uuid": "c7e60de7-cfdb-49a9-8afa-52a9cc7c1ea4", "comment": "Malware payload (Smoke Loader)", "value": "ce6276a30b6ec0135563b59a22ea76635acf885cbae2b422dc276ed1175c2f9cf72e81492d50dfbd20d4c767620733a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675436485, "uuid": "cfb09687-f9f5-4aee-aa8c-e59149fcd7eb", "value": "T17C14DF323A90F072C1AA10345C64DBA7BB7EB8314679D5577B6807AE4F307D06F7624A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675436485, "uuid": "2eb1c8fa-e124-4410-b44e-21216b4f1a1f", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675436485, "uuid": "b90fbb97-9cb2-4d2f-9885-f6bc29146e01", "value": "3072:a5J6SmGNrirLTUgjoNsWfn5GWrlQHPuWi5vKChnQb3wn97qJ:a52rLTxjUsjWraWdvq6mJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675436485, "uuid": "3ffc5581-b1bb-4c22-b74f-eed2819d02e8", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675436485, "uuid": "01a636df-d55e-4cf6-90f4-5f79d19cca40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675436485, "uuid": "bd8463fe-7126-4256-9ee9-f1cecc07aa58", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ecb0aa-a3ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675432628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432628, "uuid": "ca83a9da-6ea2-415b-ac3f-72af90fa26ff", "comment": "Malware payload (Smoke Loader)", "value": "1082dc2824b2ee52285f8dab5b4adcd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432628, "uuid": "5b638d97-697e-492a-8cc3-29eeab606c89", "comment": "Malware payload (Smoke Loader)", "value": "be943cff3ddc8fddaba89b354a54c6097cc4182be24253bf5edfd06565ad5f90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432628, "uuid": "c2bb53ea-95cb-4a4b-a122-e99f53a10f96", "comment": "Malware payload (Smoke Loader)", "value": "8e6ec81947e73b447c6ae9e287d827873a74dc24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432628, "uuid": "6c37e6a4-3052-4f7f-9d09-f27fda3a79d8", "comment": "Malware payload (Smoke Loader)", "value": "ed2794b878a730caa7d217711aafa3cbd203da3e081021259c0b68d949a420f8b2b30853b2f982faa866af7730ca72a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432628, "uuid": "568a95e7-7103-4ff8-b7aa-88917a30e806", "value": "T1D814D03236D0C072C3AB1430D824DAA6AFBEB5304675965B7BA817AD5F303D1677A317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432628, "uuid": "f3c58ba5-7061-4081-a5fc-e225eeade440", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432628, "uuid": "be307784-43a0-41ae-ad06-2b256107524e", "value": "3072:ae27kNl/aFVs7hLZjZKpuWls584tAe8eUFk4ypmvSmYZWejy7zxx:ae+Fs7hLdZeutedImvSmYZFjkzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675432628, "uuid": "63a2e372-b3f7-4896-9b4e-66711cc0bb62", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675432628, "uuid": "4c7e4a8a-31c4-4f6a-9161-6828b7bc6dc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432628, "uuid": "651e9952-bb44-4eeb-b52e-db8065320b89", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3b7632-a36a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675391544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675391544, "uuid": "98b97cf2-61ec-4a9d-81c2-4dcc04994adf", "comment": "Malware payload (RedLineStealer)", "value": "8ff0643da102e8798863cb33c2c9daa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675391544, "uuid": "cc2b1744-99d5-4bea-bea9-be4a682d1f38", "comment": "Malware payload (RedLineStealer)", "value": "bf9c5169a7460c5fa8615d56fe486af12b2f7c1ffb52e4847df408dce5d5504b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675391544, "uuid": "66819415-1613-416a-8ce8-eee2cedbf4dd", "comment": "Malware payload (RedLineStealer)", "value": "670b95e278664de0c08ca99b9d6845710578545f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675391544, "uuid": "c9424698-4bc3-45ab-9dd6-084aa787834c", "comment": "Malware payload (RedLineStealer)", "value": "57304a0a98e5ec8b155cb0b2be4241ad4acdcd08649b2c30249396f5002172d86ccf03ff8a9d8a1e2e89f3a43d19a780", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675391544, "uuid": "7646c0fa-61f0-4921-af2e-bdc099e30534", "value": "T1D894AF426292FC41F625CB729E1EDBF47A1DF9D38E686F6652185F3F1972072C2A3210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675391544, "uuid": "b07dd4b7-de43-413f-8cf5-b9e69ba2d0d1", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675391544, "uuid": "08c3b5c4-602d-43c2-a238-fd9add577947", "value": "6144:j1FCL2nLabIjdZt0y69rWkpFAiLyFPGsYc3lwKwpxSGUQ8AjV6ptCbNKN:j1FCKnWbMdj0fnAZYgleSGUQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675391544, "uuid": "4f4c0c57-dd34-4ddf-b988-832617961864", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675391544, "uuid": "fb086af7-3035-4bac-b05b-ee23f99e1dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675391544, "uuid": "786892d6-272b-4f10-8bfc-b3d65518ec48", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6e2f36-a3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675442358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442358, "uuid": "58fba045-1dbf-45dc-9a54-e7950c1e7a48", "comment": "Malware payload (PureCrypter)", "value": "1fbb38a076974e7096240433fe11273c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442358, "uuid": "2ed8440b-6deb-43be-96dd-1fc6072eb234", "comment": "Malware payload (PureCrypter)", "value": "c0cfa03c73a2b89cbe7567c333b262a15cbb4c24c0bcb225db1ad0e6f0f0c5d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442358, "uuid": "700426fd-f704-45c7-9f8c-969a0bb52691", "comment": "Malware payload (PureCrypter)", "value": "0fefab8c4375e0671d5c25dcc7e63fc416c49426", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442358, "uuid": "724ed4f6-3c06-45fb-a520-c05990acc4a4", "comment": "Malware payload (PureCrypter)", "value": "11066d4f21b41df3a0c1d18ce014d4349167f1e1eb3d918ccc2014e28fc936515bd1e741f5506024bd5534b30b0a2f8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442358, "uuid": "23404576-66f3-4ee8-a752-9a0050896820", "value": "T12D5533752725C8763B1C8F2331C0BB3A817914FDB1A870C756AC13BAA79C99E6D21973", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442358, "uuid": "3f52a6ea-45fc-43b0-9229-cdd5471ff447", "value": "24576:DmsXTz7wVedFFxd6LUOngGuFgRdSu5/Tep2CD5PqNHXe5:DzDzXF04OngGvdV5/yICDkNHXe5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442358, "uuid": "91f8e29e-af9d-4143-864b-574cc2a79519", "value": 1334960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442358, "uuid": "33ad06da-4124-4445-af17-6020ae6eec71", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442358, "uuid": "2c78b925-67cf-4137-a036-17736c9f1754", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ff0958-a3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675442317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442317, "uuid": "ffe2f2a8-b7cb-4610-af93-0e9e9ff236d7", "comment": "Malware payload (PureCrypter)", "value": "3b17cd66110ad93010d8d1b837cf5bb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442317, "uuid": "10205e07-ac86-4c6b-9c73-da0a3031172e", "comment": "Malware payload (PureCrypter)", "value": "c0d769a26856b5bc3633100d7a798660e60a64da5806c8445d3ed63a5f3f538d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442317, "uuid": "2fc7e963-a5ed-400c-9e92-ce59e6953f8a", "comment": "Malware payload (PureCrypter)", "value": "61fb4670940fd077e6637b6daba340fbd2dbab63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442317, "uuid": "92e19497-3f52-453d-928f-46cf114d4c7a", "comment": "Malware payload (PureCrypter)", "value": "a85187c216e0cb545740384ed90e18fc1f90030bd6b4a7c8b5d0a332cd77e1a4a6fa522c336f2b86d5c7cad354f1ea2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442317, "uuid": "4f023d7a-7aee-46e1-80e2-79a8647781f6", "value": "T1D655335C1F66554EB4E89DF60E1DB6C3203BD6B3EDF421E0656DBAC78AD100B8E2250D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442317, "uuid": "e09492af-c289-408e-9cf2-9e512bcfbeb9", "value": "24576:CCh7GBOeCodA8zKNbcqh+xPOOgtj5M+Nn227zVLY+HIoXxurGl+JntMckUBiCbtK:C4G9A8zKNbcWFw+NbmFoXxj+gcUCb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442317, "uuid": "6bbdb1ec-3d1e-4462-a690-407b506aa82c", "value": 1296302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442317, "uuid": "07c1d944-9f9d-4381-8458-284e83f02fe1", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442317, "uuid": "6817b4bf-2022-45cf-9d8d-63c52dd22dd6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc960fbc-a3c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675428800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428800, "uuid": "f8c3bdfb-9b4b-4178-9d61-7b55f419342f", "comment": "Malware payload (RemcosRAT)", "value": "4d3870cf2fa0e869bbfa107c825f4849", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428800, "uuid": "8a0e78b7-343b-4ba1-a22e-feb436d0de03", "comment": "Malware payload (RemcosRAT)", "value": "c0e2de257b40366c2e97a6c4a074d18a49a8ade3037632cd754489d26198dbd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428800, "uuid": "39deb0cc-572b-4252-b341-2e1a118bb6a3", "comment": "Malware payload (RemcosRAT)", "value": "0141b868dbb9e97c4236db41e12b20b013fcf869", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675428800, "uuid": "3d138c86-fbae-439d-a5c0-1eecd24e402b", "comment": "Malware payload (RemcosRAT)", "value": "57d6a1e98e0428f1dda6b37afcbc8e7c94cf970e47eef2023c19b7641da6ba8b5d84edd7b3aa6c2a81e0e25aa5193ac8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428800, "uuid": "365d3ffe-dc9a-4561-a967-94f83f319429", "value": "T1B5254C1137EC461EE9AF8B74E032101543F1F183F792D7BF45A9A0987DE2B569A01EA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428800, "uuid": "5555956c-dffb-40ff-8def-b8fb14936584", "value": "12288:E24M/WlO3yEpjb/LCE3+UB+3GHdXTL9eqMPvWJf+RIa3Y9BtIDiAXHNbTx:EzM/wiXV7DgYftii8tb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675428800, "uuid": "19b5a645-e370-4245-9b48-b8326272b030", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675428800, "uuid": "77338ea3-490e-4547-9507-a0c5e2a40995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675428800, "uuid": "94550451-9af8-4ed8-90a7-e35a63f45466", "value": "c0e2de257b40366c2e97a6c4a074d18a49a8ade3037632cd754489d26198dbd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae8cd62-a3cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675434730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434730, "uuid": "c043f50b-053c-49d3-9d8b-647868092447", "comment": "Malware payload (GCleaner)", "value": "e434ab8576192ac86d1b535b3fb8edbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434730, "uuid": "aed2558a-e91d-4cce-a25b-4d6ea1e39e49", "comment": "Malware payload (GCleaner)", "value": "c0f27d5ba6667582250ada48d723785bbbff855263ecc928fb2ea4de11c4206c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434730, "uuid": "281c082a-6eeb-40e8-b156-795da2d8022f", "comment": "Malware payload (GCleaner)", "value": "87cc180d39263973e960b8d22942ed52f03a7243", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434730, "uuid": "3e0e3d1d-2f75-41f5-9668-d9dcfb5bc4c1", "comment": "Malware payload (GCleaner)", "value": "3da710d30a31af2a44675ff7fd2dd63574dd483b2fbe025137b2b8e98661911db43b6720a97bcaea794f32aeca441c9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434730, "uuid": "d199aa04-d52c-4166-85a3-1bce49ca4fbb", "value": "T14D95330292914EB2E527CF74B0791247B9A63D163279614270CE7A4E3F7B6F6788D32C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434730, "uuid": "1c1e314b-8557-49af-a896-0113fe577fd3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434730, "uuid": "9b0251cd-2f17-464e-9c15-07c92b59f7b7", "value": "49152:ygpRhd0FQdnUGoFVSUShIzoa48mSDR3YLCgv2MR:TDhd0idUGoFj6IEa48fQv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675434730, "uuid": "dbe676df-0300-41f0-bd8a-b35638044a7d", "value": 2043464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675434730, "uuid": "abdb788f-b4f7-4f4f-a275-50853ad51435", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434730, "uuid": "9e0e0ec6-b0ec-482b-8771-77b0de72532f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35165fdd-a396-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1675410104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410104, "uuid": "83709e0e-9739-49c0-b9cc-da997b7e7b01", "comment": "Malware payload (Chaos)", "value": "77bd76f4e4b9481432022ab3b10c89c0", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410104, "uuid": "6e93673e-b61a-4470-930e-f48f745307d9", "comment": "Malware payload (Chaos)", "value": "c15e2ffa84d30fa17e9c61c19cde98b22ac6e259ec16b68a9927bed13a0aec07", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410104, "uuid": "408258db-b30d-4c16-9175-3a8cc2e39167", "comment": "Malware payload (Chaos)", "value": "8213a974f617ee9b191e605856e776ab96ff4382", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410104, "uuid": "f3b23e35-15af-447e-bf8e-0250e49939fd", "comment": "Malware payload (Chaos)", "value": "6052636aefb30349d37992ba17981a07c9f2e1b94022d86bfe0dc61e6b21316dc539693c7a96c7bad3a5c8ab083fc0d3", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410104, "uuid": "8f1b33b9-0ccf-4782-853f-eff65817c425", "value": "T180932E4562654531E6B90DFE487833C90E6AFD138B2AD198647F3DE9BCB22848BF4347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410104, "uuid": "6c03607c-cecd-43de-b50b-5e46fe08460a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410104, "uuid": "37b07143-20cc-4755-9eb7-77101d0825fb", "value": "768:yuqo2ptMp1g4+kR7Er9jJxbXeqxSIHTe9dLTdp:yto2ug417Er9jJsqjHs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675410104, "uuid": "3f0a8dd0-29fc-432f-9241-03b9b39f09e6", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675410104, "uuid": "7dcb46d1-e4c8-47ae-8bfe-9dc9700efdad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410104, "uuid": "6e19d179-c654-4fdf-bd28-99b9141e53fa", "value": "2023-02-03_77bd76f4e4b9481432022ab3b10c89c0_destroyer_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247c282d-a3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675442289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442289, "uuid": "a776d442-a37c-4d62-832f-beb0f15e4091", "comment": "Malware payload (PureCrypter)", "value": "ccfe4b20694730b6b8834d85cd188c0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442289, "uuid": "c7ee441e-75e9-4c08-87f6-08f1a060da92", "comment": "Malware payload (PureCrypter)", "value": "c1b6913855783e6d5f25505632e91da1dcf3198059ceee8e33b5d394800117ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442289, "uuid": "e3299bc9-2926-4731-9fd7-bbc28968f53a", "comment": "Malware payload (PureCrypter)", "value": "dbafc1d53a00a158766c3014352dc4f39d82dbd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442289, "uuid": "5c3e646f-5a52-43e5-892b-6da09cf26d81", "comment": "Malware payload (PureCrypter)", "value": "2648a0bdefc848c45ba54c5abe4c25656e5de4fb871b8f46c9359b50451c689b12ec11b4ca9d880f4234a03b2e41b749", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442289, "uuid": "82686029-8e6e-441c-86e6-3ee503d8b314", "value": "T1F64533BA1A52E7B59B15D416A27EF80B43D63203EF20EC138849B77869D7B136334C79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442289, "uuid": "2a17a7d6-e25c-4851-8df0-47a2c37d9bc3", "value": "24576:6c1C2Bno4c0nI4fAQuYsUK7SpdZY4stTehgE9Lqtf0eEmhj5lolb0a5G:6uC21HzIgWF7SpQ4s5Q60TmhjLolAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442289, "uuid": "b1e0d9a2-91f4-4a2d-9893-7ffd01edbb50", "value": 1263164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442289, "uuid": "7a971dc8-56da-4c87-a16b-7472bfbdf9b6", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442289, "uuid": "1c26339f-de41-4e35-a307-990171070601", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9adf062-a3dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675440445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675440445, "uuid": "dc118fb1-d9d4-42ab-8e92-529283673ffa", "comment": "Malware payload (DCRat)", "value": "90631c5269980f1ea596b3c76974d262", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675440445, "uuid": "57e98ef7-3b32-479b-8db5-7f123a96f4a3", "comment": "Malware payload (DCRat)", "value": "c40f3216652866e041fd154c38dab5f443f65da7e995e45ce473bf2662e2f7e4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675440445, "uuid": "213762ca-f803-43e0-bb65-d3a8b86e4196", "comment": "Malware payload (DCRat)", "value": "889a1edb9b462ed0d3a5cc8ecf0427696d6095c5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675440445, "uuid": "46a05a10-204c-4ed8-a4fb-9f48750b2ff6", "comment": "Malware payload (DCRat)", "value": "8880d9e6a41cef99ce6a16df8315c7e40c42d7ce6355b38a2a0f699c019a1546744c11bf8073bf5217fa6225754712ac", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675440445, "uuid": "63387286-2cb5-4d09-b9c5-5e9e8e200a0b", "value": "T1E0235D4037A88136F2BD4BB4ACF3E6418679D6672903CB596CC814EA1F13BC596136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675440445, "uuid": "2d92715a-d7a2-4203-bcd4-a5d919181d61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675440445, "uuid": "bd71e22b-1ebd-4e65-8bd9-6bd4c418585c", "value": "768:dOEuILWCKi+DiBtelDSN+iV08YbygemmbbeUZvEgK/J9lZVc6KN:dOtmBtKDs4zb1CbeMnkJ3ZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675440445, "uuid": "5a3ca932-067b-4539-96d6-994645e2d572", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675440445, "uuid": "e3ed796f-9863-4b50-97e2-820a617cf601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675440445, "uuid": "d691b5bf-48d0-461b-b537-1bcb596bedab", "value": "bJyz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838f6be1-a3f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (KillerLocker)", "timestamp": 1675450609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450609, "uuid": "bd73d5d8-e667-45b4-b690-18bba287cd2e", "comment": "Malware payload (KillerLocker)", "value": "80cc1b6e8dab57e15accc0a02d9dd513", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KillerLocker", "colour": "#A00999", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450609, "uuid": "cfd1b01a-7dbf-490f-894b-c07260c13882", "comment": "Malware payload (KillerLocker)", "value": "c47c909f062f7f806552a56eb6b7f35a694805ce0fda3cb5c4e18a4885822392", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KillerLocker", "colour": "#A00999", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450609, "uuid": "8dd4edb4-ab1a-49f5-861d-5b729e552e7f", "comment": "Malware payload (KillerLocker)", "value": "f29ccbe3ded63804b87f5bea92c20fda99582300", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KillerLocker", "colour": "#A00999", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450609, "uuid": "22394052-00f2-4f72-af97-335e65eefffd", "comment": "Malware payload (KillerLocker)", "value": "d069a95e1930032e448ec37151560efa09371b3f01f69ee3ce5ac89a6ddd7b284b375c98a96f7f7ae81612a4a79828a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KillerLocker", "colour": "#A00999", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450609, "uuid": "9ea613e2-f23e-4d73-b72b-c023b845a92a", "value": "T1E095BE16FBC296E2D883407952E7977F4D359A14C738C9D38B9118ADCC226D1A63F3E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450609, "uuid": "0a8e1830-5344-4229-b0a2-1c4b0b25dd55", "value": "b29b5b88fc23333dd8d88d3a5c9fde27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450609, "uuid": "f800385e-0dbd-4769-9d13-c17743ff5567", "value": "49152:gTQeCeqHZ3g3Ynmv6hyAdrzoPQFKTR4R64B/re:gTQFFRmGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675450609, "uuid": "c689aebe-32c9-4d20-921b-c79615c47106", "value": 2042368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675450609, "uuid": "6c9c866e-b009-4557-bd3e-be5041ce141d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450609, "uuid": "3966ffd4-1c35-4671-bf82-fc0784f7bd60", "value": "c47c909f062f7f806552a56eb6b7f35a694805ce0fda3cb5c4e18a4885822392", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff813b83-a3b2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675422470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422470, "uuid": "9926f94f-8435-41a6-a1c4-6afd7a4c73da", "comment": "Malware payload", "value": "77ab3ef08da5c25a0d2cda9d1e969fd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422470, "uuid": "516cbad2-e498-4d44-bad4-af8feabd1ef0", "comment": "Malware payload", "value": "c4b1556b4e6200b07fa44d29d460c3036bbf5b4c4902d51fc995f8956315c2fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422470, "uuid": "b96b937a-9d1a-4f8e-8166-b01d4f614ff5", "comment": "Malware payload", "value": "a25a7835daffcbbf01b09b99a9a7040eef7961d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422470, "uuid": "48068da9-ae40-455e-800a-de152bd154d6", "comment": "Malware payload", "value": "33cc847176313a9cc77a6334f431719825078d92b5ac610d9d0149520621a55924b6ad798477e42772e8b60dd92535e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422470, "uuid": "27ab5f69-2632-478e-ae09-6757dc8a804b", "value": "T1A0A69D90F99B90F1DB43193148ABA27F63306D054B20DF87E6187F7BE8776910E76289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422470, "uuid": "5dc95725-1b06-473d-be43-0f6a0072bf56", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422470, "uuid": "2d7302f5-bedf-49ee-b621-984df6cd4f9d", "value": "196608:8y4k9QT86cvIy/HC2GKStjsMPbvi+6uuge8oxks:2YQw6AIyCvKStJPbvF6ube1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675422470, "uuid": "e808df44-d360-4d22-b62d-ebd5e644d412", "value": 9680384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675422470, "uuid": "afbb981a-5c4c-4939-840f-8e510f722b90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422470, "uuid": "6a1edadc-3528-4f9a-a69c-40529a30d7a8", "value": "c4b1556b4e6200b07fa44d29d460c3036bbf5b4c4902d51fc995f8956315c2fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2851d54a-a3f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675452174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452174, "uuid": "49a3c454-98bf-4f77-a5a5-4759b61238bc", "comment": "Malware payload (Smoke Loader)", "value": "3b52ce5889083bd27555ea98db7b4821", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452174, "uuid": "f861f320-38dc-4f98-ad9f-8bd8df95f5b6", "comment": "Malware payload (Smoke Loader)", "value": "c4c7dc85ff835323b9f3c0a41cc8a84c14731142ec23d161f90f90ee32058aff", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452174, "uuid": "490e652d-a434-490d-846f-a9e816243786", "comment": "Malware payload (Smoke Loader)", "value": "c21e6c56b0e90858fd11eecf552ae6298f38fdb4", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452174, "uuid": "f6503b77-d75d-4aba-8f42-922ed2a1e760", "comment": "Malware payload (Smoke Loader)", "value": "20058531180209382a9fcfbf8beb95a8b72f0b62162ef0c4390372b321783e1e6fa1124a896ebcc6d25afa4624a9089e", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452174, "uuid": "5e4a7c6e-5b9e-46d2-8a0c-a1c38d9c74f8", "value": "T181648D02A2D2FC41D625CB729E1EDBF47A1EF9518E287F6A12185B7F1972172C7A3310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452174, "uuid": "0efa15df-8d38-483d-b7af-d04c1372f753", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452174, "uuid": "ba67ab2f-ba55-4247-9dfb-71fbdd207a98", "value": "6144:SWnwL0PLTnK7oFE7xE5boiQRalwKwpxg4oKjV6ptCbNKN:SWnwoPCs8+5bmolegXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452174, "uuid": "092bcf4b-5921-4c3c-8fad-af15251520ae", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452174, "uuid": "c52fd161-5212-42c2-bab8-de3df6b903db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452174, "uuid": "e10550b4-6e72-4284-a6a0-0df2a77f9e9c", "value": "3b52ce5889083bd27555ea98db7b4821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d9125d-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675454206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454206, "uuid": "a1327012-1bb3-49e7-9243-57955fa6fb8c", "comment": "Malware payload (PureCrypter)", "value": "e0cc6846911afa0d6c15347edde8aaf0", "object_relation": "md5", "Tag": [ { "name": "734e3c03e637737ad83cebb46eae00e3", "colour": "#18069F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454206, "uuid": "f2efa3cf-76fc-4391-9f8b-ad54e5a6c931", "comment": "Malware payload (PureCrypter)", "value": "c5a3f54351ede93cac138841565d56607e1a43a0c01be9c318b6b60455625972", "object_relation": "sha256", "Tag": [ { "name": "734e3c03e637737ad83cebb46eae00e3", "colour": "#18069F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454206, "uuid": "0fc8e397-215f-4f81-bf8d-d7ee82abde87", "comment": "Malware payload (PureCrypter)", "value": "2792acde511945bb86bc3ea94435fbfc01bd4253", "object_relation": "sha1", "Tag": [ { "name": "734e3c03e637737ad83cebb46eae00e3", "colour": "#18069F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454206, "uuid": "68174b23-0c50-4f09-b6bf-a0e6adb2061f", "comment": "Malware payload (PureCrypter)", "value": "864443dc63d8947bb4868e52158d8f4a282d43fd35c7989936f9b93ddcd4620cf08d0e1a4f4c8adef38e2ec259ea0d24", "object_relation": "sha3-384", "Tag": [ { "name": "734e3c03e637737ad83cebb46eae00e3", "colour": "#18069F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454206, "uuid": "aaed2a32-7ae7-4f4a-81a5-c0015839f735", "value": "T1D5C55A0271D1CEA1E7440773D4BB6836836487826653F38B29EA13295C173F5A6B8BDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454206, "uuid": "efaf26f3-4919-4b81-aade-07be2a910cf1", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454206, "uuid": "25a4b079-3dfa-4cb8-9cba-9cdab68c0799", "value": "24576:Yot7Ls3/2C7xhBJ4Lgw9S2W2iLdmUVTlGXoLuiZ5dQ/SstVdIgXgFhUpzemM0pmD:cBsKXddQqeIUiUpzemvZkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675454206, "uuid": "8fadd678-1d86-4af3-947d-2f2b83e5e24f", "value": 2660352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675454206, "uuid": "0b0aa3e3-23fa-4f3e-a424-d69c10d81a25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454206, "uuid": "25c42f56-14e7-4cb5-98f0-901be8bb2650", "value": "734e3c03e637737ad83cebb46eae00e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29862393-a3a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1675417386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417386, "uuid": "cfa27e2c-3645-4a82-ba87-4a07a1da25a5", "comment": "Malware payload (Mekotio)", "value": "8a449ed53ae453d27d1c70c4cd13b3e6", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417386, "uuid": "e2c5d8b1-3e6b-475b-82ba-2714e3abe1eb", "comment": "Malware payload (Mekotio)", "value": "c65cc9456350965b909eaa16b19f02f9ed6e1bba1288be7b8623f827dd9df89f", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417386, "uuid": "06a8781c-e230-4dbb-ac39-9f66f08b2882", "comment": "Malware payload (Mekotio)", "value": "78e1eac8c0b45cbcaa53d70679c1ba1729594675", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417386, "uuid": "26c69821-f7d7-4957-8f20-66e9662e293a", "comment": "Malware payload (Mekotio)", "value": "6e59dbd480fc78406e56042d5858451b58989a7469eebe845e60ac81554350a3184cd7d8469bf70b01c62a875bed9c6d", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417386, "uuid": "ea9961d1-838d-431b-8d33-cde04d1dcdd5", "value": "T17F762323719A4136D1EEC5754A2BBFD630F62725876250FB56C81ECE39E25E06332E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417386, "uuid": "b103e128-83e0-4d3f-8618-9e7a1327d707", "value": "196608:jeW5gia8pGbdkjKHMsgJhD38uuHlu1jY/8fK:jeoa8Gbdk2HMsgrDsu6u5O8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675417386, "uuid": "a28ad7ce-23ac-4f03-92c5-3bb1d9a3ddf4", "value": 7454720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675417386, "uuid": "664f4035-fbe7-4727-86ac-5d2fa4ac5a3a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417386, "uuid": "8ca70b7c-3278-4cb5-8120-ca8dce95d593", "value": "FACT63dcc.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd7af8d-a3b0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675421206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675421206, "uuid": "541ea223-996b-4540-a2ba-b5352bc22a6a", "comment": "Malware payload", "value": "818b4f67a76a098f86585b7002811252", "object_relation": "md5", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675421206, "uuid": "f1c42e31-2c4a-437b-8ea7-658f6320c0f2", "comment": "Malware payload", "value": "c6abaa1798fdc315947208387a9d98f64df938f08d83d4aae9963e599df8028e", "object_relation": "sha256", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675421206, "uuid": "3d7a7b57-4f2b-4bf8-a368-828e4d2ee504", "comment": "Malware payload", "value": "8c6843ca603edc75ab6e08b4c25ef28b3dc2d120", "object_relation": "sha1", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675421206, "uuid": "975fc839-fc12-4e67-824b-3b83f3ca4e4b", "comment": "Malware payload", "value": "eb42bb32ce174a8516505b2664f29e677c0f583a5585999e2fc7a7bdfd38b62cebb66474711237b43e8397fa3be1d7df", "object_relation": "sha3-384", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675421206, "uuid": "bccd00f8-1946-4bf5-96c7-1b56069fa1f1", "value": "T1F562D061D61C10F9DB009BBF8A2264C94ED1B6548CF03CAFB6047056B9DBE1646E2B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675421206, "uuid": "b42f9571-0811-432d-9d23-513d3026069d", "value": "384:KpTPtNthiBMqXUQcSgcNFOrXa40gZvu/C2K+JJU9j/AZ2R3:C5yMqXncpyShZvuquZ2R3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675421206, "uuid": "64ae546c-b6a8-4014-b958-ee4072916fb2", "value": 15123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675421206, "uuid": "cd6de3fa-0a43-4b2d-88ca-888ad4616bbe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675421206, "uuid": "dcf12f34-8b7e-4e41-8022-2c2833623bdb", "value": "Shipping Docs.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b0f175-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675454023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454023, "uuid": "4b346a48-f111-4766-9de8-2f066192ea6e", "comment": "Malware payload", "value": "3e3dfebd924fec783a8edf30476fb670", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454023, "uuid": "6589c596-3a59-40df-9981-2baa8d0770c7", "comment": "Malware payload", "value": "c6bba34f8198331c883212aeb76f4ee436df04cfc8a121c12401de1a35169f2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454023, "uuid": "ff8ff379-6e5c-4ba5-b29c-1cea09fa3797", "comment": "Malware payload", "value": "8bc18a4bd2c45211444f0d337ecbcf7cc64e799e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454023, "uuid": "c2be3cff-cc37-4166-9f0d-913d6c9fa47c", "comment": "Malware payload", "value": "363efde0b9ad8b87820e8634d8bb40183c50328d998c462c70a52d1157cc3579cfe81bda4aa4d26eaba66aaa5770ce2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454023, "uuid": "995374f9-30b9-4d3f-bd79-5f4b4e0a5c4f", "value": "T1468523527AD1C272EA6200313530CFA3F7E6A0359EB1E113ABF54AFD5F607E157252A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454023, "uuid": "8cf1f289-76e4-4368-834c-7a65115d877f", "value": "b65d7d05727ada8b2acd168719f50dd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454023, "uuid": "7374fb1b-0410-4cda-89fc-1e024e780e24", "value": "49152:NU3xUG0CtIfw9J20VrEbB84roN9PLuNlFIm:63YfJ0VrA84UN9SJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675454023, "uuid": "a45e0d47-a152-41d6-8d0b-ad8f9a1edd51", "value": 1872384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675454023, "uuid": "ec66ab7a-c3a2-4802-86ec-fb5bd9135f7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454023, "uuid": "403ebba4-015b-4893-a4e7-da72bed01711", "value": "3e3dfebd924fec783a8edf30476fb670.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b299b5-a3da-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675439467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439467, "uuid": "a7004d98-956b-48f8-bd9b-bfacd844a582", "comment": "Malware payload", "value": "a881838937a145cab27e5c9b439a1ff5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439467, "uuid": "6c7ed32b-44da-4867-a856-529150bb7df4", "comment": "Malware payload", "value": "c743ba08610d442531bb897a35748ba6fe897e730cea6e29377ba21141901326", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439467, "uuid": "48ef73d4-baf5-457e-8e2a-054fc7ec40fd", "comment": "Malware payload", "value": "4cac0241e3d0e1636a174134a623a879adb2a86b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675439467, "uuid": "821e42cb-f484-4af9-9188-66fa7f1df59d", "comment": "Malware payload", "value": "1892e2fee1a766975fb2c8204b4e44b5e79dbe15387378c820736f385be972370cbfe16f394e2fb45bfcbe9f32bb7042", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439467, "uuid": "d4717448-141e-4f32-aaec-88b6294846d7", "value": "T1B7F3C5252E18C792D4C40FB1DA015BFA8E7F1D67FB382D47B7807D2836722E78695988", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439467, "uuid": "6ab7f1b7-c3a4-48c6-afe7-e9e8b2650f76", "value": "06ac1f21ee2a357ffb0dd7db52cbbb13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439467, "uuid": "462f7b34-fff2-4a65-8551-f7c59f1a8912", "value": "1536:muW0xpn7JWWkH7Jx1Q3j1OefTixyvYZKmWuz82HnJq0Wm03O8gOo:s0TIVAJOHxyCKmW12q0WmG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675439467, "uuid": "0851fad5-5298-4d3e-871e-ec29266ec565", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675439467, "uuid": "118e7f3f-2ff5-4f46-bc3c-013c3b4d43c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675439467, "uuid": "b7def9e1-b9c7-4362-826a-2d6834ee78ba", "value": "c743ba08610d442531bb897a35748ba6fe897e730cea6e29377ba21141901326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80fad681-a412-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675463489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675463489, "uuid": "1b3c4e47-d4cc-4a2f-8cda-95de61099a35", "comment": "Malware payload", "value": "4889016cb4c6dc8612490d3f1023bc8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675463489, "uuid": "35b1c9a1-8f3c-4c58-88ee-fe25e3219e8b", "comment": "Malware payload", "value": "c7bcb4ba1ed82ed12877dee125383516bc3e64460e6b0d39a74b08cdbaeeaf6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675463489, "uuid": "cf261485-268d-4908-9688-53280470ee28", "comment": "Malware payload", "value": "425fe851d64d3ab266ecc6cf54c4f9dd7848cf44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675463489, "uuid": "4157a162-7a01-464d-84ec-330eb2f8925a", "comment": "Malware payload", "value": "3ac2539d3d80757ac6d10564858fb05638c3c410dd139fbcb1b50f1909f61789a2642ca30f708f4073e3b50f1b41773b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675463489, "uuid": "97d253aa-c4f3-43bc-b274-0430b5f01bfa", "value": "T1AD953341F273897AE003E2776C31A519BE3B7E252A301B0C715461EE3D776C5F96E22A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675463489, "uuid": "2dd8f5bd-779c-4691-bc3a-0d711a319812", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675463489, "uuid": "c0d5bef4-0bc9-4b6e-813e-5598ef703c4f", "value": "49152:ygyvFn4MkH90f0ZGbiJ0npo6tTMiXTkqwxKV1gxjPLCgv2MR:T+Fn47H9SoOi6p9nkq/Dgxjrv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675463489, "uuid": "6df325b3-7900-43a8-b761-9db9acd6e071", "value": 2035106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675463489, "uuid": "cf5e68a4-10a0-41d2-bd9e-44cbc9b968a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675463489, "uuid": "82ff3073-7951-4153-8ecb-fd276d3d6dd8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc12b965-a37f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675400452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675400452, "uuid": "7fc03b38-c240-402a-8bf1-25078cfc7469", "comment": "Malware payload (RedLineStealer)", "value": "58a5f24d38c6b64d2f6240b4624360c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675400452, "uuid": "80e4d866-356b-46d0-bb5c-b6d4266bc2bb", "comment": "Malware payload (RedLineStealer)", "value": "c845ecc5ccb60ddc7f986846e45937b902dbe48d346ed1fcf1f3d39334d87139", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675400452, "uuid": "ed1048b0-bf6d-4bd5-a049-97e35c14dc18", "comment": "Malware payload (RedLineStealer)", "value": "322cc8c767c547ecd671c545fb441067ba3c138d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675400452, "uuid": "d287425b-286d-426f-bbbc-27db62b0c116", "comment": "Malware payload (RedLineStealer)", "value": "64343d3ccfb86055b08a811ac90c04d524f173e069d75ff7097dc1474a165571a88e5cebc3ab3f101f48debf0f6b3639", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675400452, "uuid": "0a962f62-2e64-42b3-a084-ebba05039ec0", "value": "T1EE94B0526AA2FC41D621CA728E1EDBF4FE1EB5528D386F6612185F3F1972072C5EB310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675400452, "uuid": "08111eba-814d-4a23-89e5-58253de83805", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675400452, "uuid": "19190a93-38f5-4ce8-9cf8-525bd85e0f98", "value": "6144:GwF8yLLVou08SNP+OhPiL21rH1Go99u09zGfL2jM3lwKwpxckCjV6ptCbNKN:GwF8yfVphYpN171h9TUD20leK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675400452, "uuid": "7bbcf1a6-550a-4720-9ace-d9ab1cebb2b2", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675400452, "uuid": "c3f99260-c492-4216-9c37-bc8ffd588b69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675400452, "uuid": "4bbbf60b-0937-4963-8769-c8d76d54aad7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02984f24-a36f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675393269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675393269, "uuid": "7376fb43-4372-468b-b6e2-31b09e6bb31a", "comment": "Malware payload (Amadey)", "value": "ab70ddc9a8bbd563edfd8082d415e12d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675393269, "uuid": "dcad3acb-5de9-4246-873e-6adca3e8c202", "comment": "Malware payload (Amadey)", "value": "c8b40650a47638a0c575425601d9b9239f4ec9ef5ae74e73ee03fea4234243ad", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675393269, "uuid": "f41eb963-4900-41b5-b05e-77b24aee06be", "comment": "Malware payload (Amadey)", "value": "818bcc586b65e503ec1941c3319773cfb083b83c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675393269, "uuid": "b8a3bbe5-d581-4fa3-9983-438f100e82f8", "comment": "Malware payload (Amadey)", "value": "7f1e9000464c8727abcf6620ade3a4e904383ee39048ffe6272c6bb45f4c61735dce6ad72cebc47e4c7048846a4563b5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675393269, "uuid": "e2010b6b-509b-4ea1-96d7-bdafc90e086f", "value": "T1CB648E4262A2FC53DA21CA72CE1EDBF47B1DB5518E786F662218DF3F1972172C5A3210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675393269, "uuid": "77c59994-35bf-4c31-a337-85628686e569", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675393269, "uuid": "e7634bff-8aa9-4a1e-b3bf-1a62da899c97", "value": "6144:VbwjLetoWYkhHZzouczZfo6aGYlwKwpxAm+MgjV6ptCbNKN:VbwjStLTHxozZfo6aPleAmZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675393269, "uuid": "a9f85ea4-9b12-463d-9344-589726471bb8", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675393269, "uuid": "89c0ff81-c3f1-45af-b9fb-edd01b87d218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675393269, "uuid": "7fe1c0be-8c89-48d3-b50f-97bd5fd0f74e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df6f2d0d-a3a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675415544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415544, "uuid": "9d0b1c3e-be3f-4516-a91e-2a0c319e01b6", "comment": "Malware payload (AgentTesla)", "value": "91fbac2ad79f0afb7069ea7f0e96d146", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415544, "uuid": "0ca0f756-4107-48bf-b32b-061bbe000a37", "comment": "Malware payload (AgentTesla)", "value": "c9182b0781c72fa1ec123613fda3fd97df12fe39be03238711345d424de3cfc3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415544, "uuid": "dc35f705-bc28-44ec-958c-988cc31fe9b2", "comment": "Malware payload (AgentTesla)", "value": "db6af0c18b3288aaef6a5a3b65fa76354a94d192", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415544, "uuid": "63a53ea1-9116-4a7d-933a-7804fe42cf19", "comment": "Malware payload (AgentTesla)", "value": "b2935037c4130506d424ccebe3ef894002ca1c5ca89608393aef4a4dcbcf64e917fdc1d938f4ce81741f5efeaaa64b62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415544, "uuid": "af7b8b1d-b1b7-4c59-9230-389b896b0f24", "value": "T1EC15230173838B08C90958F5C2D7062C49F3679BB9F7E55A39958BDF0EA13A1DA887CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415544, "uuid": "858f5d8e-12d9-4ad4-97e6-6f73e13128b9", "value": "24576:SVgSJ8E3TR7P8jRmK3mE8uO8Mw+4UwiZNK6Q:SVgSJ8ESRmJluO8MhoWEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675415544, "uuid": "f8e4d0cc-3ade-4d69-bde8-98502d6103fc", "value": 910336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675415544, "uuid": "9d1b4df7-c2f8-492a-b31d-ae10216450a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415544, "uuid": "9909f2ef-d182-4067-a9af-64c1031f7a89", "value": "Fedex AWB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e090005-a38b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675405422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405422, "uuid": "9e80e6ff-a95f-4497-b52c-eab7190e396f", "comment": "Malware payload (Amadey)", "value": "320901f2b1f31440d32ca70e06531e03", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405422, "uuid": "e55a5689-b3b7-4ce7-905c-90d7dc37cf70", "comment": "Malware payload (Amadey)", "value": "c98c6cce1f6d5d8428978db579c7a281de9546412515c9e8f9714659c33b31c8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405422, "uuid": "ad4c4f0b-45b3-4058-bdab-ed239c3771b3", "comment": "Malware payload (Amadey)", "value": "1e7b6f66ceab6675b40f379d2b7a27449e88d5b5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405422, "uuid": "e187a5f5-4b6d-4d05-8d78-be0926372826", "comment": "Malware payload (Amadey)", "value": "66afdfd617d02f962893c62a6ada6e0b1fe5acec02d1955779387d6e0d59d2c006d6bb2c0177ef41932f47e319395aeb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405422, "uuid": "74940108-f74c-4a99-b005-7483af2bf563", "value": "T1D1B412327580D4F3C1BE8574B918E781BBAAA53055798C5B3B6C0ABE1FB33C05A36355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405422, "uuid": "8ec13b0f-2a97-4db6-8c52-eb2bd0269e9c", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405422, "uuid": "0098bc00-7d12-4434-980f-bb04e92a90cd", "value": "12288:i7F8hCoBt8n0bC0/l7HyHGJoF+W6AxtIVW9p:iBBoBtpbC0/BSmA+W6AxWW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675405422, "uuid": "ba7bd28e-5e19-4cd6-b439-2b29cacb8897", "value": 525312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675405422, "uuid": "29059045-0a87-43c1-a331-4a835f00b683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405422, "uuid": "c8a4e5db-2c08-4e66-a1f1-e4410d413d34", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0461063a-a3f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (XWorm)", "timestamp": 1675448677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448677, "uuid": "09dd56aa-48ec-41b1-8ecd-d7062239e8e0", "comment": "Malware payload (XWorm)", "value": "bf7fe9c6c486d15a4da480c3e6d12396", "object_relation": "md5", "Tag": [ { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448677, "uuid": "7e7ccb6f-8181-4ba2-86a1-c6e52e8952e5", "comment": "Malware payload (XWorm)", "value": "c9c522936a3b964e6926bfb73adca91f0091094964ce7a768418a705ec871502", "object_relation": "sha256", "Tag": [ { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448677, "uuid": "652d580a-baa4-4d0a-802d-c48cec239d87", "comment": "Malware payload (XWorm)", "value": "9edce6cdc831b66d55484e4169143ec134abef75", "object_relation": "sha1", "Tag": [ { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448677, "uuid": "6a4839df-a174-440d-b30e-905879fafd79", "comment": "Malware payload (XWorm)", "value": "88c732d2877770db6bff857f7bfc8c0a31be29061fc01ae3ea0199b351b27d0542dd39f9e6646d4aa026ea4def3a93e6", "object_relation": "sha3-384", "Tag": [ { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448677, "uuid": "378b00ad-d045-44cc-be30-f0e47b784267", "value": "T192B3C2DAB81F8049525980DE92E4DC2F764F87C27923CF207604B9CC6216FAA16535FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448677, "uuid": "e488e987-6a0c-41ad-826d-85284af4beba", "value": "12:O+h3awpefBNnj5H6NPnqkc+h3awpeZ9nF6NPnJo:O+9xYZNj5wqh+9xYZlym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675448677, "uuid": "c9679675-9f56-48d1-90e2-e8246b845479", "value": 114274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675448677, "uuid": "d9fa86f8-b238-4bae-9946-1eace0ac6543", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448677, "uuid": "4abf0fad-f3d4-49ab-a832-2f232c5be28c", "value": "new.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e355c39-a3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1675442413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442413, "uuid": "a45d9c86-d6fc-4447-bbda-9e59eda826dc", "comment": "Malware payload (Fabookie)", "value": "c7e0666ac264eff1d8d9a8d30f7c8d50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442413, "uuid": "1f3aec2c-aa69-4153-82ee-40effeeb279d", "comment": "Malware payload (Fabookie)", "value": "cab726a29297e3feba59120e1f2be6f8c15f29a0acc2008a493dbf0850ecf8d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442413, "uuid": "6b4b79c5-0533-4c06-9239-c0f184667bec", "comment": "Malware payload (Fabookie)", "value": "2a2913f72905a10a60ee3189d8891eedf5a19398", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442413, "uuid": "73543f84-43bd-4e0c-bfd2-656c50910aa0", "comment": "Malware payload (Fabookie)", "value": "d3a1338dcb2141d088013a1cd1671657c3061be4f9270e62d913ca8f30ce2ebfb8e2b565c942413385c7da5a2360b82e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442413, "uuid": "fa3c2af9-c709-410b-a8b7-5f86bbb119be", "value": "T1E3F512FD62443358C41E8C305533AD45E1FA962E16E9C5A97ADBBE80BFBB811C916F0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442413, "uuid": "38153e5f-f4f9-4093-a3b9-39ba3a0e5b8b", "value": "245fbb05d3da4d7c6badd5cc3e1f9b98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442413, "uuid": "8ff2773d-84d5-4203-8072-09ceb273b29a", "value": "98304:hjIQmy+KW/U77AZOBTCUw3A1MICMwQEVC8:npW/U7cmCUw9InEVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442413, "uuid": "171af7ec-5efd-415c-9783-a095249e572e", "value": 3650048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442413, "uuid": "e5d6bad0-0dcf-49da-b3a2-4a85cbcce56a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442413, "uuid": "0d02f022-fc0b-425f-8fb1-44dfa3cf01c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252ae711-a3ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675419097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419097, "uuid": "c316015a-a323-411b-bc8b-d856ed36a87e", "comment": "Malware payload (AgentTesla)", "value": "32de4a61880f85a18f34011e7a2113db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419097, "uuid": "2c4c123a-9adf-4bc6-9b38-d744a9c9eb0c", "comment": "Malware payload (AgentTesla)", "value": "cac42576ce1d941b30261fea52e04e229a88db712de63e283320dc63c3e13e20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419097, "uuid": "38c10133-08a7-4ceb-afc1-8cc76cf51d77", "comment": "Malware payload (AgentTesla)", "value": "4414e31e03eac85715bcebb726f737b35b5aafb8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419097, "uuid": "c0c59b55-5f08-49d3-b02f-cf192ff1285b", "comment": "Malware payload (AgentTesla)", "value": "2ece377bed841058fb523904e7d8b2d7591cd2471ae6f6af0d8336107d43458d70533be8edab1d02bda84290a6a88805", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419097, "uuid": "927268f4-2c24-4c6a-a6eb-9c16bc358d78", "value": "T1B3058E6337B099B2F78720B204247B9C6BF07513BE56E2939BB737C06785DB67298142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419097, "uuid": "9d462dfc-9fd0-4982-a348-d35d13e7d54e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419097, "uuid": "92de9570-d4e5-4cc9-8a7a-a30374c93a91", "value": "12288:dhefaqG4yPax6Fy2MxzpekalIzLRtuhU6+YLgsRWa/37EC3:LeSqG4yPax6F0x1eks+vuhU6h/3gy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675419097, "uuid": "025929ba-c476-4f44-84b4-8e09e8379c0f", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675419097, "uuid": "ec9058e5-822a-4134-b4bb-a9c698580c73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419097, "uuid": "7125c790-c27f-4771-89b4-f89690203c87", "value": "EVP I_287008 O_298659 C_4091 PO_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d74e1e-a398-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675411230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411230, "uuid": "4afb62e3-6ef8-4959-a6ae-8a89124fed92", "comment": "Malware payload (DCRat)", "value": "47ccecf2258d29d638401f6df97c5be7", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411230, "uuid": "7beeb742-4705-4611-aba3-4e83436f62c6", "comment": "Malware payload (DCRat)", "value": "cb935fa3310496d857ca61490428ef25f4a2d88c213627d9bd9a887b06323d87", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411230, "uuid": "450c3aec-b803-4a6c-a8d1-9bbdb2f453dd", "comment": "Malware payload (DCRat)", "value": "c91532cc7664f8a1c06ceb8a3f6611b48980dc22", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411230, "uuid": "d9a5cbd9-1c6b-4063-874f-5f31229dc261", "comment": "Malware payload (DCRat)", "value": "78ecbe595d89c62b114f2e7909b6e4bb2bb59c1f97edd7c6d25bcfd1e7aee2c3040b5807b64090c9d2eabd82abccdd4c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411230, "uuid": "94f904bc-fa25-4645-a093-7205d4a10fdf", "value": "T14F657C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411230, "uuid": "2743c857-dc50-4f50-8600-e6037244d6be", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411230, "uuid": "94126052-1de5-4a05-8680-b33167435952", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675411230, "uuid": "bd835eae-5aeb-4426-8672-5a5debf9b614", "value": 1409677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675411230, "uuid": "dccbbe8a-1d72-446e-9465-70713e214f7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411230, "uuid": "70803d5d-584a-4d18-9d22-135162e7a179", "value": "47ccecf2258d29d638401f6df97c5be7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df79b01c-a403-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675457205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675457205, "uuid": "448cb368-6c52-4ba8-bfe1-2b922912a75f", "comment": "Malware payload (GCleaner)", "value": "1a1a066e24097030d18dcb401a364645", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675457205, "uuid": "1c97b4a0-994b-454e-9402-dc0a1c00b601", "comment": "Malware payload (GCleaner)", "value": "cbf9e05b505c04e0ce351ffcfdb44ce5eff759f48ffe4612ab454c6c6f7a890d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675457205, "uuid": "0a15db86-291e-4238-b933-fa4b02ff4d13", "comment": "Malware payload (GCleaner)", "value": "e26603df62b3b32c0d4eb4ffdc9aafca9a105dd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675457205, "uuid": "d327cde8-0255-4aae-b4f2-e6dd5a90000a", "comment": "Malware payload (GCleaner)", "value": "52a9c0c583901746149a6b03105a06b83ce539c96506acff78f362d4a860567c769935ebb6be8048f982408282b9280b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675457205, "uuid": "725020e5-b919-4e1d-8826-78f5d266a11d", "value": "T16995334124F1517AE503EB3A2B727541AB12F9A09074046871AE79DF3EB37B0FC5A2E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675457205, "uuid": "0ccda2ef-5b54-41bd-b260-3342a289c1f9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675457205, "uuid": "543a5ac0-ed03-4005-acb1-b63c3bc3d1cf", "value": "49152:ygizoh/wqNR7MWBUXJm1lZ5Ax+YLMQyxVHHLCgv2MR:T//PNR7peX2ZSlLMzVHTv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675457205, "uuid": "0ea3e748-6bff-4e69-998e-f135b15d793a", "value": 2055330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675457205, "uuid": "5e74ea52-3070-48ea-9bfc-fd9a7f78e678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675457205, "uuid": "03b6ede1-8f19-4dde-8532-4e375610c359", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787b1d91-a3cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675432981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432981, "uuid": "9fdef2af-6d3c-4230-b0e9-761c4ff94574", "comment": "Malware payload (Amadey)", "value": "683bc5768bf765e829f0cb38d69be917", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432981, "uuid": "358da91a-9a38-4feb-8ed1-5d602024b899", "comment": "Malware payload (Amadey)", "value": "cd8a883483acd4c827f0644bcfafe76432fa05c25bd59bc69d57066b97a65d26", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432981, "uuid": "d2113471-9a6b-42df-9254-62d4673e0279", "comment": "Malware payload (Amadey)", "value": "67a705b8b83c7b685548462803c836e8693ab842", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432981, "uuid": "c2cd4b3f-0793-4d7f-b3d2-99a502cc1003", "comment": "Malware payload (Amadey)", "value": "d9973f636633dac9839e6828a9949ab690695fc0885ebda4e18fd4e892ffcd23f93938d2adaff3d79649ce27479392f3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432981, "uuid": "e873ef76-3bb7-4a6a-afeb-cf6de7c36bb9", "value": "T1D214C0323290C073C17A11308864D7A6ABBEB43246774A17FB9907AA9F736D056F735B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432981, "uuid": "d929442d-ffcd-49be-8872-09b5e65cbcab", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432981, "uuid": "996b0a56-c302-46db-b8f7-1251cb4703dd", "value": "3072:5eUC9+/A662kLIjypMTWCj51XOh85/nYO0qLi4faHtxFZhhRXU:5el32kLqyqT0svdHaHFfXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675432981, "uuid": "a07502ea-609f-45a6-bc76-00b56f4d0d0c", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675432981, "uuid": "ae181a91-dcc0-4a3e-8680-db82730d335e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432981, "uuid": "997453b4-2da0-4cae-9f16-6b8e643c2d26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4741f2e0-a38c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675405840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405840, "uuid": "6ddd2ab5-9d39-45f2-b788-11247016ed5b", "comment": "Malware payload (Gafgyt)", "value": "c7aa9ec5a4d29f5829716b60c62bac70", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405840, "uuid": "e971964a-3be9-4828-a5fd-30156f7d1b23", "comment": "Malware payload (Gafgyt)", "value": "cdf16795ec6ea3857851ece799fbe687e0b646a3f555ebd34199a64500b705eb", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405840, "uuid": "62e2018f-7ea1-4741-8de8-fb6283d7dccd", "comment": "Malware payload (Gafgyt)", "value": "1dd56db66741f03b30552c1ecc8238ee511c5b96", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405840, "uuid": "b542e5cb-23f4-4c39-8cd0-92ceadb91f69", "comment": "Malware payload (Gafgyt)", "value": "91a8e0cfe40c808d0595935357140f82b0b6d305eafe9f2274f388d67d1e74a828daa2e5dedd753b5d29aa258c318c5f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405840, "uuid": "86715869-732b-4c29-b87b-32e2a844f502", "value": "T16C836B23A651C67BC0875BF92BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405840, "uuid": "206b28d5-edcd-450b-8422-2c9fa303ac54", "value": "1536:eB7cH1LhKlBqIKVhuzdPQq0aJP9sWtjG7ew3nzLWODPPmoIYuOVje+ZNne:eRMhKlcluzdPv0o+QK7eknzL1DHmrYur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675405840, "uuid": "a827b660-b801-40a0-98de-89242f86f031", "value": 85796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675405840, "uuid": "b105ca12-e6cc-40f9-96cd-c694b60a9171", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405840, "uuid": "42cd6fc6-4b68-4f81-8dfe-d623b0ecf87d", "value": "c7aa9ec5a4d29f5829716b60c62bac70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19aef92c-a3f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675451720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451720, "uuid": "6b370384-da31-42cc-8d26-09cb9605e48b", "comment": "Malware payload (Amadey)", "value": "35e1eae2088c0d0b9c7cef0326b52137", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451720, "uuid": "4391a251-60e8-4e7f-b637-03e607747cb4", "comment": "Malware payload (Amadey)", "value": "cdff27759fc4225de77938ecee8dcf3df13f00ca1a44083408e5652be8f89934", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451720, "uuid": "852aefca-21bc-44d9-97da-53bebdbe30f0", "comment": "Malware payload (Amadey)", "value": "68883fcd329e0bdd9fb9eb489e4ee25f249f38d5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451720, "uuid": "aab8ffbf-95be-4cc5-b54c-0541b600381f", "comment": "Malware payload (Amadey)", "value": "f6ce2fca52c1ee6092fea115678de3b23b4a316d53ba805d46711eda9d568e6f3d9cf7071a87a9d82b1053cec95b9a6e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451720, "uuid": "47daa072-88f0-40c0-b1d2-39dc23749bca", "value": "T1CFD4122135A0C431C27E403C6864E7A1EBEE71310AB9951B77A5477B4F706E1AA3E78F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451720, "uuid": "ee156e91-007e-4726-857c-ab21da8f9c32", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451720, "uuid": "cdc178a4-a3f6-411f-93dc-05323d3a1c5e", "value": "12288:TeWlXHb+N55C8h+MJBaWb8B4J7aicm2sGUfXnxFdtQYd5SL:T1rydh+s1wiJzcsBnxF4W5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675451720, "uuid": "069a8aa4-db1f-4259-9444-62d1e4c13164", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675451720, "uuid": "021468fd-ba4a-40ec-9f96-3168ea5c2f35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451720, "uuid": "adc69616-0fdd-4228-ad58-781abf9a3925", "value": "35e1eae2088c0d0b9c7cef0326b52137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b58a101-a3fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675454487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454487, "uuid": "46c31252-04da-455a-9b22-183388a69ad8", "comment": "Malware payload (PureCrypter)", "value": "5db56a2a691ad99d68488038487b9ce2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454487, "uuid": "3609b7d8-ee75-43e4-9b8e-527538233589", "comment": "Malware payload (PureCrypter)", "value": "cee061e30661c66afd79c2db18777cf4555e3d98b1efff521d1007a5c16b815d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454487, "uuid": "0b8a579b-03dd-4585-a5d7-83ee3b84bb85", "comment": "Malware payload (PureCrypter)", "value": "d75dee71d67ddf3f94c290a19e51e68e49d8136f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454487, "uuid": "4a4aad86-858a-47a9-857e-1f3a89dd295a", "comment": "Malware payload (PureCrypter)", "value": "4d9ba6e562a48560478979267775222432674094441a74f2bd49330b2d95ee695404d038e13ddf48445d2cce159bb6f1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454487, "uuid": "e7cc79fd-e367-4e6e-8d76-5869a806e492", "value": "T1E2C53A02B1D1CE72C2940F77D49F98144760C722A287F36B2AB52329E8473B5AF596DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454487, "uuid": "16c38e0f-8336-498b-8aa6-d16f5bf9b2a0", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454487, "uuid": "f00bb104-b202-41fe-9ff8-aa047f1ea053", "value": "24576:S2WeSZhBOYaw5tJkzmPolpkKkv2jBHBAXIWV0AK+XfsViE17nQt6kqE2npFvSjbx:Mh5tWzmPZNujNKXu3rQ0LkMT4vjLcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675454487, "uuid": "baa9860c-f62a-4528-9f0b-32fb5557a9ab", "value": 2529792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675454487, "uuid": "30b81db2-d7a7-4b05-b930-a6efeca1c033", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454487, "uuid": "5d664a0d-a87b-4994-b932-518e9896578d", "value": "ccfe4b20694730b6b8834d85cd188c0f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb7bb58-a38c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675406119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675406119, "uuid": "5e3c5ce0-d6ca-4590-8406-d6cb930bd868", "comment": "Malware payload (RedLineStealer)", "value": "263b8035deee94792c6dae8c28caa3a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675406119, "uuid": "b67760bd-9231-4553-986f-cb0b1147e4da", "comment": "Malware payload (RedLineStealer)", "value": "d014221e7665a769df2f0a71ea6c7254f87061bba767ba50165e8f48f3d5a8f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675406119, "uuid": "7d0cb41d-9cba-4785-9f38-7d42a809795b", "comment": "Malware payload (RedLineStealer)", "value": "b6835e5ec97aada95d6f2e653327f28f3f2779c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675406119, "uuid": "ee80e713-eb4b-4c90-b01c-7c0536500166", "comment": "Malware payload (RedLineStealer)", "value": "acb127d3d0dd76831c37fc8dd7102ce2dcbf84fd5fbf6a81e5ac9b908a3ea44cc23ec6565f5606c41f1a81fa320fbd2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675406119, "uuid": "1b5b8aef-aba5-4222-ae7a-240ef97185c7", "value": "T1B2D4D042B2D2FC41D621C6728E1FDBFC7A1DB9518E687F6A13189B7F1572163C6A3220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675406119, "uuid": "1f8e2eab-f1e7-4d3a-9e96-ea4f663253f3", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675406119, "uuid": "04cb777f-1ca4-469a-9673-687fa10c5efb", "value": "12288:3cdGMkC2aK2ZlndfyQotdjFQXbEYRuCcvgK80yYU/7ePZt:2lhK+fyQ2NFOfuCWgKLU/7ePZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675406119, "uuid": "8a9a05d9-cff4-4004-8e63-0af9052ecdcb", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675406119, "uuid": "9946dd69-e291-4c74-8a91-f7b4c86d9ec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675406119, "uuid": "86fbd147-88a3-48f8-b128-382ab920125f", "value": "263b8035deee94792c6dae8c28caa3a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea4fcd3-a3f7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675451782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451782, "uuid": "3f1fa2ad-063a-4d75-bb6f-943888609ca1", "comment": "Malware payload", "value": "b09dd1b9352c146f30aba1d335a9f8c0", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451782, "uuid": "e5435574-6738-4e74-99e8-601a9055a3ad", "comment": "Malware payload", "value": "d089b6082b4f5ecf765148ffea5885d8cd81e9e078d69bee786be9e6d60a653f", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451782, "uuid": "8f7d9c66-6e15-46ab-9559-23ad775ad906", "comment": "Malware payload", "value": "ef60833665cd779aa14a9edc0b9f6ce59f942736", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451782, "uuid": "d0f03029-69b3-4a85-9170-ce0b35db7b5e", "comment": "Malware payload", "value": "1a9b508ce99c1056a3a949695d1ffbcf6bfb1e1e3d98cc86bfdb54462e7f71b8cd99dcf5355edabc8f261a66ab14aed7", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451782, "uuid": "8b4d2f25-7755-446d-97ca-dbc676a3e275", "value": "T122F10B707189982A95AA05B7B2327FC30DDFD8B38375571436BB297FA8C60B00A473D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451782, "uuid": "17d7f175-f7d9-4c5e-a9e6-0d11bcce3377", "value": "192:3VLQFlqqBA8tRKaJL7JL/gTSjP+bNztibIdV9L+kLcqCqNdxktQ2H2j:ZowaJL7JL/gTSjwNzCI5L+kLcqCqfxkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675451782, "uuid": "67b8c82e-519d-498d-a229-fa345ff25188", "value": 8039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675451782, "uuid": "3d18dd45-ae77-43b9-a3fc-e17efd6230a2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451782, "uuid": "4178fd9b-18f9-4277-ae7c-4f7847d34c78", "value": "INV.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae114ed-a3ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675432475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432475, "uuid": "5c20b868-2f92-48c7-9679-a189279ef536", "comment": "Malware payload (Loki)", "value": "790dbaf50a1f32404df6b8229ae649b8", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432475, "uuid": "6435d636-da2c-438f-9ec5-c2bc1e789862", "comment": "Malware payload (Loki)", "value": "d08d1a989a97dae9bb1392e4d7024832cd78379a7528f31dfcb8fd48261ad5b5", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432475, "uuid": "9cfa05ff-171f-4fe7-b45f-4daf00cef642", "comment": "Malware payload (Loki)", "value": "f4d953f7f908923ed9f19a1e48b78972abe6b11d", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432475, "uuid": "03a2a318-c4aa-4c8f-98eb-bd0f5b5a5327", "comment": "Malware payload (Loki)", "value": "c67bba61b4755d37383542b02e680bdacafa19ef810ea00a42219f46837a94cfd076441750e59cef8ad6e83b3ff4eec6", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432475, "uuid": "a1605350-9605-4fbb-8495-2ad843af426d", "value": "T153F48C9377B198B3F68B00B5042837CD2FE07503BE85A257A77B7AD09B518FBB698141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432475, "uuid": "0bf8ff54-6fc3-4584-b017-39a20b46e597", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432475, "uuid": "13035cd7-f5a3-4592-b2f7-89f12383f7d1", "value": "12288:02iNZlSE+At6Fy2MxzrZ2A8saJwwW+CzX4cy6FRgMrRjfhl5q799f3pqG4yPa:01dH+At6F0xZ18sewwW3rlngMljfbE76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675432475, "uuid": "9aa2eb95-1308-4007-8780-b3c95f377ee6", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675432475, "uuid": "40dbe54d-86df-486c-a57f-101e8ae7baa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432475, "uuid": "4cc8808e-3c03-4be8-9b5c-dd4e0491341a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60224914-a3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675442389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442389, "uuid": "b921e622-52a4-406d-bc81-2daf0d229083", "comment": "Malware payload (PureCrypter)", "value": "6e1a50bcab9ee8765837b2d3727279de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442389, "uuid": "7f7cf873-80d0-48a2-8298-84ab09c7e2a4", "comment": "Malware payload (PureCrypter)", "value": "d130428602c948d1cfaa428efc21757ed7ab8f588838799e691c3959da4afb32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442389, "uuid": "517270be-1856-469f-8ec5-c157dadd2ff9", "comment": "Malware payload (PureCrypter)", "value": "2fb81bfa6d8f82060194e065753c36c7a3f034dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442389, "uuid": "e1bdf109-5d54-41b3-999a-fd3338d1dde7", "comment": "Malware payload (PureCrypter)", "value": "4f7471b1b2d7b44331a6c3371f809772cac43ea58eb3f975431e8be2d83edf9a1596ee8cd3dbb907fc3d1f4fae387924", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442389, "uuid": "9ca84d62-e38b-4c5c-8d79-888a32da1fe9", "value": "T1EB45336B35944AD2C8818C8BDD93372B0ED82517B2123F561BBD9FBDEB448B837B9110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442389, "uuid": "85ac5035-1134-4e8f-969c-5dca95cadaf5", "value": "24576:D5zvh2ajImqTsAbj/pI8oxrWwOIVlC8PhoXHNOsJuYssdDVCj0:DFpzN+s6I8oNWwrPUQskmu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442389, "uuid": "0cbcee03-a5ba-42fd-882c-3982a320eac6", "value": 1229008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442389, "uuid": "2fc56e6d-fce6-4021-af9f-04e5bb620d65", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442389, "uuid": "3bfa261e-f6bd-4e64-8082-1d800c76b2b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d299f3b4-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675454177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454177, "uuid": "10d38fe9-7b76-4cad-a49e-f984e1fc6120", "comment": "Malware payload (CoinMiner)", "value": "3c1b3455b8bea8e7836ebd349c435f2b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454177, "uuid": "2324b7be-9e99-4634-a1cc-fa88ba014f04", "comment": "Malware payload (CoinMiner)", "value": "d1e7c1eb04f5beb2b5ef0f521450178182038acfe6ce9dcfe1bc83f6441f88af", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454177, "uuid": "a9f0064a-2459-4da9-b59a-f019f1986320", "comment": "Malware payload (CoinMiner)", "value": "859d2e8717ae15deb3204f8228baaf57a68f34d4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454177, "uuid": "566f0e04-2ae0-44a2-ba3e-262dfa813774", "comment": "Malware payload (CoinMiner)", "value": "298763bbdd05157e434a0c4130bc12a5333835db21d3de5c4dcda9f09a5a4ccd600de3b35fcfd88e04ec52493f22a273", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454177, "uuid": "d99c64b2-55e9-48b5-840b-fd415aa8017d", "value": "T182F501336358CD69C4543D38C79AAEF397036C74DECD0A7B7380BE0A3532A859D9694A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454177, "uuid": "c3b5ad9b-8f58-41cd-8ba0-a93b0779ad65", "value": "bcd3fe804530e8575ac6b829cf67aac0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454177, "uuid": "98a1b7fe-0542-4f21-a744-2d4b08878438", "value": "98304:DN2z2M78E8zibH9PF0rXwZj7+cspC+UqEXcr1UV:al8zibx/+xocr1UV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675454177, "uuid": "8487a636-2294-44c2-8829-7c2f89bf66ee", "value": 3470848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675454177, "uuid": "acc9c902-92b5-4c26-816e-f7d213480f21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454177, "uuid": "0740a22f-39f7-4bc1-8a0e-34a00757b650", "value": "3c1b3455b8bea8e7836ebd349c435f2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "655ad530-a3ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675420064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420064, "uuid": "9358852b-9fe1-45d2-bd36-0478aa4a06e9", "comment": "Malware payload (Mirai)", "value": "0f555ce3dcc43343f59874e06b896c15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420064, "uuid": "98f3d05e-73b4-4730-9074-672d29dd0860", "comment": "Malware payload (Mirai)", "value": "d20b4eeee0bdf1fcfbda53e7ac2270f78ec55fd5792ab4cee5a5730437b05199", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420064, "uuid": "1d5de145-de4b-4564-af40-7ef9e63e3c8e", "comment": "Malware payload (Mirai)", "value": "3b73cce1d0b6f6bc40ce560e9ff3bee9877c0cf2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420064, "uuid": "d336b13a-cb80-4939-8a1a-54b31e0532cb", "comment": "Malware payload (Mirai)", "value": "e5a3ecbbf3cbc57edc62bab24d47bf81a6f5d49da70baee6432259dd3440ab1a3922267a6f6238f527a537ee35bfc75e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420064, "uuid": "d037cb57-6dfc-4494-9d09-1b594d573f43", "value": "T170736DD5B8004E7DF95FD6BE81224A0CBA2173045FA30F2BE667FCA32D72199AD46C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420064, "uuid": "8f64195a-6fd7-4756-bf19-07c4d6a2b962", "value": "1536:OEpRwHZVxocdJAo4twkrrySq5Iyhb91G0QXD+h4SYfM6zu8zY/h:dApvAo47ruayF5OSeMWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675420064, "uuid": "f9574db2-30cf-4c69-89ed-c0006c7e2cd1", "value": 80292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675420064, "uuid": "a1709ceb-7c84-4102-901c-ca5eb2bf7c60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420064, "uuid": "5c1e077f-4fd6-49b8-a09c-5e2bf93a673a", "value": "0f555ce3dcc43343f59874e06b896c15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14269eda-a41a-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1675466743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675466743, "uuid": "e00fb470-fc74-4021-88c4-e2eca39a1858", "comment": "Malware payload (DanaBot)", "value": "14b6b9f3f83e96f00d832f38babc9dab", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675466743, "uuid": "b031d8ef-63c6-4851-b555-f6c3c1999ab8", "comment": "Malware payload (DanaBot)", "value": "d3770888bbcadbc8b129b9af9952ad251f5f61b652706fa1efda41644c8f68cf", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675466743, "uuid": "7eb1c7bf-fc4d-4d6e-a650-045540c6d99f", "comment": "Malware payload (DanaBot)", "value": "c91a3fcea88046a56c4304e744c8634d577f9e90", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675466743, "uuid": "0fe9cd0f-6826-4ec2-873f-7e96ea8de462", "comment": "Malware payload (DanaBot)", "value": "7d9c7ccc5f283dbeddc1b86f72e73d715da1cc9de22b449d8ff439de148cb0e7d724f32ab69e9b275be8207056c96f10", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675466743, "uuid": "3ca8d1c2-f3bb-4087-90b6-363d039f8716", "value": "T15B7633CE4F73770BE33A3C7DDCA2C2A2A15A3BD5291A12F484466EC5E2E11B45F74921", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675466743, "uuid": "481c48b5-eafe-4c30-95a9-ac18655d1fd9", "value": "9c5dbad9f39a2527082e88a0fe3ac89e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675466743, "uuid": "823b4b16-597e-4d8c-9bcc-da05b0a9b9a0", "value": "98304:y5zQIJRC38QYCAdX2Yz4Btye5Zc32bhDVew9NO7wXDefLIicZsZQL89AV0vNezgQ:y5kdscbJox7XD8jN2QW3mxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675466743, "uuid": "0e13c4d7-5fb1-450b-adb1-40ea9bd28151", "value": 7122944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675466743, "uuid": "3ab08839-8991-4141-a1d3-dfab375704b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675466743, "uuid": "72e9983b-0aed-4e8f-b2dc-cb96e3cd00b1", "value": "D3770888BBCADBC8B129B9AF9952AD251F5F61B652706.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23288d04-a3f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675451306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451306, "uuid": "d613e4cd-6a15-4fff-b94b-da6b788661d8", "comment": "Malware payload (Mirai)", "value": "d4c4529a24227fa2457e9b0d4edc2151", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451306, "uuid": "386919ec-9f82-4e0c-b02a-bd547bce5b81", "comment": "Malware payload (Mirai)", "value": "d3e0e00cecb2e611d93e388403c7a87baea4ad39fef8dcba7c52c75fccfadbcc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451306, "uuid": "ac6171b6-3a24-4b45-943e-efb4cad07962", "comment": "Malware payload (Mirai)", "value": "fdffdea0f1275904bda72ad46a82da7f0a5516d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451306, "uuid": "21f9b11f-1432-4ae5-a48f-812a5fec9b62", "comment": "Malware payload (Mirai)", "value": "0a16070393e5c4594a8be09b887869aadf25ed3ed5f831b4f794c3d07a674d6cfb7272d948d449a71f2f255045075494", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451306, "uuid": "123deade-60d7-4733-8f14-91524a5b5785", "value": "T192631A86F4628513C6D416FBB66E50C8375A43AAF1EF3202FC210F543AC694F1E33A96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451306, "uuid": "b54a4298-d411-45be-9cab-2935d5c34d8e", "value": "768:LGpwdgWsQUz1s9n9akRBgJBUps0I4i6PLLySoTMINqKdg41rxGtelbkNtagQM:Cydts/kRCJa64j66idHBItBQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675451306, "uuid": "c3373553-46bd-4fe1-9640-64ca01958c19", "value": 69420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675451306, "uuid": "688e354f-2cb3-4c2c-b8f3-21e566131323", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451306, "uuid": "927327f6-de84-47b7-9f81-5df370eae291", "value": "d4c4529a24227fa2457e9b0d4edc2151", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32bcb126-a3f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1675452191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452191, "uuid": "ac8c5640-74ec-491a-9806-be98da738dc0", "comment": "Malware payload (DanaBot)", "value": "cbd9607dc0d542cded87b2dd91fc91ec", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452191, "uuid": "2c437dfd-e4fd-4cff-81d8-84332053dbae", "comment": "Malware payload (DanaBot)", "value": "d51bd4115033c28670e76f0c5bfb141e4658d09f9fbdda32d6d787bf0012a0e7", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452191, "uuid": "3345e0e5-9646-4283-aa09-15567055a31d", "comment": "Malware payload (DanaBot)", "value": "a5f35bfc839e23ce16baf3ccfdf939ad762013e5", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452191, "uuid": "9b2a1499-9ea6-42ee-92c3-156115150d33", "comment": "Malware payload (DanaBot)", "value": "b6e13b0e32d4850cb868a7e64c1efa7278d974ca78b56f49c165c390c52584cca52d6ff141f4c1a3251c3dd2e153a24f", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452191, "uuid": "9f7cb470-0778-4b1f-93e2-f96282747dc2", "value": "T17FD50836D370F12BD07D0636852AA65E80652271D920ACBBB7904E4C7FBAFE1D729707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452191, "uuid": "13faf023-6427-4471-971f-391741ad538e", "value": "02c465fde349692a2bd98c27befd17a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452191, "uuid": "38e800ae-affb-4636-9c57-f00639448890", "value": "49152:cmMQIDc0oKLnioa/5Ox8lMGc8QGQ5UzHjLdTwH:lMQgBuoa/QalMGc8QGQ5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452191, "uuid": "8ce7e218-0128-4176-acb6-76ff434b1b15", "value": 2903040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452191, "uuid": "010c7c93-4cb5-4977-8679-31d7fd1effba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452191, "uuid": "75bcf47f-98fa-41a6-a90c-f9282c5d877a", "value": "cbd9607dc0d542cded87b2dd91fc91ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3c3993-a3cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675433527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433527, "uuid": "23505076-138a-4a24-bb8e-81825353c803", "comment": "Malware payload (AgentTesla)", "value": "30e993cc05c9c2c17e1daebd3f0e3578", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433527, "uuid": "accd220b-991a-4d34-89cc-0b69a00ce0f0", "comment": "Malware payload (AgentTesla)", "value": "d55ed6edc1d88b77349bc30c36e8796e0fd1495f36b565c9300dff667860ce44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433527, "uuid": "20e50bc2-5a88-43fb-a5a3-1705f7b32481", "comment": "Malware payload (AgentTesla)", "value": "ca8fa28e5c22ef181ad92a37942b3afe6016700b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433527, "uuid": "5633d583-d58f-43c6-9df8-3a62dfa20886", "comment": "Malware payload (AgentTesla)", "value": "88549204c72daa36a6013b50d6f4080279a6d949a3bb84a80912c4464e1b96b2d64037e078290d0aa97a0648ae4bdd30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433527, "uuid": "2491a8b3-9c48-481c-846f-0afd42b7381a", "value": "T162059D9377B198B3F68B00B5142C37CD2FA07603BE95A263A77B7AC097519FB7298141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433527, "uuid": "93e9221b-6def-450b-a883-4f951bf5afa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433527, "uuid": "aeaaad62-e09c-4fba-beeb-13abe535f718", "value": "24576:T1dH+AdHALvnP+/J8H49P6F0xMpqG4yPa:TPHrdHCP+/Ji4cWiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675433527, "uuid": "1b27b7b4-509e-413c-a78e-e6bbd4525fe0", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675433527, "uuid": "a148387e-6b4b-49ca-911c-c3e0cb5b631c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433527, "uuid": "5acc7fdb-1d7c-498f-8760-7d2de82301e7", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f727d676-a3ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675448655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448655, "uuid": "1116a2e8-dd6b-4554-b1a0-a6fc2198fcd3", "comment": "Malware payload (Amadey)", "value": "be0c0547570c0da64a4de45481fc25a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448655, "uuid": "409df165-624e-45a7-b62e-ecc4b7774401", "comment": "Malware payload (Amadey)", "value": "d5e68fcd0bede7400aee8e16cf3b3938c3a403e68ef6d3e49215cab5429c3565", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448655, "uuid": "ca16e3a6-89e3-4810-a970-17b41ed91df3", "comment": "Malware payload (Amadey)", "value": "eab6920232113bcdc9484829b69da285b3ba8770", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448655, "uuid": "75b2933b-16e7-4550-b5bd-b236c311fe09", "comment": "Malware payload (Amadey)", "value": "cfa4f6ce60eab129a0c62697edcb343bc9fdd13dd9174e48b6cd8324b0fd16d14d1518b0c68259b448fffb617bc840c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448655, "uuid": "15d3ecac-1b33-469d-aac1-e3fd6cccc20f", "value": "T13DD412123540C033C57B14342864EABDAFBEB6320A7A4B57BB6807AE5F25BC0562775F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448655, "uuid": "20ab9d2a-7be1-4e2e-b195-2a09018b60fd", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448655, "uuid": "4c8f08de-fa50-4811-8073-bb68d0e9b259", "value": "12288:1e+gAEakkYgK+8hSFwTc9px5XYqS/S5d5:1fMDeK+HFwTu/wq5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675448655, "uuid": "da103000-6034-44ef-9c75-490191b41d49", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675448655, "uuid": "af6a00eb-048d-49a3-a202-1e0ef6e7286e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448655, "uuid": "f888367c-78dc-4a72-a278-ce90ae31696a", "value": "be0c0547570c0da64a4de45481fc25a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "408edd2e-a359-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675383924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675383924, "uuid": "98645706-889f-4f18-9636-f7fe489fc313", "comment": "Malware payload (RedLineStealer)", "value": "b8d2c95e7e0f9ee794156705c201d335", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675383924, "uuid": "14b2aa43-9992-4114-b87b-602cc8772926", "comment": "Malware payload (RedLineStealer)", "value": "d65d829acc865ec68308b69495d2ee5fd55ce8e810fde28ccf091b269bb4b31d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675383924, "uuid": "775dd080-ce29-4c6b-8e64-f8c38afe6d80", "comment": "Malware payload (RedLineStealer)", "value": "39b9b0b0dcc1270a46602404c30a4dce7938d2fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675383924, "uuid": "9acc0af7-ca5e-4f6a-979b-e2371e96f329", "comment": "Malware payload (RedLineStealer)", "value": "ea05443386f9d993e74b68da3f623bb7037be6ec4db5d95301daa43302fb95107968d184ff4db7347c1be6c2eec9b309", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675383924, "uuid": "e474842b-c4be-4355-b487-d7d63de56b9e", "value": "T18904C41437BCCD11E5BA1A3F6961A05047BF98126852F75B76C327CE0E32B40FA57AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675383924, "uuid": "09d8103d-beaf-471d-aba9-3d722f492e4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675383924, "uuid": "53a1ebf0-e700-4746-a169-5fc84563c2f3", "value": "3072:XxqZW1dagUNRbMTSPLUZeZ5FRhC/xNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOl:hqZmTSPoWRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675383924, "uuid": "71da4c2d-fe1a-4f84-989e-b901ec9668b9", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675383924, "uuid": "c3bfdc30-d327-4cd9-baf2-7ec5904f374f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675383924, "uuid": "f422faa4-4441-4ac3-85bf-b37078751524", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f125fac4-a364-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675388945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675388945, "uuid": "8f29ef7d-4ac7-4dfd-88ac-900c526c8ecc", "comment": "Malware payload (Smoke Loader)", "value": "39de40dddcf75cc857dac75d64ca7c2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675388945, "uuid": "474f4c32-7f05-48d4-a99e-9bc5f0cca58a", "comment": "Malware payload (Smoke Loader)", "value": "d88d2826c07358bf80c09379121d77e21077f7261a6ac7bb3daaea95e7692cb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675388945, "uuid": "9949be41-5d29-4760-929a-2daa52b7be1e", "comment": "Malware payload (Smoke Loader)", "value": "3a11f38a29e6615c0a584b18628d18a3f7a4fb40", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675388945, "uuid": "221276ba-fb94-4d2b-b997-8c822c5ef07d", "comment": "Malware payload (Smoke Loader)", "value": "b472095b15d20c926a63a5e0d8aa04baae101dd55b128975b4428050c24f6e3754dc4823e1927f8df46f3af54ae7b5ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675388945, "uuid": "bc2cd4cb-8e38-4009-9ac3-a55e4a00e4b9", "value": "T1B8648D42A2E2FC41DA21CA728E1FDBF47A1DB9519E786F6A12185F7F1972073C5E3210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675388945, "uuid": "c6a85ffb-c701-41bd-9a7b-cf9347b93772", "value": "8da36f6dce34183aedb624e434f46f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675388945, "uuid": "c6663e10-9911-4cd2-ade9-c4798c9879ad", "value": "6144:cvHjLeto9eQrd3IWYaOGDwslwKwpxH/3jV6ptCbNKN:cvHjSt2eQraWJDwslej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675388945, "uuid": "5ac73c08-d3b1-4e56-abb7-8731c008d2eb", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675388945, "uuid": "586838dd-1bf0-452c-8e9f-e558a09df837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675388945, "uuid": "7bc02b11-96f6-40f6-8228-7dc2ce8dfd13", "value": "39de40dddcf75cc857dac75d64ca7c2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cdddb22-a39f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675413929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413929, "uuid": "0ebcf0c0-2009-4b32-8e22-81a578ead886", "comment": "Malware payload (RedLineStealer)", "value": "e30e255eeb7b86eb56c0693abaef7224", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413929, "uuid": "67d0ffc5-2bfc-4c14-bd01-90edf538e791", "comment": "Malware payload (RedLineStealer)", "value": "d8a592f17d5c8edea455e9d6499a8692e7fa9b9d57e81b46431de754f54e1619", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413929, "uuid": "43c282bc-78b7-4b73-99a3-baec248334d8", "comment": "Malware payload (RedLineStealer)", "value": "0e38a6251c6e7bc6e99be2bbf49a430b72255cdf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675413929, "uuid": "a154106c-e100-46d6-813a-6e0c13718173", "comment": "Malware payload (RedLineStealer)", "value": "f1dac0815754b51a5b18b26d43a4861173072e8f2c9f0faf940076ccf4d39cb42720496aad8fc9d222dd4682ef705c48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413929, "uuid": "6c28320b-546e-4688-90e0-6fc7baacb08e", "value": "T16184012275C1D072C95B4630AC64DB662B7EF6315638A807BBE817BE4F702D1673B31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413929, "uuid": "2db91483-e146-4b0f-adce-33ad7c7baf8e", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413929, "uuid": "793c0620-c6e8-4aeb-a4d1-7cbacf9a9832", "value": "6144:YHnsoLYPPfY3dG+apJaQSQLgorfDSQDXSwKMXeAxw:YHsoUfYN8SQaQfrNAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675413929, "uuid": "0655c1cd-d5af-4b0e-a361-50c02a9d81f4", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675413929, "uuid": "428967b9-63cc-44df-9169-388e6ce6882c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675413929, "uuid": "89cd4d8a-a021-4a00-aa4b-9216c24b9f25", "value": "e30e255eeb7b86eb56c0693abaef7224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a7dd18d-a3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675442406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442406, "uuid": "db8916a4-707f-475e-9474-5eafa1bc7eb9", "comment": "Malware payload (PureCrypter)", "value": "734e3c03e637737ad83cebb46eae00e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442406, "uuid": "6909af91-d467-4bce-adb2-4a526360a87e", "comment": "Malware payload (PureCrypter)", "value": "d8d75e120338946209da6f61438c59f4464561758fbf0addbe4b50b40f81e6f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442406, "uuid": "48b75eaf-2dc4-4582-aec4-ba3b1ab057f2", "comment": "Malware payload (PureCrypter)", "value": "37badc7b0fca7d58698b44460c84bc7b5ef03e78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442406, "uuid": "a8241d96-fd6d-4b2c-8252-6de34eb87e2c", "comment": "Malware payload (PureCrypter)", "value": "2b98bb5a056e4d880e82839cc21cfd3391424bb526d80f05ab28b30f8ce4355c00bb6a1af40df8a3377c032d8e9071de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442406, "uuid": "437792e9-a249-426f-a3ea-37d284d804a1", "value": "T1E955333138E33E250EBCA709E3B6AF155F20AAF95BDB6D1480CCF53605342AC995C7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442406, "uuid": "4b7332d5-49f8-45c7-ac52-35cc7745d7f1", "value": "24576:vfpMwxz13Oyn6NvEFxvx0Iuu/MsepGsD8aLA6UPWcgXcXhUhIzGSiqfEwLE+7YVT:vBM0zwFNvwXXJwGs867cUwUyzGSVLUVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442406, "uuid": "c24ec456-4912-4686-9696-7fb825f65be4", "value": 1351177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442406, "uuid": "f39ab43e-5cd6-45e7-afb0-074f62d1e620", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442406, "uuid": "be3baf0c-a65a-4a94-b13d-37675bc4c705", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e319f8ed-a383-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675402236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675402236, "uuid": "e9037e32-fa16-4867-b6ce-e3b10b78ba92", "comment": "Malware payload (RedLineStealer)", "value": "6c2a5008f01ea5fc51e70e0e775883e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675402236, "uuid": "3653a8cf-2981-4df9-8e64-f6ae3bd056aa", "comment": "Malware payload (RedLineStealer)", "value": "d90cc5d953f48c18660bad6edafd3f1f5fb03756f8558fc349dfec4418c14b96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675402236, "uuid": "98522ba1-6aaa-44ad-afa2-aa00ada04359", "comment": "Malware payload (RedLineStealer)", "value": "90ed4866379e35c2a20e6e862c56df753e95e5df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675402236, "uuid": "002498b1-e7b3-4411-a8a6-2e043899d7f9", "comment": "Malware payload (RedLineStealer)", "value": "ed6e5c97cfab71988f32f910ecdf77afb371dd04d535af6b89e67652808ed64e4bc6801a24d148be14ef56471a0b0a45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675402236, "uuid": "7aea4d28-98e7-4bb8-a98d-8cbcb91938cb", "value": "T19A5533B317DDCE80C5890B7D7D837E8A1F0AA0F0A5DC0A6AAF56C94E3BF4B295600D55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675402236, "uuid": "381671df-649b-404a-a6ed-5ca2295fa20d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675402236, "uuid": "4f6ef6be-d349-4bb1-82f7-1a8573015409", "value": "24576:dPKpTbfbpfF0mrA6TI2MH6pbHqnq3byxHJ1jh/GvFf/Qw+oRCpd:dCJtFk6TIi573UHrF+32pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675402236, "uuid": "b8165fac-3d9d-4167-9889-f3e9f26e829e", "value": 1318400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675402236, "uuid": "405c30af-d9df-4eb0-b2b5-c5ca6b0e3191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675402236, "uuid": "3f1a37d7-e643-40d6-a82e-e5cf4bed9410", "value": "6c2a5008f01ea5fc51e70e0e775883e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ad11cc-a3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1675442343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442343, "uuid": "8eec00db-6c53-4c3c-8073-3897f14500d8", "comment": "Malware payload (DanaBot)", "value": "1a904107cb5b50c41a9a16912387e3c1", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442343, "uuid": "a6e9f81d-1526-480b-b49d-f906575eb514", "comment": "Malware payload (DanaBot)", "value": "d9591561d1734fd90d7112d639c162fb3dc1910aeb77d8517b0ed14ee96c33eb", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442343, "uuid": "c6914cf9-02e1-4151-b93c-b84320d85b71", "comment": "Malware payload (DanaBot)", "value": "52ae836393e634161420fd863c874383424a7554", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442343, "uuid": "1672106a-1cf6-4856-a34e-96a6416d3de5", "comment": "Malware payload (DanaBot)", "value": "067e0d5a05154761f41b6c9f88416ef22b41f68e796d7b61667566cab58cfc0deb29cb65ef10e28b965f1e79ebf65a16", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442343, "uuid": "5e86895e-f31c-456e-8088-66eaa1224bcf", "value": "T1D666CF26A248F127C0BD0A365929A6AF906A2270D9209D77F7540F0CBFF67D1DE2D707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442343, "uuid": "675c1979-6ef9-4a16-9b7f-5a84b1fda907", "value": "02c465fde349692a2bd98c27befd17a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442343, "uuid": "c6b8d6c8-cb71-42aa-b9c1-941d793a3017", "value": "98304:6zp35bfcuES0LuX2kBGQnfSJScysP9NPyA8KDbEo9ZLHPjUdLH68GuvT84:61Nf0LuXXGA7FA9NPyAFcC9ea8B3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442343, "uuid": "8fbbc6f8-e693-4efd-bef2-dd491a5b00ab", "value": 6510592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442343, "uuid": "5ba92dad-3357-4e9b-8a3e-cf2786c1200d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442343, "uuid": "a052c536-7c22-4d87-9c2d-9962110ee8cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dfc6e5d-a39b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675412240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675412240, "uuid": "03987cb3-6af2-41f3-acc0-6724cbf4cb25", "comment": "Malware payload (Smoke Loader)", "value": "a57f8d835e4ee44ece456f153afea53e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675412240, "uuid": "1264b346-e442-41bd-b7ce-3837872872b8", "comment": "Malware payload (Smoke Loader)", "value": "daefa1992110b9e7aadbf7364e36e621e389a3b92ea9f6b4f3c4debe9f7cc7d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675412240, "uuid": "79b03e9c-267f-44fc-a831-3e3b383690bd", "comment": "Malware payload (Smoke Loader)", "value": "ce249eb9807503c011b88871edb19f9a31dca673", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675412240, "uuid": "f08115ae-66ee-46d0-aa04-f0c093419fd4", "comment": "Malware payload (Smoke Loader)", "value": "96e4ffef39dd1682d153d8a593efa4e507b883c90249ee1784f02e0bf5a90026e14c8f88b2406618b31dc82aa2d47ab1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675412240, "uuid": "4d998cab-1f70-4375-a8e5-5084cdd4141e", "value": "T1AA54E02238D0D072C47740305934DB95ABBEB531667A984B7BB80EBEAF706D1573638B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675412240, "uuid": "16e8db76-fa3d-4536-aca6-708dc20d40c9", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675412240, "uuid": "40503528-6c75-491e-8aa3-3be1d973594f", "value": "3072:j7vXDy9uQr23hL/pD+JW+ge5rcfvfr+A9QZrqLy3KT15thsK0Kl+qC6TZw:j7vXxL/pD+Jzgt/6/q2aTx3tli6dw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675412240, "uuid": "f0026410-0c2a-4b79-b8ca-719a9cc44cf7", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675412240, "uuid": "367cbd1b-ca52-473b-a774-18c4ed1bde49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675412240, "uuid": "f4aa3f14-ec1a-4bba-8259-b5bb26c8fd43", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d3d1ddb-a3f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675451323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451323, "uuid": "44067108-69ea-443a-abc2-d8b00ac89606", "comment": "Malware payload (Mirai)", "value": "4ef2ea170050df0f16ae817151a01db6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451323, "uuid": "24d1b4ba-a69b-43ad-95a8-6ddac2bd70ef", "comment": "Malware payload (Mirai)", "value": "dbaa2f1194c9078ffd78b66ae8ecfea47a7cc26aecee782bdd5bb258a253e50d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451323, "uuid": "1a7bd5ce-7e29-4cc8-8368-66bfed156ccf", "comment": "Malware payload (Mirai)", "value": "9ea73abb42c059f69cf95e7a498467aa2cc5ef5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451323, "uuid": "baa0d818-e6d3-4605-85f1-189fbbfcb7ec", "comment": "Malware payload (Mirai)", "value": "942eee62f63403f0eca050919895eb851633fbeb586fc12a5bc3785fcde4f84588f7fad2564f1ad9280f8db9a4273577", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451323, "uuid": "f3f6555f-07a7-4db3-89fb-5b5c1598fec3", "value": "T16A830B1A6A318FADF75C867553B38E60968C23A776F1D241F41CC9002E6074E296FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451323, "uuid": "bc620b34-37a8-4218-94cc-67ea950ac694", "value": "1536:Zg3n+jqiBrauU+sB87aehoZ/u3qMpmItuG:ZU+j3BrauGBG9v3qO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675451323, "uuid": "851b37a0-404b-487c-be46-b2f4949d532b", "value": 84988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675451323, "uuid": "2a56338a-c8eb-4e99-912c-28323e92dbc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451323, "uuid": "8d35978e-6114-4f53-994f-40331d30ff64", "value": "4ef2ea170050df0f16ae817151a01db6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5f3650-a3c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675429823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429823, "uuid": "7e84fa36-25b4-467b-921d-cfbadecbb26d", "comment": "Malware payload (RedLineStealer)", "value": "218abbe8836627ccbda1092f6a316f5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429823, "uuid": "31ba8d5b-0df3-4266-b22f-4c30e01807cd", "comment": "Malware payload (RedLineStealer)", "value": "dc5b34bdced7fa49e52334863cdd3834cde95b2e259bd91e64bb0ff491ead2f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429823, "uuid": "b5aca9d0-7ea1-407c-accf-3039370c6024", "comment": "Malware payload (RedLineStealer)", "value": "aea31c3325f1bc58e2d3b40f92a93a2aec9e4c35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429823, "uuid": "18c66eb8-f04f-4b36-a99c-bac786238cf9", "comment": "Malware payload (RedLineStealer)", "value": "70fd0598ce0c50e203da2aa5223e7540388caa353b4ea891747b900d4d6bc2829aeef1ebde036bd82f4c6a61317b130a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429823, "uuid": "c92bcaf8-839b-4e5d-b316-1e55ae58fdab", "value": "T178B4123279D0C032C46610B08830D791EB5EA7725A75896F7B6C2EAD6FB07E1A637316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429823, "uuid": "f8e91a95-673b-47bd-a269-350aa6e59172", "value": "b65d7d05727ada8b2acd168719f50dd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429823, "uuid": "96b1802e-798d-479e-add8-680b9672c830", "value": "12288:0nww3uCuFC+UpYE3TYLjvbwcIXM/8V/CrSZR/re/i:0wHCuFCL3TYLjbJ8aSAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675429823, "uuid": "1c996a63-c030-4250-ac12-817d4ff35064", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675429823, "uuid": "b1c5f6a3-31fc-45f2-9f6b-3226f8b98c9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429823, "uuid": "7cff89b7-9e24-4c33-b46f-c165d4675abe", "value": "218abbe8836627ccbda1092f6a316f5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5698950c-a3d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (CobaltStrike)", "timestamp": 1675438507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438507, "uuid": "cef53418-128a-472d-9edd-c653381b105d", "comment": "Malware payload (CobaltStrike)", "value": "433f0b0922f13e0f0c6de039a390a504", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438507, "uuid": "292fa0ff-013a-41ad-af47-06d4846638ad", "comment": "Malware payload (CobaltStrike)", "value": "dc6b5ebd52ed71ad93454f0406f4e9f3f5f038cbc631a3b7a86cf6a6b2d17dc2", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438507, "uuid": "7d28c90b-d597-4ede-a324-95eb4a2bbb0d", "comment": "Malware payload (CobaltStrike)", "value": "47e6e443a87a5067699d96af568d32f290b7bbf4", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675438507, "uuid": "a21efbb9-8677-4fc6-b252-579a7df7fc87", "comment": "Malware payload (CobaltStrike)", "value": "c649b096a6598007bcc1a5fd36badb789de367d2d0335b5391420d3f4b92b9328b90ccf2fcdc2acde8f6ddbde0636501", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438507, "uuid": "236d45f5-6e4d-45b2-8387-58f93f3761fc", "value": "T112248C913685F036D0960479A64FC7724EBDBC3416B198C7BF984EA99F22293DB39307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438507, "uuid": "f1c64448-1bd0-42c0-a731-c26ae2ef4bb2", "value": "d78bb42be898a6d63b468b408da27a2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438507, "uuid": "42bc48ad-dc28-41c4-8c16-591db199ed68", "value": "3072:v/QPFX1eqEfuBNSYuiM8CNj8hFsoMX0ghsJRgCD3iFw9jdU55jq:v/MEfuN0t8C5oFsoeRM3o0jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675438507, "uuid": "6b984087-3e95-4d52-a80d-68b00a9a7591", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675438507, "uuid": "50ac3848-506b-49f7-948c-6cb2eba66e88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675438507, "uuid": "7e689504-4c0f-4afd-b14d-5874fd8b943b", "value": "2023-02-03_433f0b0922f13e0f0c6de039a390a504_cobaltstrike_meterpreter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef983f4e-a390-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675407840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407840, "uuid": "0b50ed8f-7123-4bb3-8475-fa99c32c3779", "comment": "Malware payload (Smoke Loader)", "value": "4d6125130089b17a9516b17b79c788dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407840, "uuid": "4d50815f-78c6-44c5-a3b4-f3d773fcf7bd", "comment": "Malware payload (Smoke Loader)", "value": "dcbd0a559aa1138a8e2330c5590c96f791217bac951a6c7c1ba4ff7419cb525d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407840, "uuid": "7f605311-2051-4ba6-b077-2cacda2e9c53", "comment": "Malware payload (Smoke Loader)", "value": "41eed2ac25e69cd9dd9d7c5b18371e86c4aba724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407840, "uuid": "48287ea9-f099-4ece-9dd3-d7dbfeabc302", "comment": "Malware payload (Smoke Loader)", "value": "64e350283b91a4b89ee6ee8dfd0d107f1ce247b2a1595131d0c0732a841179782a0a2fdd5827ea6a2febf495923072e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407840, "uuid": "9c049fec-88cb-4ad9-ab1a-ea28db1742e8", "value": "T12314D03239C0C072C9BA45309830F7566FBEB8314675954FBBA81B7E9F706E1662631B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407840, "uuid": "6ad4a3e7-99ca-4b02-b106-140a168ce40d", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407840, "uuid": "813ae3de-07fe-465a-9669-ea348fc95638", "value": "6144:KHeJmMLlfOLlFiajZmrFPDghTtOjmPwO:KHSmMilFisZEdsvOjiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675407840, "uuid": "d07312a1-bac7-4618-a7aa-8c7f75d264c1", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675407840, "uuid": "42ee82e3-df46-4cca-80c2-65b4845c7ed8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407840, "uuid": "08d9f808-37d7-42be-9810-d9ccea705a8f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fadc1a7-a3e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675442818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442818, "uuid": "c2fd1101-02c6-4a6c-b4dd-381f7b15c134", "comment": "Malware payload (GCleaner)", "value": "deba4c109367cbaab0b561822d600c3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442818, "uuid": "90b161ca-a1f1-42f3-87ae-1dd41394ea7c", "comment": "Malware payload (GCleaner)", "value": "dd1b40ca647bba826a48a96e4c88af689af8171351e44681374e4919dfd9b55a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442818, "uuid": "4ba8b762-65b9-475c-92ac-56c4eddba77c", "comment": "Malware payload (GCleaner)", "value": "c4097ee0af37e67c79c9662fdb7717d6319b004f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442818, "uuid": "7ddc261b-c41f-4e0e-ac4d-88112b4e39d0", "comment": "Malware payload (GCleaner)", "value": "4b085073ba2b1876e00669c23676668c1f4ebf1589ef3a94e874576de6ac5936d6f3b0472acbaf25959274022d1c3116", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442818, "uuid": "a4b0029e-9de6-4d6f-8fbb-37aec1fec2ac", "value": "T1E895330E97F534B3E18286B0BE214D31CEB37B112178331531BE618959FF16A729DA9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442818, "uuid": "a5881ecf-6f85-49fd-8e5a-068783dd66ca", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442818, "uuid": "77fb85cf-427a-4ae3-b7f6-59e1c06c55cf", "value": "49152:yg3B+82KQbydHgwRHpDPHdzAwPamt0lmV8suz8ySoQ8LCgv2MR:T3+PbylgkHd3v9V8ayJQ8v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442818, "uuid": "183e280b-8ff6-482f-b44b-ef845dbcab57", "value": 2016046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442818, "uuid": "a2307fa3-1486-4d6d-bdbc-4901283aead9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442818, "uuid": "e64cf11f-b7db-43ed-b2e0-22f4dec0fd27", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9345f0b6-a3b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675422288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422288, "uuid": "ffd87678-e2ab-43f2-8a49-fab675f069b9", "comment": "Malware payload (PureCrypter)", "value": "cdb75538c7adc7829a93cdf9a27c1fd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422288, "uuid": "7e050f51-e6eb-412f-9c84-334a28def97f", "comment": "Malware payload (PureCrypter)", "value": "dd218eb78e26587e43df5f00ff3ad87e23154c672615309a193a657323b62e20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422288, "uuid": "72eb4bfc-5c1b-48d2-9456-d06b3d8ad33b", "comment": "Malware payload (PureCrypter)", "value": "2e5ff4e8f2b4b087ccc7f4cb2ad59d4c3617a0c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422288, "uuid": "c02c97d9-089e-4251-88de-876b09cfc53b", "comment": "Malware payload (PureCrypter)", "value": "3f7f16df4a54a7eee4dc0f1986eb6de81c4e4aa2f30e55c773b267b9e638ddfb2cc277fb82ccdff9013dcd68c1246987", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422288, "uuid": "b1682a1d-5b72-480c-820f-decfdfe5a2ee", "value": "T1FCE5339DCFE980A4DB03B17A7EBC0D3FC35193618E7903F984B17A130AC2B569165A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422288, "uuid": "8f7b8997-74ed-424a-9e90-60a53d564776", "value": "98304:k5Sh7zrcGtirr9gIKvvwPDxISVNImdJ3R9/4:WAXrjtirrGIyYTD3R9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675422288, "uuid": "10823bfd-2991-42cc-be74-8498a224b709", "value": 3151872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675422288, "uuid": "a8e91662-b388-4220-8d0b-0c95b0a67c1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422288, "uuid": "85c3704b-e016-4b06-89d5-e7330c0805de", "value": "cdb75538c7adc7829a93cdf9a27c1fd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b439010-a3b6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675423886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423886, "uuid": "9ff4dc1d-f6e3-49be-bb72-6b0bc394930e", "comment": "Malware payload (RedLineStealer)", "value": "e9aed8480c90ef7d65ce1ab842b3abc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423886, "uuid": "070de52a-dd6e-4361-bb7c-6d40058a6551", "comment": "Malware payload (RedLineStealer)", "value": "dda0f4221046a25ed0417f5c907596e2b95c36a5c6b1fe2809bcbe1c29a093c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423886, "uuid": "5c275b29-061c-4115-9990-be253745aa7b", "comment": "Malware payload (RedLineStealer)", "value": "3c9c75f0d0fe902041305051d15189fde4d46ca3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675423886, "uuid": "877f8433-d032-49cb-8dd3-a5fb35a8bacb", "comment": "Malware payload (RedLineStealer)", "value": "8923352e93b0fec905a757a1beddf9ae2f26d67b08cb9f81378bd3a9863d4198528fed70328cb1f4cc84ff173364f71b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423886, "uuid": "67436efa-4ee6-48b8-977f-6ffd6d0719f4", "value": "T19364022236D0C071C57F15305C24EBA9AB7EAA3151BD990BBB780BAD8F606D1673734B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423886, "uuid": "993244b5-3bf0-4245-bf15-5a2ec35dc72e", "value": "072a8f61f2ea0ff476bece6d90579847", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423886, "uuid": "de6205a7-c4d7-46e8-aed5-2d32b04009dd", "value": "6144:jC6dL7eeQG+TrYzwmc12F0IduGkyojO2MlpXc79VjcY:jC6djQG+Tr9joFRQo2EXc7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675423886, "uuid": "74f1abdd-74f9-4d1a-b04e-23be16ee1cc1", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675423886, "uuid": "e20f4fa4-9e36-4d53-8c00-df80d5d48b25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675423886, "uuid": "1f443e36-a137-4319-9a7f-cccac452236d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d973c321-a3c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675429708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429708, "uuid": "7703b32e-943d-44cc-8383-6f77bcad1fbe", "comment": "Malware payload (Formbook)", "value": "693ebb1ece93a67524728b14d0112f2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429708, "uuid": "c7127eb9-674d-4611-9d5a-24e6c7168e21", "comment": "Malware payload (Formbook)", "value": "ddaf734203775ba854a597b395d5bbea5140b877727aac7c4f0120ec8de793b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429708, "uuid": "5afbbdf3-ab53-467e-8e58-8ac5a193f170", "comment": "Malware payload (Formbook)", "value": "d019b3a1cedc526c95496529044585b13f0f82f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429708, "uuid": "f469c3ba-3a08-4123-bdbe-2968bff27a49", "comment": "Malware payload (Formbook)", "value": "bb60675cedb35c173f5eae352fe57298a9ab5dfa2c54c8693f848b0b96a40984cd1af738ff5054985f0a63046bd3aebd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429708, "uuid": "50427f5c-059c-4c28-a9e9-896a37867899", "value": "T19584231476DAD8EFE90797321F34939EAE34F50BD8D8664BA3A1451831BC840C85FB67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429708, "uuid": "6b58ad7a-f56e-4ce2-80ed-7e428dd7547b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429708, "uuid": "d3b1cf11-35a8-43b5-879c-8ba9f260bf0f", "value": "6144:vYa66Y8Z01f63u9HZ/YsQrl1qwlaLlJ5yvfNrRha3+5xSmdFths6febxMsVrOrnP:vYUz0B6h4TWNRg3Mxbd7hsCebx/F4nge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675429708, "uuid": "e648488e-abbd-4ef5-ba11-d2a2706de34e", "value": 382630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675429708, "uuid": "4541d80e-d0d0-4805-88c8-506eb7bc5eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429708, "uuid": "91e856be-b2d0-4fb6-ad37-f754badd622a", "value": "TT Swift($42,072)2.2.23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df98c6f-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675453847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453847, "uuid": "f255a61e-466c-49c6-a8b4-f542a3478f0e", "comment": "Malware payload (DCRat)", "value": "c29abe9b95ab8b2fd8e4f646514670ff", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453847, "uuid": "2b5cd88c-6886-4127-a9a1-dadfe4968d9b", "comment": "Malware payload (DCRat)", "value": "de1b45a91771776e4059b2d2161717de2ec14648a374d398f6b928c859a46ec7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453847, "uuid": "1c1d6355-ba95-413a-8a12-cdea4544423d", "comment": "Malware payload (DCRat)", "value": "a959a4441e4695e604ef1442d668f9a9171a9f5c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453847, "uuid": "213b11d6-6d13-440f-86a3-39dccc5f01cb", "comment": "Malware payload (DCRat)", "value": "799efab31c1e42b86e6b974ef8b9013377713bddecc4cda7093cdc1a2572a530dbb50a404f7f586ee56a0eef728275f8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453847, "uuid": "f581b079-f9f4-4f16-86ad-a345a7eb43db", "value": "T1D7657C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453847, "uuid": "1c19dc2f-5f3c-4761-86f3-ade4f445b3f9", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453847, "uuid": "bad0d78b-a176-4783-bb98-75ff46be419a", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675453847, "uuid": "bace7e02-d485-4b26-b8f4-30d481619d01", "value": 1410763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675453847, "uuid": "b782e9b8-cab6-40df-88e2-573722c46684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453847, "uuid": "053b7d79-fa1c-47ff-8998-05e62401536a", "value": "c29abe9b95ab8b2fd8e4f646514670ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72abd292-a3f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675450580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450580, "uuid": "500a5228-466b-4afd-af1d-2c31ee79d3ff", "comment": "Malware payload (Amadey)", "value": "49ce7ac1f687c86f0f29e2563a6e474a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450580, "uuid": "67ef55ee-60e2-4fa2-af1c-7b1db117c6e3", "comment": "Malware payload (Amadey)", "value": "de1e4c8df120d3a1fe46093c55594635b5d104595680a2eeaf9c3b84227c0d79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450580, "uuid": "11883700-ba08-46ec-9010-c0ff20ee8b54", "comment": "Malware payload (Amadey)", "value": "8cf8ba8689cb3e1de6d12bfe5847a227beba5b8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450580, "uuid": "40d05359-b6aa-43a8-965a-d7dddb89ed4e", "comment": "Malware payload (Amadey)", "value": "39f4b5d10d0208a6a2c20f7da4bca2a251f0d72f84a42b71bdf436f742628eb63775ef4e90d9ce10c5f207fb779bf978", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450580, "uuid": "23d35940-1708-44d0-8c5a-a125b3d15ce1", "value": "T1F2D4123236D1D472C36B04351824EBA1BB7EB53141B5C97737E8279A4F71EF2122A36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450580, "uuid": "2621067a-08c4-414c-9293-65ffe9b908ee", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450580, "uuid": "790a5685-6a38-4856-890b-31ca7c956277", "value": "12288:ve3ibVOKQCh8G7z0ig3EFlHdB5vJTU/UJJrlGLamnfWY34:v6wpxfl9iYcLamZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675450580, "uuid": "1c17bf8b-c9b4-4cab-8633-8912a6df20f4", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675450580, "uuid": "edda0d10-6848-42c8-90ac-f34570c7eab4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450580, "uuid": "ba8b411f-bd57-452b-b65e-31bf24dde707", "value": "49ce7ac1f687c86f0f29e2563a6e474a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6334b59f-a3f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675452702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452702, "uuid": "ee61d9e1-5dce-4324-b2e5-e873910f5203", "comment": "Malware payload (AgentTesla)", "value": "22458ddb5e4c34d46155eca69aaebea9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452702, "uuid": "20ffabe3-c96f-4a95-8dc7-61c322a5924a", "comment": "Malware payload (AgentTesla)", "value": "df439bff97d28e23956a71daa13d628a07b7cc2973ca3a6956d7b9036d13700c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452702, "uuid": "f2e329f6-2f0a-4acc-8c8a-6feb850888d5", "comment": "Malware payload (AgentTesla)", "value": "b7d54ba14e35138ff6c6b3a99b538b75146f85d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452702, "uuid": "5fc3f603-f651-417a-8fe9-e522d048fce8", "comment": "Malware payload (AgentTesla)", "value": "c147eb745a4c4195b586126f02a01311bda0269edf4e0b749535d06d49115b70f26c718d7dd6db6949c10bbe4ed9a698", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452702, "uuid": "1244d0a7-c7b8-479b-a371-1f352ac0f907", "value": "T117059D9377B1A873F68B00B5142C378D2FE07603BE95A253A77B7AD097518FBB298141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452702, "uuid": "59cbcd0a-d289-4bff-baa8-c10b15340626", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452702, "uuid": "5954ebbe-cea9-42f0-b3e7-dbd9deb441e1", "value": "24576:j1dH+AVd6jAClqxiDhtO9lBuIZ86F0xMpqG4yPa:jPHrH2F2IIvWiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452702, "uuid": "54591b6d-5857-421b-ab31-17f7175da8b0", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452702, "uuid": "d5d90646-c9a2-4b79-b4f4-e59e3a8681d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452702, "uuid": "eed32847-4051-4119-8b4c-2e765fee5a96", "value": "22458ddb5e4c34d46155eca69aaebea9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69daa321-a38c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675405898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405898, "uuid": "1e413fbc-23bc-498a-92b6-a9577023807b", "comment": "Malware payload (Smoke Loader)", "value": "690efa29725bc7d74a136dd341ba141b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405898, "uuid": "61e528da-4318-4cc3-b183-a1f67b40fb35", "comment": "Malware payload (Smoke Loader)", "value": "dfedc6b8d6335105e0267dd47aad6ebb91418b73d5bcb75d861063f9297b4689", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405898, "uuid": "81940b25-eb57-43c5-b62d-fa7c5d2d1da5", "comment": "Malware payload (Smoke Loader)", "value": "33b8b5737e2a9f165543ec41623058623c9f7531", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675405898, "uuid": "998d7416-3324-48c7-b413-7de8a5bf7dce", "comment": "Malware payload (Smoke Loader)", "value": "011816ec517a151f502397355a326209647ef67c2d136b0976fe4ae6f1c88cda246e7eee5a655aae91f8113faf4a5ad6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405898, "uuid": "d5e0ba4d-53d0-4fdc-b7e7-fe04e57063a1", "value": "T1AD14CF323980F071C8F740309820EBB56BBEB53146799A8B77971B6A5F706E1273635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405898, "uuid": "9dd4a141-dc27-4a1d-81a2-03b481b5a698", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405898, "uuid": "a4c82a9c-93ca-4294-a5a4-32de6bb7007f", "value": "3072:V7CX3EFp3IKLf0jRWZH5A1bBZTglr1y/8Lkvwo9UIg0yk7z2ROaANqDZJ8w:V7CoBLf0jRk6FLaZy/79vv2ROagpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675405898, "uuid": "8969a0ed-fe49-42c3-8bf5-c0e2826c8d2a", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675405898, "uuid": "198c8a7e-562d-4ede-836a-ee4ee07f44f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675405898, "uuid": "779b1403-6983-4539-bafd-f1a550ae4bc6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e627f983-a3cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675434024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434024, "uuid": "0afadc83-f22c-4218-9299-bbc29249f2c0", "comment": "Malware payload (Quakbot)", "value": "190753b3288cb60dbb034db366c18a15", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama236", "colour": "#DA0789", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434024, "uuid": "76405d3a-1572-4211-95ee-7874ce2dd0d5", "comment": "Malware payload (Quakbot)", "value": "e0258e4d45a488bfa45356a5bc55080d7ecc273cd0c1cb7556960427fba9c23f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama236", "colour": "#DA0789", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434024, "uuid": "b3eda3cb-712d-4fc5-bbd0-06e089793766", "comment": "Malware payload (Quakbot)", "value": "f48ed000f0706a5bb8e9819478aacfdbe99211ad", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama236", "colour": "#DA0789", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434024, "uuid": "edc988d9-3f64-47a7-a4ad-a88544a59f5f", "comment": "Malware payload (Quakbot)", "value": "d44691c38c78da4d82a196b4038a2606ded99fac4bd6130e382594d3d06d0d6a9dbc92d5156de68e28289e0981a87fc0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama236", "colour": "#DA0789", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434024, "uuid": "c9972a27-570d-419e-bcbb-0031437b3d5f", "value": "T18C85AD0242CC129AF14D3B78243C1F7FD3BBB7A87B19634E9654B8A9AFAB7D34115600", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434024, "uuid": "4739ead8-a6d2-48ef-8f7d-b572afee2b8b", "value": "a3432b773266dde6a100dba767517009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434024, "uuid": "999bfc17-b076-4e46-9ffa-ddb986f48917", "value": "24576:zrj3nPW3ednWPiT8VTBqcATV8KIyydLXGcq8z+0uaEYmgEJ/tc1:T3nCeCiT8aHxyM18z+XatEJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675434024, "uuid": "2e428737-9f08-4e45-9768-73a45855bfe5", "value": 1761280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675434024, "uuid": "043d0264-74ce-4c50-b88b-ab8a154c6a92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434024, "uuid": "ef6973aa-b1bc-4296-8302-b274253a82e4", "value": "44607.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76bb30a9-a3ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675419234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419234, "uuid": "4eca44b3-e808-442a-9e7e-2d9b2cc8f92b", "comment": "Malware payload (AgentTesla)", "value": "d294610d7a8f7e2a792bd2699baba2b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419234, "uuid": "17baa505-c658-43ee-9911-1261e147f79d", "comment": "Malware payload (AgentTesla)", "value": "e0455da32a9d0fbab7f1059d40256b25bee1108f15ec97b6cca65b5b4ae88bb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419234, "uuid": "8eba1ce5-6725-4d61-8559-acc1188c6ba2", "comment": "Malware payload (AgentTesla)", "value": "8850bf7757f8c7efaa1e0f7d15cf66f2103237d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675419234, "uuid": "c0955ea8-2676-4c54-915a-b83f3490f015", "comment": "Malware payload (AgentTesla)", "value": "cbc788558899dd2121676be9bf04d4cd72e3d15e85c3c2501c33f384e00be6ef1398234f24f015e072413846066e2113", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419234, "uuid": "89ca39b2-0dc5-4d35-9adc-a280a97f2b63", "value": "T17E52D141B4E4FCA5EA70202C0B924756FF38560662B38427E97DFF495E431AC9F1CA53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419234, "uuid": "c0b533d2-9ff8-4fcd-a7c0-b902fa1dd71b", "value": "384:8NfdbcH6HOSUPpwPlY9/6bpAEdATXL4FEgH4S:8wH6uBBCYV6bpsXL4FEgHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675419234, "uuid": "7b98d77c-72d2-49a7-abaa-92df9b96fd17", "value": 14162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675419234, "uuid": "7ef92ea7-673a-482a-8c12-0c6da097a00d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675419234, "uuid": "97a6cb71-3b22-490d-9cfc-d62ef45f0108", "value": "1835DIR231029551-CRE001.XZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a34c56-a396-11ed-88f6-42010a9c006e", "comment": "Malware payload (Dharma)", "timestamp": 1675410216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410216, "uuid": "976b77d8-82fe-41c5-a669-75814c948e54", "comment": "Malware payload (Dharma)", "value": "42c7de47cfbd79e1372d9742029de902", "object_relation": "md5", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410216, "uuid": "0acaa157-e767-4fc2-acfb-277dfd179017", "comment": "Malware payload (Dharma)", "value": "e140a653caf5e4be9aaef3a2209d5c7e417f6eb0bd67ed2f878b82d606b045e2", "object_relation": "sha256", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410216, "uuid": "b5528cec-24af-419c-9615-a08dedd63997", "comment": "Malware payload (Dharma)", "value": "c67363e9ab759dc98510d72429b127724913b76e", "object_relation": "sha1", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675410216, "uuid": "6e27b577-6dc6-4fb2-841d-c351c9fdc510", "comment": "Malware payload (Dharma)", "value": "9e8962726a5d7b4912fdc856b2ba8aaf71288012bb001a8551e4aaf6768acf6202d6f9f4ed9dda79ed08a13c0e795311", "object_relation": "sha3-384", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410216, "uuid": "285f9c13-584c-41e5-9114-b85e16c6694c", "value": "T191938C29D521D135F8A254FFCBF68AFCAD644B211303D4D797C01E8AAB868D5F832627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410216, "uuid": "d34c6aaa-f343-47fd-93f4-f1291a152fe1", "value": "f86dec4a80961955a89e7ed62046cc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410216, "uuid": "8ad9c41f-cec0-49dc-be80-571820b22884", "value": "1536:tBwl+KXpsqN5vlwWYyhY9S4ACKSn1TLbSrLFpUWVFzAW7y7:Hw+asqN5aW/hLQKSnZ/S3AwFzAW7y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675410216, "uuid": "28e60f2a-d232-4ac1-b725-d9a330369467", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675410216, "uuid": "b740bb67-ca12-4c6a-8bb9-0289db941a94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675410216, "uuid": "b3824934-207f-47da-a94e-51fb6c95623c", "value": "2023-02-02_42c7de47cfbd79e1372d9742029de902_crysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae7193a-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675454164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454164, "uuid": "2b1886bc-9f81-49a9-a3ac-e62fc42b3dbb", "comment": "Malware payload (Formbook)", "value": "9e6a31e3ed6a76befc77a4aa587b8fa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454164, "uuid": "19e8638c-e412-4f4a-8bc2-3b1a9372814b", "comment": "Malware payload (Formbook)", "value": "e1556a1dda46c2e872e9a18f21d8cbbf8f71d0dd65094e9ec6cac22a9a1aa915", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454164, "uuid": "421e598b-752d-4c26-b5f3-eca61755dfe5", "comment": "Malware payload (Formbook)", "value": "ec8eee0abf372cfa354a20482d873486f0477b7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675454164, "uuid": "5dc68ba8-45d4-475b-97c3-7080e2699cef", "comment": "Malware payload (Formbook)", "value": "5af9cf49c2291d732911fd41a339d5fe1aa8f4cc94a5cffb22d89a0cb9bd7c2d81ce0639b96d36991326eb8554219414", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454164, "uuid": "bc916fd7-4ea0-474a-ac49-0699b38f3b8d", "value": "T110059D9377B198B3FA8B00B5142837CD2FE07603BE95A253A77B79D097518FBB298141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454164, "uuid": "c6be45d1-b643-482a-acc8-124be6e81515", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454164, "uuid": "b70de917-8233-4fbf-8888-ffa1e113703a", "value": "24576:a1dH+AIOaqp/DreSGYxqBGLWPDXn6F0xMpqG4yPa:aPHrjV7rfG9BFPWWiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675454164, "uuid": "fb986833-6b20-4852-8822-0346bbd18cf4", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675454164, "uuid": "a586af23-419c-4bdf-91cf-602abb3c1787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675454164, "uuid": "c824bfbb-aecc-432c-b087-0ef227e1eee9", "value": "9e6a31e3ed6a76befc77a4aa587b8fa9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a456f25e-a3a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675416734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416734, "uuid": "cd7399e3-fa3a-4287-9aa5-465a9581b12b", "comment": "Malware payload (Smoke Loader)", "value": "6feaf0fd32f56cd35642f47b7d35225a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416734, "uuid": "aa2db401-dff0-4a72-b670-3af6406d18ef", "comment": "Malware payload (Smoke Loader)", "value": "e1956e968b7124158c959cbfb07338172f2607a0fc29dc7eea283817c2a2985c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416734, "uuid": "9678c78a-6c60-456e-bfc5-2ee827d7c528", "comment": "Malware payload (Smoke Loader)", "value": "bc031edaf638bc23bcf86d8d736cf0938ffab0ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675416734, "uuid": "892186a4-034a-4831-97cc-764356979f9b", "comment": "Malware payload (Smoke Loader)", "value": "e9d60a8d5e105e091a73b2fa8f64d857e9abaa3019846d5aae39901efbe3008c1e9247410163d8cf204efaca50127fae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416734, "uuid": "c11c9fd1-dbcb-41c8-958e-fed3c5faa02f", "value": "T16D14D03239C0C072C9B641319820FBA4BFAEB9315679454B77A91B7E5F702E0673635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416734, "uuid": "5a382348-7f8b-4372-a7e9-930d3add02b9", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416734, "uuid": "8c42781a-9e6f-47d0-9638-d0e58fa9297a", "value": "3072:zHiXiFTk4pxLZmLzWg95ob9RxPzlli2dgJSpvUvWqBjPw:zHiATLZmLzF+8JhWqNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675416734, "uuid": "cc0ce015-a962-4724-9d79-f74cc211de48", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675416734, "uuid": "0da566fb-3027-431b-87f1-f6afb1ee463c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675416734, "uuid": "50b56a78-239b-450e-951c-45e0f2e9148c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d1765b-a3b8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675424781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675424781, "uuid": "f75e00f5-18b7-4120-b8e3-624a431d3f88", "comment": "Malware payload", "value": "2d601ab09dc923ac8ab1281054b39bcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675424781, "uuid": "81355e03-064a-4847-9dc4-db31eda1297b", "comment": "Malware payload", "value": "e1d1cf6d16e212495f901bf1be50bf62e47ac08f35b168c3ee0a1faf5849fa34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675424781, "uuid": "786a6980-2d47-4428-a49a-114038f6386d", "comment": "Malware payload", "value": "c17446adc28377ed631649ec210f77e495f73eae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675424781, "uuid": "a861d3ba-e9cc-497c-b17e-20e963ec4ad5", "comment": "Malware payload", "value": "19c917c8c611a14d19fd60905668fcdb492795998e2afff10b6d41c9394c1eed74a49dd1e4a7af08e73c02bfb2c23bc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675424781, "uuid": "f29ba339-58fc-418f-b7ee-81b5197e3b21", "value": "T148C34C52710A861EEEA732B6DC5BCA744648FDCD5160E34C64EB7B037FB2643448BA1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675424781, "uuid": "a22c65f2-4392-45b5-8005-74d356f1d2aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675424781, "uuid": "a9f5c50a-2027-4f2e-92f1-c9620f8b2a49", "value": "768:mManLNycm/kNrAze48mNhNwLiIXpEe51wRwZ:qraGmNhGrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675424781, "uuid": "67f7c0b1-d14e-4739-969d-89a2f254510c", "value": 121856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675424781, "uuid": "56aa8335-f080-406b-a160-2e7d5852dd52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675424781, "uuid": "24d240df-47d6-4319-be50-ac63ba1ac586", "value": "00000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64346662-a3e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675444543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675444543, "uuid": "bf0ad78c-a38a-4a96-bfe5-50579f919a90", "comment": "Malware payload (GCleaner)", "value": "0feee67b0ac84a2db297e2b78ad8c676", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675444543, "uuid": "e2e3b750-e8d4-428b-86b9-991f4d2efc85", "comment": "Malware payload (GCleaner)", "value": "e1e2a35be840e40050049a20dc40d045d3feb80ccd8847703d2f7f1500e4e058", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675444543, "uuid": "38719b3e-db6a-47df-8c7f-52b7e0d85817", "comment": "Malware payload (GCleaner)", "value": "2ceb5bb66343ff3a1cebacd4c61fb625eecaeeda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675444543, "uuid": "55cb0cdc-0a49-4735-ab27-e32a8f90c839", "comment": "Malware payload (GCleaner)", "value": "05c4254770b1c3658e6f2fde018a99c66203b57ee9c8ff56c66b1e34d9a8a06bb93eb5dee584257f1301a56fec42896d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675444543, "uuid": "1d188491-2f0c-44cc-9675-78a2cdb2317f", "value": "T1DC95334B85E28E3BE8628636192C8714F8BF7E6524F4624130DE6D0F1FFB62661D9352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675444543, "uuid": "51eea510-fb78-4488-8f01-1ccb58bf662d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675444543, "uuid": "3ac2c12e-fa96-4c47-aca6-8596384afff8", "value": "49152:ygvTWEpy5lmeU7PV/Iox0Tqp4ZMDHLCgv2MR:TvTW2yTZcPxIoxU7Z+v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675444543, "uuid": "4b5fdc6c-458c-4beb-a56d-73162b7c9d7b", "value": 2040377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675444543, "uuid": "ea55c2a9-64d9-4598-a617-78dc360b6ada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675444543, "uuid": "e0809a34-cf36-42fe-9ab8-d886aafcc123", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245bc9b6-a3d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675434987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434987, "uuid": "628914a5-b44b-4714-bd5b-8f43e6e811db", "comment": "Malware payload (RedLineStealer)", "value": "9256d4a73e6f2a37e0713aaf3dfcb88d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434987, "uuid": "146f9f8c-71fd-47b6-a8cf-7ff4428a6a9c", "comment": "Malware payload (RedLineStealer)", "value": "e2145cb74caf435887344832b31954afd855e60d07cfa5fe2a0bcc4a32b8c363", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434987, "uuid": "d2e1c45a-3972-4a3c-9532-c8387b9bca46", "comment": "Malware payload (RedLineStealer)", "value": "5e60d3ca6d38e008b18cc6ba08014eb0344356ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434987, "uuid": "d7530c79-d9bc-4feb-94c3-5cec8f9c1a58", "comment": "Malware payload (RedLineStealer)", "value": "0837979a7b053d2f7331541a5e5794b0980eee2a14362ce551517c406c72ca6597c9e919b731e6cb882105b5d318b75d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434987, "uuid": "ab32d895-5879-4ca0-8e46-c89069244469", "value": "T1D814CF3236D0C472C16B40305868EBA97BBDB4315676990BFB6817BE4F306D167FA34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434987, "uuid": "0fc309e2-1241-4ac4-96cf-358641befef9", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434987, "uuid": "d4bea691-ead3-4459-97d5-8f7207d071e9", "value": "3072:ze7XMAD7vr36JVfKrZLH3R48RWH9R5ZxJPpEtTkJQIXJNNnvq6b5:zej6JlQLXRFRYJsBIXJNFR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675434987, "uuid": "77661bab-804d-4a9e-8cea-88c49b66dc88", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675434987, "uuid": "f82461b9-5489-4fa4-a034-4a2566a9bccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434987, "uuid": "56a92301-1c96-45d8-83e4-d0a67794c2e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3270c2b-a375-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675396116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396116, "uuid": "f66f258b-af98-4c50-8031-9f45291f93bc", "comment": "Malware payload", "value": "8b2d2cb5735c6d3c818e7b83789aff22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396116, "uuid": "271e5216-10bf-494a-9fd2-5c3c17a1d92e", "comment": "Malware payload", "value": "e29459de30dd44db74aeda10be771937072ad957ebdad25b3078dc25c531838d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396116, "uuid": "da1dc435-3479-49b6-a993-3f0448af63f2", "comment": "Malware payload", "value": "c4f2d801e0d726805972df5e3140323020ca9422", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675396116, "uuid": "dc092968-96a6-418c-893d-9f85b3325d7a", "comment": "Malware payload", "value": "3b18e1b291397f0532550c7cba63c4cc6ec44d1f1a13c684edec4baf90b853c8ea9679837177cdff22b25520a8f182a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396116, "uuid": "5a26ee0b-42e8-43c8-b290-a331e9342213", "value": "T1EA76331A39E1D471F30A81771CE51BC8E065FB9D9AE304737BD98B1CAEB6398C52421B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396116, "uuid": "c2394fb4-311c-49b7-aa81-92de5f977bee", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396116, "uuid": "1be8b387-4451-4b58-904d-0a5ee59bd291", "value": "196608:91OTHVKRP8k551q+dzg4YLMtxwZKCeBiJZKFsT329:3OTHVKRPN51txi6SZfeBcKFsj29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675396116, "uuid": "22960f91-4379-4685-afcc-8d1dc4088ca1", "value": 7636826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675396116, "uuid": "2ce99f84-e6aa-4910-9aab-2647597d5161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675396116, "uuid": "f1c6406d-70ff-4f4e-8b7e-16addf956211", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92cdd062-a3ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675420140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420140, "uuid": "e50649d9-7c65-411e-b65e-35233903f5a2", "comment": "Malware payload (AgentTesla)", "value": "af72e06f3c672737077fd04a6cd44af1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420140, "uuid": "cb31fced-8c3c-422b-92ca-08c04fc3db10", "comment": "Malware payload (AgentTesla)", "value": "e2e7cc72bc5d7046056f1784e2b21f760359131dbb37329e880211cf28ee69d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420140, "uuid": "37ef14b5-4d5a-4bf6-b127-c219105dd21b", "comment": "Malware payload (AgentTesla)", "value": "fea30b1b6cf409b3e29c703cea59f179f8c426d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420140, "uuid": "6f7e3870-67bb-476e-b5f5-cc8a4f6329aa", "comment": "Malware payload (AgentTesla)", "value": "ffafb727bee6069cff8d7210eda2976b495402e1ac06b881433eafb2c1f20e5823c222ca466e315d831e1c3f25f33dc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420140, "uuid": "96c344a3-7a64-4ee3-a9a0-1cdcabbb7784", "value": "T10D03FA8821AC8B33FEAE1BFE14B9659BA7F665376010FE892DCDA1D47195B400700B4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420140, "uuid": "7ce93735-0706-4ef7-8e3b-93345500aafb", "value": "768:YevzNw901TxGi+ZPc3XyvgQu9Et+mZqt5RYVMLvZO4v:zNwe1T4i+ZPoXyYQss++qtfYys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675420140, "uuid": "324d2f82-d8ed-49e9-896f-541e7461aa7f", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675420140, "uuid": "3e77b239-21f8-4005-b273-8367bec5dcfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420140, "uuid": "6e0a122e-e8b7-485d-adfc-303771981dcc", "value": "BANK DETALS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a138a6-a3ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675448552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448552, "uuid": "9a9b42c6-c443-4fd4-a7e4-5e5db91547f3", "comment": "Malware payload (Mirai)", "value": "8e3a5e64276427c156ef66c01eaee6f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448552, "uuid": "44f4517e-bf90-4534-9b4e-aaf5a7858af1", "comment": "Malware payload (Mirai)", "value": "e36481625b3c97f51cfe81852bb999450c4a61c36a6ffa3d3d592c307b51a2d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448552, "uuid": "6b89d128-42d0-4e17-bd58-4e4c54cd9f4b", "comment": "Malware payload (Mirai)", "value": "7f0aeea41b6b37512cd37a7aef04178d471e9b61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448552, "uuid": "5417d6fe-78ca-4c44-a4c2-ac21554b75b5", "comment": "Malware payload (Mirai)", "value": "d05a1a76c209a1ede1ea5eb29eb8e53f285efee9b1e94f22ab338144d97a656f33ab4d1dfeed46a7bb10973ee8f21c25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448552, "uuid": "4e53f985-3101-4a4b-b7d2-05712024953c", "value": "T17EB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448552, "uuid": "92ec6019-030c-4830-af03-31b4ae34f2dd", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1x/LWy:c9sSyzz36YaWWgg1xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675448552, "uuid": "e503c00d-38c7-47ae-bafc-cfd45fc905b4", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675448552, "uuid": "94d1278d-c5c7-4362-98a9-94298c63dd25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448552, "uuid": "e4c38e2b-d255-42cc-a07a-17f8d444b744", "value": "8e3a5e64276427c156ef66c01eaee6f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659771d4-a3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675442398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442398, "uuid": "42688d24-1c67-4a33-b47e-8c967c79f549", "comment": "Malware payload (PureCrypter)", "value": "bc017289fecf6f4bc53c16323a56ca48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442398, "uuid": "955e1682-cb46-4feb-8860-fb87d6334930", "comment": "Malware payload (PureCrypter)", "value": "e36837a72be41a1436f5130869e60b70f4d579472d41774f93780f2f56a665da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442398, "uuid": "6e4329bc-8b51-4963-9c5e-855d3de1dc12", "comment": "Malware payload (PureCrypter)", "value": "540e9c5e09070e0d78403f5fb5564ac5080ca5cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442398, "uuid": "e988b9e8-18c6-4008-8dc4-8572a34c2cd3", "comment": "Malware payload (PureCrypter)", "value": "fd05087c56ec6c815714e20eaf5845b3d6440e22a4a95e597d523645bb56ff3bd88b1fd2bb712490790fec1d09217376", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442398, "uuid": "80f50506-174d-4c33-abea-cf38338506d1", "value": "T1D955338CA383F72D91952CA9B6F218293927C70F8C0B111DA6E454AFB1579E17D4EBF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442398, "uuid": "77aa8442-3f3e-4fe5-b226-f7e487a2d86f", "value": "24576:5DG+Y2ZCwte4UD058+LLRfoSVditNH71iyaJyvVuJJd:5C+RZC34U28YtfoSVUjH7eBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442398, "uuid": "ade9bc3d-cf1c-42ee-a0a9-719c87d312d0", "value": 1297680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442398, "uuid": "a39f5463-7de0-4a65-b061-54a917c93306", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442398, "uuid": "acd0362a-6a38-4b90-aa55-0e19fd62858b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d190084c-a3b9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675425399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425399, "uuid": "1e4328b1-aad0-4f7a-bbc9-55ded9f614e5", "comment": "Malware payload", "value": "346e9454c0b03dc632e1c2ffdcf210c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425399, "uuid": "ff850dfb-d486-416b-b35c-f7aba8c5fe87", "comment": "Malware payload", "value": "e62b923bc1c280d8bac5686523b45f4b959baa7b31d1e55a43eeebd4ea6bc639", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425399, "uuid": "137c4072-b86f-4817-9d07-542e56dd5c96", "comment": "Malware payload", "value": "55be647dc909e377c6e5595d0f1b624a7e793965", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425399, "uuid": "6c324d1f-680d-4c8a-8d74-f2a8b96fd7f3", "comment": "Malware payload", "value": "9569a54aaa36679bfe86d6e28029bf81095481d42149bb3a489fb6b9decaacb6974335e28dd77e8c7cd84c919205260e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425399, "uuid": "7e23e932-4ab8-41d2-9253-79d3e7367bc7", "value": "T191C36C0079C0D476FAA76AB13560CEE89C2FFE350F755DB733A4943A1A606B04528DBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425399, "uuid": "887b70ae-f9a7-4944-87a3-89a7b58cbc08", "value": "3391d25821f027ad2ca25f972b6a2038", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425399, "uuid": "ef487e0f-9b13-4616-874c-e3c86465dde5", "value": "3072:87jNlSc7P8c26HCBrHvIC3KbBhun+A4Dc0IuV6W:mlScNaYhuzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675425399, "uuid": "c348eb03-3007-41f8-bf90-a1b059091b3e", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675425399, "uuid": "cb358cba-5333-4a22-8fbc-771ef2c0798a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425399, "uuid": "fcf98179-3232-491c-be23-f6411db2aebe", "value": "e62b923bc1c280d8bac5686523b45f4b959baa7b31d1e55a43eeebd4ea6bc639", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0e282d-a3ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675448638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448638, "uuid": "4baa1106-31a5-410e-8e78-e56a3d054ad4", "comment": "Malware payload (Mirai)", "value": "be51427b2e20c86beb027ef022176689", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448638, "uuid": "6535ccba-ac75-48b0-a5e5-d16d98abd47e", "comment": "Malware payload (Mirai)", "value": "e68003dc0d50d7420906c3edcdac6833b6f5ddfe9c109256fe1a150a4ca53f49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448638, "uuid": "8957cd24-2261-4d65-b037-3074b2d86ab7", "comment": "Malware payload (Mirai)", "value": "791dcb2803f80f3febdac8a342f1ae3fc4694e06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675448638, "uuid": "11f40b0a-f7da-405e-b6b5-bbb2ce69954e", "comment": "Malware payload (Mirai)", "value": "4a0c1eb281597b574eb651e83cff0244e8eb12ad2d5a06e72a3d80c7183427ef9adaf4ebbdb5fea93daa85a3ab7c6f1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448638, "uuid": "6b0caec5-7c67-46f2-a671-3a6e89610f81", "value": "T19E330A8EB8029D3CF91BE6BE54164E0DBA3177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448638, "uuid": "aed2133b-29ce-4242-b819-d3f67e02edca", "value": "768:gduPBFnHooqR8qOCKq2cH4Y3e+TK806MMUVjzMfQXOtHud2oGy:r/hqaJM53eqK806MHdMfQXoHuCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675448638, "uuid": "9d797f85-6309-45f4-9257-29feca916e5c", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675448638, "uuid": "b05ee3e1-9632-4c9b-8c13-5cbc8ef3b26b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675448638, "uuid": "dc09f25d-41ab-4fb2-a8bd-99b5f8509db4", "value": "be51427b2e20c86beb027ef022176689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa0c21bb-a402-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675456821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456821, "uuid": "8727f68e-2cb6-40f3-af7f-97c4fc50289c", "comment": "Malware payload", "value": "f06defea0262887f2952ae5f6fa716e0", "object_relation": "md5", "Tag": [ { "name": "1675417198", "colour": "#E1D5CC", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456821, "uuid": "498888d0-d282-4144-b074-95a13ce1681e", "comment": "Malware payload", "value": "e6da827d704493325f8d8719ff7e814c86b67f30677a82a6e2cf4efdddfbd2a1", "object_relation": "sha256", "Tag": [ { "name": "1675417198", "colour": "#E1D5CC", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456821, "uuid": "9e08e331-cd64-4a2c-9bc6-aa9e89f0d407", "comment": "Malware payload", "value": "28f74a3b943eb26fc4fabc92000daf80081c4ba0", "object_relation": "sha1", "Tag": [ { "name": "1675417198", "colour": "#E1D5CC", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456821, "uuid": "e0fbc4f3-1179-42aa-85f2-6eb90372f333", "comment": "Malware payload", "value": "f78ab503ce7580237991555166351e18d897da12424bdd00fcb126979fca65522eae49fcc814463d20048a143338cfba", "object_relation": "sha3-384", "Tag": [ { "name": "1675417198", "colour": "#E1D5CC", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456821, "uuid": "9abe1abb-6550-4fa7-9a27-c188f849700c", "value": "T1D7445CFCD96F0480CB26DAB173826F292B3AA37DFE464A59F252384C95C1644E491FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456821, "uuid": "d86eb983-4e79-411d-9cb1-74dd054b8040", "value": "6144:DEO3n4sfGcd/Sv66lDxZHlsPG5og+XSM1CeN0NGe5:DEO39fGcxSv6gHlP5ohSaCemGe5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675456821, "uuid": "f4f666e1-eba8-44e5-93cc-cb9179c206ed", "value": 258264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675456821, "uuid": "13e6ee2d-e1de-44b2-baf5-da829eb38cd3", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456821, "uuid": "7285bd5e-e6a4-486f-a29e-a1f4fec563d6", "value": "Original.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f6c761-a3f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675449053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675449053, "uuid": "9eaf9629-7b8d-4cc4-99e6-f0b58979c6d4", "comment": "Malware payload (GCleaner)", "value": "56619eb249a4bb7fd54b59b5f6d8b1c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675449053, "uuid": "924ec8c2-a39f-4582-8f53-4a4362f03abd", "comment": "Malware payload (GCleaner)", "value": "e8079c283cdf53221bd815deef6b33ace170cb1811ce2d2ab79dbc763ba3794a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675449053, "uuid": "a2ff2d65-83b7-4ea3-8d30-1ff307104d34", "comment": "Malware payload (GCleaner)", "value": "316e051a18fd785a9bf1d5814a9b42f6e74c7eae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675449053, "uuid": "194cbfb1-3251-4ed1-8260-ffd6c164228e", "comment": "Malware payload (GCleaner)", "value": "60b47cf7086e5d85bfa2e4b68e42683792ce55c9dce48b63d5ebde450682e458e5396ef37180a3b1911788b1ca3e7c85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675449053, "uuid": "d1001a32-52e2-4313-8074-a8b354ff5a8d", "value": "T17FA53303B0688CBDF111353C66345413F96B6A92F5386248367F679E3F7B1E926AC386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675449053, "uuid": "a0868239-6a55-4289-9bcc-c4d1a82605f6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675449053, "uuid": "97049974-89d4-44f1-908d-e7fb2c3c11d9", "value": "49152:yg9gVUYilVxGMrn220Q6IT8qh9qfh2UkLCgv2MR:TKV4xDP0QJTPaAUUv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675449053, "uuid": "2f99a399-0c69-43c0-86e0-307a37d41147", "value": 2084622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675449053, "uuid": "fed9213f-cec4-4c28-8465-71d622bc2403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675449053, "uuid": "86e131a7-7879-4ac5-9456-6889987c6e54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c14b9c8-a3c7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675431108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431108, "uuid": "8b982ee3-8910-4565-8455-bbfbbf454c87", "comment": "Malware payload", "value": "9342ee5e6dd692b357b512269b35a59a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431108, "uuid": "5592cb4d-fdd0-48c5-af6e-d8020d70da2a", "comment": "Malware payload", "value": "e8340421f6bfccc9590f760bb5d4a2a614c8bb1f30f6d6671395f2792d8bf6d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431108, "uuid": "53bf0e7a-b7e6-4331-9f5f-8aab6b2c0e86", "comment": "Malware payload", "value": "d305b075c7a9ac9c45c39e56b24a7d62d5a2279a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675431108, "uuid": "5fbf1f74-ce6b-41b3-91ea-e4e2c9c7666e", "comment": "Malware payload", "value": "118f728c7fe0ba2f056da46cd625d6f4829ee84e32d9d322f9a05139666cf1e0e994ababb2bb3ade916b79897ef7fd18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431108, "uuid": "c222a4ad-69c0-4f95-bf80-c00edf74e457", "value": "T1F4B36C0727C97402F9648C3C3B259578CE2EDDCD2E82D7D245EC3DCBBD62A496B29129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431108, "uuid": "77e98747-19c9-4073-8c3c-433524c12111", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431108, "uuid": "ce131b3f-9f82-44ce-ba87-ac68dd459687", "value": "384:PEfPrDlsc0mXhI4xFxlYh6GmTx3qVWV4U6DAl3YlTloNlvcloNlvAlfYlNlZ7lZc:enlsKxFx2YnJq+6RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675431108, "uuid": "cf30bfc0-0987-4ae9-807f-1cd4c6efbb45", "value": 112640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675431108, "uuid": "5a5ce8dc-3d09-4740-ba39-aad51acd3f82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675431108, "uuid": "d637326b-24b7-447a-8f38-057f7ed24e86", "value": "00000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8de467-a3af-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675420802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420802, "uuid": "4ac53347-bbb3-43e6-b2b5-5d7d061f58e4", "comment": "Malware payload (AgentTesla)", "value": "4e6ef05211d10ac6ac193be9e5de038e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420802, "uuid": "36320431-6280-46e8-a9de-82353603b598", "comment": "Malware payload (AgentTesla)", "value": "e88c590be7923ade93a69f335ec96a5aba8a189cd4f4002f31e70d315a842bfa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420802, "uuid": "338de76c-07a1-4101-8b5b-81b5040fe75f", "comment": "Malware payload (AgentTesla)", "value": "a90e1cc038b6e93096ea260e466ad4d1d6386102", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420802, "uuid": "227d3227-555c-4991-8e77-79798dc00195", "comment": "Malware payload (AgentTesla)", "value": "c881c04c05ee02a7b7cbc92bb626b5a64e1bae02e5efa726144ca2344f39dcda8d912e19c3ab2eb8fdafa5f71d044c47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420802, "uuid": "2f9a2fdf-30ed-4d1f-85f4-4f578956ffb1", "value": "T18B058DA337B195B2F78720B104347A886BF17603BE16E2939BB737C06785DB77298152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420802, "uuid": "518756cf-4593-4044-8095-15d850ea1c45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420802, "uuid": "4088a44c-8c89-48da-a965-aaadc6cba823", "value": "12288:7BhefaqG4yPayiZFUH9AaB08xofl6+4ogg/m6Fy2Mxzo3:7XeSqG4yPaTTUaay8xolLm6F0xM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675420802, "uuid": "e8ed3b4a-4844-40a8-a3fc-4efbbd31aeaa", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675420802, "uuid": "9965ba81-156a-4e49-9935-dfa053d8028c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420802, "uuid": "df728afb-0dc3-4436-a83b-9fb1ca2c0fed", "value": "NEW PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b91b98-a3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675422702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422702, "uuid": "686ebfdc-d719-4295-aeb9-3c283930e84c", "comment": "Malware payload (Formbook)", "value": "f580ff0c03fbb8c2dd8e02e84117fd89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422702, "uuid": "06157a8d-c7f8-4f7d-b626-f6251892bcd7", "comment": "Malware payload (Formbook)", "value": "e89194b4e6132af01b7678f279eda434aa59cd960f301d05836d4e7ab653f0ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422702, "uuid": "16ae363f-c304-4469-9cea-c480f011099f", "comment": "Malware payload (Formbook)", "value": "d45cdda4a3ca10fb2f5b56bff3ee80be3fdb7b90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675422702, "uuid": "7fb161e6-81bc-4241-9218-d8d263f44412", "comment": "Malware payload (Formbook)", "value": "a6826499acb21ac8e0927306baaba1c8598570c3a7822dbc802e886f738befee111595e03364041d018bad0952575015", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422702, "uuid": "334aed23-080b-49ad-bad9-a460ff449d5b", "value": "T1A2B67210F3E84333CDB70776A83A73800278F6A6A8C7CB9F9684A11BAD1235546627B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422702, "uuid": "f8d9f417-0e95-4ff6-b3ac-e6078537eff8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422702, "uuid": "69b6282c-4a58-4aee-a196-bd6eb470516b", "value": "96:8g9hA1IjcxVNiG5J+OC4XLo9PnRZOk9gcu7VlkKBxNezNtI:8g8zMG+OC4XLotTlBu7VeKB4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675422702, "uuid": "d8ee55db-b185-47aa-b6e3-cd2dfde1f502", "value": 10492416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675422702, "uuid": "c5f4bbb5-2e06-4740-a8df-a18f83e2e983", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675422702, "uuid": "e527747f-cd0f-41c2-9d8c-bd37bf79c046", "value": "e89194b4e6132af01b7678f279eda434aa59cd960f301d05836d4e7ab653f0ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d66c430-a3ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675447646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675447646, "uuid": "667679cb-5a00-46c4-8b10-3469a099ea60", "comment": "Malware payload (DCRat)", "value": "932283bf61964cc15f22308ae3a9d013", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675447646, "uuid": "dbf14360-2e7a-46cd-8087-84406d7bad4b", "comment": "Malware payload (DCRat)", "value": "e8967e7e29637e86409f73b31e2e775bde676b25ae6b121380a1b95a48fd3195", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675447646, "uuid": "a07ccb32-3aab-4f5a-8b67-6f6206a95dd7", "comment": "Malware payload (DCRat)", "value": "15ab81a2bd7d6a430e89aa34c2d4f04b8cc83e8d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675447646, "uuid": "78634531-5a00-4d74-9e33-0c4cf37f159a", "comment": "Malware payload (DCRat)", "value": "4e2f6e57e15d7cb91a6a461c53c9b87e6a6ccd861bd892462af1de2f2da63ef73f481bfe1d3ac0e3ead433477495b079", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675447646, "uuid": "ace2c8bd-d1ff-40b2-ac35-53b0cd4e4a0f", "value": "T10A236D4037E88136E2FD4BB4ADF3A1458679D2672903CA9D6CC814EA1F13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675447646, "uuid": "dcaf2893-b7b6-487e-9439-748a636a78d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675447646, "uuid": "816a6e60-edeb-4954-b840-35ccdde7f1e3", "value": "768:p96mxUTILWCaS+DiMtelDSN+iV08Ybygee9OMHHZ1CvEgK/JnZVc6KN:p96AKWMtKDs4zb1hOWHvCnkJnZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675447646, "uuid": "f6500fcd-43c9-4d32-971e-a52da211dc68", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675447646, "uuid": "10e6d28b-f24d-4a13-b0ce-10773754d94f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675447646, "uuid": "9b077d62-f031-4d21-b204-9950fba41e14", "value": "bJyw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544f108b-a410-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675462555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675462555, "uuid": "b6012899-0628-44c4-986b-5444ae08ec4f", "comment": "Malware payload", "value": "82b54cc69ddd2797cf486f4caa05e997", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675462555, "uuid": "cb847288-69b4-46cd-aff6-3d9e027d2a3c", "comment": "Malware payload", "value": "e98df0895c550ab9781548c91b429e738b94ccb2bce4f903bd66061a6e9c05ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675462555, "uuid": "7cf7b3d5-4274-4671-a46c-d36cb44973d4", "comment": "Malware payload", "value": "273063471bb1746d02dfa1c9f81659fd7604a912", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675462555, "uuid": "e498b21b-1b7e-4a9b-945d-7fb574a44825", "comment": "Malware payload", "value": "f575622cb1f41cf5efd0aaad97c77826b94898962ae5226321c40eefcb761364a294ea4be57194085ea86a7ff8fe6eaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675462555, "uuid": "6ec00d6d-bb26-4576-a3ce-523f8da652b9", "value": "T15D953393E026D57AD28595B40FA9C850ED73FD711C7C520930AF7A8F0B372D668BE12A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675462555, "uuid": "86c921f1-8160-40a7-bcbb-15d28451f15f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675462555, "uuid": "d5071e67-58be-44f1-a138-8f5f7c5011e8", "value": "49152:ygZDxzPjGosDBmWok4OWOVYi6J4OQcH8dRZVgLCgv2MR:TRxDq3zjpWWYiO3cd1Iv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675462555, "uuid": "c0ec80f2-1421-4822-8abc-fe3f0fe7caf9", "value": 2048094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675462555, "uuid": "d83063e7-8cc6-4525-8d97-0ffc7b4f2a5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675462555, "uuid": "a57b1310-d72a-41b8-9ddd-ce9f817f7883", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1ebc59-a3f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675452021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452021, "uuid": "29766e81-f927-4e6d-913b-54bfa18a316b", "comment": "Malware payload (Amadey)", "value": "68f4eab1f91b0162772325ff19335dfd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452021, "uuid": "840ec56b-eb33-46dd-931a-159166ddf469", "comment": "Malware payload (Amadey)", "value": "e99c991a0e212e07b49a05c1af19f14c07ad9dd904cdc9805925ced9bcd2459d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452021, "uuid": "3d5dcd2a-b0a2-46c5-93e8-7516f14ce80e", "comment": "Malware payload (Amadey)", "value": "93cf8569baccc59dcf3231e5fe1f24f3b7fd2c5b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452021, "uuid": "598f763f-81ea-4bfa-83c3-7cfa9b5939de", "comment": "Malware payload (Amadey)", "value": "b3a0411fdbf831022cbe2a3231706b85f12414f3ca74f328fe94b597f0be612960fc569dbd69921e2a82cb4e10abb621", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452021, "uuid": "8d711f9e-3e43-4b76-a211-a5d8d1f42b4d", "value": "T183B4122235C1D8B3C02A71315C23DF65BDAFB53042BD9AAB7B6A0B595F30AC1163725E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452021, "uuid": "ff8ceddd-fdb5-4208-9db9-309723fdd958", "value": "6b1aa8e68ec0f35426270b76446d282c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452021, "uuid": "1e34b9c5-7df5-4394-bae0-4a9fd1eb3e18", "value": "12288:KaQYNybmdaZcyzGWX7FodjHSspmDTHJHFxrV7qL3ZIDTQ:KBO+mMZcsGC6dPp8JIIDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452021, "uuid": "6dda03fa-1a1b-48e2-86aa-a6d1f5acb354", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452021, "uuid": "caf26553-445a-4bbc-817a-47bc5d74d4f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452021, "uuid": "a0020cff-63de-49a0-8c36-c42168161d61", "value": "68f4eab1f91b0162772325ff19335dfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f14d4fd-a3ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1675432455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432455, "uuid": "03a3be11-7788-4a77-84c3-1644d51d7323", "comment": "Malware payload (Fabookie)", "value": "13906543928682808218eef5b53a0bfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432455, "uuid": "f28560c5-cf2b-44d1-9347-6c5ddbb25c70", "comment": "Malware payload (Fabookie)", "value": "ea3c6db7cd5e30d7591b57c2e3cf09533811fdf692a3c2f5293c351d67dcefa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432455, "uuid": "eb87bb5c-b90c-4f49-b363-dffbd0d84e62", "comment": "Malware payload (Fabookie)", "value": "17215608bdb850d98e17d762fb8636d62cb96ce6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432455, "uuid": "6b1ac8da-55b2-44dc-8080-108acbd1da90", "comment": "Malware payload (Fabookie)", "value": "95ee43aac9af5f6d1530db788d0dc020349ee47d750ab6be97067475ceafc6e5e859aa4a61c44fb04c5d948be13bc53d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432455, "uuid": "d5cbfc28-c265-433d-96eb-f0c934cbd881", "value": "T106F502FE61443754C05F88384423FD86B2B6592E1BEC95AEB5EBBAC07B6F410DA01F52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432455, "uuid": "fab58d49-1c82-4d1f-8491-044864532e22", "value": "245fbb05d3da4d7c6badd5cc3e1f9b98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432455, "uuid": "96ab4e43-8c71-476f-9303-75b962ae2db5", "value": "98304:BcbFheM2n+WjK3ElKPf68qCBOgVkKlk1f:ubO70j4YhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675432455, "uuid": "014f9cc1-a0f9-47ce-b39b-8ba838bf4492", "value": 3638272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675432455, "uuid": "3f12a04d-56e5-45c0-9aee-310b19ae25ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432455, "uuid": "dd4c6fc4-7c9b-4e2c-b0a8-38a49cb2b0ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba468d5-a3bf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675427966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427966, "uuid": "d195e520-1dd1-4ef4-899c-cafed3c4eb1a", "comment": "Malware payload", "value": "f62b8ac1f4d527d6ca4f780505934f64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427966, "uuid": "5d756323-53b2-4697-8fa3-3d276d1dcb54", "comment": "Malware payload", "value": "ea4b3f68b9c26f5ee77436e17e69bedcc49614c0ae68188f092c61073cc6e65d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427966, "uuid": "1fa92261-fe66-4cee-81fc-2a69ebfea57e", "comment": "Malware payload", "value": "1d3e7c5d28ce32923020310ca7ed1f50da7d8955", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675427966, "uuid": "02eb6126-6bab-4097-90e0-8fadefd77558", "comment": "Malware payload", "value": "c52851c6068daa8569594e492175aef2df088835ecb62513f763a84f3316d100adb659a482dd58af5012262165cc7e87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427966, "uuid": "1f235ba4-8db9-427d-8da3-cadfc04a79c3", "value": "T1BDC36B1036C090B2FDA769B12860CFA5ED3FFA354B355EE723A4953A1E706D04426DBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427966, "uuid": "11720912-45b4-4b5d-9d6d-36075b88df5a", "value": "3391d25821f027ad2ca25f972b6a2038", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427966, "uuid": "a2718a8a-0f5f-4011-9834-7c0b49e83d9c", "value": "3072:nUGpE2cjJ7UGfC56kJg7zLONu+Hos2CuVhzm:nUa275LOEHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675427966, "uuid": "cc9d2754-3d0f-476e-9173-570df087a450", "value": 119296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675427966, "uuid": "16b82912-24c8-422b-b4e9-129b2f75a938", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675427966, "uuid": "e3d76243-66d0-4d10-8155-a423978a53a7", "value": "ea4b3f68b9c26f5ee77436e17e69bedcc49614c0ae68188f092c61073cc6e65d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbea88f0-a355-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675382467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675382467, "uuid": "4243fd70-f90c-4b24-8bb8-c8660f66d7b0", "comment": "Malware payload (GCleaner)", "value": "fbdda5c119a5c434693903047c172b82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675382467, "uuid": "c6810be6-5225-422e-a98d-0bf5c93751cc", "comment": "Malware payload (GCleaner)", "value": "eab1a0c2056b76f6e114f9590b5498f08783fe9332188f2c3cb7cd33e176a9ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675382467, "uuid": "4a601de4-f509-44b7-96ce-b4a02630c38a", "comment": "Malware payload (GCleaner)", "value": "9ef4faca51faa8797f299c2b9e1f5a527e246355", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675382467, "uuid": "3a4e2685-616a-4a7c-b8a1-80a1afb4865d", "comment": "Malware payload (GCleaner)", "value": "e2dcd5f5417fc430b2d96630196d6d1fa278d872e55e64f546260ed8249b84689b69a0c21289b6461d59174eaec9b7d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675382467, "uuid": "cc38afd4-b948-4053-9ef9-692279ca7dbe", "value": "T11C953306E5B6A133C1414EB00E148464F7A77C8F377D223431BF79DE6E266E0686EBA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675382467, "uuid": "7fe97156-12ab-4d5c-825e-471e1a70bc5b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675382467, "uuid": "43e2ccbd-58e5-4804-8f40-9feafc32ed76", "value": "49152:bgmXHn3uskvpjsjnJiZcdQZsvXX9DFt/rNiU62hDhJv0vGKSLCgv2MR:cmX3XkvpOwZc88NRi3WFZe6v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675382467, "uuid": "a76c478d-4914-482d-82ba-38958b279b71", "value": 2044399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675382467, "uuid": "1230e0b0-4804-4fc7-8086-ef6948bff91c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675382467, "uuid": "70b32c80-aca5-4426-b887-1f61f7940930", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7447705e-a3a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675417512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417512, "uuid": "efcc51ba-d786-4326-909c-2767d229acb0", "comment": "Malware payload (Loki)", "value": "018abbc00af05f8e7349c3b3d0786862", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417512, "uuid": "f4ab89c6-90d1-4212-a472-d14dc4db871f", "comment": "Malware payload (Loki)", "value": "eb152370bc4424a178832f9e8c1c06f527f0a4a2e1ac2cf1e671e0290a098eb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417512, "uuid": "1a2ae7da-8b39-48cf-a73e-4a4f881b8362", "comment": "Malware payload (Loki)", "value": "049e6854e7a49fa9c45a1580293814fa49ac1580", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417512, "uuid": "30e89caf-0d1a-40dd-90fc-51ad992d1a75", "comment": "Malware payload (Loki)", "value": "21bb6bff2f1a65de2bddaf906a2345abcfbfdac4242cf0f48a8e8a0ca321e8414349a2c0a42a35c7560e5f43a04d001e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417512, "uuid": "11404371-b635-43d4-a472-668b2462c6d3", "value": "T1DFF46D6337B199B2F78720B204247B885BF17503BE16E2939BBB37C06785DB77298152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417512, "uuid": "4cad32b9-5518-4186-84ba-fc9b59437ee5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417512, "uuid": "e48653af-c078-4206-9da5-e596acdc8595", "value": "12288:dhefaqG4yPap6Fy2MxzHhoOtG0OqwXURf3:LeSqG4yPap6F0xW4IUR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675417512, "uuid": "a3bf8748-7a35-47c0-994d-51094e245f66", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675417512, "uuid": "f3704ba1-bdcc-460f-97c2-e2ec1302c0be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417512, "uuid": "72d6cb6b-c6d0-4efa-9593-83cf6cb0b73d", "value": "PROFORMA N.71A 03-02-2023pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53eb5c01-a3ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675432490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432490, "uuid": "ccd65e33-86cb-43e4-8a32-63900df4a0ef", "comment": "Malware payload (RedLineStealer)", "value": "86221cbb7f0dd696acfc913ad055f1e9", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432490, "uuid": "d8da0a14-7553-4c5b-9053-a4cdada60dca", "comment": "Malware payload (RedLineStealer)", "value": "ebb2dcf0d743e210a391d665b4589e3a0e41189ed1b21fcacc8c14caf13b1ce6", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432490, "uuid": "ed11d86e-59d6-40ce-8f70-b19c0ceb53f8", "comment": "Malware payload (RedLineStealer)", "value": "52aceb9f15f0ebceef27b378e06e42613739b481", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432490, "uuid": "bbf48bf4-a502-46ec-a906-dfce06a58df7", "comment": "Malware payload (RedLineStealer)", "value": "bc8145b446c8baa48014a94ca0bf2528e93fe663baca6b589ed354e5f70b21777ceab15957a7bd3e4cfbc9f453228b82", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432490, "uuid": "1ecfdd82-96ca-4287-8908-017df4581cb4", "value": "T1BF55336201E3660FD85ACABBD9776504F5B7D116F0323E2EEBC4341229F85E42246DBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432490, "uuid": "232b7b41-c6a7-4c8c-8b9f-e77ba267cbf4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432490, "uuid": "8aaaa7bf-1c28-4b8f-8ae3-c8432bc66a52", "value": "24576:g+JA0Sg9WLT0Fo2/JJTBQ0g1A9K9rjF/lQkBNnWZrXBkUGlcUDSg1fcjzajdg8MC:XJJ92wZXgu49rjF/+kBNmxZG5DSg10j/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675432490, "uuid": "c2fe359f-83c2-4a48-b7ea-be10272d8412", "value": 1318912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675432490, "uuid": "12b15c37-18a8-4212-b522-bdf08bf1f3be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432490, "uuid": "29b9774a-8afc-406e-a454-5be95bffb1e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0325aa-a358-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675383756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675383756, "uuid": "b4d36a89-61ff-4496-be8b-f2aea35f0a69", "comment": "Malware payload (Smoke Loader)", "value": "301b82fbdc28928c5fe44bf501f363b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675383756, "uuid": "f31a9d01-eb64-4348-84de-00c007103d22", "comment": "Malware payload (Smoke Loader)", "value": "ebf3d58e41457acc722c1abec57661c7a8bbb580db62177a3d25ba4405f4dafc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675383756, "uuid": "c5cf550a-2d94-4f5c-8097-0414e545e3c6", "comment": "Malware payload (Smoke Loader)", "value": "db648891a77c8993b46c6ee76ec4f1f10266fc8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675383756, "uuid": "6990c244-0263-48e8-a9d2-fcfd01581030", "comment": "Malware payload (Smoke Loader)", "value": "e976b672efff766403f7cfc6454b61b013b003fc901a6d32369334044b256febf46ead92ea1ceab0937b9fa8e8fb3ded", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675383756, "uuid": "09e2c311-bc2f-4223-9d0c-7ff3a0cd6380", "value": "T10D647D42F293FC41D621C6729E1EDBF47A1DB9514E286F6E12199F3F1A72172C6A3230", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675383756, "uuid": "2927a81f-8b72-48be-ac8d-d5cd5c88bce2", "value": "2ff60b2f756b6533c2643b340c02a5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675383756, "uuid": "c5c81afb-e02d-4032-9c46-91cef65dc789", "value": "6144:l2tHLwThFXc6hSW0/PJa+p+y8yt57lwKwpx8YajV6ptCbNKNc:l2tHMTTXl8RRa+pp8U7le8Yuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675383756, "uuid": "f7fbd18c-2c28-4628-a955-00bfcb421f18", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675383756, "uuid": "dce77404-c622-48ae-9cd4-bd2d75efb69e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675383756, "uuid": "d14dc6b5-bc01-4ab7-ab81-f9615d7cad8d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae19731-a3fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675453225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453225, "uuid": "225133bf-64d6-477b-9d67-c3210264ef82", "comment": "Malware payload (Amadey)", "value": "d9a65fabc8fb627a54439baad9af3b77", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453225, "uuid": "662b21a4-3746-4022-9a23-d57c3b3195aa", "comment": "Malware payload (Amadey)", "value": "ee5f153d746b367e98ec49a499e8829a5844ae8f386a13e83c4535675e2a6b3d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453225, "uuid": "efd51461-95af-4d78-977c-04fefbf1c443", "comment": "Malware payload (Amadey)", "value": "bd43325d0b755a9a325d2c09f284ae3bad01ed18", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453225, "uuid": "d88a902c-4195-44ad-a9be-a7e099669cad", "comment": "Malware payload (Amadey)", "value": "98f49387c9bf4612925e1a397f6c45dce43c0024970e531a9f3f5de80e1cb0a20c2f6a0f5429e9a9af2f0bc601518aa4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453225, "uuid": "c23214af-879f-4aa7-920e-e8b69854f651", "value": "T1D0D4123332A0D0F3C1A641B4DC14E7A6AEFDBD3056B9885B77591B7D9F302D0613A25A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453225, "uuid": "006f8f62-4c38-48fa-b7c9-37e1dd681276", "value": "11deee92ae37204b8493d8d64f5f1f69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453225, "uuid": "e3f5809d-f98e-4d2e-8005-f367176fa00c", "value": "12288:pvBWfItDdiHhhWzeHyf+kVPSfeO8tMtJmJLfCb9zxofRB66zrYX:pMIRdiHvWzeE+Maf+t4QJrCb99ofn66W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675453225, "uuid": "9922ba45-bab5-4525-8473-db515c090794", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675453225, "uuid": "098eb3c7-717b-498d-b80b-331fdaa259be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453225, "uuid": "71922378-0c0f-4e82-bf66-11648835cb05", "value": "d9a65fabc8fb627a54439baad9af3b77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5174fd9-a3cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675433968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433968, "uuid": "83fb42b6-9663-4b45-af64-4639db3c7615", "comment": "Malware payload (AgentTesla)", "value": "22db4ae349f3ef09af5e08b1d54f395d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433968, "uuid": "bedfa142-981b-42e9-9d81-8868174370e2", "comment": "Malware payload (AgentTesla)", "value": "eec946f0290cdbb199c804a9ba1a896b5bcad0d0e62c1e1cdd542f5f3e934808", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433968, "uuid": "01b9fdf3-21ce-4e24-b2ba-c49bda8493a0", "comment": "Malware payload (AgentTesla)", "value": "1dbd04c100865412ea87e87c3434855c5ae0b05a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433968, "uuid": "21f3d83a-3d4c-47d7-9210-84ca30a19d63", "comment": "Malware payload (AgentTesla)", "value": "d2f02baa178711235009c146559310df21ea0d3b595cff075c2da9d03d2c30a930efee6b5d65d8156424842ba32214e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433968, "uuid": "52198baf-8bc4-4c00-941d-86b6a9c5882c", "value": "T111D46B8377F1A872F6DB10A514283B8D2FE07103BE55E2579B3B79C09705AFBB298152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433968, "uuid": "34af2f51-6a60-441d-86dd-daa32de6a287", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433968, "uuid": "ecc5eb1f-8852-4f94-91f4-8add5f748721", "value": "12288:S8ZJCH31NoeOZgzd6Gxq+6eYOJtFcPvH0YhHqG4yPa:SwJcNwgRxG6QPvHHqG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675433968, "uuid": "2951b454-cbdf-4c45-87e1-1318aa3bc7a1", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675433968, "uuid": "99b68ee0-7dc7-4771-be05-366d73e80a85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433968, "uuid": "46b447aa-ef9f-4e56-9d54-8f5f35bf628b", "value": "AWB NO. 8148557141.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2251eb85-a3cd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675433695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433695, "uuid": "ccdd23b0-d813-4c77-96bb-060cef30cbf5", "comment": "Malware payload", "value": "fd41de84055bc77901bbf8a0231a2d6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433695, "uuid": "2edee551-c549-4aa2-86a3-6eddc61a66d3", "comment": "Malware payload", "value": "f03bddccbf717a56855dfe47f5260b246f40a3dcf711ceedc8a2667e59513432", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433695, "uuid": "a070ff09-1f63-4562-b984-2c34db072c34", "comment": "Malware payload", "value": "757ad1971ea3259bdedf282a4f044ca28a95eaf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433695, "uuid": "b007c925-b98e-47e8-a40b-2f0032a5c2b4", "comment": "Malware payload", "value": "8bd1eb34122ca08fefd3899521db41e20853e188e976214555c64b4385128fdff127a0432819605dcc454e530a18e892", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433695, "uuid": "7ed7e3ec-1a5a-47b1-86c8-64290e429116", "value": "T1A7B36E0035C1E476FAA76AB12550CBE4AC3FFA240F35AEBB2354943A1E645D14439DFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433695, "uuid": "90de0966-f37e-402f-a315-a403d151267d", "value": "3391d25821f027ad2ca25f972b6a2038", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433695, "uuid": "33402550-756a-41f8-802c-1d58dc5ba686", "value": "3072:J+htTHyedfhI3H69sycHfrC1442seaE9L2upOuVhT:MZdZmf42euf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675433695, "uuid": "53f74d01-6eb6-4fff-9678-4308b594ed89", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675433695, "uuid": "226b95dd-c19f-487d-a310-da2ccd5fd114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433695, "uuid": "9978619e-31c7-4f88-86b8-516d236c42ab", "value": "f03bddccbf717a56855dfe47f5260b246f40a3dcf711ceedc8a2667e59513432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0903b44a-a403-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675456846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456846, "uuid": "990a01ec-02a9-43f2-9b20-9413dc13582d", "comment": "Malware payload", "value": "69db4be25c1611c17e00603c6aa2e8bb", "object_relation": "md5", "Tag": [ { "name": "1675417198", "colour": "#E1D5CC", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456846, "uuid": "dcc82bae-d5a9-4f85-9bc2-4ecdf551f4b4", "comment": "Malware payload", "value": "f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68", "object_relation": "sha256", "Tag": [ { "name": "1675417198", "colour": "#E1D5CC", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456846, "uuid": "b7e8d7d5-44f1-49b5-921c-6b0325331cf6", "comment": "Malware payload", "value": "4044d9b57187ff5179f0d4cc51e849de57c73ded", "object_relation": "sha1", "Tag": [ { "name": "1675417198", "colour": "#E1D5CC", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675456846, "uuid": "0549aad4-79d3-4e7a-a9f6-bbdb1cb5b3a6", "comment": "Malware payload", "value": "6da5077cbfc1b6cace74665425f5f74ea0149e2a42f8aee32fa055733e1efcf6c8e42ff0cf5a3405b0d0c34de855322e", "object_relation": "sha3-384", "Tag": [ { "name": "1675417198", "colour": "#E1D5CC", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456846, "uuid": "e893a452-fc2e-412c-9f59-a0b4b1bb12f8", "value": "T1BD85AD1242CC129AF14D3B78243C1F7FD3BBB7A87B19634E9654B8A9AFAB7D34115600", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456846, "uuid": "b3652d2f-135c-4063-9932-1dc4e9cb8ea5", "value": "a3432b773266dde6a100dba767517009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456846, "uuid": "04a7a780-7c8d-4613-87b9-e243dbf376cc", "value": "24576:nrj3nPW3ednWPiT8VTBqcATV8KIyydLXGcq8z+0uaEYmgE7v99de7:f3nCeCiT8aHxyM18z+XatEh9de", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675456846, "uuid": "3554349b-c794-4be9-a419-08b427b49622", "value": 1779019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675456846, "uuid": "bf97d737-deb9-42de-9dec-67f4be782b1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675456846, "uuid": "f8e213c8-04e7-4217-80f2-fe89bc8556c0", "value": "r.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1de1e7-a3cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675433418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433418, "uuid": "34709148-0e73-4500-a657-76e43a84135c", "comment": "Malware payload (AgentTesla)", "value": "1abd19b81de959da0663de59225941a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433418, "uuid": "440f17e4-8e1e-481f-a6a4-272c00ebe781", "comment": "Malware payload (AgentTesla)", "value": "f0e95ff0016fa9716b91e8c61ef8d64c29f37e7d7c1adb13d76ecdb7269a299b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433418, "uuid": "4cd055ff-cfaf-4b04-89d6-68d518a4c015", "comment": "Malware payload (AgentTesla)", "value": "a99e1ee9d73c40a52f7de89f3ef7197b251c0a2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433418, "uuid": "b73c4b1a-ed2d-4ded-b863-7fb289e92238", "comment": "Malware payload (AgentTesla)", "value": "9aad478c1d45afab7300c99dbe6d8b7f15904c164091046f800dd64bf106712d4f72498fcccee05f08160ccd355ec168", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433418, "uuid": "7828e880-a028-486d-b995-85b7c309a041", "value": "T1BC159D9737B1A4AFF687407144283FC86FA07013BE46E253A73B3AD497098FBBA94151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433418, "uuid": "a263e598-5c5d-49e7-a519-af0a77b38e0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433418, "uuid": "fe6cd802-208c-4c30-8936-5c36d6df0340", "value": "24576:qeoK25o5IURdkcAmAk6SO8SmF6F0xMpqG4yPa:656fRdk1rk6S5kWiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675433418, "uuid": "d033e98f-c0a9-4e7b-ba9a-c39fcb4d9a1c", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675433418, "uuid": "b0e40967-71e0-4c5c-a16b-f537be18d763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433418, "uuid": "d51d4959-40e3-4bc1-95b9-a23e9cfe92b8", "value": "CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950fed52-a412-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675463523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675463523, "uuid": "6d660e32-e99e-4071-ac80-c76824861115", "comment": "Malware payload", "value": "335577e59b4d5a62837d57654ba2d089", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675463523, "uuid": "5021fa77-794c-4609-a279-f15ee7bc7d33", "comment": "Malware payload", "value": "f0f0279eb38391e25a6cac9c903da0bd23d418ed8100194295ea69130acc5e3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675463523, "uuid": "09602e07-529c-44a0-94b8-6a70701a4a95", "comment": "Malware payload", "value": "71ed640ebd8377f52bda4968398c62c97ae1c3ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675463523, "uuid": "35f53dd1-18f2-4f05-92f4-6bf582d044b0", "comment": "Malware payload", "value": "80c6549513164065dd207b52bf38ce52642de947fdb3f48bcad34a50bf388c0a09e44cb3b48714954e9f1927969b9ba2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675463523, "uuid": "2c3eb094-c84c-47a8-8dd2-2a0b61a3736b", "value": "T13033733A7760E436C4E39D7B46889134D3A13373E00B8537E9097D5C97344A99ABE3AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675463523, "uuid": "52e05f4a-910b-4fb7-b35a-69b38e61d142", "value": "768:KNMfHePxhnYK2bIyxcdCVA0hXhUS/Dhihk8S0Mr86WUG+s5ksK4cKD8QpWxhQeFe:KGM14xP/T9Fe5weXKq4ucO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675463523, "uuid": "7b8ad855-a8f3-4503-8a25-9fb0de7e1b8f", "value": 50932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675463523, "uuid": "e736b49e-9b8f-4529-a66b-1010ddac12fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675463523, "uuid": "209754fc-5f4d-402e-9f2e-adb88eeda464", "value": "f0f0279eb38391e25a6cac9c903da0bd23d418ed8100194295ea69130acc5e3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71c88f5-a412-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675463607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675463607, "uuid": "3dd1b98b-1f94-4ac8-88b1-eb5988514fe4", "comment": "Malware payload", "value": "038ac6de85184acb806a11c68927124b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675463607, "uuid": "cbc2ea31-0fef-4e11-920e-64423fd32e46", "comment": "Malware payload", "value": "f11cfa8c6ef5b3f0eba4f2748d802e8dbfae5056eac59d6e14d9223069af751b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675463607, "uuid": "c7230381-449b-48c7-a97a-fe60b8515dd1", "comment": "Malware payload", "value": "6489fdb08ba72e7c3280fc3fa1ba1642093337b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675463607, "uuid": "f08c8294-2b19-41ee-9e26-1be3f7b0a2ae", "comment": "Malware payload", "value": "97be290da2c863f6a7a53e6760cdfc49586d5b87491134927fe164ec772e26f751cabb69fd00a4241424f53d2124bc70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675463607, "uuid": "4f8de48f-b131-4d82-bd5a-9579f324616c", "value": "T1FE7633403CD088BDD9E180305DE4A762F5E7EA4548338EA37349C73D9DB54A1EA1AEB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675463607, "uuid": "dcf8aaf2-5c1a-4ad6-9820-8dadc17e58aa", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675463607, "uuid": "8714fae2-a617-4f35-b291-be4fd55bb705", "value": "196608:91OZQqjN0X/565pO6N7PPZneRAZPN8Ljl32JLbE:3OZQqC6xZYAPwWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675463607, "uuid": "466e4e45-ca62-4693-aee4-4a2b33e95f49", "value": 7634755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675463607, "uuid": "ae25a5a4-eb2c-46ff-b336-165e87461e5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675463607, "uuid": "9f5a1235-095f-4156-b637-70434a7d415b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d0a49d-a3cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675433327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433327, "uuid": "8e41ced1-85fe-4c30-979b-91ff64b934f5", "comment": "Malware payload (AgentTesla)", "value": "259c465decc19ee0127d9d66e732cfba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433327, "uuid": "e8b17b3f-ed0f-4c80-a2d6-705c3e14143b", "comment": "Malware payload (AgentTesla)", "value": "f220e9f588cb2724058ad0601c449f612f9355243aaa2fd7ee1d87fd177cdc1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433327, "uuid": "7392e6ed-c497-4c87-80b1-d4a43ae5ceab", "comment": "Malware payload (AgentTesla)", "value": "d502defbe8e4d9b6a6ca0a29a28a0da6c4c30352", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433327, "uuid": "06e52ba6-5672-484c-8d65-a9bdeda931ee", "comment": "Malware payload (AgentTesla)", "value": "c5cc0d56fa0970c3aad205b8ffb854c5489e71feb9dfe85071b4923c42ea4abb5878c415a908c0c4aab3ab77405bccc8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433327, "uuid": "fc1ccab7-62f9-4a52-9178-bdebc32b74f3", "value": "T14103E99821AC8B33FEAE1BFE14A9659B97F665376010FF882DDDA1D43195B804700B4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433327, "uuid": "549cd3b0-e0ab-4a88-8f59-1f6087b6c057", "value": "768:vevDNGja1TxGIP+tZS3XpgTR5t+jZqt5RYVMQY24v:0NG21T4IP+tZ2XmNz+VqtfYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675433327, "uuid": "63f6371f-2072-4ac9-a5c5-fb911231a626", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675433327, "uuid": "ba61c5bd-bbbb-4939-93bf-026e6b46e114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433327, "uuid": "bfaf03c9-7e9d-471c-8bdf-beeb889f8714", "value": "2rOFsW8MAO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e945b9e5-a3c5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675430593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675430593, "uuid": "cca50011-c21e-4a55-ada2-0df0418e7a75", "comment": "Malware payload", "value": "3cd4c27892321b0a372238c3ed486b93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675430593, "uuid": "a3f588a8-c562-484d-bf64-816aa50c314a", "comment": "Malware payload", "value": "f2e970af4a03688cd4cbdd5359f85571ee3c09d9274552aa9bca42706a679a4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675430593, "uuid": "a72d1fa0-4378-4a42-8fe6-2a15d65141f7", "comment": "Malware payload", "value": "8a8dd1ab42b44b4ef05c822359bff5593bb0c14e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675430593, "uuid": "57ce554a-6960-4e55-a18c-1ef94f0c0bbb", "comment": "Malware payload", "value": "16b83ce5c2590e0e81f2f80e544c904083a448a564c8a8594b38b3166d03c923ae494db948a55e8086fa06e74784b9ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675430593, "uuid": "196e4114-d2f8-480f-9852-d2b765fa9a4f", "value": "T1ECB36D0075C09473FAA729B03560CEE89D7FFE350B645EA72394953E1E70AE04929DBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675430593, "uuid": "6e53c189-07b3-4e00-8d52-2b8fe901716c", "value": "3391d25821f027ad2ca25f972b6a2038", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675430593, "uuid": "9cfb8a47-ba79-4b6d-a7f1-b246a2470b20", "value": "3072:u7gZwYcAmHjMes+Z6OQ/4ywApzP3N9ogQ/vi4uVeg+:u7gZgf3XyP3yXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675430593, "uuid": "71edff1e-9c29-4064-bedf-b72bd4dd7f3f", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675430593, "uuid": "0fe5ed0b-b5ec-4aa2-9505-6bf8bcd128f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675430593, "uuid": "98ba2ac2-8a7f-40b9-bd3d-9f64ee45c517", "value": "f2e970af4a03688cd4cbdd5359f85571ee3c09d9274552aa9bca42706a679a4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a32fde-a3f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675449330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675449330, "uuid": "2a2d3aac-241d-4708-89e1-249f8538d275", "comment": "Malware payload (DCRat)", "value": "3c77aa38298785317ba568f6561458c2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675449330, "uuid": "d09b8ccc-3cbb-42d2-8168-eaede1824332", "comment": "Malware payload (DCRat)", "value": "f32a37424ccba445f53662ff847a5ed6c5692d827a57fe3e0ca2cdf1a8f41790", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675449330, "uuid": "d40f6aef-2be1-4609-a9a7-22424185f77c", "comment": "Malware payload (DCRat)", "value": "15fc4eae70d13df375df13eec67d2208d4b83334", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675449330, "uuid": "4d41e97c-1c98-40a5-b2db-2b90fabd3fa0", "comment": "Malware payload (DCRat)", "value": "3581755180469e4c79d2afbf84e72233fa548c356fc01e293a035a26fc4c4ba15a78a906e03dfb50b072b91f3c4a9de4", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675449330, "uuid": "c8bc7bd9-c4f2-4796-b8c1-bcd1eb5ba33f", "value": "T1CF855B027A46DD12C0691637D9EF586407ACED013BAAD71A7E9B336D69313A38D0F1CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675449330, "uuid": "a8e82fc7-d86f-40db-bf1e-b881124d31a3", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675449330, "uuid": "a1cfa2e4-8691-4364-902e-33b0ec2ba2e4", "value": "24576:h2G/nvxW3WSZ01e3J09QcGtD2F0Wpq0Ld7UT29cENYaK2q5aj+4H:hbA3velF2CTK2q5aya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675449330, "uuid": "7b9d86d9-ec68-4c34-851d-16b0306208fb", "value": 1769666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675449330, "uuid": "b864b92d-b05f-4942-a602-b74e0ea004fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675449330, "uuid": "33d9d6d3-063f-4bdd-9a74-6fa7e168d016", "value": "HEUR-Trojan-Spy.MSIL.Stealer.gen-f32a37424ccb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e539d16-a399-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675411355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411355, "uuid": "6d654f8a-067d-4311-90f8-376388dfa858", "comment": "Malware payload (RemcosRAT)", "value": "f5af494c6516ba984e491a9df594aca5", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411355, "uuid": "dad627c0-2efa-4c29-ae72-05aa9800e9a4", "comment": "Malware payload (RemcosRAT)", "value": "f33f4e61bc25416df3a8aeaef260772a09338553653de716acabc0293b52d620", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411355, "uuid": "57b64987-9826-459f-85f3-171d943402db", "comment": "Malware payload (RemcosRAT)", "value": "6c86516f1acc0f7207cc4c389c68a06569541293", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411355, "uuid": "cbb25c44-b8db-45ff-80ec-d19fd362d5b8", "comment": "Malware payload (RemcosRAT)", "value": "c882e5b4149234638ea13eefb84c82d5ab89e64079f933c2db2b1213ad8e806c0539fc113be2e0e5846f6511f07e9c88", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411355, "uuid": "b8ce40d7-a775-40b6-892a-964221f5b602", "value": "T1922533B0D1238FAEB0E6EEE5D4A652A960B43D5AE545231CD9180F59375FFE000B3D63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411355, "uuid": "8b55d833-aeb7-408a-beff-5514d38d28df", "value": "24576:c32i9e4G0KVXFwD1c2DLSiXVTvqGwDf+ykna:cGOe4GpBF87F7qGwDBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675411355, "uuid": "7b048f0c-0aed-4310-a600-bfd2a65c07b9", "value": 973009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675411355, "uuid": "9f87ca61-5a4a-4c66-bd8b-685f48345be3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411355, "uuid": "970e51d2-8cfb-4410-b4ea-3f28f8f4ce23", "value": "New Order PDF.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38df142c-a3b9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675425143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425143, "uuid": "0494d7dc-db51-4cec-a71b-6163a0e5e3cc", "comment": "Malware payload (AgentTesla)", "value": "c08d79d274da7153024a2f9159511462", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425143, "uuid": "80b72123-4282-498f-b67a-09dde90a3a7a", "comment": "Malware payload (AgentTesla)", "value": "f34473ce88c29af6df47f7b05e9cd19411823d3963b49a079f62f3da983a3141", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425143, "uuid": "e063bae3-8117-4af9-9ba7-0c1b52a80b26", "comment": "Malware payload (AgentTesla)", "value": "5959dc0ee9b43184ae792305ed519b850ec766c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425143, "uuid": "cb09d81b-0425-4341-a90e-2f669c003974", "comment": "Malware payload (AgentTesla)", "value": "0710c5a28ca3edf2000fc2f3d6173c7345f6fd3f160ddb1ee0a364ed9ca0d644b1ac4ddedc10c6e59b739d9449fa0f7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425143, "uuid": "19b46aa8-c543-425a-815d-eab2d136f897", "value": "T1FFE4235033E882A1D9A847F96A23C18123F376298A75D23D5EB5F1DF1875B40AD40BBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425143, "uuid": "ae43ed69-29bd-46d4-930b-efc68fded982", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425143, "uuid": "22042a3b-4d6f-4cfa-954a-fddbe89ae50b", "value": "12288:cK4MtEwcU3gZ+GQzjkATGdsLVmxD7kkldonwmrSRkQxFoRMgUr:cd6AAgZbQzlG2+HFfo6k+FoRMgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675425143, "uuid": "95ad7d4c-b7f8-4fbc-b6f8-427e12d8e6bf", "value": 715776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675425143, "uuid": "83d9a279-6afb-4a55-948f-560eb01e7778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425143, "uuid": "df252aae-1cec-4df7-9ab4-ea2bc43b1cf0", "value": "f34473ce88c29af6df47f7b05e9cd19411823d3963b49a079f62f3da983a3141", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d32b5c-a3ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675420227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420227, "uuid": "a7a60969-c7bf-4bb2-892f-2d00203ad467", "comment": "Malware payload (AgentTesla)", "value": "0a25dd5660057eb8fa23b8d57d1d4708", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420227, "uuid": "3a943fe7-5de7-4982-a148-35fe52a4ada5", "comment": "Malware payload (AgentTesla)", "value": "f3809eed8c6490f0e42711041dd0d7610ffc043759df52c873184052e36e2af1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420227, "uuid": "e95955fe-3c5b-46c2-8bf1-aeca01c2f4eb", "comment": "Malware payload (AgentTesla)", "value": "a8bb4191a8a0dea730def8254967c80db1c2b7d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420227, "uuid": "4f532b61-accb-4b6f-bc50-a0fa474c709c", "comment": "Malware payload (AgentTesla)", "value": "127f941653b4f93e93bd87606355ae20f24eb0bf3299ccb0286f3b0df045e2ea9e1692ec80816dbb32a5c3eae54f17ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420227, "uuid": "8c49caab-c28d-45cd-a544-7cada514b159", "value": "T11203E99821AC8B33FEAE1BFE1479659AA7F665376010FF892DCDA1D475957800300B8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420227, "uuid": "52db43c4-24ca-47ea-8270-6ce0104ef3d3", "value": "768:fevwNGja1TxGIP+tZSPXLgF43rt+cY/qt5RYVMyc/U24v:fNG21T4IP+tZKX8iJ+xqtfYzcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675420227, "uuid": "4069bfa6-3438-42f5-b685-21f51022d9f2", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675420227, "uuid": "47036bda-a2e4-432b-bcfd-43c43055081b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420227, "uuid": "bae0b7f2-3113-4125-8b40-e6ce785bf235", "value": "SHIPPING DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea284c3e-a405-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675458082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675458082, "uuid": "b1abdc81-6a5a-4a5c-8e66-d0b074b89296", "comment": "Malware payload (Smoke Loader)", "value": "e436ceb40c24f7a3aba0f203fa7ad641", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675458082, "uuid": "1c5a4140-3c93-4c20-96e7-2bb34edb2b7b", "comment": "Malware payload (Smoke Loader)", "value": "f3953ccb9b3207f7ef910f8abee2941c620e545960f123acc59c13ea59a0438b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675458082, "uuid": "653ded72-90b5-4a8e-bbbb-967b37d7409e", "comment": "Malware payload (Smoke Loader)", "value": "1d232348f08c97473537610fade5eebe1f1116d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675458082, "uuid": "f9529120-3b6e-4bbf-97ca-3375c49afca1", "comment": "Malware payload (Smoke Loader)", "value": "7b9ef235bed3ca39de37f79deb62cffe0e6e43ff49a94fc5faa473483ad411c5b277266a9d945d0cba77b45dcf960539", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675458082, "uuid": "03f88bfe-b776-4f4d-a0de-a5f621357877", "value": "T15F14D03236C0C4B2C17B50309C60CBA47B7EB83196759A577BA81BAE5F313D0563AF5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675458082, "uuid": "2bd3596d-1b8d-4e85-8654-29964648e5f8", "value": "11deee92ae37204b8493d8d64f5f1f69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675458082, "uuid": "4e65f262-1223-41ef-8894-035c6396c0f5", "value": "3072:GoJ6HVoYkLrCWP5W4q5KMK90yvGX3j27KMUSVNGMfQeTN+03E:GohLGQ5MKUVSVNG4TN+mE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675458082, "uuid": "8a25e707-cec4-40b4-8643-7912360d2490", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675458082, "uuid": "1bf09a0d-6e46-4817-bb08-f5e8a60fc9c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675458082, "uuid": "0f24e8dd-3ad5-4150-b049-5c26ec065e46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0047ce4-a417-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675465823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465823, "uuid": "669d56e7-a1d4-4059-866d-80dc351cbb6f", "comment": "Malware payload (Amadey)", "value": "45f4fcf857adb957f3dde8530d1b19d9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465823, "uuid": "4108218c-bc47-4909-a4a5-ace3bc060afe", "comment": "Malware payload (Amadey)", "value": "f3deee627b07f716348e99e7a4af565621b83bccd793709b972c093ef21bec39", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465823, "uuid": "c57c0a24-7f50-400b-8b76-334cf3b2a26f", "comment": "Malware payload (Amadey)", "value": "6a4dfff51284280de93c0f1e8e622803c38d9ed6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675465823, "uuid": "996d24f4-b62d-469a-bdaf-655618b07b31", "comment": "Malware payload (Amadey)", "value": "52ed396a4768122dcaec362e84e0ddc8c81d8c348c579a24ac9627e4857259d8c80a7abe7fab0283bf7e330d6d4a5a22", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465823, "uuid": "3c42974e-f883-43b1-8ebb-1f407fb79364", "value": "T146D4122235D0E032C96B10714820B676BEBDBD35427AC91B7BAC1BAE5F70AC05A76347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465823, "uuid": "73754cf4-411e-474b-82b1-495c964e6647", "value": "11deee92ae37204b8493d8d64f5f1f69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465823, "uuid": "411d9d97-b75f-4699-b3d9-511531546a16", "value": "12288:GvDYJRNu3Qu+43qN1q5QoBagpRLoU2TKavg1lYX:GSRUR+43qHUQocgr8U2TKxYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675465823, "uuid": "4f58c3b3-8b0d-499c-a03d-2268dac55174", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675465823, "uuid": "5c654670-a921-45d9-87e9-e5940f91504a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675465823, "uuid": "ad9063f5-d3e5-4fb7-a85e-421571327e16", "value": "45f4fcf857adb957f3dde8530d1b19d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec183b3-a3bb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675425958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425958, "uuid": "3fe35670-4dc4-4ebb-b2fe-e343a7618f74", "comment": "Malware payload", "value": "38b4b3f330f44b98467a35412ccf00af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425958, "uuid": "62faa18d-bf71-470d-84d8-f931b6d5ec32", "comment": "Malware payload", "value": "f41a0a080a46bdd579a443858f2171359c01e656b5e3b42d4a72e84011d9a415", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425958, "uuid": "14959e61-8101-41de-8002-0b4de27b592d", "comment": "Malware payload", "value": "7928d8f377019e43208a32b9df8406e4dcc27cfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425958, "uuid": "291b193b-4763-457b-8b84-4770bf7a8e07", "comment": "Malware payload", "value": "6b2b623f3993416161e66811c50be333390379f923f8a87fff1a12e963586045a0496ef949e45d360a9096bf964285e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425958, "uuid": "55ab579c-22fa-445e-8f6b-596d7b6acff9", "value": "T1BCB36C1076C08076F9A729B434A0CEA4986FFE394F759FE72394D1391B605E04A39DBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425958, "uuid": "b452400c-b400-451b-ad9d-80b15e342524", "value": "3391d25821f027ad2ca25f972b6a2038", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425958, "uuid": "87dea6c4-386d-47b5-9b0f-fa15de525378", "value": "3072:sgYATKPsonJ8YzTWpXCe4emrDGj55GvLsY4hVuZ+1uV+6Z:wATKUonx7o5G7MG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675425958, "uuid": "1a5729bd-306f-46dd-9363-402d7980f0e1", "value": 117760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675425958, "uuid": "e70b8a52-0580-49ca-92ba-178a38796868", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425958, "uuid": "2241d572-334e-4674-a8bf-82de1ef5ae90", "value": "f41a0a080a46bdd579a443858f2171359c01e656b5e3b42d4a72e84011d9a415", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088d1abd-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675453838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453838, "uuid": "ae9b0443-e791-4bf7-a7d5-cd85928b8f4b", "comment": "Malware payload", "value": "40e8391dda586fcc3245e3e0cd3db84a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453838, "uuid": "ff9bfd36-1755-4f3b-8158-c0bd07903c89", "comment": "Malware payload", "value": "f47f93fca80edb9f8ce76192dca5fe86747524d3953b01ee06293645298845c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453838, "uuid": "b2cebfbb-c4b1-42e1-9602-9b13d785908e", "comment": "Malware payload", "value": "74bc9272857c14a9a66a156d68c868bcb8d3133b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453838, "uuid": "90e430f0-ac02-410c-a31b-354383b625ff", "comment": "Malware payload", "value": "4394294697677bca97f79df20e55b5c7cfc8688a03bd2b32ffa07d9a21b2054df63ef17f0936cbd6ad065a76f57421a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453838, "uuid": "e08e7f35-8331-4b4c-9e2a-68a3050b6235", "value": "T1656412C97994E87FCC17D03A49598D948BA67677226FE293404362DA5C4FF1B8E1C0B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453838, "uuid": "fd5e07c6-8960-40b5-8c6d-c9494d4fa9ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453838, "uuid": "e604f1d3-782f-452b-9925-185c2d3cf980", "value": "6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675453838, "uuid": "7605df7a-1a78-4564-bf02-5c344db7f725", "value": 335940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675453838, "uuid": "99c27ee5-fe14-4841-9591-7b0cf88489ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453838, "uuid": "6c71da5b-3a66-4241-83e3-da1f210dbe17", "value": "40e8391dda586fcc3245e3e0cd3db84a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9efb773e-a3f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675451943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451943, "uuid": "1d8c9d17-d335-45e3-9538-0ad74f7b80f9", "comment": "Malware payload (Smoke Loader)", "value": "3ec936a0681e9e747fcad66473afa22c", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451943, "uuid": "0a00e7ef-448a-4627-bd18-6895494f5358", "comment": "Malware payload (Smoke Loader)", "value": "f4f641ef6dfb91df7d7071e7338ada9383ed6e0f1fd8df388fd8e2c1a54a98cc", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451943, "uuid": "9b88c955-341e-4ae1-b0a5-6e6e41da7bc1", "comment": "Malware payload (Smoke Loader)", "value": "2688fd6122bdd5ab56217b90d7357bae995502e3", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675451943, "uuid": "f4871fa4-a77f-4ff9-b080-46f494e4f84d", "comment": "Malware payload (Smoke Loader)", "value": "ccda374b21ed22060b29fe022475636d83824c80a4594c51154213a95b6606fba1a956b2f5b1f10d763066e09aa16480", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451943, "uuid": "bb1e1cd9-eec6-4551-9cb9-53478144f4c2", "value": "T1B414E03279D0C032C5778134AB24E6A16F7DB5310A79994BBBA807AD6F703E12E3535B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451943, "uuid": "bb7b7f8c-8bef-4720-9f8d-de04f6e55059", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451943, "uuid": "a31545a8-ff3e-44e9-bf75-2ea1bb7632a2", "value": "3072:27uXB/3D223LO2bOWdt5Hhk3WRSvA/taEHiT/at8xrhkVw:27uk+LO2bOIhkG5FamixxMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675451943, "uuid": "57991c6f-829d-4d3f-9b3f-e285716e536e", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675451943, "uuid": "dc1d53bc-cafc-40cc-b7aa-ddc49827d4d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675451943, "uuid": "11d42d13-5b3f-49f3-a102-1d9e804f3e0b", "value": "3ec936a0681e9e747fcad66473afa22c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a82620-a3b9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675425086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425086, "uuid": "721e9058-fc0e-48a5-89b7-ec10c20a648a", "comment": "Malware payload (AgentTesla)", "value": "680ab6d7a8d07efd8fc74020138b3d9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425086, "uuid": "bde22ff7-8f9a-42d8-835d-94344c63fa4d", "comment": "Malware payload (AgentTesla)", "value": "f5c390ae7deb67f68f921833cc2efef8d6b5c24206fdecfd8b72225f663c375c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425086, "uuid": "41677921-fb65-46f0-b28d-202e7179ee5f", "comment": "Malware payload (AgentTesla)", "value": "fba2cd2d06e466cd1f89901a47dc1a89c018181a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425086, "uuid": "52b5d2ba-d1ab-4f7a-a0f6-68d471409e2d", "comment": "Malware payload (AgentTesla)", "value": "835e44e0644c50050754ec578552af7cdcb204f2d0d91fe0e4ba2a7b1dfb35537f137b941996de0f49d4aa6e88e40c00", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425086, "uuid": "7ca1de6e-cb97-436b-a220-f8e5d3e311ca", "value": "T1CB158D8737B1A8BFF68B407154283F886FA07503BF46A253973739D49B098FBB698151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425086, "uuid": "b8b96be8-fa8d-4898-8eee-aa93ec4095d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425086, "uuid": "97a05590-7ad0-4d7c-a4fa-67977cdb8d38", "value": "24576:w3tyil2JCrRMlhUJrp3Gnj6F0xMpqG4yPab:dJoRay2GWiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675425086, "uuid": "05724295-0a82-4087-823a-cf14ffe2abd7", "value": 892416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675425086, "uuid": "6eeb2763-0d5d-4971-90d7-58f0a122e85a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425086, "uuid": "6dae973c-3c7c-46b5-b3cc-a11d136ba409", "value": "USD 46947,6 20230101162552.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1135ad8-a37a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675398394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675398394, "uuid": "3d78e786-0358-492b-a7f5-72d07abfac86", "comment": "Malware payload (RedLineStealer)", "value": "a73f0d3af42f6d6c3e766e73073c8695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675398394, "uuid": "c67423f6-501d-4bfa-b26f-6aa988bdf0fd", "comment": "Malware payload (RedLineStealer)", "value": "f631e0f585f43a7ea2cb466f7fda23b13fc0551206207c027eeffbbbf153db3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675398394, "uuid": "2a0604ca-efa8-4f45-9874-d7758767c3ee", "comment": "Malware payload (RedLineStealer)", "value": "54275740146c1533811bf3563e222c0aecd38875", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675398394, "uuid": "24f22114-c0c9-40fc-9c97-30221d982259", "comment": "Malware payload (RedLineStealer)", "value": "67e729ce3ec238bb087d3ffe2c64b7a7d508430163ccecfba995e8c86ec3579a8009b0c8d29d73c17726b6e61ecb78aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675398394, "uuid": "939e5274-b717-4f02-bf04-b7aa65ffdfd2", "value": "T19994B042B2E1BCC8F5318B728F1EEFE47A9FBE404E1977B51294AB1F14711A1C962325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675398394, "uuid": "518c49bd-32fa-4ee5-b5be-4012613b735e", "value": "e479a558a3a55c2bde918dd7ce07e020", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675398394, "uuid": "8d5c4e53-c016-4d83-a5af-e518e859b846", "value": "12288:HS2FnwTvpLWEPBw4RIrbU1p9CJb7d51S:BKzxnGrYz9qb7d5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675398394, "uuid": "3d6a0e71-e9de-47f8-a7c4-2324990db62c", "value": 418816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675398394, "uuid": "a7b94283-625f-4e17-ada4-e16a7aac4021", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675398394, "uuid": "2fe2f8c4-7cbb-4316-9b3a-4c12d2b10bc7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a81e42-a399-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675411419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411419, "uuid": "da5d0d0b-fb06-4aee-b296-2759f15b50b3", "comment": "Malware payload (Formbook)", "value": "0611d3bf0dc4e825d0a253f0789a2b50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411419, "uuid": "63043303-2909-4eea-a2c5-518839c94042", "comment": "Malware payload (Formbook)", "value": "f64f6071b9ac0ff49b27d7c34999f4723b88069a7a20f7e9fe1a463fb05686e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411419, "uuid": "0943aff7-833e-4505-8111-acd91db1cf0c", "comment": "Malware payload (Formbook)", "value": "b91c51823f452c6146e70846154ee1a630abe0b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675411419, "uuid": "9cdc994c-dda1-4a64-bbde-29d596a69223", "comment": "Malware payload (Formbook)", "value": "8ffb70b70e4e81c1fdee6d1582ee98d8c5ec4dc3829267629b0a0838506e9bd746e618c053a87ad85a033c599b361549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411419, "uuid": "af9f7c0a-d58e-4c70-93e4-9ccdbfb97543", "value": "T17E03EA9421AC8B33FEAE0BFE14B9659BA7F665376010FE892DDDA1D435957400700B8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411419, "uuid": "a01641a8-62a6-4aab-b52e-5c468dca76fe", "value": "768:tevPNqfe1TxGW+t12yXVgIKtt+7oCqt5RYVM/NQJw24v:ONqm1T4W+t1rXa9v+bqtfYkCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675411419, "uuid": "84245f85-2d17-4442-86fd-c3b535dd727f", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675411419, "uuid": "1bf95c35-1cc4-4cac-81d3-8bb472755700", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675411419, "uuid": "e56c1ddc-1ee3-4fe2-8542-8557cb42bc50", "value": "Bonanza_Enquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089ac788-a3b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675421626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675421626, "uuid": "e5d7b187-bf5d-4d03-afa8-c3cf33884ff9", "comment": "Malware payload (RedLineStealer)", "value": "9874e0e2d946c7eb4b3e891af15a6ae7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675421626, "uuid": "605f138a-25f1-4f14-9a92-4c55361be619", "comment": "Malware payload (RedLineStealer)", "value": "f66323bf68bc898f32c22e815e4f36bb350c2e62b291577e389f8fe087267296", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675421626, "uuid": "10360088-db3b-41b7-8447-b43c5849ea21", "comment": "Malware payload (RedLineStealer)", "value": "cdbe837ba31f7ba9e48f56261fb3263bdbcd59e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675421626, "uuid": "fd33fd58-7464-4a1b-949a-dfb36e9ed8c0", "comment": "Malware payload (RedLineStealer)", "value": "067442ae74b89dd5e6cbc0b414d92df4f1126e14cd3763572549dbd4d69e6e3f91bfd6d95d59efd7e11e334125d25a0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675421626, "uuid": "ba49e15d-6bb7-4cde-91b9-194f6a042de7", "value": "T10AD4122179D0D071F26AC5304830E697BBBEB83115315A0BB7A857AD6FB0AD05B3E35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675421626, "uuid": "904feb5c-9c0f-468d-8ad6-acac92254b4c", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675421626, "uuid": "04da6a4a-e8ad-4ba3-8a89-c8632902623a", "value": "12288:CHVNF3CvHZVXFka7yQx3HUvVlMk7mhE/Esg3VF:C1rCvHLaabl+VlT7d8/3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675421626, "uuid": "aa7a06f5-7258-4d9a-9723-1126485c9824", "value": 616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675421626, "uuid": "1fe1ed17-635f-470c-9589-4668f4a22519", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675421626, "uuid": "69591b3a-15e9-40bd-bb85-9bfeb0b1bf39", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e856a2c3-a3db-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1675440040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675440040, "uuid": "06c83e85-c52f-4f3f-8481-5fa30a330dcf", "comment": "Malware payload (TeamBot)", "value": "6f918cff25ea3d623311791a62929338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675440040, "uuid": "57a58484-b75b-43e8-b5e6-843ebcf5ff8f", "comment": "Malware payload (TeamBot)", "value": "f6f3362795202bb5734676c0ada843d211c968cffae53e16ccec79ced53e4952", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675440040, "uuid": "c818f558-f009-4ce6-a987-3c97fcc0c4ac", "comment": "Malware payload (TeamBot)", "value": "9737383c44e91b0033929bae7984b25a6472ebf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675440040, "uuid": "cc0646b8-8e0d-4409-95a8-506351050f5d", "comment": "Malware payload (TeamBot)", "value": "54a4ffe29b98db0ee4d759e3c03edefbe35eb8008d44e1cd3710ab9ee297effd38867e5ab314fc74f07fc7767d7841f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675440040, "uuid": "33bfc18c-98c6-4c77-9247-ff7df3292e8d", "value": "T15814D0323B90C072C5AB50305C64EBA56BBEB931557ADA5FFB9817BE4F302C0563634A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675440040, "uuid": "ec206097-41d0-4832-926b-a95b0853deee", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675440040, "uuid": "01da05b2-e3eb-42b3-b4d6-03476b3a0120", "value": "3072:keP/+d3dtL5XeLqjzILTWD655JthT5WEzI1b3KCx+DnfIH:kenM5XeLwziTxthT5W3x+LIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675440040, "uuid": "1b7b7f80-f8a5-4c89-b4ac-b26d260e20a0", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675440040, "uuid": "c43fb4f1-d995-4464-8795-ca6f306a6ffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675440040, "uuid": "ffac7780-c02b-4554-8d11-224bcc0925a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0285e9d-a3cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675434014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434014, "uuid": "7d19dc89-e5ec-4aa2-bab0-3add32824bcd", "comment": "Malware payload (Quakbot)", "value": "99c4cbc9c1e93b79dadc4fa39c78000d", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "obama236", "colour": "#DA0789", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434014, "uuid": "170f8d53-30ea-46f2-93d2-81c7698bab45", "comment": "Malware payload (Quakbot)", "value": "f75391f4412d224d02096de3b0d2732e76876196e894a064741a5908696d7cbe", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "obama236", "colour": "#DA0789", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434014, "uuid": "a3824619-2f00-4910-9d5d-3d0ada9df881", "comment": "Malware payload (Quakbot)", "value": "95205dbc938e22821b889ec2d54faefb68799aec", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "obama236", "colour": "#DA0789", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434014, "uuid": "893117ed-403c-4039-b1b1-518497ab8e77", "comment": "Malware payload (Quakbot)", "value": "c1fa9005d9fac7009182948bb2331144315b1c44e804a97550b5f365bb15d0923541d2c5345c1d6142db1eb89671782b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "obama236", "colour": "#DA0789", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434014, "uuid": "7e725ee5-7c97-4f11-a5d2-2e8572705b87", "value": "T111B1844355E74F1C0E82A6E9B534E8E2C69D0B34D3C6D77FED47102BB1426F189E9098", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434014, "uuid": "bb878e4b-c118-4527-9b5d-dfa94b81820c", "value": "96:rqF5vK5VC+iNVCv38RncynB8xCoA8TkpCynBu9cEAG6s93rFSEEGAwGfaf9wfwzt:ApKIeTkoGfK9wIzwqVGEl9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675434014, "uuid": "4cbd1d29-4d78-4b23-a562-a3735d0ff6cd", "value": 5324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675434014, "uuid": "f3f37722-458b-4add-b602-a68929c634cc", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434014, "uuid": "214d39bb-d9bb-4a43-8855-55a65e894e95", "value": "Open.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff53670-a3c3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675429745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429745, "uuid": "a6d29c71-8345-4502-a5e0-0bff7c7d2492", "comment": "Malware payload", "value": "891c84dc07ed8f2439dcf0b0fb2cce62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429745, "uuid": "265ca5d2-f89e-4811-b1b4-74b326af2c2b", "comment": "Malware payload", "value": "f754e7647915e892a84e048d9817939ef1135e3c41d43bc70e9c895c95aa8408", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429745, "uuid": "d79545fe-5373-4620-86c2-b64bfb7eac7a", "comment": "Malware payload", "value": "c4e06c7b02008fabed90f78d5fe778c18ff2bffb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675429745, "uuid": "ee82e82e-34a9-4a5d-99db-cb8e04067cf3", "comment": "Malware payload", "value": "684958b9b7a87c46193ae84ee5e9aa674ef9b5555ecd6bd31ed996ff2f8e9e4039f43a72e4acf4854f14b861843abca6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429745, "uuid": "fb17a8de-cb65-4bfb-b589-9914da7b20e1", "value": "T1DBB37C0075C0947BFAAB2AB034A0CEA4986FFE354B355FE723A4D5391A606F04524DBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429745, "uuid": "5d276a8f-117d-47fb-8a72-38f593e2804f", "value": "3391d25821f027ad2ca25f972b6a2038", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429745, "uuid": "3f506e1e-9fd2-4ba0-a017-108ac0e2e494", "value": "3072:ltMOCOLjn8gdWkx0crZyT4Jgr3PmJe1j/TfXRuVDL:Pjp98JPm2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675429745, "uuid": "7b6e9f6e-e24b-4dbc-8140-fe744393c459", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675429745, "uuid": "c518a967-9ace-4cba-bedf-c69501ef29bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675429745, "uuid": "67b6d2fa-bb08-456d-b5b8-331f1e5de5f4", "value": "f754e7647915e892a84e048d9817939ef1135e3c41d43bc70e9c895c95aa8408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d02c5f-a3ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675420299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420299, "uuid": "ea25b854-1449-469a-ae1c-9dae901a292f", "comment": "Malware payload (Amadey)", "value": "189caf31add777f6f1798bad79a799c0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420299, "uuid": "7aa7bc0a-47b6-465d-b326-31128d2eb047", "comment": "Malware payload (Amadey)", "value": "f76cffa91d5d5fbbd7671491d681d7316223271647b0032e9ed4082ce8a57be9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420299, "uuid": "5040d646-1d2c-4ce3-a9c5-6cd1298c668a", "comment": "Malware payload (Amadey)", "value": "27fd8b3872c34bcef5aa088df2e038f60a92d485", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420299, "uuid": "5b0b5ab5-3574-40b0-98e1-11b358dafff2", "comment": "Malware payload (Amadey)", "value": "79cf6a8751fb758ce5a02a47edd3da87c76fb623b16f172801282000175eae13343326a2bdba99296058974d275b22ec", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420299, "uuid": "42626e83-d0c0-4ba2-b44e-90562118c025", "value": "T16C14D0323580F072C97B05305C60D795AF7EBC315639991B7BA806BE6F706E1623A36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420299, "uuid": "57f9a45b-6d20-42fa-b9b5-2f757da1e4e4", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420299, "uuid": "b30a208a-ab33-4189-b8b2-e3d31c15dae6", "value": "3072:pH+XF+nRZTcLtCTKGW5N51/J3H8NckqV60hArhaswpB9Aw:pH+IALtCTKGc1/pMDqV600aZ3Aw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675420299, "uuid": "997488b6-a46e-4a69-9ba5-a2b78c6b041b", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675420299, "uuid": "1851ff12-3ba6-4b96-9e3f-49ca42a2c441", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420299, "uuid": "60212d80-99d3-49a5-8c69-07f24f5d77e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681ba6e7-a3c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675432094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432094, "uuid": "805862a2-e788-4357-9344-568db9a8aa7b", "comment": "Malware payload (GuLoader)", "value": "cb173dd2b4b01b65f759cbc8b4c3df30", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432094, "uuid": "8c7a2445-4b2f-4153-b8da-ccd79edf5022", "comment": "Malware payload (GuLoader)", "value": "f7a260beec427f7863a82db269e34d3742a984354bdd9da45b99488f3f9f2c5b", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432094, "uuid": "836df858-1939-4ba1-8dbe-697c92afa16c", "comment": "Malware payload (GuLoader)", "value": "5f7b30852748dcd8c2549875a750d08e814c11f5", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675432094, "uuid": "e094b16f-1dea-4558-b71b-e534d77ec784", "comment": "Malware payload (GuLoader)", "value": "718b61ab15106be7a14c110f09ecc3d095173065f9d7b79ba06016d09e1f2e7a293e978249ecf1b7943d86237627c29d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432094, "uuid": "973e6cf5-a40c-419d-889c-c039f34ac431", "value": "T1D9D423440A601962C8B307B9A6B2523F0F4BFC50B7567C23B6334A86D4D86A7D69FCDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432094, "uuid": "0c06ba03-0d97-49da-abaa-ce99369d1c3a", "value": "12288:vcKbzZgSn9VoB72gyj7VPna3inuvTXNVRiArArJiHsxJxGxz:vcqZxg72gyj7R+qu7dV3RHsxHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675432094, "uuid": "93e6a251-00ce-49e9-939d-47a8546748e9", "value": 608323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675432094, "uuid": "3437f525-9245-49db-afaa-beb36bf2fca6", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675432094, "uuid": "c19777cb-67eb-4158-a678-ea9d9413d67c", "value": "Purchase order 50048205.JPG.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1abbdf4-a3a7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675417615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417615, "uuid": "8bff7052-3a7d-46b9-8891-bf27e88a8cc3", "comment": "Malware payload", "value": "f8ad4b5ebb6c70f4cc1422c5fb48b108", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417615, "uuid": "99e63564-54c8-4a51-a1a5-2a7d07cda2fd", "comment": "Malware payload", "value": "f7ae8d31914c810e87e90131d2e16573e1c31cf1ee46b955c8018c9c2b3ed890", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417615, "uuid": "ba07ceee-2d00-4aec-83b5-3b71fa074005", "comment": "Malware payload", "value": "bbe0043d69bcfef21f76bfc7b73ba74546ef6b35", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417615, "uuid": "38632c65-d135-4747-8c17-f7654ac35971", "comment": "Malware payload", "value": "4473890418b7397e8815cf12ed64d03e805fc9ed701863e3c5e7449d80874bbefe3e3cdc12298b79671719417e3ab10d", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417615, "uuid": "cc6fa21b-4a64-423a-9b20-e977cec73226", "value": "T1DED5330C43BAB8FCF89A062927638DD1C5E922F0A58254B2D76C19981C3F57E17DFA61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417615, "uuid": "d1cd8822-ee80-4edc-9728-e914423cb06b", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4Q:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675417615, "uuid": "24e54b1b-9c55-4bbc-988b-93318c81f61a", "value": 2953216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675417615, "uuid": "1e9b981c-0e5e-4757-adc1-5558ac0958dd", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417615, "uuid": "c505b5d7-895b-4629-9ae4-2f49c3c49406", "value": "f7ae8d31914c810e87e90131d2e16573e1c31cf1ee46b955c8018c9c2b3ed890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff67b34-a3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675442281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442281, "uuid": "00a0def0-013d-4fb9-9f6b-08b68ac3adbc", "comment": "Malware payload (PureCrypter)", "value": "41ae5c5fe7e4c5f343be8badbd4d79ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442281, "uuid": "0d3e6cdb-220e-40b6-99d8-d7314b746407", "comment": "Malware payload (PureCrypter)", "value": "f8084dab285866327dba7ee5538d0a20ec86b7696fb8aa2e7e03fdc7d56e0836", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442281, "uuid": "1a5aa770-d32c-4ac6-8ca3-3c1c6ac5f669", "comment": "Malware payload (PureCrypter)", "value": "c494f863e36d9c3bcb0617b1147179cea22c2db2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675442281, "uuid": "df4bf179-88eb-4145-b3bc-9d40d20109b6", "comment": "Malware payload (PureCrypter)", "value": "e013c5537793142842dfebfa18d771234ee8e944498e9b8419ee67bba4bced1e0a321e69ddf1a1447ad7af18c05ebd83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442281, "uuid": "355c5389-fd0d-430a-8be7-5a2d8665094b", "value": "T1635533C185F17F2F4A017E7062C05946C55A3757EDA390BDB8FBEC61229AC9A3C37288", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442281, "uuid": "cbf3aa37-7e86-4442-b194-43cabec959c2", "value": "24576:Vdxm+vR8Ul/tTd4w0trjCcGPMa4ORE2MW3Rs9g56pazwTCdfaLdqg4VfYRM:lm+vR8Ul/1d4br49CjcrAMwTCdfOUgCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675442281, "uuid": "c7c319fd-a0e5-4aee-8623-e32a8074a0f2", "value": 1286269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675442281, "uuid": "b7db998d-73ba-4b8f-b510-eac5d18db26d", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675442281, "uuid": "fbbddd71-936f-4a56-9c14-447524ffe2b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2573aec1-a3cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675434560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434560, "uuid": "4b1cf050-103b-48ba-90ff-9fc397738ba8", "comment": "Malware payload (AgentTesla)", "value": "22a71e4fdacde37e22ad31e82527b72b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434560, "uuid": "df89d146-39a1-4848-afd3-853ba6f758d9", "comment": "Malware payload (AgentTesla)", "value": "f8a6ee7e1121fdd250e62ee3c3941e283e605f69acc52d19aef9fc21a4ccc7ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434560, "uuid": "1ffc9813-adfd-4fe8-8346-8d4ce381c804", "comment": "Malware payload (AgentTesla)", "value": "abbed160fede80a24a5e07083fc10340d9c5e590", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675434560, "uuid": "e6012e44-2723-4d27-972c-3986586d6c58", "comment": "Malware payload (AgentTesla)", "value": "882079324ea656bd6df89c20f7a99125da920e2252d266485b4f92281e87da3eb5afe8a498a94b9cf96bd0d1d11dca75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434560, "uuid": "0cd62060-0c22-4a2c-b636-97fbee731386", "value": "T159D4C43D197617E6C338FA6186E18420F6EEA1923703F968DDE65AD14F025C2BECE51C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434560, "uuid": "35de0b2f-0ef3-463c-b8a9-fc176a6ba26b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434560, "uuid": "804b09d8-7223-4b85-a6f3-6b4219feaa20", "value": "12288:HuEq+C+2SlLVseHKNTn7tunA+/kSSsljwXqErzq3d7wykNLI/jzMcHpyA5XR3+n0:HuejseHKNTn7tunA+/kSSiKqWONySjIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675434560, "uuid": "38c9b486-a826-4a41-85a3-ead1d766f721", "value": 632832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675434560, "uuid": "8b43b83b-8a8b-4264-af07-dd55bb6ca9be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675434560, "uuid": "0000e769-1a27-41e1-ad9e-b557e3248896", "value": "f8a6ee7e1121fdd250e62ee3c3941e283e605f69acc52d19aef9fc21a4ccc7ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e37c11-a38f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675407289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407289, "uuid": "5e3e7279-b81d-4324-a691-689b633bd4bc", "comment": "Malware payload (SnakeKeylogger)", "value": "1ccd7ec5e3adf4355e77bcc1f2f64b63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407289, "uuid": "7c95c3c0-374b-437f-a280-e2a3a27c6182", "comment": "Malware payload (SnakeKeylogger)", "value": "f8a9dd3d1e24b6e889dc9b8e752f442bbf2527d97bb5028bbb95c94ce262de67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407289, "uuid": "c455d990-5106-4d2a-8859-cd6d9b34c11d", "comment": "Malware payload (SnakeKeylogger)", "value": "d5a42f6a179d2a63bd0912a2a728334d0594a92c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675407289, "uuid": "e448cead-4e44-4f50-82de-71370ddb508b", "comment": "Malware payload (SnakeKeylogger)", "value": "a76975ed5a891129e8d2dd7546ef98849fa20bb4831245464bc0061c36d80fdec5c96576aa05a69ef90363b88adecc7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407289, "uuid": "ddcaea3d-65c8-44d0-8b87-9b8bf0a6f158", "value": "T12245332226A9D172DE3B37B412F561EBC81B32543D17DF8FCD0BB702589B2909BA5B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407289, "uuid": "3b71a93f-a6a7-4bd4-90c2-963150532d3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407289, "uuid": "7ecb46b2-2456-4b57-946d-1fceca3ef385", "value": "24576:RB05LEShOyOMs+pUcwAJk4TALNqeOMz7Hc3WCqD2wAG:yEShOaFwAJfAQeXz5C1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675407289, "uuid": "1aedef4a-58fe-4d68-b8f7-42beda37f85a", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675407289, "uuid": "bac04069-cfae-4580-84f5-f0c1b789c656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675407289, "uuid": "4b279703-378d-403c-83c9-7499b76375af", "value": "Q1343 Q1344 240 Dishware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae4a849-a39b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675412423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675412423, "uuid": "4503ff94-cde8-4906-a066-3d5457133311", "comment": "Malware payload (RedLineStealer)", "value": "d8ed6f3a783504c0f907ddf393257b8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675412423, "uuid": "ececc37c-c816-4dcd-9704-9597c6131402", "comment": "Malware payload (RedLineStealer)", "value": "f8d86ffd797da81b58136a711f18088c235dc2db72cfb19cee744f6612db6120", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675412423, "uuid": "a86467e4-0c57-48aa-a1ac-0d18bf491487", "comment": "Malware payload (RedLineStealer)", "value": "cb6984a784ae1be0945a24e1492fe952063e39bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675412423, "uuid": "9789ce4d-8504-4d17-8ceb-605a0aa65ff6", "comment": "Malware payload (RedLineStealer)", "value": "b7f5effac3663c3f87e2e41f0125a3011e54423b62d3f4f171fd3d4d97f77c05314279330e5183ee6f6df48fa056273f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675412423, "uuid": "a08318e0-5f34-499d-be57-6de98109beb2", "value": "T184D4122635A0D032CAAA96301934E796AF7DF4301575681F7BA93B7E5F303E017253AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675412423, "uuid": "e9bed5b6-1c1c-44a0-a47f-9d8ed164d821", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675412423, "uuid": "bf9702a3-bd0c-4e37-bfaa-18b93a91833b", "value": "12288:2HxJMAI56W88WprgTVtL51yilKrioSOEQbF:2RJIrpWaTHaEQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675412423, "uuid": "6abf38fa-53da-4518-8a17-0bbcb1515288", "value": 616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675412423, "uuid": "ec02b32a-efef-431d-a1f0-91a90c93d6d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675412423, "uuid": "4d11d1c1-62ae-419a-b5e0-fb72f8810dd2", "value": "d8ed6f3a783504c0f907ddf393257b8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05bc2fc-a37b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675398742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675398742, "uuid": "4122a99f-f986-4a06-b6bc-cb60c37bd58c", "comment": "Malware payload (GCleaner)", "value": "9c479cd31bbf9dc58804d401665a17d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675398742, "uuid": "f9eac9ff-1948-4df4-bf09-c18b477a359a", "comment": "Malware payload (GCleaner)", "value": "fb084da6f6ee2671fbdf15f334236ed0a59aa9cde72057b02cf188a7a490d0b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675398742, "uuid": "29482e10-8161-4336-8675-51c4ddb27478", "comment": "Malware payload (GCleaner)", "value": "9ade531b44941b0fbf8d3face534176104842478", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675398742, "uuid": "f706bc9b-d405-4e8f-9051-4019a11d5023", "comment": "Malware payload (GCleaner)", "value": "06b2ba1a88375c0a7eb6a6c50fa441c83fae29d5c8d7b6ebbb53b74b2d8bb80a2e96f4a195a46f02a73001791b9ecefb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675398742, "uuid": "2dd2b2be-d68a-4be2-bda1-191421c78c83", "value": "T1B4A53342B8F8DA32D041CD780D245B7A7B23B52A35280351716C265F6F3B271BADB7E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675398742, "uuid": "5fdd1bc5-7238-4069-9bb9-4e4a2530f9ef", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675398742, "uuid": "94952e4f-0593-4891-a4eb-4a937b0f1e50", "value": "49152:ygyVoSeHSlhGzKaoA6A9RyQ2ECGtsNShiJkLCgv2MR:TyVoRSlhBgyQ2EVsNShiJUv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675398742, "uuid": "4fa94565-6ae8-401f-9e79-f31c5c651a2a", "value": 2082387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675398742, "uuid": "817cbbe8-5473-4711-b13f-629b76d3cc4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675398742, "uuid": "2c9a861a-1270-4ffa-9d95-fd9ea6569791", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ce4d9a-a3ff-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675455210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675455210, "uuid": "c2941d0f-6e7f-4c20-88fa-07a3bab7c3ff", "comment": "Malware payload", "value": "6b1e64957316e65198e3a1f747402bd6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675455210, "uuid": "1f34c20f-8a7f-40da-b6c3-938a2baa3625", "comment": "Malware payload", "value": "fbad60002286599ca06d0ecb3624740efbf13ee5fda545341b3e0bf4d5348cfe", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675455210, "uuid": "fa03c886-ebbb-4a68-ae8e-87392921509a", "comment": "Malware payload", "value": "f4df8c9d37a76eadf1125a74865032d83920123b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675455210, "uuid": "5601889b-9b9f-4319-a585-a0c6f7267ecc", "comment": "Malware payload", "value": "3e4880ba57d7c4e7d4425a4e0e34fd4a09acdd8dc4581184d754af59059e6abbb108caa4220a115cf234ccb88162b491", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675455210, "uuid": "1a8c775a-4b2e-4e64-a716-9c3ddf621b0d", "value": "T195546C06B2E50CBAE863913DC9635946D7F2BC120771D6EF03A0465A6F377E0A93BB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675455210, "uuid": "31e31b71-12f8-4c8c-889e-78210c4f3436", "value": "b1c714163a3d228e61ff045c9924482c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675455210, "uuid": "a4d1b575-9696-4b82-a1f4-835cbba72ab2", "value": "6144:DaP0aNyfRYkalElFD5EX7ZEL1PJ07ohmfTSf420:DU0aYRrzDSX7JoU20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675455210, "uuid": "f3f44431-d15e-4de7-8d2e-c95d36fa8b93", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675455210, "uuid": "2d55b153-0260-47d7-80ad-b1dbe8015af7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675455210, "uuid": "1bdce689-5f56-430c-8f05-8f0e87313d3a", "value": "view.png.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc53adf2-a3e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675446006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675446006, "uuid": "88c72cc7-c395-4e77-bd93-7bf15af5c308", "comment": "Malware payload (Loki)", "value": "e0159a317ce13f73c7dd98338d9be097", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675446006, "uuid": "c52c868d-d80e-40e7-ac71-8ee1a99a092c", "comment": "Malware payload (Loki)", "value": "fbe33894ce251973a6b8d01c80c6b3d40aebf299117b243c70a574f7cfc49727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675446006, "uuid": "c3bc5a73-7cac-4979-9966-0906cf9428cb", "comment": "Malware payload (Loki)", "value": "54c677b005842eac47a29db3872be5088f006eaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675446006, "uuid": "edb26fa5-729e-43d1-9c9f-98aad4c65ab5", "comment": "Malware payload (Loki)", "value": "af5ace0382063effc6d63e58926f5edb9c25eadc6d23cacc46a5698bd49168ec402d84de254d3ae2f2c339d5b4826b3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675446006, "uuid": "252e9e68-d461-46e2-850e-921031c25552", "value": "T163C46A9377F29863FACB01A514283B8D1FE07103BE55E2579B3B79C097059FBB698212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675446006, "uuid": "f4237146-a500-4dc4-a7e3-69a6d7b4f7e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675446006, "uuid": "10676234-3078-4e80-adf2-5337158bfdf1", "value": "12288:U8ZJCHkyb1UQ1f6Z9iSSy32o2MqqG4yPa:UwJUbyQxAh2o2MqqG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675446006, "uuid": "9e39bd43-f35c-4b0f-ac08-83c122bde69d", "value": 574976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675446006, "uuid": "59461e69-3996-4a5f-b8b7-071cb6241ee9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675446006, "uuid": "53c274f5-ddce-408d-8ba7-651679224e74", "value": "PROFORMA N.71A 030223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5bf71f-a39f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675414167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414167, "uuid": "3d330aeb-a257-427a-aa1d-e82a84abeac5", "comment": "Malware payload", "value": "0e4e1025f15cb4bebf089082a2b0f4ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414167, "uuid": "95fd4b72-ff56-4834-bb0d-1cd2680f3401", "comment": "Malware payload", "value": "fc0f113025efd6601036a286bd27855f0afcd26bce4a0207ad83c9e7d0e360fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414167, "uuid": "a41b9d9c-2534-46fb-a834-7816c40bfd70", "comment": "Malware payload", "value": "7a5a58d78878e884ff460a03f43eef159f616e26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675414167, "uuid": "895cdc4c-c89a-42e4-a9fa-e541f6639616", "comment": "Malware payload", "value": "5037d7bc60f7cf605be790aba235d7fb9fb93a6e33354cc0af5a3d4f59e10ccf24de160919770f15c0a2f394238456f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414167, "uuid": "8500ab71-324a-49fd-96be-938b3daabcfe", "value": "T19A72088673F4827ADBEE0B705D3351004AF1D7468877FF9D98D8809A4EA3B544662773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414167, "uuid": "4c93eb74-242f-4225-9462-3bbf1897a887", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414167, "uuid": "9d91d710-c0d2-4f38-b267-82aad9fe9340", "value": "384:mDuI8XU1nFqpInHmbMKJNa65C4fjVI5GAWaew:iu9MnFPnHCpfakaew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675414167, "uuid": "805ed5ed-b310-4faa-b7bd-4944fb49b7fa", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675414167, "uuid": "48ac6b99-22b8-4b4f-91af-db34928b001b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675414167, "uuid": "2283afe3-68a4-4469-b94a-42c70717fa61", "value": "NicoDrip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6e0f4e-a3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675453843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453843, "uuid": "d01806be-442a-483b-bd2b-84c2442fc309", "comment": "Malware payload", "value": "853e574759f1b0311aa3c44695763c40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453843, "uuid": "603865ec-1208-475b-b094-b216e944668d", "comment": "Malware payload", "value": "fd071aba7517aad0d98f8cf8e41c527afcf0a293e256e3351ea36d5bf5a3b7be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453843, "uuid": "ed85d866-6625-4358-a727-77011eceee6c", "comment": "Malware payload", "value": "9d4a45cfb65a4f447cc7ad100c87466bc40e18e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675453843, "uuid": "53171408-67cb-4ba2-a313-a23d4d706c92", "comment": "Malware payload", "value": "1805df7bcc107ec78bc8048f2cf33ff4c43b49bf6f8ff19b534dc0ee1b671e0978bb94db92afa0a0df09fa7b5a815684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453843, "uuid": "40cb1fee-15b4-4fbf-ba35-f26131f502ed", "value": "T1FD6412C97994E87FCC17D03A49598D948BA67677226FE293404362DA5C4FF1B8E1C0B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453843, "uuid": "78fc9bb4-28c0-4ffa-aa31-dd82804939ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453843, "uuid": "d325e450-3212-4361-89d3-adcd619bb7b5", "value": "6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675453843, "uuid": "e848a008-a126-4df9-bb6d-58ce3ab56451", "value": 336869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675453843, "uuid": "d7c6c5d2-bf8c-4dda-a28c-5f57dff81eea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675453843, "uuid": "972fc393-12b3-4f8e-aa11-8c5aebb27e8e", "value": "853e574759f1b0311aa3c44695763c40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f448c3-a3c5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675430499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675430499, "uuid": "7e901633-f92c-4193-9f43-5917d9c93a34", "comment": "Malware payload", "value": "9111123d91343c6d028e13b43ee25f6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675430499, "uuid": "9bc00d8b-bd3e-49f8-8a68-389678cc9cf0", "comment": "Malware payload", "value": "fd529ad6eeca81d8b37b9ad5f0b7e6678d93aabf22333bbd82209aff419010fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675430499, "uuid": "b9efda56-6cee-4be6-8054-f34ce49c1063", "comment": "Malware payload", "value": "8f01142ad090f73d79bb48becd35256fceac352a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675430499, "uuid": "7d8f7547-1fb2-44bc-97d4-6c7d14660ad5", "comment": "Malware payload", "value": "f7c7c52f126c3f71e75a6bb399e44a3766de6719096d4f29fdc98b7efc7f8b962f7b189f10a766b9124eb9604d398c3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675430499, "uuid": "937210bc-ffc6-42f7-8190-0428fe7f8c7c", "value": "T108F412057AE81BA2EABD87FE5028791117F07C2B5812E3674EB170DF9633B029675E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675430499, "uuid": "e186b7e9-dc8e-4fe7-ac31-00ad22211f74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675430499, "uuid": "068d9622-e052-4489-bc14-fe2deb355516", "value": "12288:Hn2wEVGeZODSQby9R/COjltXVlNhM6mSByHLCvcUQPvfxNxyHRyn4isugt8t31Ro:HrNoKm7COptFP+7eyHGGvJNIxTZlqt3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675430499, "uuid": "748a690b-4799-47cc-ab57-66bf398a813d", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675430499, "uuid": "32c1c2f7-b9d5-4a4c-8491-4c5a7792ec33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675430499, "uuid": "8217f9be-075e-406a-bcd1-03859a79c90d", "value": "fd529ad6eeca81d8b37b9ad5f0b7e6678d93aabf22333bbd82209aff419010fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb565aaf-a381-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675401391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401391, "uuid": "53e749df-e297-4d3a-85fa-e230d445e2d8", "comment": "Malware payload (GCleaner)", "value": "bd114e8afa0fe48d09a44053c82d5f5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401391, "uuid": "cbee308d-bbc6-43cc-908e-814c231a9e94", "comment": "Malware payload (GCleaner)", "value": "fde51302457b6ce2e1518a4a8fa09535441543fbd1b0bfe4f00fe6e5e0c55068", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401391, "uuid": "c3021659-81be-42cb-9a07-e558f0be8525", "comment": "Malware payload (GCleaner)", "value": "df0234f0547ed0997e55e50dee38048165edf197", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675401391, "uuid": "45d37f2d-5153-406d-b6e1-791135c0bb2f", "comment": "Malware payload (GCleaner)", "value": "e8969d4000a856bc8300b881142685c0e250baccbe1aba06f8600bd8b78df181f376422d003418c3e45d4c05ce34099d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401391, "uuid": "4252b167-d659-461d-ad86-55015deed054", "value": "T136953317A45865B7D37747396C239A60E1336F2670760274308A4FAD2EB3640FE9EE39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401391, "uuid": "5f21c310-2557-479f-9eb8-bdab748a20eb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401391, "uuid": "9490567b-d21e-4056-bfbc-8a0569c325a9", "value": "24576:y3wSl+e1L4PSVKC/NDShcpBEsTfQWssPrWC305uNahBW5f9R3uyhr0Ej27tch5LV:yg5CubWAC3ku4hsH5u0y7WjLCgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675401391, "uuid": "c07cbc2c-ee4d-463c-bd59-2f06b07b2f54", "value": 2007971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675401391, "uuid": "4bd6877c-ca98-45fb-abcc-9c8173c0118b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675401391, "uuid": "0e005ab5-10e2-43e7-a5f2-d6d059c12f62", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded1251f-a3f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675452480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452480, "uuid": "ee70d050-93ca-4b85-9cf6-f85668c6f7e7", "comment": "Malware payload (AgentTesla)", "value": "f821d5ac1e5c0fdc0cf1e039ba4e5da8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452480, "uuid": "161e8524-4df0-4bc6-b92e-24ece03679a4", "comment": "Malware payload (AgentTesla)", "value": "fdea6cbc0e5bef7d8bbb20f5fdea53b54209dd3b3e39fec27f07222e1bdd3b44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452480, "uuid": "81dcf5e6-8456-468a-ab74-f97547062d56", "comment": "Malware payload (AgentTesla)", "value": "d7746c39a06eee3377b657433abd18b7c656a501", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675452480, "uuid": "7b5b35e8-6354-4da8-8b50-b774d893e85d", "comment": "Malware payload (AgentTesla)", "value": "7aa607123100016300b10438af4b1b53c3e07d70071cb325c4557b9601cec7bf8074e7533134ea9db7b7d3300240e24f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452480, "uuid": "162da670-379c-4ab3-beb5-abca09f49106", "value": "T151948C11316E640862FB2E271F9BFB6A5B3F2BC104B58D5A51CC060A9BDED408B753F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452480, "uuid": "f8fe07ed-1e3a-48c0-b494-873ea8eb8ac1", "value": "192:fQgw3hFFFFFodFFFFFRFFFFFIujFFFFFMFFFFFW5sAz/qFFFFFnFFFFFnFFFFFnq:fpO68KILU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675452480, "uuid": "5e422bf1-e0eb-45f9-b98a-075980638cee", "value": 409762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675452480, "uuid": "dd527e69-81ad-4d49-bf11-b26bccf7624b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675452480, "uuid": "8b7dd332-9497-4e1f-9bf0-643fc47ed90a", "value": "doc#_comprobante.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c32a02f-a3f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675450596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450596, "uuid": "c674c4a0-2809-4aed-9d7c-dee1c1a9b004", "comment": "Malware payload (Mirai)", "value": "693393782e813596e34c20e470109eb2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450596, "uuid": "350e9440-9983-4d6a-b976-bc4b65343fc9", "comment": "Malware payload (Mirai)", "value": "fed837eee086fc272b94b029fcba2faaf4e51c3e318c7517f20f676f91249058", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450596, "uuid": "daab9f36-f385-4cef-bd52-3cd6084eb9d1", "comment": "Malware payload (Mirai)", "value": "d055b40a749fb32d55e42a0ead28aa944ffafd7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675450596, "uuid": "863624fe-8000-4be2-a462-c7c3cbb90da2", "comment": "Malware payload (Mirai)", "value": "9443622ddcd01d642f932a30e713d94d575c452f18a0c2a5f8c271c88788af5b6af0dc670a6d9be4cb09da0e3dfc2c51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450596, "uuid": "f5cebf2d-a185-4804-882d-97064cb05ac1", "value": "T17B534CC5E523C8F5DE1509F63073FAA04EBAC17BA16ED943FF205425B882E452722ADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450596, "uuid": "32d856df-2293-42ed-beb7-d2d8108cdb33", "value": "1536:wb+I6HLzdUGJ2zKQ9NCBGvqD4MuA00EHqWB0:wbr8LzdUG0mSNCBGSD4zhJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675450596, "uuid": "d1185dca-3331-49bd-90e6-f8b78009b12b", "value": 64400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675450596, "uuid": "2fa15459-17dd-4d58-afb6-4c9c86de1514", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675450596, "uuid": "aca426b5-fbb1-4e2f-b6d8-e8efef44dc80", "value": "693393782e813596e34c20e470109eb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e44fdf77-a3a1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675415123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415123, "uuid": "baa7934d-45ec-41af-8dcf-82698b1003a3", "comment": "Malware payload (RedLineStealer)", "value": "24ab0a896a6666871c456d4b74feba77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415123, "uuid": "4203b891-c2cd-4920-adf0-155ad07dc841", "comment": "Malware payload (RedLineStealer)", "value": "ff79367e72372a543a8dc2f9974c90e5fa61d286a52dc4b9a4e1a576052dfe58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415123, "uuid": "f4cf476d-59e5-49ab-bbfc-08e0f149975c", "comment": "Malware payload (RedLineStealer)", "value": "98a0ef4600067094a1c36f3f506b07db43026f52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675415123, "uuid": "a7097c17-a991-47f9-8eac-ffb6d1c31267", "comment": "Malware payload (RedLineStealer)", "value": "7a0feb679c0e06fea57b732e08d524200f96a58ee9876c2e8ab75c54ff515a95d4d8917789fc9f3501edd281d8b31bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415123, "uuid": "eccc831a-f26c-4b60-9487-56356252a975", "value": "T194D412717280C072C76B16391828D781BF6D7572866B9D8B3F586AB94F70BC16B3231E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415123, "uuid": "8b62deb8-7e6b-48df-9e1d-3c7c9ce17caa", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415123, "uuid": "b6e9f5d8-6acd-4e0d-86fd-aef3eee00005", "value": "12288:AH2YrgoQV8HJ2fYy6qlIo4CEbRiOvFQnf6jr1F:AWBoQV/wQKbCEU5nf6jr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675415123, "uuid": "1fe987f5-9283-4a6d-850c-24c86d648a3c", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675415123, "uuid": "9e7c3b63-6003-478d-9774-1b73118f3a1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675415123, "uuid": "51193ec2-6a35-4a64-81ea-651c3ea491ce", "value": "24ab0a896a6666871c456d4b74feba77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8867fb-a3ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675420294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420294, "uuid": "e6ac07cc-244b-42cc-a646-893d1f76424e", "comment": "Malware payload (RedLineStealer)", "value": "de329172cab83eae07cd3a275d022a0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420294, "uuid": "28e517f8-caa9-4f8f-bc10-9103c183eb29", "comment": "Malware payload (RedLineStealer)", "value": "ff83551948b62e7ca1c8911003b0284d9ab620488406e30fef5f31dbf3f650cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420294, "uuid": "3d23b080-51d8-4305-ad23-6a5eb70af494", "comment": "Malware payload (RedLineStealer)", "value": "4494c1c5010946e5dc3eeccb686cb2248cb556f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675420294, "uuid": "48847ce6-c5ae-4302-80ff-071bfe0af5de", "comment": "Malware payload (RedLineStealer)", "value": "b8be4451a24ddc1ac64badb8e86d05b3007146ffcae71fd52cccc1b148ad62d4ee5c739c4a68eef3da25dbd25ae9fc12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420294, "uuid": "02ffa57d-2673-4218-81e6-e6456d6a0dcb", "value": "T1FC64013235D0C0B2C4B751718831E696BF7DB431657A6647BBA42A2E9F30BE0973A347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420294, "uuid": "8cef6007-8c7d-408b-8f20-2bc26c94a5e3", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420294, "uuid": "885a7fee-a99b-4d71-bae1-bb076edd8e8f", "value": "6144:97BfMSLb0X9E6wGIYlkrO2XvncUzqwUZfKE4q0w4mWwM:97uSM9EhrYlkq2/bdUUEQmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675420294, "uuid": "2247efc0-55db-4db1-9748-8df3c1ba9baa", "value": 309248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675420294, "uuid": "a78f37cc-ebd0-4a6c-b96c-3b19a3f2b98f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675420294, "uuid": "df5a32a1-a0ca-4520-b181-942a1f8d1db7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffbc7cb-a3ba-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675425719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425719, "uuid": "aea6c27b-b134-4c27-8b64-afe0c7ccffbb", "comment": "Malware payload (GCleaner)", "value": "91d3339b847620e5d28345beea5d5fab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425719, "uuid": "d30ca4d5-e5d3-4804-a818-13fc5f95518c", "comment": "Malware payload (GCleaner)", "value": "ffdefb00e203ee0c34b21360b005af6fc1130960a99f1cbc3dbe686c69c7fc59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425719, "uuid": "494c610f-0385-4630-b6ee-781151429ade", "comment": "Malware payload (GCleaner)", "value": "f5ff7330d10da2a35af37ed6a780c6133a54896b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675425719, "uuid": "17d828fd-4322-4e1c-8076-851ba1439d1f", "comment": "Malware payload (GCleaner)", "value": "f4f2d3bdf6280130e08a0609b4f4c441b10a906122d9325770202926d557351c73a48794e7ed4f05322f5b17bfe03346", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425719, "uuid": "0f695fba-3bb5-4dbf-9821-1e798d07977b", "value": "T12E953365A17F8373D1E267367E688902AC637F4119B0632138DD2BCE16336616C2FB9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425719, "uuid": "d4542435-3849-4058-95d8-b50196776555", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425719, "uuid": "d9aa2fc4-17d9-4555-89b8-16c7c49e196c", "value": "49152:yge5Kdd3jszbInAx0odm4066llbRtx0eyhBfTPppLCgv2MR:Te5kubInAvEFXll9tx0v/fTPpFv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675425719, "uuid": "9db08797-7772-49dd-8090-4e10058cc898", "value": 2044073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675425719, "uuid": "39bdbcee-739a-4b08-9e5c-3cf2c2d37a71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675425719, "uuid": "2e30a8d1-fae5-423c-a0f2-16108cb27606", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f4d8ac-a3a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675417974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417974, "uuid": "02a8ddb4-fcdd-4a0a-b3a5-8de8e3627505", "comment": "Malware payload (AgentTesla)", "value": "d25ce91177e60832ed408599c15bf8b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417974, "uuid": "9ab48530-3085-44c6-a888-94ce7b642882", "comment": "Malware payload (AgentTesla)", "value": "ffebdf8853d1b78bb5edf651dcd1613fed259c6ad8bb6055b72453f99fba80e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417974, "uuid": "de4a823a-27cf-4298-a23f-743807dc737c", "comment": "Malware payload (AgentTesla)", "value": "6a755fb3ffccf8913fe75a557199365305fa6d5c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675417974, "uuid": "d4d1f2c8-7491-4e34-b659-33861cf26241", "comment": "Malware payload (AgentTesla)", "value": "5d57537de888d8d6031f9f7ef1b7ac3bac00600644737f769a09fdd3940278a72eff32922834b181963e26f27dc7bcec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417974, "uuid": "ff3c4905-5c84-4565-9b77-70ab348064d5", "value": "T119C1DA01BBEC4332DE3287329C7357414278B35558675B7EBCC8A21FAD222C94B62BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417974, "uuid": "bd33ca8d-21a5-4797-80b8-58e3b6696e90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417974, "uuid": "0897083d-ab88-44ac-9d39-5bd90d35ee48", "value": "96:p3lbpKge6jU8fwteyIMPaKLuRyRke2LEFzNt:QwT0tLCKLufeX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675417974, "uuid": "ae9a64b9-793a-4ae4-b1a3-fc02175e8171", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675417974, "uuid": "2f6d59ff-69e6-42f6-81ce-c12ce0d1a450", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675417974, "uuid": "943576fa-aed7-48b8-851a-558973908f2b", "value": "Vessel Particulars.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d153fe-a3cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675433025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433025, "uuid": "dc8dc08f-81ca-4983-825a-4e9b53b2597c", "comment": "Malware payload (RedLineStealer)", "value": "7a2057da7c85914250954c17361036fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433025, "uuid": "c615e97d-4e05-483a-a91f-280fa54fc0af", "comment": "Malware payload (RedLineStealer)", "value": "fff54c811ef576b7d2fd2b38bf764776f669ff11e1cccd4932275570e0043894", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433025, "uuid": "8552ea9c-80ee-4f50-b342-0b920c6ecb68", "comment": "Malware payload (RedLineStealer)", "value": "c652cf8790319860fd6d7b5c5d588980b142f674", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675433025, "uuid": "0491b1fc-f307-4d59-83ce-0cd7653a2d8c", "comment": "Malware payload (RedLineStealer)", "value": "0c742a61d75dbef62d013b4a6997d2d108653656f31054d51a0de17f9315d96e32bc89a99677533c2c8d05cb435eb864", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433025, "uuid": "f7d5ad4e-14d3-410b-9c74-78c4e80c3b6e", "value": "T160D4123334D1D0B2C2AB15745820D76A7B3BA53106B55A1B7BAC1AAFCF743C06F2A647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433025, "uuid": "54633f7f-151d-4c34-b6c9-efc1539bf700", "value": "9cc63e51c7384890862677f7b0b2380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433025, "uuid": "f9e55cf9-f20a-4f08-8db0-424968d868b7", "value": "12288:J5pzqAqOgH1HmagZhlae7LhyRA2v7hnMKt1V6hTHC:J71XqgNaeX+A2vFnMKt1YC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675433025, "uuid": "98cdf8cd-e4e2-4f11-a520-e832067fc62c", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675433025, "uuid": "8632430a-31cd-46e3-845f-b5d2deaf68c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675433025, "uuid": "f867c7dd-53d2-471b-84b6-e9238e0e7e87", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }